Changelog

Aleph follows CalVer (e.g. 26.7.21). Releases ship multiple times per month; the version is kept in lock-step with the VERSION file and the alephcore crate. Breaking changes are flagged prominently in the release notes, but the API and architecture may evolve until 1.0.

---

26.7.21 — chat / work / code Session Mode + Loop-Graph Governance Layer

The largest feature drop in a while — 282 commits across three days. Three threads run through it.

1. chat / work / code session mode — the third twin of exec_tier and think_level. It statically partitions the tool presentation surface (progressive-disclosure core set + deferred-tool tier), never permissions. Picked from a Panel composer pill, from Settings → Policies as a global default, or conversationally via the new session_set_mode tool. Each mode also drives a distinct right-panel behavior (chat = badge, work = plan surface, code = tool detail) and adds one cache-stable prompt line.
2. Loop-graph governance layer — a governance topology store, a nine-action tool, an audit ring, objective ACLs, a prompt layer, and a root gate. The closed-set governance edges give the four single-loop failure modes (Goodhart, reference blindness, ring conflict, measurement decay) a topological answer.
3. Entropy-reduction and hardening sweep — the Telegram and Discord channels were gap-analyzed against reference implementations and shed several thousand lines of dead parallel layers while their access control was unified onto the real router; macOS desktop rails were corrected against real hardware; a multi-module adversarial review pass fixed dozens of correctness, concurrency, and security defects across the gateway, providers, extensions, tasks, teams, sessions, and skills.

Added

• chat / work / code session mode. A user-selected static partition of the tool presentation surface, orthogonal to permissions. Single source in config/types/policies/session_mode.rs; request > session > global resolution with stamp-on-carry; the partition lands on the two existing presentation mechanisms (progressive-disclosure core set + deferred-tool tier) so src/harness/ gains zero lines.
• Mode v2 semantics. Family tables match on _ word boundaries; MCP-qualified {server}__{tool} names are exempt from the builtin tables; media_understand stays listed in chat and code; chat's core subtraction can no longer drain to empty; subagents inherit the parent mode with a short prompt line.
• Loop-graph governance layer. A governance topology store, a nine-action tool, an audit ring, objective ACLs, a prompt layer, and a root gate. Documented in docs/reference/GRAPH_LAYER.md.
• Graph × multi-agent fusion. A team node kind, live-joined teams in graph status, team pair targets, victory-claim triggers that poke watchers on team disband, and a built-in loop-auditor agent.
• governance_metrics in-core probe. Replaces the sandbox-walled sqlite shell probes the audit sensor could not legally reach, plus notes-era activity counters on dream_reports.
• Discord interactive approval buttons. A two-way ApprovalCallbackSink flow, plus edit-based reply streaming.
• iMessage inbound reactions as context. Add-tapbacks arriving from the user are surfaced to the model as context rather than dropped.
• macOS window targeting via Accessibility. A public AX window resolver (CGWindowID → AX by geometry) so focus raises the specific target window and bounds are set on the exact window, with an osascript fallback.
• Grounding evidence gate on team task review. task_review approvals can now require grounding, with acceptance metadata helpers.
• Daemon-computed session cost. session.usage computes cost via core pricing and the duplicate price table in the shell was deleted; plugin.install gained a unified handler that classifies the source (the CLI stops guessing).

