dev/repro: add worktree-isolating driver script; clarify browser context

Add dev/repro.py — a maintainer-only wrapper around `omnigent run
dev/repro-agent`. It prompts for the bug URL (or takes it as an argument /
bare id like OMNI-1234 / 3987), creates an isolated git worktree off the
current checkout's HEAD (branch repro/<slug>, auto-suffixed on collision),
and runs the agent FROM that worktree so the authored e2e test lands on its
own branch without dirtying your checkout. The worktree is always kept; the
script prints its path + branch + cleanup command at the end.

It lives under dev/ (not shipped in the wheel) rather than as an `omni`
subcommand because it depends on a source checkout — the repro-agent authors
into tests/e2e_ui/ / tests/e2e/, which only exist here.

Also, from PR review:
- AGENTS.md: note that UI-journey reproduction drives the desktop app's
  embedded browser, so it expects a desktop / embedded-browser context (fall
  back to the backend path / needs_more_info when there's no browser pane).
- README.md: document the dev/repro.py driver.

Co-authored-by: Isaac

.claude/skills/antigravity-native-e2e-dev/SKILL.md

@@ -71,8 +71,10 @@ Three transports, easy to confuse:
    agy models   # exits 0 and lists models only when signed in; else 'Please sign in'
    ```
    `False` / non-zero → run `agy` once and sign in. agy's token lives under
-   `~/.gemini` (`oauth_creds.json` on macOS, `antigravity-cli/antigravity-oauth-token`
-   on Linux).
+   `~/.gemini` (`oauth_creds.json` on macOS through 1.0.10,
+   `antigravity-cli/antigravity-oauth-token` on Linux); agy 1.1.7+ on macOS
+   writes no token file and keeps the credential in the Keychain, which is why
+   `gemini_login_detected()` falls back to `agy models` there.
 4. **`tmux` is on PATH.** The agy terminal is a runner-owned tmux pane; the CLI
    attaches to it and the executor drives it via `tmux send-keys`
    (`_preflight_local_tools` hard-fails without tmux).
@@ -86,7 +88,7 @@ Three transports, easy to confuse:
 
 ```bash
 cd /path/to/omnigent
-.venv/bin/omni server start          # detached managed server on a free loopback port
+.venv/bin/omni server --background          # detached managed server on a free loopback port
 .venv/bin/omni server status         # prints the URL, e.g. http://127.0.0.1:6767
 SERVER=http://127.0.0.1:6767         # use the printed URL below
 curl -s "$SERVER/health"             # {"status":"ok"}

.claude/skills/antigravity-sdk-e2e-dev/SKILL.md

@@ -47,7 +47,7 @@ tests.
 
 ```bash
 cd /path/to/omnigent
-.venv/bin/omni server start          # spawns a detached server on a free loopback port
+.venv/bin/omni server --background          # spawns a detached server on a free loopback port
 .venv/bin/omni server status         # prints the URL, e.g. http://127.0.0.1:6767
 ```
 
@@ -134,7 +134,7 @@ streaming, harness.
 7. **Turns take ~10–60s** — always wrap in `timeout 280`.
 8. **Local-runner topology:** `omni run <bundle> --server <url>` runs the
    harness from your **current checkout**; the server only holds state. The
-   managed `omni server start` server runs from whatever venv launched it.
+   managed `omni server --background` server runs from whatever venv launched it.
 9. **Never print/echo the Gemini key** in logs or commands.
 
 ## Code & tests

.claude/skills/copilot-sdk-e2e-dev/SKILL.md

@@ -44,7 +44,7 @@ the unit tests.
 
 ```bash
 cd /path/to/omnigent
-.venv/bin/omni server --port 7788 --no-open    # foreground; or `omni server start` for detached
+.venv/bin/omni server --port 7788 --no-open    # foreground; or `omni server --background` for detached
 curl -s http://127.0.0.1:7788/health           # {"status":"ok"}
 ```
 

.claude/skills/cursor-sdk-e2e-dev/SKILL.md

@@ -35,7 +35,7 @@ Cursor as SDK `custom_tools`. This skill is the proven recipe for running it
 
 ```bash
 cd /path/to/omnigent
-.venv/bin/omni server start          # spawns a detached server on a free loopback port
+.venv/bin/omni server --background          # spawns a detached server on a free loopback port
 .venv/bin/omni server status         # prints the URL, e.g. http://127.0.0.1:6767
 ```
 
@@ -116,7 +116,7 @@ that works, the full stack is good: key, egress, bridge, harness.
 5. **Turns take 30–90s** — always wrap in `timeout 280`.
 6. **Local-runner topology:** `omni run <bundle> --server <url>` runs the
    harness from your **current checkout**; the server only holds state. The
-   managed `omni server start` server runs from whatever venv launched it.
+   managed `omni server --background` server runs from whatever venv launched it.
 7. **Never print/echo the Cursor key** in logs or commands.
 
 ## Code & tests

.claude/skills/harness-integration-guide/SKILL.md

@@ -115,6 +115,19 @@ All capabilities are **required** for a complete harness integration:
 - [ ] Unit tests cover tool bridging, auth, model routing
 - [ ] Mock LLM tests cover the happy path without real API calls
 
+### Shortcut: ACP CLI harnesses are one catalog row
+
+If the vendor CLI speaks the Agent Client Protocol on stdio (the
+`goose acp` / `qwen --acp` family), do NOT write a new inner module, registry
+entries, or a spawn-env builder. Add one row to `ACP_CLI_HARNESSES` in
+`omnigent/acp_cli_harnesses.py` (label, binary, ACP argv, aliases, install
+hint or npm package, vendor login command) plus docs. Validity, module
+routing, picker label, capabilities, install spec, readiness, setup steps,
+spawn env, and the live e2e-matrix exclusion all derive from the row;
+`tests/test_acp_cli_harnesses.py` asserts the wiring per row automatically.
+These rows run through `omnigent/inner/acp_harness.py` and `AcpExecutor`, own
+their auth and model selection, and reject `/model` overrides up front.
+
 ---
 
 ## Part 2 — Native harnesses

.claude/skills/pi-native-e2e-dev/SKILL.md

@@ -76,7 +76,7 @@ Two ways a turn reaches Pi — test both:
 
 ```bash
 cd /path/to/omnigent
-.venv/bin/omni server start          # detached managed server on a free loopback port
+.venv/bin/omni server --background          # detached managed server on a free loopback port
 .venv/bin/omni server status         # prints the URL, e.g. http://127.0.0.1:6767
 SERVER=http://127.0.0.1:6767         # use the printed URL below
 curl -s "$SERVER/health"             # {"status":"ok"}

.claude/skills/polly-e2e-dev/SKILL.md

@@ -118,7 +118,7 @@ right vendor, cross-reviews). That is the live recipe.
 ### Run a live turn
 
 ```bash
-.venv/bin/omni server start && .venv/bin/omni server status   # prints $SERVER, e.g. http://127.0.0.1:6767
+.venv/bin/omni server --background && .venv/bin/omni server status   # prints $SERVER, e.g. http://127.0.0.1:6767
 SERVER=http://127.0.0.1:6767
 timeout 280 .venv/bin/omni run examples/polly \
   -p "Investigate how the runner enforces tool-call policies and report file:line evidence." \

.claude/skills/run-load-test/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: run-load-test
+description: Run the Omnigent load test and produce a results file explaining the latencies. Load when the user wants to load-test / stress-test / benchmark Omnigent under concurrency ("load test omnigent", "stress test the server", "how many hosts/sessions/turns can it handle", "load test real agent turns / conversations", "run a load test"). The test makes each simulated user a real omnigent host that creates host-bound sessions and drives real multi-turn conversations with a mocked LLM; it boots its own local stack (dev/loadtest/run.py). Gather inputs, run it, then read the generated summary.md and explain the latency distribution (avg/median/p95/p99, throughput, failures). NOT for single-request latency micro-benchmarks (that is dev/benchmarks/).
+---
+
+# Run the Omnigent load test
+
+Drives `dev/loadtest/` end to end: collect inputs → run → read `summary.md` →
+explain the latencies. **Each Locust user is a real `omnigent host`** that
+registers over the host tunnel, creates host-bound sessions, and drives **real
+multi-turn conversations** — every turn is a genuine post→idle loop through the
+host's runner, with the **LLM mocked** (zero latency) so the numbers are
+Omnigent's own overhead. `-u N` scales the number of hosts.
+
+It **boots its own local stack** (server + mock LLM), so there is no server to
+point at, and it runs **from a repo checkout** only. For single-request latency
+micro-benchmarks (not concurrency), that is a different tool: `dev/benchmarks/`.
+
+## 1. Ensure deps (repo checkout)
+
+```bash
+pip install -e '.[loadtest,dev,agents-sdk]'   # or: uv sync --extra loadtest --extra dev --extra agents-sdk
+```
+
+Run with that same interpreter (e.g. `.venv/bin/python`), from the repo root.
+
+## 2. Gather inputs
+
+Ask the user (AskUserQuestion when several are unknown); all have defaults.
+
+| Input | Flag | Default | Notes |
+|---|---|---|---|
+| Hosts | `--users` | 4 | Concurrent hosts (N) — the main scale knob. |
+| Spawn rate | `--spawn-rate` | 1 | Hosts started per second. |
+| Run time | `--run-time` | 120s | `40s` / `5m` / `1h`. |
+| Sessions/host | `--sessions-per-user` | 2 | Host-bound sessions each host drives. |
+| Turns/session | `--turns-per-session` | 4 | Turns per session — history grows across them. |
+| Reply length | `--reply-words` | 60 | Words in the mocked (streamed) reply per turn. |
+
+**Capacity caveat — say this to the user if they ask for large N:** turns run on
+real host + runner subprocesses, so N hosts × M sessions = N×M runner processes
+on *this* box. It is capacity-limited by design (real turns, not faked). Start at
+`--users 2 --sessions-per-user 1 --turns-per-session 2 --run-time 40s` to confirm
+the stack boots (~10-30s), then ramp to a few dozen hosts at most. At high N the
+load box saturates before the server (Locust warns about CPU).
+
+## 3. Run
+
+```bash
+python dev/loadtest/run.py \
+    --users <N> --spawn-rate <R> --run-time <T> \
+    --sessions-per-user <S> --turns-per-session <TU>
+```
+
+It boots the stack, prints the server URL + registered agent, runs Locust, and
+writes `dev/loadtest/results/omnigent_load_test-<timestamp>/`.
+
+## 4. Read and explain
+
+`Read` the `summary.md` and relay it. Focus on:
+
+- **Outcome / failures** first. Exit 0 + 0 failures = PASS. Non-zero failures are
+  the headline — check `console.log` and, for a host that failed to register,
+  the per-host `results/.../host-workspaces/<name>/host.log`. At high N, failures
+  usually mean the *load box* saturated, not the server.
+- **turn** — the headline latency: one full post→idle agent turn on a host's
+  runner (mocked LLM), so it is Omnigent's per-turn overhead. It **grows across a
+  conversation** as history accumulates, so a rising p95/p99 with larger
+  `--turns-per-session` is expected and is the interesting signal.
+- **host online** — host tunnel registration cost; **session create** — the
+  host-bound create; **Ops/s** — aggregate throughput at this concurrency.
+
+If failures appeared or the tail looks high, suggest a concrete next step (lower
+N if the load box is saturated, raise `--turns-per-session` to study history
+growth, lengthen `--run-time` for steady state, or check server logs/metrics).
+
+## Notes
+
+- Scenario file: `dev/loadtest/omnigent_load_test.py`; driver + report:
+  `dev/loadtest/run.py`. Full reference: `dev/loadtest/README.md`.