Fixed

• Every Panel send re-carried the composer's cached mode — all four send paths now carry mode on the first message only, and session_updated syncs mode and exec tier back into Panel state so the pill and right rail read store truth.
• tool_search could be collapsed by progressive disclosure, pointing the model at a guaranteed-miss lookup — it is now pushed into the request core set at registration.
• Telegram ignored the operator's configured access policy. The inbound router fell back to defaults for Telegram, and the channel-local pairing store was never written to. ~2.8k lines of dead parallel layers were removed; parallel nested-config / account-pool / resolver layers in Discord too.
• Gateway leaks and drops. Per-connection event-forward task leak on every WS disconnect; channel forwarder died permanently on broadcast::RecvError::Lagged; webhook backpressure silently dropped inbound messages instead of returning 503; raw error chain leaked to the Panel — all fixed.
• Command injection on desktop open / launch — now dispatched through ShellExecuteW instead of a shell; symlink planting during bundled-content extraction refused via symlink_metadata; skill download path traversal closed and the scanner file size capped; cluster file.write no longer has a TOCTOU window.
• Certificate approval could be authorized without a fingerprint match; the webview microphone grant was not origin-restricted on Linux or Windows — both fixed.
• Approval failed open on a missing policy file, and permissive_default disagreed with Default::default() — both now fail closed.
• Prompt-boundary injection. Transcript, focus, and prior-summary content now escape boundary markers before entering the prompt; ToolAwareChunker asserts a non-zero token ratio.
• Provider failover cloned the entire conversation on every request and published route state non-atomically — ~2,000 lines of unreachable provider code were deleted.
• Extension lifecycle races — concurrent reload is now serialized under the load guard; malformed plugin results are no longer masked as ServiceResult::ok; AuthorInfo parsing uses the leftmost separator.
• Cluster node keys were byte-sliced, breaking CJK node names — normalization is now Unicode-aware.
• macOS capture and recording rails. Screen recording is cropped to the requested region via setSourceRect; completion is verified before reporting success; typed bridge errors are preserved on OCR, window-capture, media, input, and screenshot rails.
• Harness ratchet tightened to the current CEILING (guarded by src/harness/tests/budget.rs:335) by removing the DiminishingReturnsDetector hard stop — a deterministic completion judgment inside the loop, which R10 forbids. The code is the source of truth; any number reproduced in docs is just a copy of CEILING.
• Session and team integrity. retire_from is atomic and shutdown timeouts surface; active team names are unique via a partial index; team protocol text and artifact content are size-capped.
• Wire request ids no longer use UUIDs (atomic counter; the dependency is dropped from aleph-protocol); a custom regex that fails to compile no longer discards the valid ones alongside it.

---

26.7.18 — Self-Signed TLS + Client TOFU

A remote-access release that closes the loop on self-signed TLS. Two halves meet in the middle.

On the server: the self-signed certificate's SAN now auto-discovers the host's non-loopback interface IPs — a wss:// connection to a LAN or public address no longer fails hostname verification — with a drift-tracking sidecar that reuses the cert when the interface set is a subset and regenerates it (never bricks) when it drifts or the sidecar is corrupt. On the client: the Panel gains in-app trust-on-first-use (TOFU) certificate trust — a self-signed gateway cert is reviewed and pinned from inside the app via a fingerprint + SAN approval splash with a TOFU/change warning, backed by a shared decision core and a pinned trust store. The macOS WKWebView cert-challenge adapter is the reference platform; iOS Keychain trust store and decision mirror wired alongside.

Added

• Self-signed cert SAN auto-discovery. A new [gateway.tls] san field plus automatic discovery of the host's non-loopback interface IPs are assembled into the self-signed certificate's SAN.
• SAN-drift sidecar. An unchanged or subset SAN reuses the existing cert; a drifted one regenerates it; guarded by an atomic regen marker and a shrink-reuse test.
• Panel in-app certificate trust (TOFU). Shared decision core, pinned TOFU trust store, SHA-256 fingerprint + SAN/subject parsing, an approval splash page, and pending-cert state with approve/reject Tauri commands.
• macOS WKWebView cert-challenge adapter + install dispatch. The reference platform for in-app trust.
• iOS Keychain trust store + decision mirror. Unit-tested Keychain-backed trust for the iOS Panel.

Fixed

• Panel token wall buried by the boot gate on a remote unauthorized connect — the token wall now surfaces.
• macOS WKWebView respondsToSelector cache was stale — the cache is now busted on install.
• macOS trust approval navigated by a relative path — now navigates by absolute URL.
• credentialForTrust returning nil could panic at the FFI boundary — now fails closed.
• Corrupt sans.txt sidecar is best-effort and regenerates the cert rather than bricking boot.
• Lite supervisor relocation is suppressed while a trust prompt is pending.
• Malformed-DER fingerprint parsing never panics (regression-tested).