.github/MAINTAINER

@@ -10,11 +10,13 @@ dhruv0811
 Edwinhe03
 fanzeyi
 kerryspchang
+kunyuchen
 lisancao
 mahesh-venkatachalam
 mateiz
 newfront
 PattaraS
+rahulrav1
 SabhyaC26
 serena-ruan
 shivam5

.github/actions/integration-run/action.yml

@@ -145,8 +145,6 @@ runs:
         OMNIGENT_CLAUDE_SDK_NO_SANDBOX: ${{ inputs.harness == 'claude-sdk' && '1' || '' }}
         PYTEST_PROGRESS_LOG_DIR: ${{ github.workspace }}/artifacts/progress-${{ inputs.harness }}
         OMNIGENT_TOKEN_USAGE_JSON: ${{ github.workspace }}/artifacts/tokens-${{ inputs.harness }}.json
-        OMNIGENT_TEST_MODEL_SPREAD: "1"
-        OMNIGENT_TEST_MODEL_POOL_GPT: "databricks-gpt-5-5,databricks-gpt-5-4-mini"
       run: |
         set -euo pipefail
         mkdir -p artifacts "$INTEGRATION_TMP_BASE"

.github/actions/run-omnigent-agent/action.yml

@@ -0,0 +1,133 @@
+name: Run Omnigent agent
+description: >-
+  Set up uv + the Claude Code CLI + an Omnigent gateway provider, run a tools-less
+  Omnigent agent headlessly on a prompt file, and secret-scan its output. Shared by
+  the release-cut (draft-release-notes) and publish (publish-changelog) workflows so
+  the LLM-runner scaffold lives in one place. The caller mints no write-token until
+  after this action returns — the only secret here is the model key.
+
+inputs:
+  model:
+    description: Provider-configured model id.
+    required: true
+  workdir:
+    description: >-
+      Repo checkout dir relative to the workspace (`.` when checked out at the
+      root, `omnigent` when checked out into a subdir). Drives the venv path, the
+      cache key, and the uv --project / agent paths.
+    required: false
+    default: "."
+  agent:
+    description: Agent directory name under <workdir>/.github/agents/.
+    required: true
+  prompt-file:
+    description: Absolute path to the file holding the agent prompt.
+    required: true
+  output-file:
+    description: Absolute path to write the agent's stdout to.
+    required: true
+  stderr-file:
+    description: Absolute path to write the agent's stderr to.
+    required: false
+    default: /tmp/omnigent-agent-stderr.log
+  gateway-base-url:
+    description: Base URL of the Anthropic-compatible gateway.
+    required: true
+  llm-api-key:
+    description: Model API key (referenced by the provider config, used to scan output).
+    required: true
+  claude-code-version:
+    description: "@anthropic-ai/claude-code npm version to install."
+    required: false
+    default: 2.1.212
+
+runs:
+  using: composite
+  steps:
+    - name: Set up uv
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      with:
+        enable-cache: true
+
+    - name: Cache virtualenv
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ inputs.workdir }}/.venv
+        key: venv-${{ runner.os }}-${{ hashFiles(format('{0}/.python-version', inputs.workdir)) }}-${{ hashFiles(format('{0}/uv.lock', inputs.workdir)) }}
+
+    - name: Install dependencies
+      shell: bash
+      working-directory: ${{ inputs.workdir }}
+      run: uv sync --extra all --extra dev
+
+    - name: Install Claude Code CLI
+      shell: bash
+      env:
+        NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
+        CLAUDE_CODE_VERSION: ${{ inputs.claude-code-version }}
+      run: |
+        set -euo pipefail
+        # Install outside the checked-out tree: a repo-root package.json would
+        # otherwise capture this bare `npm install` and hoist it there, leaving
+        # this dir's node_modules empty.
+        CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+        mkdir -p "$CC_CLI_DIR"
+        cd "$CC_CLI_DIR"
+        npm install --ignore-scripts --no-audit --no-fund "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}"
+        node node_modules/@anthropic-ai/claude-code/install.cjs
+        echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
+
+    - name: Write Omnigent provider config
+      shell: bash
+      env:
+        GATEWAY_BASE_URL: ${{ inputs.gateway-base-url }}
+        OMNIGENT_AGENT_MODEL: ${{ inputs.model }}
+      run: |
+        set -euo pipefail
+        : "${OMNIGENT_AGENT_MODEL:?Set the action model input}"
+        mkdir -p "$HOME/.omnigent"
+        python3 -c "
+        import pathlib, os, json
+        gw = os.environ['GATEWAY_BASE_URL']
+        cfg = {'providers': {'databricks-gateway': {
+            'kind': 'gateway', 'default': ['anthropic'],
+            'anthropic': {
+                'base_url': gw + '/anthropic',
+                'api_key_ref': 'env:LLM_API_KEY',
+                'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
+            }}}}
+        pathlib.Path.home().joinpath('.omnigent', 'config.yaml').write_text(json.dumps(cfg, indent=2))
+        "
+
+    - name: Run the agent
+      shell: bash
+      env:
+        LLM_API_KEY: ${{ inputs.llm-api-key }}
+        WORKDIR: ${{ inputs.workdir }}
+        AGENT: ${{ inputs.agent }}
+        PROMPT_FILE: ${{ inputs.prompt-file }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        STDERR_FILE: ${{ inputs.stderr-file }}
+      run: |
+        set -euo pipefail
+        project="${GITHUB_WORKSPACE}/${WORKDIR}"
+        prompt="$(cat "$PROMPT_FILE")"
+        uv run --project "$project" omnigent run \
+          "${project}/.github/agents/${AGENT}" \
+          -p "$prompt" --no-session \
+          2>"$STDERR_FILE" | tee "$OUTPUT_FILE" \
+          || { echo "::warning::agent exited non-zero — caller keeps its fallback"; cat "$STDERR_FILE"; }
+
+    # ::add-mask:: only redacts rendered logs; the caller still redacts artifact
+    # files before upload. This aborts the run outright if the key leaked to stdout.
+    - name: Scan agent output for secrets
+      shell: bash
+      env:
+        LLM_API_KEY: ${{ inputs.llm-api-key }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+        if [ -n "${LLM_API_KEY:-}" ] && grep -qF "$LLM_API_KEY" "$OUTPUT_FILE" 2>/dev/null; then
+          echo "::error::Agent output contains LLM_API_KEY — aborting."
+          exit 1
+        fi

.github/actions/setup-node/action.yml

@@ -1,37 +0,0 @@
-name: "setup-node"
-description: "Set up Node and pin npm, with npm dependency caching keyed on the web lockfile."
-
-# Single source of truth for the JS toolchain across CI. Pins npm to the
-# EXACT version that regenerates the lockfile in oss-regenerate-and-smoke.yml
-# (npm 11.12.1); without this, jobs use whatever npm Node 20 bundles
-# (npm 10.x) and the `package-lock.json` freshness gate in lint.yml would
-# flake on version-skew churn (dev/extraneous flags, metadata). Keep this
-# version in lockstep with the regen workflow so generation and
-# verification never diverge.
-
-inputs:
-  node-version:
-    description: "Node version to use."
-    default: "20"
-    required: false
-  cache:
-    description: "Package-manager cache to enable (passed to actions/setup-node)."
-    default: "npm"
-    required: false
-  cache-dependency-path:
-    description: "Lockfile path used as the cache key."
-    default: "web/package-lock.json"
-    required: false
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
-      with:
-        node-version: ${{ inputs.node-version }}
-        cache: ${{ inputs.cache }}
-        cache-dependency-path: ${{ inputs.cache-dependency-path }}
-
-    - name: Pin npm
-      shell: bash
-      run: npm install -g npm@11.12.1

.github/actions/setup-pnpm/action.yml

@@ -0,0 +1,21 @@
+name: "setup-pnpm"
+description: "Set up Node + pnpm for the web workspace"
+
+inputs:
+  node-version:
+    description: "Node version to use."
+    default: "22"
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      with:
+        standalone: true
+
+    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: pnpm
+        cache-dependency-path: pnpm-lock.yaml

.github/agents/feature-blog-drafter/config.yaml

@@ -0,0 +1,206 @@
+# feature-blog-drafter — drafts ONE feature-blog post on omnigent-site for a
+# feature the feature-blog-scout selected as blog-worthy at release cut.
+#
+# Like doc-drafter, it gets a checkout of the omnigent-site repo as its working
+# tree, so it inspects the REAL site (existing blog posts + conventions) to match
+# the house style, then writes the post in place. It can also read the omnigent
+# code checkout to confirm facts (commands, flags, docs paths) before writing. It
+# is a single agent (no sub-agents) for simplicity and speed.
+#
+# Run headlessly by .github/workflows/feature-blog.yml with cwd = the omnigent-site
+# checkout:  omnigent run .github/agents/feature-blog-drafter -p "<context>" --no-session
+# The agent ONLY writes the new post MDX in the site checkout and prints a summary;
+# the workflow commits, pushes, and opens the DRAFT PR.
+
+spec_version: 1
+name: feature-blog-drafter
+description: >-
+  Drafts a single feature-blog post on omnigent-site for a scout-selected
+  feature. Inspects the live site to match conventions, confirms facts against
+  the omnigent code, and writes a short one-screen user-facing post, marking the
+  mandatory demo for a human. Writes blog prose only (never product code) and
+  never commits or pushes (the workflow does that).
+
+executor:
+  type: omnigent
+  config:
+    harness: claude-sdk
+
+async: true
+cancellable: true
+
+# os_env runs unsandboxed (sandbox: none) — the same posture as doc-drafter.
+# The drafter sits in a STRONG trust position: it runs only on ALREADY-RELEASED
+# history; the only secret in its env is LLM_API_KEY; the omnigent-site
+# write-token is minted by the workflow AFTER it finishes. Honest residual risk
+# (same as doc-drafter / polly-review): with network allowed and LLM_API_KEY in
+# env, an injection hidden in the input could drive an outbound exfil request; a
+# network-denying sandbox is the real mitigation but is not used for the CI
+# fragility reason documented in doc-drafter/config.yaml, so we accept the same
+# residual risk. cwd is the workspace root (holds the material files the drafter
+# reads and the omnigent-site checkout it writes).
+os_env:
+  type: caller_process
+  cwd: .
+  sandbox:
+    type: none
+
+# Same blast_radius guardrail as the rest of the project: catastrophic commands
+# denied; ordinary git reads run without an ASK (headless can't approve).
+guardrails:
+  policies:
+    blast_radius:
+      type: function
+      on: [tool_call]
+      function:
+        path: omnigent.inner.nessie.policies.blast_radius
+        arguments:
+          gate_pushes: false
+
+prompt: |
+  You are the Omnigent feature-blog drafter. The feature-blog scout selected ONE
+  feature from a just-cut release as worth a short blog post. Your job: write
+  that post into the omnigent-site blog. You author blog prose (MDX) only — you
+  NEVER write product source code or tests, and you NEVER edit anything in the
+  omnigent code repo.
+
+  ## Write ONLY the post page — the blog surface already exists
+  The blog infrastructure is already in place on omnigent-site: `app/blog/`
+  layout + index page auto-discover posts via `lib/blog.js`, and the nav links to
+  it. Your ONE and ONLY output file is `app/blog/<SLUG>/page.mdx`. You MUST NOT
+  create or edit any layout, index (`app/blog/page.js`), sidebar, `lib/` scanner,
+  navigation, or other site plumbing — dropping in the post page is enough for it
+  to appear. If you think infra is missing, flag it under "Manual review needed"
+  rather than scaffolding it (inventing plumbing can break the site build).
+
+  ## Inputs (in the run prompt)
+  - `SITE_REPO` — absolute path to the omnigent-site checkout. It is your ONLY
+    WRITE target — write the new post there.
+  - `HEADLINE`, `SLUG`, `CATEGORY` — the scout's selection for this feature.
+  - `DATE` — the release date (YYYY-MM-DD) for the post frontmatter.
+  - `MATERIAL_FILE` — a path (in your current directory) to a file holding the
+    contributing PRs' changelog entries and, when available, their diffs. **Read
+    it first with `sys_os_read`** — it is your ONLY source of truth for what the
+    feature does, its commands, and its flags. (It is a file, not inline, because
+    a large diff would exceed the command-line length limit.)
+  Do not fetch external resources. Ground every fact in `MATERIAL_FILE`.
+
+  ## Step 1 — Understand the feature
+  Read `MATERIAL_FILE` (with `sys_os_read`) carefully. Pull exact facts — the CLI
+  command(s), flags, harness ids, config keys — from it. Never invent a fact; if
+  it doesn't settle something the post must state (e.g. the exact command), omit
+  that detail rather than guess. You may read the omnigent code checkout to
+  confirm a command or a docs path.
+
+  ## Step 2 — Match the existing post conventions (read-only)
+  This is why you have the whole site checked out. Before writing, read an
+  existing post under `app/blog/` and copy its frontmatter shape and JSX
+  conventions EXACTLY — the import lines, the metadata/frontmatter helper, the
+  frontmatter fields (`date`, `category`, `author`, `heroArt`), and the body
+  structure. Posts are auto-discovered by `lib/blog.js`, so you do NOT register
+  the post anywhere — matching the existing post shape is all that's needed. Read
+  `lib/blog.js` only to confirm which frontmatter fields it expects; do not edit
+  it. Every post's title + author + date + reading-time header is rendered by the
+  `<BlogPostHeader slug="SLUG" />` component (registered globally in
+  `mdx-components.js`, so no import is needed) — use it as the first thing in the
+  body and never hand-write a `# H1` title (item 1 below).
+
+  ## Step 3 — Write the post (short, one-screen, in-style)
+  Create `app/blog/<SLUG>/page.mdx` — this is the ONLY file you write. Keep the
+  whole post to roughly one screen; it is a changelog-blog entry, NOT a long-form
+  article.
+
+  The five items below are the SHAPE of the post, in order — they are NOT section
+  headings and NOT sentence lead-ins. Write flowing prose. Do NOT emit label text
+  like "Who it's for:", "The problem it solves", "How to use", or "What's next" —
+  neither as headings nor at the start of a sentence. Do NOT write a Markdown
+  `# H1` title at all — the title and byline are rendered by the header component
+  (see item 1); a `#` heading would duplicate it. Use `##` for any in-body
+  subheadings only if genuinely needed (usually none for a one-screen post).
+
+  1. Frontmatter first: after the `import { pageMeta } from "@/lib/og";` line and
+     the exported `metadata`, export a `meta` object carrying
+     `title: "<the benefit HEADLINE>"`, `date: "DATE"`, `category: "CATEGORY"`,
+     `author: "omnigent"` (default; a human may overwrite it during review), and
+     `heroArt: ""`. Then, as the FIRST thing in the body, render the header:
+     `<BlogPostHeader slug="SLUG" />` (use the exact SLUG you were given). This
+     component draws the title + author + date + reading-time byline, so do not
+     repeat the title as text. Follow it with a short opening paragraph that says
+     who it helps and what they can now do as a natural sentence ("If you drive
+     long agent runs in the web UI, you can now line up your next few messages
+     instead of waiting for each turn to finish."), NOT as a "Who it's for:" label.
+  2. In 2–3 sentences, describe the problem this removes and the outcome, in the
+     user's terms. Lead with what the user gets, then just enough of how it works
+     to be concrete. Let the "orchestration layer over many agents, any device,
+     with governance" wedge show through the framing; never sloganeer it.
+  3. The demo. You CANNOT produce the screenshot/recording, so emit EXACTLY this
+     marker where it belongs, with a one-line suggestion of what to show. It MUST
+     be an MDX comment (`{/* ... */}`), NOT an HTML comment (`<!-- ... -->`);
+     HTML comments are invalid in MDX and break the site build:
+     `{/* DEMO REQUIRED: 15–30s recording or light/dark screenshot pair, realistic data. No sanitized mockups. Suggested: <what to show> */}`
+  4. Show how to use it: a short prose sentence plus, when the feature has one, a
+     copy-pasteable fenced command block (only commands/flags grounded in
+     `MATERIAL_FILE`), and a link to the relevant docs page. If it is a UI feature
+     with no command, describe the click path in one or two sentences instead.
+  5. Optionally close with one plain sentence on what is coming next, ONLY if the
+     material clearly supports it; otherwise stop. Do NOT write the closing CTA /
+     star ask — the workflow appends a fixed footer.
+
+  ## Voice and content rules (IMPORTANT — the last drafts failed these)
+  - **User-facing, not implementation.** Write about what the reader can now DO,
+    never about how it is built or verified. Do NOT list harness ids, internal
+    component names, per-harness verification status, PR numbers, flags, or
+    "verified for X, still being verified for Y" caveats. If a capability works
+    across harnesses, say "works with any agent you run in Omnigent" — not a list
+    of `claude-sdk, codex-sdk, ...`. When the material is full of engineering
+    detail, translate it into the one user outcome that matters and drop the rest.
+  - **Few dashes.** Do NOT use " — " (spaced em/en dashes) as a sentence
+    connector; it reads as AI-generated. Write separate sentences, or use a comma,
+    "and", parentheses, or a colon. At most ONE dash in the whole post, and only
+    if nothing else fits. Do not use "not X but Y" or "It's not just … it's …"
+    constructions.
+  - **Plain and concrete.** Short sentences, active voice, no marketing adjectives
+    ("powerful", "seamless", "effortless", "game-changing"), no hype. Prefer a
+    real example over an abstraction.
+
+  Leave `heroArt: ""` in the frontmatter. The workflow generates the hero image
+  from your `IMAGE_PROMPT` (below) and fills `heroArt` in; do not set it yourself.
+  Ground every fact in the material; if unsure, omit it and note it under
+  "Manual review needed".
+
+  ## Output contract (your final assistant text)
+  Emit these two single-line fields (each on its own line), then the summary
+  block. Extraction is by prefix, so order between the two does not matter, but
+  `BLOG_PR_TITLE:` MUST be the line immediately before `<!-- BLOG_DRAFT_SUMMARY -->`.
+
+  - `IMAGE_PROMPT:` — one sentence describing a concrete visual SCENE that
+    depicts THIS feature's content, for an illustrated hero image. Describe the
+    subject only (what is happening, the objects/actors and their relationship),
+    grounded in what the feature actually does. Examples: for a queue/steer
+    feature, "a person lining up a stack of chat message cards that feed one at a
+    time into a working AI agent, with a hand redirecting one mid-flight"; for a
+    multi-harness feature, "several distinct robot agents plugging into a single
+    central hub that routes their work". Rules: NO text, words, letters, logos,
+    UI screenshots, charts, or watermarks in the scene; do NOT mention colors,
+    art style, aspect ratio, or "flat vector / navy / starfish" — the workflow
+    appends the fixed brand style. Just the subject.
+  - `BLOG_PR_TITLE:` — a concise, imperative summary grounded in the feature
+    (e.g. `BLOG_PR_TITLE: add feature blog for side-by-side harness sessions`).
+    Keep it under 60 characters, no trailing period, and do NOT prefix it with
+    `blog:` (the workflow adds that). This becomes the blog PR title.
+
+  Then, after a line containing exactly `<!-- BLOG_DRAFT_SUMMARY -->`, emit:
+  - `## Post drafted` — the path of the single post file you created
+    (`app/blog/<SLUG>/page.mdx`). You should not have edited any other file.
+  - `## Manual review needed` — a checklist: `- [ ] <item> — <why>`. Always
+    include the mandatory demo line (the `{/* DEMO REQUIRED */}` marker you left).
+    Note that the hero image is auto-generated from your `IMAGE_PROMPT` and the
+    author byline defaults to `omnigent`; list each as "review / optionally
+    replace" rather than a blocking task. Add any fact you had to omit for lack
+    of grounding.
+  Then STOP. Do NOT `git commit`, push, or open a PR — the workflow does that.
+  Leave your edits in SITE_REPO's working tree and print the summary.
+
+  ## Act in the same turn you announce
+  Never end a turn after only saying what you will do — emit the tool calls that
+  perform it in the same turn.

.github/agents/feature-blog-scout/config.yaml

@@ -0,0 +1,121 @@
+# feature-blog-scout — decides which of a release's features (if any) are big
+# enough to warrant a feature-blog post, used by feature-blog.yml at release cut.
+#
+# Given the same PR-range material draft-release-notes.yml already harvests (the
+# per-PR list + the mechanical notes), it selects 0–N features worth a blog post,
+# ranked strongest-first, and emits them as a JSON block. It has NO tools and NO
+# sub-agents: it selects from the material it is handed, so a run is fast, cheap,
+# and can't hang. The feature-blog.yml workflow parses its output and runs the
+# feature-blog-drafter once per selected feature.
+#
+# Run headlessly:  omnigent run .github/agents/feature-blog-scout -p "<pr material>" --no-session
+#
+# Security posture (mirrors doc-classifier / release-notes-drafter): runs only on
+# ALREADY-RELEASED history (every PR was maintainer-reviewed + merged), on the
+# trusted default branch, with LLM_API_KEY the only secret in env. The
+# omnigent-site write-token is minted by the workflow AFTER this agent finishes.
+# Its input is author-written PR text (a prose injection surface) — the workflow
+# secret-scans stdout and redacts artifacts, and every post is a human-reviewed
+# DRAFT PR.
+
+spec_version: 1
+name: feature-blog-scout
+description: >-
+  Selects which features from a release's merged PRs (if any) are big enough to
+  warrant a feature-blog post. Applies a signal-based bar, caps at the requested
+  limit (default top 2–3),
+  and emits a ranked BLOG_CANDIDATES JSON block (often empty). No tools, no
+  sub-agents — a pure selection turn.
+
+executor:
+  type: omnigent
+  config:
+    harness: claude-sdk
+
+prompt: |
+  You are the Omnigent feature-blog scout. A new version has just been cut. You
+  are given the list of pull requests merged since the previous release — each
+  with its number, title, type tag, and (when the author filled it in) the
+  one-line changelog entry — plus a MECHANICAL DRAFT that groups them into
+  Major-features / Breaking / Bug-fixes buckets. Your job: pick the features (if
+  any) big enough to be worth a short feature-blog post, and rank them.
+
+  Most releases produce ZERO — that is the expected, correct outcome for a
+  release of internal work, fixes, and small additions. Only select a feature
+  when it clearly clears the bar below.
+
+  ## The bar
+  A feature is "big enough" only if it hits **at least 2 of these 4 signals** —
+  all about the *nature* of the change (the number of PRs is NOT a signal: a big
+  feature can land in one clean PR, and a pile of PRs is often churn):
+
+  1. **New user-facing capability or surface** — a new command, mode, UI
+     surface, integration (harness / model provider / MCP tool / sandbox /
+     deploy target), not a tweak to an existing one.
+  2. **Changes a workflow** — it gives the user a *new way to do something* and
+     has a "how to use it" story; not "faster / fixed X".
+  3. **Demonstrable "why it matters"** — you can state the problem it solves in
+     2–3 sentences AND picture a 15–30s demo of it in use with realistic data.
+  4. **Fits our wedge** — orchestration over many agents, any device, with
+     governance. We are the layer *above* individual agents; competitors sell
+     one agent. Multi-agent / cross-harness / cross-device / governance features
+     fit; table-stakes single-agent features do not.