---

26.7.17 — Native Gateway TLS + MCP On-Demand Discovery + Plugin Skills Folded In

A security and hardening release. The headline is native gateway TLS for remote connections — the gateway terminates TLS in-process, fails closed on plaintext to any non-loopback bind, refuses insecure transport to a remote client by default, and resolves the real client IP behind a trusted reverse proxy; the Panel forces wss:// to remote hosts. Alongside it: MCP discovery convergence that retracts the eager resource/prompt index layer in favor of on-demand discovery tools, plugin-bundled skills folded into the skill mechanism with the agent catalog revived, deep file-op path safety, and a broad hardening sweep across the harness, tools, context, cache, loop, teams, and memory subsystems.

Added

• Native in-process gateway TLS. New off-by-default config ([gateway] tls / trusted_proxy / allow_insecure_remote).
• Trusted-proxy real-client-IP resolver. A spoof-safe resolver reads the true client address behind a trusted proxy.
• MCP resource/prompt discovery tools. mcp_list_* let the model find MCP resources and prompts on demand.
• Plugin-bundled skills are visible to the model. Installed-plugin skills are folded into the skill index and skill_read.
• call_id-exact approval correlation + completion-order live tool events.
• Workflow interop for .mjs / dynamic workflows.
• Gateway dead-letter forensic trail.

Changed

• Fail-closed remote transport. The gateway refuses plaintext on a non-loopback bind at boot.
• Dropped aws-lc-rs for a ring-only TLS provider to keep the Windows build clean.
• MCP discovery converged to one on-demand channel.
• Harness R10 line-budget paydown. Dead prompt-layer surfaces pruned (net ≈ −3.4k LOC); ceiling 5035 → 4988.
• Deep context-layer hardening. Sixteen items from a gap analysis plus a context-cache hardening round.
• Loop layer, rounds 5–7. Wake/resume deny layer, tree budget for teams/swarm, Guardian cache/breaker, goal wait-barrier.
• Teams coordinated-tasks, rounds 4–5. Snapshot protocol restore, pause/resume gate, live escalation leader.
• Memory management D1–D4. Ack-inversion fix, session-end wiring, compression fixes, batch remember.
• File-op path safety. Symlink-safe delete/move, glob/deny re-checks, collision de-dup, per-path locks.

Fixed

• skill_read refused symlinked/duplicate skills — now resolves by precedence.
• Gateway remote-auth rotation kick + device resurrection.
• serde_json map-insert key type in message_history.
• Two pre-existing alephcore lib-suite test failures unblocked.
• Workspace-wide clippy / rust-doctor cleanups to keep -D warnings green.

---

26.7.15 — Three-Tier Execution Permissions + Note Layer + True Cost & Token Accounting

A hardening and safety release. The headline is a three-tier execution permission model (Ask / Auto / Full) with an action-aware approval gate — the human sees the exact command and the grant keys on it — surfaced as inline approval and ask_user cards in Panel and a polled HITL overlay in the TUI. Alongside it: a matured knowledge-memory note layer (graph path-finding, [[wikilink]] supersession, CJK full-text search, contradiction→supersession closure), truthful cost & token accounting (both were partly fabricated), a repaired cluster enrollment / reverse-RPC path, and a large harness R10 paydown that deletes zero-consumer abstractions and an unreachable ~3,800-line tool-hydration stack.

Added

• Three-tier execution permissions (Ask / Auto / Full). A single operator-facing knob reads each tool's declared metadata (idempotent / destructive); unknown tools fail closed in Ask; the [sandbox.command_policy] hard-floor can't be lowered by any tier.
• note_graph_query read-only tool + note-graph path-finding. Bidirectional-BFS path finding, typed relation edges, [[wikilink]] supersession, crash-safe index, CJK trigram full-text search.
• In-window restart-to-update banner. The desktop shell injects an update banner on stage with its own sentinel control channel.
• TUI §5.12 maturity. A /sessions picker, a live context-window gauge, a polled Ask-tier tool-approval overlay (HITL).
• Live cluster fleet feed.