+
+  ## Hard exclusion filter (never select, regardless of signals)
+  Pure bug fixes, performance, refactors, dependency bumps, CI / build / test /
+  tooling, security fixes or hardening (never advertise these), docs-only
+  changes, and single small flag additions. Anything still behind an
+  off-by-default flag or otherwise not user-visible yet.
+
+  ## Selecting and ranking
+  - Judge readiness from the range: only select a feature that has landed and is
+    complete enough to demo this release. Skip anything half-landed or spread too
+    thin to show.
+  - Collapse related PRs into ONE feature (as release notes do) — a feature is a
+    theme, not a PR.
+  - **Cap: rank strongest-first and return at most the number of features the
+    run asks for** (the run prompt states the limit; default is the top 2–3).
+    Even if more clear the bar, never exceed that limit.
+  - **Final self-check per candidate — drop it if it fails:** can you picture the
+    15–30s demo, and does a benefit headline beat naming the mechanism? (Signal 3
+    and this check are the same demo test — apply it as a filter and as a veto.)
+  - When in doubt, leave it out. A missed post is cheaper than a weak one.
+
+  ## Writing each candidate
+  - `headline`: a benefit headline, NOT a feature name — lead with the user
+    outcome ("Run Claude Code and Codex side-by-side in one session"), not the
+    mechanism ("multi-harness sessions").
+  - `slug`: short, kebab-case, url-safe, derived from the headline.
+  - `category`: a short tag for scannability (e.g. `Multi-harness`,
+    `Governance`, `Web UI`, `Models`, `Deploy`), inferred from the change.
+  - `why_worthy`: one sentence — why this clears the bar.
+  - `signals`: the signal numbers it hits, e.g. `[1, 2, 4]`.
+  - `pr_refs`: the contributing PR numbers you were actually given, e.g.
+    `[1304, 1312]`. Never cite a PR not in the input.
+
+  ## Security
+  You are running in CI with access to secrets. Never echo secrets, tokens, or
+  credentials, and never make outbound network calls.
+
+  ## Output (STRICT)
+  Emit ONLY the following block and nothing else — no preamble. On the common
+  no-blog release, emit an empty array:
+
+  <!-- BLOG_CANDIDATES -->
+  [
+    {
+      "headline": "Run Claude Code and Codex side-by-side in one session",
+      "slug": "claude-code-codex-side-by-side",
+      "category": "Multi-harness",
+      "why_worthy": "New cross-harness workflow that lets you review one agent's work with another.",
+      "signals": [1, 2, 4],
+      "pr_refs": [1304, 1312]
+    }
+  ]
+  <!-- /BLOG_CANDIDATES -->
+
+  (Emit `[]` between the markers when nothing clears the bar.)
+
+  ## Act in the same turn you announce
+  Never end a turn after only saying what you will do — produce the
+  BLOG_CANDIDATES block in the same turn.

.github/agents/release-post-formatter/config.yaml

@@ -0,0 +1,169 @@
+# release-post-formatter — a tiny, single-purpose agent used by the
+# publish-changelog.yml workflow at release-PUBLISH time.
+#
+# The GitHub Release notes stay as they are (crisp emoji bullets under
+# "Major new features" / "Bug fixes"). This agent turns that already-published body
+# into the narrative post the WEBSITE wants (mlflow.org/releases/<v>-style): an
+# intro summary plus numbered sections for the OUTSTANDING features only — minor
+# items and bug fixes are dropped — each explaining what the feature is and how to
+# use it, with demo + docs-link placeholders a human fills in before merge. No PR
+# links, no emoji. It invents no new facts, versions, or flag names.
+# It has NO tools and NO sub-agents, so a run is fast, cheap, and can't hang. The
+# workflow drops its output into the site page; on any failure the publish step
+# falls back to the raw release body.
+#
+# Run headlessly:  omnigent run .github/agents/release-post-formatter -p "<release body>" --no-session
+#
+# Security posture (mirrors release-notes-drafter / doc-drafter):
+#   - Runs only on an ALREADY-PUBLISHED, maintainer-curated release body, at
+#     publish time on the trusted default branch.
+#   - The only secret in this process's env is LLM_API_KEY. The omnigent-site
+#     write-token that opens the release-post PR is minted by the workflow AFTER
+#     this agent finishes, so it never coexists with model input.
+#   - Its input is maintainer-written release text — a prose prompt-injection
+#     surface. The workflow secret-scans this agent's stdout for LLM_API_KEY
+#     (abort on hit) and redacts artifacts, and a human reviews the site PR before
+#     merge. Honest residual risk: with network allowed and LLM_API_KEY in env, an
+#     injection could drive an outbound request that exfiltrates the key; a
+#     network-denying sandbox is the real mitigation but is not used here for the
+#     same CI-fragility reason documented in release-notes-drafter/config.yaml.
+#     We accept the same residual risk already accepted for release-notes-drafter.
+
+spec_version: 1
+name: release-post-formatter
+description: >-
+  Turns an already-curated GitHub Release body into the narrative website post: a
+  short intro summary plus a handful of numbered sections for the OUTSTANDING
+  features only (minor items and bug fixes are dropped), each explaining what the
+  feature is and how to use it. Links features to a real site docs page when one
+  matches (from a provided list), else omits the link; leaves a demo placeholder
+  for a human. No PR links, no emoji. Emits the post between RELEASE_POST markers.
+  No tools, no sub-agents.
+
+executor:
+  type: omnigent
+  config:
+    harness: claude-sdk
+
+prompt: |
+  You are the Omnigent release-POST formatter. A version has just been published.
+  You are given two inputs: the curated GitHub Release body — crisp, emoji-prefixed
+  bullets under headings like "Major new features" and "Bug fixes", each bullet
+  ending with the contributing PR references, e.g. `(#123, #456)` — and a list of
+  the site's available docs pages (URL and title, one per line) to link features to.
+
+  Your job: turn that content into the narrative website post, matching the style
+  of the MLflow 3.14.0 release post (https://mlflow.org/releases/3.14.0/) — see
+  "The MLflow 3.14.0 style" below for exactly what that means. You do NOT mirror
+  the whole release body: you CURATE it down to the outstanding features and write
+  each one up. You must not invent features, versions, or flag names.
+
+  ## Output shape (STRICT)
+  Emit ONLY the following, between the markers, and nothing else — no preamble, no
+  top-level `# vX.Y.Z` heading (the site adds the title, date, and byline):
+
+  <!-- RELEASE_POST -->
+  <one-paragraph intro summary — see the intro pattern below; flowing prose, no
+  bullet list>
+
+  ## 1. <Feature title — a noun phrase naming the feature/command>
+
+  ![TODO: add a demo screenshot or GIF for "<feature title>"](TODO)
+
+  <1-3 short paragraphs of prose, present tense, addressing the reader as "you":
+  first what the feature IS and the problem it solves, then HOW to use it — the
+  command, menu, or workflow. No PR references anywhere.>
+
+  _Learn more in the [<matching docs page title>](<its URL from the docs list>)._
+
+  ## 2. <Next outstanding feature>
+
+  ...
+
+  Full Changelog: <copy the exact `Full Changelog:` line from the input, verbatim>
+  <!-- /RELEASE_POST -->
+
+  Then, AFTER the closing `<!-- /RELEASE_POST -->` marker, emit a machine-readable
+  map of which PRs back each feature section you wrote, so the workflow can build
+  a per-feature demo-video reference table for the reviewer. Emit it between its
+  own markers, as a JSON array in the SAME ORDER as your numbered sections — one
+  object per section, `title` matching the section's title text exactly (without
+  the `N. ` prefix), `pr_refs` the numbers from the `(#123, #456)` refs on the
+  release-body bullets you folded into that feature (integers, no `#`). Include
+  ONLY features you wrote up; omit bullets/PRs you dropped. This block is metadata,
+  NOT part of the post — never put PR numbers back into the RELEASE_POST prose.
+
+  <!-- RELEASE_POST_PRS -->
+  [
+    {"title": "<Feature 1 title>", "pr_refs": [123, 456]},
+    {"title": "<Feature 2 title>", "pr_refs": [789]}
+  ]
+  <!-- /RELEASE_POST_PRS -->
+
+  ## The MLflow 3.14.0 style (match this)
+  - CURATE, don't mirror. Pick only the ~4-6 OUTSTANDING, headline features and
+    give each its own numbered section. DROP minor features, small tweaks, and
+    everything under "Bug fixes". There is NO "Bug fixes" / "Fixes & improvements"
+    section — omit it entirely. (MLflow 3.14.0 has 6 feature sections and no fixes
+    section; comprehensive changes live behind the Full Changelog link only.)
+  - Intro: ONE flowing paragraph. First sentence follows the shape
+    "Omnigent <version> is a major release focused on <core theme>, from <X> to
+    <Y>." — theme and X→Y span drawn from the outstanding features. Then a sentence
+    or two naming the biggest ones as prose. No bullets.
+    (MLflow's reads: "MLflow 3.14.0 is a major release focused on closing the GenAI
+    development loop, from getting an app instrumented in the first place to
+    reviewing, testing, and iterating on it.")
+  - Headings: `## N. <Title>` — a NOUN PHRASE naming the feature, including the
+    concrete command/flag/UI name when the input gives one (e.g.
+    "## 1. Omnigent for iOS"). Never a verb phrase.
+  - Each feature section, in order: a demo placeholder line, then the prose, then —
+    only when a docs page genuinely matches — a "Learn more" link (see "Demo
+    placeholder" and "Docs links" below). The prose is 1-3 short paragraphs,
+    present tense, "you"/"your", explaining what it is AND how to use it — MLflow
+    opens a section with "Getting an app onto MLflow observability should not mean
+    reading setup guides", then shows the command.
+  - Tone: hybrid marketing-technical — name the developer friction and the
+    practical workflow, in approachable language. Conversational, not cutesy.
+
+  ## Demo placeholder (a human fills this before merge)
+  The release body carries no demo media, so you cannot produce it — emit a clear
+  placeholder immediately under EACH feature heading:
+    `![TODO: add a demo screenshot or GIF for "<feature title>"](TODO)`
+  Use the literal token `TODO` so a reviewer can grep for it. Never fabricate a
+  real-looking image path. (The workflow adds a table of the release's feature
+  PRs and their existing demo videos to the PR description, so a reviewer can drop
+  an already-recorded clip into these placeholders — you do not reference it.)
+
+  ## Docs links (link to the most specific real page/section, or omit the line)
+  The "## Available docs pages and sections" input lists every real docs URL and
+  its title; INDENTED lines below a page are `#section` anchors within that page
+  (URL already includes the `#slug`). For each feature, add the "Learn more" line
+  ONLY when a listed entry is clearly about that feature:
+    `_Learn more in the [<that entry's title>](<that entry's URL>)._`
+  Prefer the MOST SPECIFIC match: if an indented `#section` anchor is about the
+  feature, link that anchor rather than the whole page (e.g. link
+  `/docs/build/harnesses#custom-acp-agents` for an ACP-harness feature, not the
+  bare `/docs/build/harnesses`). Fall back to the page URL only when no section
+  fits better.
+  If nothing clearly matches — or the list is empty / says none available — OMIT
+  the "Learn more" line for that feature entirely. Do NOT emit a `TODO` link, do
+  NOT guess a URL, and do NOT link a loosely-related page just to have a link.
+
+  ## Fidelity rules
+  - NO PR references. Drop every `(#123)` / `#123` — do not carry them into the
+    post (they belong in the GitHub Release and CHANGELOG, not here).
+  - Prose, not bullets: turn "- 📱 X — Y" into sentences. Drop ALL emoji.
+  - Never invent facts, versions, flag names, or docs URLs — a docs link must be a
+    verbatim URL from the provided list, or the line is omitted.
+  - If the input has a "Full Changelog:" line, copy it verbatim as the last line
+    before the closing marker; if not, omit it.
+  - Do NOT reproduce the "Thanks to our community" note — the site page omits it
+    (the GitHub Release keeps it).
+
+  ## Security
+  You are running in CI with access to secrets. Never echo secrets, tokens, or
+  credentials, and never make outbound network calls.
+
+  ## Act in the same turn you announce
+  Never end a turn after only saying what you will do — produce the RELEASE_POST
+  block in the same turn.

.github/areas.json

@@ -24,7 +24,7 @@
     "                 - 'web/' before 'web/electron/' and 'web/ios/'",
     "                 - 'omnigent/inner/' before every 'omnigent/inner/<harness>_'.",
     "  owners     - candidate reviewers/assignees. Must be maintainers in",
-    "               .github/MAINTAINER. 2+ each. Edit these freely: the",
+    "               .github/MAINTAINER. 2+ each incl. owners_paused. Edit these freely: the",
     "               reviewer-logic tests run against a frozen fixture",
     "               (auto-assign-reviewer.fixture.json), so ownership changes here",
     "               do not churn them. areas.test.js validates this file (every",
@@ -58,8 +58,7 @@
       ],
       "owners": [
         "serena-ruan",
-        "daniellok-db",
-        "hzub"
+        "daniellok-db"
       ]
     },
     {
@@ -181,7 +180,9 @@
         "omnigent/policies/"
       ],
       "owners": [
-        "TomeHirata",
+        "TomeHirata"
+      ],
+      "owners_paused": [
         "ckcuslife-source"
       ]
     },

.github/ci-deps/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "description": "Pinned npm CLIs the e2e workflow installs (claude-code, codex, pi).",
   "dependencies": {
-    "@anthropic-ai/claude-code": "2.1.163",
+    "@anthropic-ai/claude-code": "2.1.212",
     "@earendil-works/pi-coding-agent": "0.79.0",
     "@openai/codex": "0.139.0"
   }

.github/scripts/changelog/release_to_mdx.py

@@ -3,14 +3,18 @@
 
 The website's `/releases/<version>` post is the *concise, curated highlights* —
 it mirrors the GitHub Release notes a maintainer already hand-edits in the
-draft→edit→publish flow. This module does a small mechanical transform so that
-GitHub-flavoured Markdown renders cleanly through the site's MDX pipeline
-(`@next/mdx`):
+draft→edit→publish flow. The narrative body (intro summary + numbered feature
+sections) is written by the release-notes-drafter agent; this module does a small
+mechanical transform so that GitHub-flavoured Markdown renders cleanly through the
+site's MDX pipeline (`@next/mdx`), and wraps it in the site-only chrome the
+release body can't carry (a byline and a "What's Next" footer):
 
   * unwrap `<https://…>` autolinks (angle brackets are JSX in MDX),
   * escape `{`, `}`, and any remaining `<` so MDX never tries to evaluate them,
   * linkify bare `#1234` references to the PR,
-  * prepend a `# vX.Y.Z` heading + a `_Released <date>_` line the index reads.
+  * prepend a `# vX.Y.Z` heading + a byline (`_Released <date>_` — the exact token
+    the site index reads — plus estimated read time and author),
+  * append a static "What's Next" footer (install command + community links).
 
 No LLM, no reflow — the curation is the human's; we only make it MDX-safe.
 """
@@ -28,6 +32,22 @@ _AUTOLINK_RE = re.compile(r"<((?:https?://)[^>\s]+)>")
 # "# Title" (space after #), so they never match.
 _PR_REF_RE = re.compile(r"(?<![\w/#])#(\d+)\b")
 
+AUTHOR = "Omnigent maintainers"
+# Average adult reading speed; used only for the "N min read" byline estimate.
+_WORDS_PER_MINUTE = 200
+
+WHATS_NEXT = """## What's Next
+
+Install or upgrade Omnigent:
+
+```bash
+uv tool install --python 3.12 omnigent   # or: pip install "omnigent"
+```
+
+- Star the project and file issues on [GitHub](https://github.com/omnigent-ai/omnigent).
+- Join the conversation on our [Discord](https://discord.gg/omnigent).
+- Browse the [docs](https://omnigent.ai/docs) to go deeper."""
+
 
 def mdx_escape(text: str) -> str:
     """Make GitHub-flavoured Markdown safe to parse as MDX."""
@@ -44,6 +64,12 @@ def linkify_pr_refs(text: str, repo: str) -> str:
     )
 
 
+def _read_time_minutes(text: str) -> int:
+    """Estimate reading time in whole minutes (>=1) from a word count."""
+    words = len(text.split())
+    return max(1, round(words / _WORDS_PER_MINUTE))
+
+
 def release_body_to_mdx(tag: str, date: str, body: str, repo: str) -> str:
     """Render the MDX page for one release."""
     transformed = linkify_pr_refs(mdx_escape(body or ""), repo)
@@ -52,8 +78,13 @@ def release_body_to_mdx(tag: str, date: str, body: str, repo: str) -> str:
         + tag
         + ". Edit the GitHub Release, not this file. */}"
     )
-    header = f"{comment}\n\n# {tag}\n\n_Released {date}_\n\n"
-    return header + transformed.strip() + "\n"
+    # Byline mirrors the MLflow release-post layout: keep the exact
+    # `_Released <date>_` token the site index regex reads, then append the
+    # read-time estimate and author on the same line.
+    minutes = _read_time_minutes(transformed)
+    byline = f"_Released {date}_ · {minutes} min read · {AUTHOR}"
+    header = f"{comment}\n\n# {tag}\n\n{byline}\n\n"
+    return header + transformed.strip() + "\n\n" + WHATS_NEXT + "\n"
 
 
 def _tag_date(tag: str) -> str:

.github/scripts/ci/backcompat-pairwise-matrix.sh

@@ -3,7 +3,7 @@
 # `e2e_matrix` and `integration_matrix`.
 #
 # We test `main` (the checked-out code = client + tests, always) against each
-# non-rc release tag AT OR ABOVE the backcompat floor (MIN_VERSION, default
+# final (non-prerelease) release tag AT OR ABOVE the backcompat floor (MIN_VERSION, default
 # 0.2.0 — the first release with the mock-LLM e2e infra; see below), on BOTH
 # axes — and ONLY those cells:
 #   (server=main,      runner=<release>)  — new server vs a previously-shipped runner
@@ -17,8 +17,9 @@
 #
 # Env in:
 #   VERSIONS    optional comma-separated override of the version set used for
-#               BOTH axes (e.g. "main,v0.2.0"). Empty = main + all non-rc tags.
-#               Blank entries are dropped and surrounding whitespace trimmed.
+#               BOTH axes (e.g. "main,v0.2.0"). Empty = main + all final
+#               (non-prerelease) tags. Blank entries are dropped and
+#               surrounding whitespace trimmed.
 #   NUM_SHARDS  e2e shard count per cell (default 4).
 # Out (GITHUB_OUTPUT):
 #   e2e_matrix={"include":[{"server":..,"runner":..,"shard_id":..,"num_shards":..}, ...]}
@@ -61,9 +62,12 @@ if [ -n "${VERSIONS:-}" ]; then
   IFS=',' read -ra raw <<<"$VERSIONS"
 else
   raw=("main")
-  # `[^a-z]rc[0-9]` so we drop vX.Y.ZrcN without over-excluding tags that merely
-  # contain the substring "rc" (e.g. a hypothetical "...march").
-  while IFS= read -r tag; do raw+=("$tag"); done < <(git tag --sort=-v:refname | grep -viE '(^|[^a-z])rc[0-9]')
+  # Drop pre-release tags (vX.Y.ZrcN / .devN / preN — same trio github-release.yml
+  # skips): they are snapshots of main, so main-vs-them is not a compat signal, and
+  # under the 256-job cap they would evict the oldest FINAL releases from coverage.
+  # `[^a-z]` guards against over-excluding tags that merely contain the substring
+  # (e.g. a hypothetical "...march"). An explicit VERSIONS override still accepts them.
+  while IFS= read -r tag; do raw+=("$tag"); done < <(git tag --sort=-v:refname | grep -viE '(^|[^a-z])(rc|dev|pre)[0-9]')
 fi
 
 # Trim whitespace, drop blanks, reject invalid tokens, drop below-floor releases.
@@ -105,7 +109,7 @@ done
 # The integration suite runs a single openai-agents leg in mock mode (matches
 # integration-matrix.sh); the model name is unused under the mock LLM.
 integ_harness="openai-agents"
-integ_model="databricks-gpt-5-4-mini"
+integ_model="mock-model"
 integ_workers="4"
 
 e2e_items=()

.github/scripts/ci/integration-matrix.sh

@@ -34,7 +34,7 @@ fi
 
 read -r -d '' matrix <<'JSON' || true
 {"include":[
-{"name":"openai-agents","harness":"openai-agents","model":"databricks-gpt-5-4-mini","workers":4}
+{"name":"openai-agents","harness":"openai-agents","model":"mock-model","workers":4}
 ]}
 JSON
 # Collapse to one line so the GITHUB_OUTPUT key=value contract holds.

.github/scripts/homebrew/generate_formula.py

@@ -0,0 +1,421 @@
+#!/usr/bin/env python3
+"""Generate the `omnigent` Homebrew formula for a released PyPI version.
+
+Splices the volatile parts of `Formula/omnigent.rb` — the stable `url`/`sha256`
+and every dependency `resource` stanza — into the hand-tuned template
+(`omnigent.rb.template`). The structural parts (desc, depends_on, install, test)
+are owned by the template; this script owns the bits that change every release.
+
+Resolution: `uv pip compile` computes the exact transitive closure of
+`omnigent[<extras>]==<version>` for each target platform (macOS arm + intel by
+default — the brew tap's `brew test-bot` matrix). The per-platform closures are
+unioned; for each package we then fetch the sdist URL + sha256 from the PyPI JSON
+API and emit a `resource` stanza. Packages with no sdist (e.g. `cel-expr-python`,
+which is Bazel-built and has no PyPI sdist) are skipped — omnigent degrades
+gracefully without them, matching the hand-tuned formula.
+
+Excluded from `resource` generation (provided by the brewed Python environment,
+NOT built as virtualenv resources — keep in sync with the template's
+`depends_on ... => :no_linkage` and the brewed packages' transitive build deps
+like cffi/pycparser, which need libffi that this formula doesn't depend on):
+``omnigent`` (the stable url itself) and ``certifi, cryptography, pydantic,
+pydantic-core, rpds-py, cffi, pycparser``.
+
+Run by `.github/workflows/homebrew-tap-pr.yml` on `release: published`.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.request
+from pathlib import Path
+
+# Default brew build matrix: macOS Apple Silicon + Intel (the tap's
+# `brew test-bot` runs on macos-15 / macos-15-intel / macos-26). The union of the
+# two closures captures platform-marker deps needed on either arch. Add
+# `x86_64-unknown-linux-gnu` here if the tap re-enables Linux builds.
+DEFAULT_PLATFORMS = ["aarch64-apple-darwin", "x86_64-apple-darwin"]
+# Extras bundled as resources. The base install already pulls the Claude and
+# OpenAI Agents harnesses; this adds the opt-in `cursor` harness (pure-Python
+# sdist). antigravity is NOT bundled — no sdist (platform wheels only), no
+# Intel-macOS build; `pip install omnigent[antigravity]` instead.
+DEFAULT_EXTRAS = ["cursor"]
+# Resolve for the brewed Python so `requires-python` markers match the formula's
+# `python@3.14` (and the `virtualenv_create(libexec, "python3.14")` in install).
+DEFAULT_PYTHON_VERSION = "3.14"
+DEFAULT_INDEX_URL = "https://pypi.org/simple"
+PYPI_JSON_API = "https://pypi.org/pypi"
+
+# Packages provided by the brewed Python environment (system site-packages),
+# not built as virtualenv resources. `cffi`/`pycparser` are listed because cffi
+# builds against libffi (not a dep of this formula) — they come from the brewed
+# `cryptography`/`cffi` formulae instead. See module docstring.