Changed

• Truthful cost & token accounting. Real spend ledger; prompt-cache discipline restored; thinking depth wired end-to-end.
• Non-intrusive computer-use. Desktop apps driven through pid-targeted input rail with window-scoped capture; six P0 defects fixed.
• Knowledge-memory note layer, rounds 2–4. Category names canonicalized; relation vocabulary cleaned; Leiden community refinement; contradiction→supersession closure.
• Memory Tier-3 hardening. Agent-scoped recall signals, severity-gated archival, maturity cohort.
• Cluster enrollment repaired. Dead cold-start enrollment fixed; deregistration made to stick.
• Deferred tools are callable. Progressive tool disclosure no longer strands deferred tools.
• Sandbox hardening. Invisible-character SSOT, symmetric breaker purge.
• Goal subsystem. Fail-closed continuation gate and an atomic continuation claim.

Removed

• Four zero-consumer harness abstractions (R10 paydown): TraceSink::on_init_seam, HarnessCallback::on_tool_call, HarnessCallback::on_complete, and the Harness trait itself.
• Unreachable tool-hydration stack (~3,800 lines) plus a cache framework and a configuration knob that never honored its reported value.
• The phantom 4,900-line harness target — replaced by the budget.rs ratchet as the actual R10 redline (currently 5,043 lines).

Fixed

• Dreaming daemon burned provider quota nightly.
• Panel auto-update 404.
• channels.set_agent accepted non-existent agents — gateway now validates.
• Provider error reads could hang on a stalled proxy.
• Instance-lock holder was unreadable cross-platform.
• Spawned subagents inherit the operator's [execution] max_iterations.
• A subagent can find its own offloaded tool output again.
• Multi-provider router deep-cloned whole session + non-atomic publish — atomic regen marker + single clone.
• And more — see CHANGELOG 26.7.15.

---

26.7.7 — MoA Continuous Advisory + Progressive Tool Disclosure + True Multi-Session Parallelism

A large capability release. The headline is Mixture-of-Agents (MoA) continuous advisory — any agent turn can now be shadowed by a panel of advisor models whose views are aggregated into the reply — landing alongside progressive tool disclosure, true multi-session parallelism, a [[wikilink]] note lifecycle with rename cascades and provenance, a deepened memory-galaxy canvas, a narration-led chat stream with a live-follow workspace, and a rebuilt session single-source-of-truth event log.

Added

• MoA continuous advisory. New virtual MoaProvider fans a turn out to a configurable advisor panel (with per-advisor timeout, prompt-cache breakpoints, signature cache); presets authored and switched via the new moa tool, a /moa one-shot, and a Panel visual-config page.
• Progressive tool disclosure + tool_search. Non-core tool schemas collapse to name + description; get_tool_schema pulls a full schema on demand; [tools] defer_mcp_tools pushes MCP tools into the deferred tier.
• True multi-session parallelism. Run gate moved from per-agent to per-session SessionRunRegistry; a run-lifetime ConcurrencyLimiter enforces global + per-agent caps; server-authoritative running-set broadcast drives unified "running" dots.
• [[wikilink]] note lifecycle. Parse, strategy-chain resolve with provenance, rename cascades (incl. typed relations), tombstone delete with targeted back-fill.
• Deepened memory-galaxy canvas. Community-centroid gravity clustering, recency/confidence brightness, relation-kind edge tinting.
• Narration-led chat stream + live-follow workspace. Compact single-line tool rows; workspace pane becomes tool-detail viewer with pin.
• Session single-source-of-truth event log. session_events is canonical; MessageProjector materializes events; ProjectionReconciler back-fills.
• Computer-use semantic interaction. set_value / ax_action accessibility actions; observe parameter fuses act→observe.
• Message-stream assembler. Single MessageAssembler reducer strips inline <think> blocks live.
• Live-hot-reloadable execution caps. [execution] run-cap is now Live via arc-swap global semaphore.

Fixed

• Session sidebar showed a raw <system-reminder> — per-turn reminders delivered as transient recall context.
• MoA presets on the default provider never activated — primary provider key mapped into named_providers; tool args schema hand-written flat.
• file_ops glob path-escape — absolute and .. patterns rejected; Windows drive-relative / UNC-prefixed globs rejected.
• Session epoch parsing on Windows.
• Sandbox stdin / timeout hardening.
• Windows standalone-server self-update.
• Panel "running" dot correctness — purely server-authoritative with sequence guard.
• And more — see CHANGELOG 26.7.7.