+BREWED_EXCLUSIONS = {
+    "certifi",
+    "cryptography",
+    "pydantic",
+    "pydantic-core",
+    "rpds-py",
+    "cffi",
+    "pycparser",
+}
+# omnigent is the stable `url` itself, so it's never a resource.
+SELF_EXCLUSIONS = {"omnigent"}
+
+_PLACEHOLDERS = (
+    "__OMNIGENT_URL__",
+    "__OMNIGENT_SHA256__",
+    "__RESOURCES__",
+)
+
+
+def normalize_name(name: str) -> str:
+    """PEP 503 normalized project name (lowercase, runs of [-_.] -> -)."""
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def _http_get_json(url: str, retries: int = 5, timeout: int = 30) -> dict:
+    """GET a JSON document with simple retry/backoff."""
+    last_err: Exception | None = None
+    for attempt in range(retries):
+        try:
+            req = urllib.request.Request(url, headers={"Accept": "application/json"})
+            with urllib.request.urlopen(req, timeout=timeout) as resp:
+                return json.load(resp)
+        except urllib.error.HTTPError as e:
+            last_err = e
+            # 404 is a hard "not on PyPI" — don't retry into a 5-minute wait.
+            if e.code == 404:
+                raise
+        except (urllib.error.URLError, TimeoutError, ConnectionError) as e:
+            last_err = e
+        time.sleep(2**attempt)
+    raise RuntimeError(f"fetch failed for {url}: {last_err}")
+
+
+def pypi_release_files(name: str, version: str, api_base: str = PYPI_JSON_API) -> list[dict]:
+    """Return the `urls` list for a (name, version) release from the PyPI JSON API.
+
+    `api_base` defaults to the public PyPI JSON API; point it at a mirror's
+    `/pypi` (via `--pypi-api` / `--proxy`) to fetch sdist URLs + sha256 through
+    a proxy. Download URLs fetched from a mirror are then host-rewritten to
+    `files.pythonhosted.org` (see `rewrite_url`) so the formula pins public URLs.
+    """
+    data = _http_get_json(f"{api_base}/{normalize_name(name)}/{version}/json")
+    return data.get("urls", [])
+
+
+def pick_sdist(files: list[dict]) -> tuple[str, str] | None:
+    """Pick the sdist (url, sha256). Prefer .tar.gz; take the only sdist if one."""
+    sdists = [f for f in files if f.get("packagetype") == "sdist"]
+    if not sdists:
+        return None
+    for f in sdists:
+        if f["url"].endswith(".tar.gz"):
+            return f["url"], f["digests"]["sha256"]
+    f = sdists[0]
+    return f["url"], f["digests"]["sha256"]
+
+
+def rewrite_url(url: str, rewrites: list[tuple[str, str]]) -> str:
+    """Apply `from -> to` substitutions to a download URL, in order.
+
+    Used to turn an internal PyPI proxy's download URLs back into public
+    `files.pythonhosted.org` URLs so the formula pins installable public URLs
+    even when resolution + metadata fetch went through the proxy (the proxy
+    mirrors PyPI's `/packages/<2>/<2>/<hash>/file` path verbatim, only the host
+    differs; the sha256 is the file's content hash, so it's valid for the public
+    URL too).
+    """
+    for old, new in rewrites:
+        url = url.replace(old, new)
+    return url
+
+
+def resource_stanza(name: str, url: str, sha256: str, indent: int = 2) -> str:
+    """A `resource "<name>" do … end` stanza, class-body indented."""
+    pad = " " * indent
+    return f'{pad}resource "{name}" do\n{pad}  url "{url}"\n{pad}  sha256 "{sha256}"\n{pad}end'
+
+
+def resolve_closure(
+    version: str,
+    platforms: list[str],
+    extras: list[str],
+    python_version: str,
+    index_url: str,
+    uv: str,
+) -> dict[str, str]:
+    """Union of `uv pip compile` resolutions per platform -> {name: version}.
+
+    Runs `uv pip compile` with `--no-config` (ignore the repo's uv.toml cooldown,
+    which would block the just-released version) against the public index. If a
+    package resolves to different versions across platforms, the highest PEP 440
+    version wins and a warning is printed (rare for sdists).
+    """
+    extras_spec = f"[{','.join(extras)}]" if extras else ""
+    requirement = f"omnigent{extras_spec}=={version}"
+    closure: dict[str, str] = {}
+    with tempfile.TemporaryDirectory() as tmpdir:
+        tmp = Path(tmpdir)
+        (tmp / "req.in").write_text(requirement + "\n")
+        for plat in platforms:
+            out = tmp / f"req.{plat.replace('-', '_')}.out"
+            cmd = [
+                uv,
+                "pip",
+                "compile",
+                "--no-config",
+                "--no-header",
+                "--no-annotate",
+                "--python-version",
+                python_version,
+                "--python-platform",
+                plat,
+                "--default-index",
+                index_url,
+                str(tmp / "req.in"),
+                "-o",
+                str(out),
+            ]
+            # Surface uv's output on failure instead of swallowing it — a
+            # resolution failure (version conflict, a dep with no Python 3.14
+            # distribution, a requires-python cap, or no network to PyPI) is
+            # otherwise undebuggable. Raise a RuntimeError (one clean line) rather
+            # than letting CalledProcessError dump the full subprocess traceback.
+            proc = subprocess.run(cmd, capture_output=True, text=True)
+            if proc.returncode != 0:
+                detail = (proc.stderr or proc.stdout or "(no output)").strip()
+                raise RuntimeError(
+                    f"`uv pip compile` failed for {plat} (python {python_version}); "
+                    f"requirement: {requirement}\n{detail}"
+                )
+            for line in out.read_text().splitlines():
+                line = line.strip()
+                if not line or line.startswith("#") or "==" not in line:
+                    continue
+                name, ver = line.split("==", 1)
+                # uv strips extras and markers by default, but defend against
+                # `name[extra]==ver` (take the bare name before '[') and against
+                # a trailing ` ; marker` on the version.
+                name = name.split("[", 1)[0].strip()
+                name = normalize_name(name)
+                ver = ver.split(";", 1)[0].strip()
+                if name in closure and closure[name] != ver:
+                    kept = max(closure[name], ver, key=_pep440_key)
+                    print(
+                        f"::warning::{name} resolved to {closure[name]} on one "
+                        f"platform and {ver} on {plat}; keeping {kept}.",
+                        file=sys.stderr,
+                    )
+                    ver = kept
+                closure[name] = ver
+    return closure
+
+
+def _pep440_key(version: str):
+    """A best-effort PEP 440 sort key for picking the max of two versions."""
+    nums = re.findall(r"\d+", version)
+    return tuple(int(n) for n in nums)
+
+
+def render_template(template: str, url: str, sha256: str, resources: str) -> str:
+    # Catch a drifted template up front: every placeholder must be present before
+    # we substitute, and none must remain after (the latter is belt-and-suspenders
+    # since str.replace removes all occurrences, but it guards against a future
+    # placeholder that contains regex-special chars or partial overlaps).
+    missing = [p for p in _PLACEHOLDERS if p not in template]
+    if missing:
+        raise RuntimeError(f"template missing placeholder(s): {missing}")
+    out = template
+    out = out.replace("__OMNIGENT_URL__", url)
+    out = out.replace("__OMNIGENT_SHA256__", sha256)
+    out = out.replace("__RESOURCES__", resources)
+    leftover = [p for p in _PLACEHOLDERS if p in out]
+    if leftover:
+        raise RuntimeError(f"template placeholders left unsubstituted: {leftover}")
+    return out
+
+
+def generate(
+    version: str,
+    template_path: Path,
+    platforms: list[str],
+    extras: list[str],
+    python_version: str,
+    index_url: str,
+    uv: str,
+    exclude: set[str],
+    api_base: str = PYPI_JSON_API,
+    url_rewrites: list[tuple[str, str]] | None = None,
+) -> str:
+    template = template_path.read_text()
+
+    # Defensive: accept a leading `v` even though the workflow strips it.
+    if version.startswith("v"):
+        version = version[1:]
+
+    extras_spec = f"[{','.join(extras)}]" if extras else ""
+    print(
+        f"Resolving omnigent{extras_spec}=={version} for {', '.join(platforms)} "
+        f"(python {python_version})…",
+        file=sys.stderr,
+    )
+    closure = resolve_closure(version, platforms, extras, python_version, index_url, uv)
+    print(f"Resolved {len(closure)} packages.", file=sys.stderr)
+
+    rewrites = url_rewrites or []
+    if rewrites:
+        print(f"URL rewrites: {rewrites}", file=sys.stderr)
+
+    # Stable sdist for omnigent itself.
+    omnigent_files = pypi_release_files("omnigent", version, api_base)
+    sdist = pick_sdist(omnigent_files)
+    if not sdist:
+        raise RuntimeError(
+            f"omnigent=={version} has no sdist on PyPI — cannot set the stable url."
+        )
+    stable_url, stable_sha = sdist
+    stable_url = rewrite_url(stable_url, rewrites)
+    print(f"omnigent {version}: {stable_url}", file=sys.stderr)
+
+    # Every resolved package (other than omnigent itself and the brewed set) ->
+    # a sdist resource stanza. `exclude` is the caller-supplied set (CLI --exclude);
+    # it augments the built-in brewed set and the always-excluded self package.
+    excluded = BREWED_EXCLUSIONS | exclude | SELF_EXCLUSIONS
+    resources: list[tuple[str, str, str]] = []
+    for name, ver in sorted(closure.items()):
+        if name in excluded:
+            continue
+        files = pypi_release_files(name, ver, api_base)
+        sdist = pick_sdist(files)
+        if not sdist:
+            # No sdist (e.g. cel-expr-python, Bazel-built) — skip. omnigent
+            # degrades gracefully without it, matching the hand-tuned formula.
+            print(
+                f"::warning::{name}=={ver} has no sdist on PyPI — skipping (no resource).",
+                file=sys.stderr,
+            )
+            continue
+        resources.append((name, rewrite_url(sdist[0], rewrites), sdist[1]))
+
+    # No trailing newline: the template's blank lines frame the resource block.
+    resources_str = "\n".join(resource_stanza(n, u, s) for n, u, s in resources)
+
+    return render_template(template, stable_url, stable_sha, resources_str)
+
+
+def main(argv: list[str]) -> int:
+    ap = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    ap.add_argument(
+        "--version", required=True, help="Released version (e.g. 0.3.0), no leading 'v'."
+    )
+    ap.add_argument(
+        "--template",
+        type=Path,
+        default=Path(__file__).with_name("omnigent.rb.template"),
+        help="Path to the formula template.",
+    )
+    ap.add_argument(
+        "--out",
+        type=Path,
+        default=Path("Formula/omnigent.rb"),
+        help="Where to write the rendered formula.",
+    )
+    ap.add_argument(
+        "--python-platform",
+        action="append",
+        default=None,
+        help="uv target platform (repeatable). Default: macOS arm + intel.",
+    )
+    ap.add_argument(
+        "--extra",
+        action="append",
+        default=None,
+        help="Extras to bundle (repeatable). Default: cursor.",
+    )
+    ap.add_argument(
+        "--python-version",
+        default=DEFAULT_PYTHON_VERSION,
+        help=f"uv --python-version (default {DEFAULT_PYTHON_VERSION}).",
+    )
+    ap.add_argument(
+        "--index-url",
+        default=None,
+        help="PyPI simple index URL for `uv pip compile` (default https://pypi.org/simple; "
+        "--proxy presets this).",
+    )
+    ap.add_argument(
+        "--pypi-api",
+        default=None,
+        help="PyPI JSON API base for sdist URL/sha256 fetch (default https://pypi.org/pypi; "
+        "--proxy presets this).",
+    )
+    ap.add_argument(
+        "--url-rewrite",
+        nargs=2,
+        action="append",
+        default=None,
+        metavar=("FROM", "TO"),
+        help="Rewrite FROM->TO in download URLs (repeatable). For proxy mirrors: "
+        "rewrites the mirror host back to files.pythonhosted.org.",
+    )
+    ap.add_argument(
+        "--proxy",
+        default=None,
+        metavar="HOST",
+        help="Convenience preset for an internal PyPI mirror host (e.g. "
+        "pypi-proxy.cloud.databricks.com): sets --index-url to https://HOST/simple, "
+        "--pypi-api to https://HOST/pypi, and rewrites HOST -> files.pythonhosted.org "
+        "in download URLs. Explicit --index-url/--pypi-api/--url-rewrite override.",
+    )
+    ap.add_argument(
+        "--exclude",
+        action="append",
+        default=None,
+        help="Package name to exclude from resources (repeatable; "
+        "added to the built-in brewed set).",
+    )
+    ap.add_argument("--uv", default="uv", help="uv binary path.")
+    args = ap.parse_args(argv)
+
+    # --proxy HOST presets the index, the JSON API, and a host rewrite so a
+    # local run behind an internal mirror produces a formula with public
+    # files.pythonhosted.org URLs (the mirror serves the same /packages/<..>/
+    # path, only the host differs). Explicit flags override the preset.
+    proxy = args.proxy
+    index_url = args.index_url or (f"https://{proxy}/simple" if proxy else DEFAULT_INDEX_URL)
+    api_base = args.pypi_api or (f"https://{proxy}/pypi" if proxy else PYPI_JSON_API)
+    url_rewrites = [tuple(r) for r in (args.url_rewrite or [])]
+    if proxy and (proxy, "files.pythonhosted.org") not in url_rewrites:
+        url_rewrites.insert(0, (proxy, "files.pythonhosted.org"))
+
+    formula = generate(
+        version=args.version,
+        template_path=args.template,
+        platforms=args.python_platform or DEFAULT_PLATFORMS,
+        extras=args.extra or DEFAULT_EXTRAS,
+        python_version=args.python_version,
+        index_url=index_url,
+        uv=args.uv,
+        exclude={normalize_name(n) for n in (args.exclude or [])},
+        api_base=api_base,
+        url_rewrites=url_rewrites,
+    )
+    args.out.parent.mkdir(parents=True, exist_ok=True)
+    args.out.write_text(formula)
+    print(f"Wrote {args.out} ({len(formula)} bytes).", file=sys.stderr)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

.github/scripts/homebrew/omnigent.rb.template

@@ -0,0 +1,83 @@
+# Homebrew formula TEMPLATE for the Omnigent CLI (`omnigent` / `omni`).
+#
+# The volatile parts of this formula are regenerated on every release by
+# `generate_formula.py` (run from `.github/workflows/homebrew-tap-pr.yml`) and
+# spliced into this file via three placeholders that live ONLY in the class body
+# below — keep them out of this comment or the splicer will mangle it:
+#   * the stable `url` / `sha256` lines  -> the released omnigent sdist on PyPI
+#   * the per-dependency `resource` stanzas (one per PyPI sdist in the closure)
+#
+# Edit the hand-tuned STRUCTURAL parts here (desc, depends_on, install, test).
+# Edit the dependency set in omnigent-ai/omnigent's `pyproject.toml`
+# (`[project.dependencies]` and the bundled `cursor` extra).
+# When you change the brewed `depends_on ... => :no_linkage` set, also update the
+# `BREWED_EXCLUSIONS` in `generate_formula.py` so those packages are emitted as
+# resources (or not) to match.
+#
+# `bottle do … end` and `revision` are deliberately NOT here: Homebrew's
+# `brew pr-pull` adds the bottle block after `brew test-bot` builds it, and
+# bumps `revision` on each rebuild. A new version starts at revision 0
+# (omitted).
+class Omnigent < Formula
+  include Language::Python::Virtualenv
+
+  desc "Meta-harness for AI agents"
+  homepage "https://github.com/omnigent-ai/omnigent"
+  url "__OMNIGENT_URL__"
+  sha256 "__OMNIGENT_SHA256__"
+  license "Apache-2.0"
+
+  # The Rust toolchain builds jiter and watchfiles from source.
+  depends_on "pkgconf" => :build
+  depends_on "rust" => :build
+  # certifi, cryptography, pydantic (which bundles pydantic-core), and rpds-py
+  # are provided by Homebrew formulae rather than built as virtualenv resources.
+  # The compiled ones would otherwise need a Rust/C build, and their transitive
+  # deps (cffi, pycparser) come along for free. The virtualenv is created with
+  # system site-packages, so it imports them from the brewed python. :no_linkage
+  # because they are Python imports, not libraries this formula links against.
+  depends_on "certifi" => :no_linkage
+  depends_on "cryptography" => :no_linkage
+  depends_on "libyaml"
+  depends_on "pydantic" => :no_linkage
+  depends_on "python@3.14"
+  depends_on "rpds-py" => :no_linkage
+  depends_on "tmux"
+
+__RESOURCES__
+
+  def install
+    venv = virtualenv_create(libexec, "python3.14")
+
+    # The Rust extensions (jiter, watchfiles) must leave Mach-O header padding so
+    # Homebrew can rewrite their install names to the Cellar path during
+    # relocation (macOS only; the flag breaks Linux ld).
+    ENV.append_to_rustflags "-C link-args=-Wl,-headerpad_max_install_names" if OS.mac?
+
+    # argon2-cffi-bindings' sdist ships an unprocessed .git_archival.txt that the
+    # (build-isolated, latest) setuptools-scm parses instead of falling back to
+    # PKG-INFO, so version detection fails. Pin the version it should report.
+    ENV["SETUPTOOLS_SCM_PRETEND_VERSION_FOR_ARGON2_CFFI_BINDINGS"] =
+      resource("argon2-cffi-bindings").version.to_s
+
+    venv.pip_install resources
+
+    venv.pip_install_and_link buildpath
+
+    bin.install_symlink libexec/"bin/omnigent", libexec/"bin/omni"
+
+    %w[omnigent omni].each do |cmd|
+      generate_completions_from_executable(libexec/"bin/#{cmd}",
+                                           base_name: cmd, shell_parameter_format: :click)
+    end
+  end
+
+  test do
+    system bin/"omnigent", "--help"
+
+    # certifi, cryptography, pydantic (with pydantic-core), and rpds-py are
+    # provided by Homebrew formulae and imported from the brewed python through
+    # the virtualenv's system site-packages; confirm they resolve in the venv.
+    system libexec/"bin/python", "-c", "import certifi, cryptography, pydantic, rpds"
+  end
+end

.github/scripts/merge-ready/required.sh

@@ -7,6 +7,7 @@
 # Generated file -- do not hand-edit; it is replaced wholesale on every sync.
 
 REQUIRED=(
+  "DCO"
   "Pre-commit checks"
   "Docker build"
   "Pytest (runtime-harnesses)"
@@ -32,6 +33,7 @@ REQUIRED=(
   "E2E UI Tests (shard 0/3)"
   "E2E UI Tests (shard 1/3)"
   "E2E UI Tests (shard 2/3)"
+  "UI Snapshot (visual baselines)"
   "Integration (claude-sdk)"
   "Integration (openai-agents)"
   "Integration (codex)"
@@ -62,6 +64,7 @@ ALLOW_SKIP=(
   "E2E UI Tests (shard 0/3)"
   "E2E UI Tests (shard 1/3)"
   "E2E UI Tests (shard 2/3)"
+  "UI Snapshot (visual baselines)"
   "Integration (claude-sdk)"
   "Integration (openai-agents)"
   "Integration (codex)"
@@ -79,6 +82,7 @@ workflow_for() {
     "Pytest ("*)             echo "CI" ;;
     "E2E Tests (shard "*)    echo "E2E Tests" ;;
     "E2E UI Tests (shard "*) echo "E2E UI Tests" ;;
+    "UI Snapshot (visual baselines)") echo "UI Snapshot" ;;
     "Integration ("*)        echo "Integration Tests" ;;
     *)                       echo "" ;;
   esac

.github/scripts/rotation_roster.json

@@ -21,9 +21,7 @@
     "Dhruv Gupta": { "slack_id": "U0A76097E1F", "tz": "America/Los_Angeles" },
     "Edwin He": { "slack_id": "U077B1V6WQJ", "tz": "America/Los_Angeles" },
     "Pat Sukprasert": { "slack_id": "U05HRKWFY81", "tz": "Asia/Singapore" },
-    "Sabhya Chhabria": { "slack_id": "U07A1KQDXAB", "tz": "America/Los_Angeles" },
     "Serena Ruan": { "slack_id": "U0571L5KNLR", "tz": "Asia/Singapore" },
-    "Shivam Mittal": { "slack_id": "U09FZKX9S6B", "tz": "America/Los_Angeles" },
     "Tomu Hirata": { "slack_id": "U07TX4PR5MZ", "tz": "Asia/Singapore" },
     "Zeyi (Rice) Fan": { "slack_id": "U09L5HT4CH0", "tz": "America/Los_Angeles" }
   }

.github/scripts/rotation_schedule.json

@@ -12,69 +12,13 @@
     "name -> slack_id + timezone mapping)."