---

26.7.1 — Context "Never-Break" Guarantee + Real Context-Usage Gauge

A harness-reliability and polish release. The headline is a context "never-break" guarantee — the agent loop now always compacts and continues instead of ever cutting a turn short — alongside a real, reload-proof context-usage gauge, launch-at-login landing on all three product forms, and a flattened, collapsible redesign of tool calls in the chat stream.

Added

• Context "never-break" guarantee. Pressure situations previously ending a turn via FinalReply now always route through compact_to_fit. A deterministic truncate_to_fit floor added as a last resort.
• Real per-model context-usage gauge that survives reloads. Computed core-side, persisted on the assistant message. New sessions show an ≈N% estimate from a local budget dry-run (zero LLM calls).
• Launch-at-login lands on all three product forms. Full desktop App, Lite Panel shell, and standalone aleph-server (new service subcommand).
• Flattened, collapsible chat tool-call display. Compact single-changing-line step strip; full-detail side panel for overflow.
• system.open_path desktop capability. Cross-platform primitive using OS default handler.
• Broader runtime-detection coverage. Homebrew rustup keg, MacPorts, asdf shims, Nix profile paths; extended Windows search for node / playwright-cli.

Fixed

• Standalone server self-update on Linux. Atomic temp-file rename instead of in-place overwrite (ETXTBSY).
• Launch-at-login toggle never appeared in the full desktop App. Switched to tauri-plugin-autostart plugin commands.
• Updater signing key rotated. New keypair wired through CI; both product forms updated.
• Cross-platform session-directory naming healed on read; chat-sidebar async reads guard disposed signal.

---

26.6.29 — iMessage Channel + iOS Panel + VESR Dynamic Model Routing

A big multi-day release. Headlines: a brand-new iMessage channel via BlueBubbles; the iOS Panel growing into a real iPhone + iPad app; VESR dynamic model routing; first-class web-fetch providers; richer multi-agent teams / kanban; and the ability to type into a chat while it's still running.

Added

• iMessage channel via BlueBubbles. Outbound text and attachments; inbound webhook + catch-up polling with offset reconciliation and GUID dedup; group/chat sends; reactions / typing / read-receipts (gated on the BlueBubbles private API).
• iOS Panel is now a real iPhone + iPad app. Native pairing screen, full iPad support (Split View / Stage Manager), TestFlight distribution, phone UI with Chat-first tabs.
• VESR dynamic model routing. Aleph records every completed run's outcome and recalls a per-model track record at run start (k-NN over sqlite-vec).
• Web-fetch provider category. crawl4ai and firecrawl are first-class, UI-configurable fetch providers with vault-stored keys.
• Richer multi-agent teams / kanban. Full task lifecycle (approve / reject, waiting-review / paused / skipped columns); live subagent-tree; broadcast storm-prevention guards.
• Type into a chat while it's still running. Queued messages render as in-stream "ghost" bubbles; flushed at the next turn boundary or force-inserted (Esc + ⚡).
• Sticky single-chat Todo / plan panel. Always-visible plan widget above the input box.
• Real per-model context-usage gauge. Core-authoritative occupancy, persisted across tab switches.
• MCP enhancements. Sampling capability advertised; protocol version negotiation; max_failures wired; post_install field; zhipu-vision and unreal-engine presets.
• Tool improvements. file_read supports images (image_read); unchanged reads de-duplicated across turns.
• Soul archetype selector in Panel agent creation; 3D memory-galaxy visual/perf pass.

Fixed

• "Model returned empty response" when steering mid-run — tool results kept contiguous.
• macOS Local Network privacy — daemon embeds a stable CFBundleIdentifier and is re-signed on build.
• Routing failover attribution — frozen model + provider attributed from model directive, not wrapper name.
• firecrawl never persisted as a [fetch] backend; gateway closes remote sessions on token rotation.

---

26.7.22+ Rolling Updates (post-VERSION 26.7.21)

Unreleased. The commits since the 26.7.21 release tag roll densely into the next release tag — VERSION is still 26.7.21, but main has accumulated ~12,500 commits. This section is a rolling summary from the 26.7.21 baseline, covering seven major work lines.

A. Aleph Hub Single Source (aleph-hub, replaces legacy src/store/)

New src/hub/ module (14 files): cache.rs, catalog_client.rs, hub_catalog.rs, install.rs, official_mcp.rs, official_plugins.rs, official_skills.rs, primer.rs, reconcile.rs, secrets.rs, trust.rs, types.rs, verify.rs, mod.rs.

• hub::primer cold-start projection: projects official MCP presets, plugins, and skills into one ExtensionEntry cache (~/.aleph/hub_catalog.db)
• hub::catalog_client direct HTTP client: fetches https://hub.heyaleph.com/catalog.json, validates the schema, scans for prompt injection, normalizes entries, and updates the cache
• Official MCP presets are visible through aleph-hub without a manual mcp.add
• Retired: mcp.list_presets / mcp.install_preset, the Settings → MCP "Recommended" section, and the legacy src/store/ module

Hub built-in tools are registered in the main tool registry; they are not owned by a separate Hub Agent:

B. Artifacts / Deliverables System

New src/artifacts/ + src/export/ modules (artifact store + session HTML export + markdown export + page + collect + CSS).

• artifact_publish tool: lets the model publish finished work products as Deliverable
• artifacts.* RPC (handlers/artifacts.rs, ~650 lines): read_text / export_html / list, 512 KB cap + UTF-8 boundary
• session.export_html + artifacts.read_text: read-only route lane fix (must not enter Mutate lane)
• Telegram / CLI / TUI with artifact_publish must branch by turn.channel_id carrying substance; otherwise degrades to banner + auto-open pane
• Panel "Deliverables" pane (interfaces/webchat/src/components/artifacts/): replaces old inspector; after 4 review rounds reaches text preview + artifact-driven badge + visible fallbacks
• Gateway capability byte route (src/gateway/server/artifact_route.rs) exposes artifacts to remote clients

C. Vault Panel Refactor (panel/memory deep)

13 panel/memory: commits + platform/wide/views/memory/ 11 submodules + platform/phone/memory/ 7 submodules.

• Card view (cards.rs, three-state shell: Loading / Empty / Content)
• Bulk action bar (batch_bar.rs): archive / export / tag across multiple cards
• Dual-track search: raw rows vs notes rows; hits invalidate; facets chip
• Deep link / anchor: locate_note page math correct after page-size selector
• Evidence chain / notes_citing: render reverse links into drawer
• Provenance (provenance.rs): writer / timestamp / source event triple
• Cross-agent selection (selection.rs): atomic consistency, avoids lost updates on concurrent selection
• Pager (pager.rs, with page-size selector)
• Loadable (data.rs + loader.rs): all 4 fetches route through it; failed fetch unrepresentable as empty
• Toast (toast.rs): per-push seq identity (module-private slot)
• Stats (stats.rs): scoped to single agent; raw_rows_total = filtered_count (with regression test pin)

Memory RPC behavior changes (memory.listFacts / memory.search):

• listFacts returns total + carries tags / link_count / updated_at
• memory.search total = filtered count (not store total)
• memory.search returns raw rows only, never notes
• memory.graph (graph.query) reports null on scoped fetch failure (not 0)

D. Voice Conversation Round 2 / Round 2b

New src/gateway/voice/ submodules: format.rs, hallucination.rs, inbound/{provider,stt}.rs, outbound.rs, sanitize.rs, state.rs, streaming/{mod.rs,whisperlive.rs,deepgram.rs,relay.rs}, voice_mode.rs, local_provider.rs.

• [voice] vocabulary config: vocabulary biasing, translated per ASR backend (whisperlive hotwords / initial_prompt, OpenAI /audio/transcriptions prompt)
• [voice.streaming] pcm_input: WhisperLiveKit MUST be true to skip FFmpeg decode
• [voice.format] config: fast-model speech regularization (display polish)
• voice.stream.{start,audio,stop} RPC + delta topic, 64 KB cap + try_send to prevent blocking
• New TTS provider fallback (TTS_MAX_PROVIDERS = 2); hop drops voice_state.voice
• GenerationProviderRegistry::get_voices_for_provider: connects to speech_generate failure path (single join point: src/generation/voice_catalog.rs)
• WhisperLiveKit hardening: --pcm-input precondition; vocabulary biasing; segment completion normalization
• Panel capture tap early-arm + Capture::pending buffer; streaming_off uses stream_id: null latch
• shared/protocol/src/voice_text.rs: hallucination filter + sentence assembly single source
• Voice-as-Context: ASR-transcribed signal into context aggregation (§2.4)
• Interfaces platform/wide/views/voice/ (10 submodules): 16 kHz box-average resampling, caption_state, level, orb, sentence, vad, wav, voice_playback

E. Loop / Goal / Strategy Subsystems

New src/looping/, src/goal/, src/strategy/ three independent subsystems, each with own state machine, pause/resume, cross-session kill switch, tree-budget single-rail constraint.

• LoopState state machine (Active / Paused / Stopped) + cross-session kill switch
• GoalStore + TreeBudget single-rail: end-to-end test guard
• StrategyStraTA pattern: goal_key / loop_key / session_key / team_key four composite key namespaces; objective + approach + phases + guardrails + success_criteria + goal_id
• [strategy] plan_team + plan_naked_loop config switches (default on)
• Team run mode pin (leader stamps usage_mode and inherits to sub-members; session_set_mode rejected in team run)
• task_review grounding acceptance metadata (GroundingVerdict)
• team_chat strategy with member /loop / /goal priority: loop > session
• Team chat planner fire-once atomic put_if_absent
• /loop and /goal pause / resume channels

F. Memory Graph Expansion (§2.16 → §2.17)

• Hand-rolled Louvain community detection (no external crate, R3 compliant)
• 4-signal community-aware recall: node relevance + Leiden refinement
• notes_sources / notes_provenance / notes_graph_cache / notes_graph_insights tables
• graph-health insights: isolated / sparse / bridge / surprising
• notes_links lifecycle: resolved_by / status / label / edge confidence
• [[wikilink]] supersession closed loop + tombstone deletion
• GraphRecomputeStage: spawn_blocking trigger, zero LLM

G. Other (selected)

• iOS Panel Phase 1 / Phase 2 fixes: default pairing switched to HTTPS + ATS; Keychain trust store; phone/tablet platform views 7 submodules
• Settings UI UnifiedSaveBar unified save bar (ProviderEditPanel migrated to this bar)
• Search Registry + Phase 3 / Phase 4 Settings UI (PII migration + provider presets Swift UI)
• Behavior [behavior] section: cut / copy / halo three input modes + CGEventTap hotkey + clipboard context (10 sec)
• Multimodal providers: Gemini / Ollama / custom endpoints multimodal; clipboard image extraction
• Routing rules refactor: command + keyword two-phase matching; context-aware routing; strip_prefix; routing_rules.move / intent_type / preferred_model
• Tool registry enhancement: glob pattern permission override; tool_search folded into request core set; plugin.marketplace.* folded into extensions.*
• Cross-module review: gateway, providers, extensions, tasks, teams, sessions, skills, resilience, metrics, pii, orchestrator, memory, etc. multi-module adversarial review fixes

---

For all major changes before 26.6, see the Aleph CHANGELOG.md.

Selected milestones:

• 26.6.x — Multi-provider failover refactor; Telegram/Discord adapter overhaul; Panel Memory Vault refactor; iMessage channel; iOS Panel; VESR dynamic routing; MoA advisory; progressive tool disclosure; context never-break
• 26.5.x — Cluster federation; ACES integration; Panel Memory Galaxy
• 26.4.x — Knowledge-memory note layer (graph path, wikilinks, CJK search)
• 26.3.x — Self-evolution discipline; Telegram/Discord major cleanup
• 26.2.x — Harness migration; R10 redline landed; Desktop Bridge overhaul
• 26.1.x — TOML config; RAG-ified memory system; POE architecture
• 2025.12 — Internationalization; permission system; macOS 26 window design
• 2025.11 — Halo overlay; Memory Module (Phase 4); AI provider integration
• 2025.10 — Rust core; Gateway WebSocket; Agent loop; macOS Swift app v1

---

Tags & Snapshots