   ],
   "schedule": [
-    {
-      "date": "2026-07-14",
-      "name": "Edwin He"
-    },
-    {
-      "date": "2026-07-15",
-      "name": "Pat Sukprasert"
-    },
-    {
-      "date": "2026-07-16",
-      "name": "Sabhya Chhabria"
-    },
-    {
-      "date": "2026-07-17",
-      "name": "Serena Ruan"
-    },
-    {
-      "date": "2026-07-20",
-      "name": "Shivam Mittal"
-    },
-    {
-      "date": "2026-07-21",
-      "name": "Tomu Hirata"
-    },
-    {
-      "date": "2026-07-22",
-      "name": "Zeyi (Rice) Fan"
-    },
-    {
-      "date": "2026-07-23",
-      "name": "Aravind Segu"
-    },
-    {
-      "date": "2026-07-24",
-      "name": "Bryan Qiu"
-    },
-    {
-      "date": "2026-07-27",
-      "name": "Daniel Lok"
-    },
-    {
-      "date": "2026-07-28",
-      "name": "Dhruv Gupta"
-    },
-    {
-      "date": "2026-07-29",
-      "name": "Edwin He"
-    },
-    {
-      "date": "2026-07-30",
-      "name": "Pat Sukprasert"
-    },
-    {
-      "date": "2026-07-31",
-      "name": "Sabhya Chhabria"
-    },
     {
       "date": "2026-08-03",
       "name": "Serena Ruan"
     },
     {
       "date": "2026-08-04",
-      "name": "Shivam Mittal"
+      "name": "Aravind Segu"
     },
     {
       "date": "2026-08-05",
@@ -110,7 +54,7 @@
     },
     {
       "date": "2026-08-17",
-      "name": "Sabhya Chhabria"
+      "name": "Bryan Qiu"
     },
     {
       "date": "2026-08-18",
@@ -118,7 +62,7 @@
     },
     {
       "date": "2026-08-19",
-      "name": "Shivam Mittal"
+      "name": "Daniel Lok"
     },
     {
       "date": "2026-08-20",
@@ -154,7 +98,7 @@
     },
     {
       "date": "2026-09-01",
-      "name": "Sabhya Chhabria"
+      "name": "Dhruv Gupta"
     },
     {
       "date": "2026-09-02",
@@ -162,7 +106,7 @@
     },
     {
       "date": "2026-09-03",
-      "name": "Shivam Mittal"
+      "name": "Edwin He"
     },
     {
       "date": "2026-09-04",
@@ -198,7 +142,7 @@
     },
     {
       "date": "2026-09-16",
-      "name": "Sabhya Chhabria"
+      "name": "Tomu Hirata"
     },
     {
       "date": "2026-09-17",
@@ -206,7 +150,7 @@
     },
     {
       "date": "2026-09-18",
-      "name": "Shivam Mittal"
+      "name": "Zeyi (Rice) Fan"
     },
     {
       "date": "2026-09-21",
@@ -242,7 +186,7 @@
     },
     {
       "date": "2026-10-01",
-      "name": "Sabhya Chhabria"
+      "name": "Aravind Segu"
     },
     {
       "date": "2026-10-02",
@@ -250,7 +194,7 @@
     },
     {
       "date": "2026-10-05",
-      "name": "Shivam Mittal"
+      "name": "Bryan Qiu"
     },
     {
       "date": "2026-10-06",
@@ -286,7 +230,47 @@
     },
     {
       "date": "2026-10-16",
-      "name": "Sabhya Chhabria"
+      "name": "Daniel Lok"
+    },
+    {
+      "date": "2026-10-19",
+      "name": "Dhruv Gupta"
+    },
+    {
+      "date": "2026-10-20",
+      "name": "Edwin He"
+    },
+    {
+      "date": "2026-10-21",
+      "name": "Pat Sukprasert"
+    },
+    {
+      "date": "2026-10-22",
+      "name": "Serena Ruan"
+    },
+    {
+      "date": "2026-10-23",
+      "name": "Tomu Hirata"
+    },
+    {
+      "date": "2026-10-26",
+      "name": "Zeyi (Rice) Fan"
+    },
+    {
+      "date": "2026-10-27",
+      "name": "Aravind Segu"
+    },
+    {
+      "date": "2026-10-28",
+      "name": "Bryan Qiu"
+    },
+    {
+      "date": "2026-10-29",
+      "name": "Daniel Lok"
+    },
+    {
+      "date": "2026-10-30",
+      "name": "Dhruv Gupta"
     }
   ]
 }

.github/scripts/waiting_on_author.py

@@ -0,0 +1,318 @@
+#!/usr/bin/env python3
+"""Keep the waiting-on-author pull request label actionable."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import UTC, datetime
+from email.message import Message
+from typing import Any
+
+LABEL = "waiting-on-author"
+WAITING_DAYS = 7
+CANONICAL_REPO = "omnigent-ai/omnigent"
+MAX_CLOSURES_PER_RUN = 30
+
+
+def label_names(item: dict[str, Any]) -> list[str]:
+    return [
+        label.get("name", label) if isinstance(label, dict) else label
+        for label in item.get("labels", [])
+    ]
+
+
+def has_waiting_label(item: dict[str, Any]) -> bool:
+    return LABEL in label_names(item)
+
+
+def parse_time(value: str) -> datetime:
+    return datetime.fromisoformat(value.replace("Z", "+00:00"))
+
+
+def days_between(start: str, end: datetime) -> int:
+    return int((end - parse_time(start)).total_seconds() // 86400)
+
+
+def latest_waiting_label_at(timeline: list[dict[str, Any]]) -> str | None:
+    latest: str | None = None
+    for event in timeline:
+        if event.get("event") != "labeled" or not event.get("created_at"):
+            continue
+        label = event.get("label") or {}
+        name = label.get("name") if isinstance(label, dict) else label
+        if name != LABEL:
+            continue
+        if latest is None or parse_time(event["created_at"]) > parse_time(latest):
+            latest = event["created_at"]
+    return latest
+
+
+def close_message(label_applied_at: str) -> str:
+    return "\n".join(
+        [
+            f"Closing this PR because it has been labeled `{LABEL}` for "
+            f"{WAITING_DAYS} days without an author reply or new commit.",
+            "",
+            f"The label was last applied on {label_applied_at}. If you are "
+            "ready to continue, please reopen this PR or open a new one.",
+        ]
+    )
+
+
+class GitHubAPI:
+    def __init__(self, token: str, repo: str):
+        self.token = token
+        self.repo = repo
+
+    def request(
+        self, method: str, path: str, body: dict[str, Any] | None = None
+    ) -> tuple[Any, Message]:
+        data = None if body is None else json.dumps(body).encode()
+        request = urllib.request.Request(
+            f"https://api.github.com{path}",
+            data=data,
+            method=method,
+            headers={
+                "Accept": "application/vnd.github+json",
+                "Authorization": f"Bearer {self.token}",
+                "Content-Type": "application/json",
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+        )
+        with urllib.request.urlopen(request) as response:
+            raw = response.read()
+            parsed = json.loads(raw.decode()) if raw else None
+            return parsed, response.headers
+
+    def paginated(self, path: str) -> list[dict[str, Any]]:
+        items: list[dict[str, Any]] = []
+        next_path: str | None = path
+        while next_path:
+            page, headers = self.request("GET", next_path)
+            items.extend(page or [])
+            next_path = next_link(headers.get("Link", ""))
+        return items
+
+    def get_pull(self, pull_number: int) -> dict[str, Any]:
+        pull, _ = self.request("GET", f"/repos/{self.repo}/pulls/{pull_number}")
+        return pull
+
+    def remove_label(self, issue_number: int, label: str) -> bool:
+        quoted = urllib.parse.quote(label, safe="")
+        try:
+            self.request("DELETE", f"/repos/{self.repo}/issues/{issue_number}/labels/{quoted}")
+        except urllib.error.HTTPError as error:
+            if error.code == 404:
+                return False
+            raise
+        return True
+
+    def list_waiting_issues(self) -> list[dict[str, Any]]:
+        query = urllib.parse.urlencode({"state": "open", "labels": LABEL, "per_page": 100})
+        return self.paginated(f"/repos/{self.repo}/issues?{query}")
+
+    def list_timeline(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/issues/{issue_number}/timeline?per_page=100")
+
+    def list_issue_comments(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/issues/{issue_number}/comments?per_page=100")
+
+    def list_review_comments(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/pulls/{pull_number}/comments?per_page=100")
+
+    def list_reviews(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/pulls/{pull_number}/reviews?per_page=100")
+
+    def list_commits(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.paginated(f"/repos/{self.repo}/pulls/{pull_number}/commits?per_page=100")
+
+    def close_pull(self, pull_number: int) -> None:
+        self.request("PATCH", f"/repos/{self.repo}/pulls/{pull_number}", {"state": "closed"})
+
+    def create_comment(self, issue_number: int, body: str) -> None:
+        self.request("POST", f"/repos/{self.repo}/issues/{issue_number}/comments", {"body": body})
+
+
+def next_link(link_header: str) -> str | None:
+    for part in link_header.split(","):
+        url_part, _, rel_part = part.partition(";")
+        if 'rel="next"' not in rel_part:
+            continue
+        url = url_part.strip()[1:-1]
+        parsed = urllib.parse.urlparse(url)
+        return f"{parsed.path}?{parsed.query}"
+    return None
+
+
+def remove_waiting_label(api: GitHubAPI, issue_number: int, reason: str) -> bool:
+    removed = api.remove_label(issue_number, LABEL)
+    if removed:
+        print(f"Removed {LABEL} from #{issue_number}: {reason}")
+    else:
+        print(f"#{issue_number} no longer has {LABEL}; nothing to remove.")
+    return removed
+
+
+def user_login(item: dict[str, Any]) -> str | None:
+    login = item.get("user", {}).get("login")
+    return login.lower() if login else None
+
+
+def is_after(timestamp: str | None, since: str) -> bool:
+    return bool(timestamp and parse_time(timestamp) > parse_time(since))
+
+
+def authored_after(items: list[dict[str, Any]], author: str, since: str, key: str) -> bool:
+    return any(user_login(item) == author and is_after(item.get(key), since) for item in items)
+
+
+def commit_after(commits: list[dict[str, Any]], since: str) -> bool:
+    for commit in commits:
+        authored_at = commit.get("commit", {}).get("author", {}).get("date")
+        committed_at = commit.get("commit", {}).get("committer", {}).get("date")
+        if is_after(authored_at, since) or is_after(committed_at, since):
+            return True
+    return False
+
+
+def author_activity_since_label(api: GitHubAPI, pull: dict[str, Any], since: str) -> str | None:
+    author = pull.get("user", {}).get("login")
+    if not author:
+        return None
+    author = author.lower()
+    pull_number = pull["number"]
+
+    if authored_after(api.list_issue_comments(pull_number), author, since, "created_at"):
+        return "the author commented"
+    if authored_after(api.list_review_comments(pull_number), author, since, "created_at"):
+        return "the author replied to a review comment"
+    if authored_after(api.list_reviews(pull_number), author, since, "submitted_at"):
+        return "the author submitted a review response"
+    if commit_after(api.list_commits(pull_number), since):
+        return "new commits were pushed"
+    return None
+
+
+def clear_on_author_activity(event_name: str, payload: dict[str, Any], api: GitHubAPI) -> bool:
+    pull_number: int | None = None
+    actor: str | None = None
+    reason: str | None = None
+    author_activity = False
+
+    if event_name in {"pull_request", "pull_request_target"} and payload.get("pull_request"):
+        if payload.get("action") != "synchronize":
+            return False
+        pull_number = payload["pull_request"]["number"]
+        reason = "new commits were pushed"
+        author_activity = True
+    elif event_name == "issue_comment" and "pull_request" in payload.get("issue", {}):
+        pull_number = payload["issue"]["number"]
+        actor = payload.get("comment", {}).get("user", {}).get("login")
+        reason = "the author commented"
+    elif event_name == "pull_request_review_comment" and payload.get("pull_request"):
+        pull_number = payload["pull_request"]["number"]
+        actor = payload.get("comment", {}).get("user", {}).get("login")
+        reason = "the author replied to a review comment"
+    elif event_name == "pull_request_review" and payload.get("pull_request"):
+        pull_number = payload["pull_request"]["number"]
+        actor = payload.get("review", {}).get("user", {}).get("login")
+        reason = "the author submitted a review response"
+    else:
+        return False
+
+    if pull_number is None or reason is None:
+        return False
+    pull = api.get_pull(pull_number)
+    if pull.get("state") != "open" or not has_waiting_label(pull):
+        return False
+
+    if not author_activity:
+        author = pull.get("user", {}).get("login")
+        author_activity = bool(actor and author and actor.lower() == author.lower())
+
+    if not author_activity:
+        return False
+    return remove_waiting_label(api, pull_number, reason)
+
+
+def close_stale_waiting_prs(api: GitHubAPI, now: datetime | None = None) -> int:
+    now = now or datetime.now(UTC)
+    closed = 0
+    for issue in api.list_waiting_issues():
+        if closed >= MAX_CLOSURES_PER_RUN:
+            break
+        if "pull_request" not in issue or not has_waiting_label(issue):
+            continue
+
+        try:
+            label_applied_at = latest_waiting_label_at(api.list_timeline(issue["number"]))
+            if label_applied_at is None:
+                print(
+                    f"::warning::#{issue['number']} has {LABEL} but no label timestamp "
+                    "in the timeline; skipping."
+                )
+                continue
+
+            pull = api.get_pull(issue["number"])
+            reason = author_activity_since_label(api, pull, label_applied_at)
+            if reason:
+                remove_waiting_label(api, issue["number"], reason)
+                continue
+
+            if days_between(label_applied_at, now) < WAITING_DAYS:
+                continue
+
+            api.close_pull(issue["number"])
+            api.create_comment(issue["number"], close_message(label_applied_at))
+            closed += 1
+            print(f"Closed #{issue['number']}; {LABEL} was applied at {label_applied_at}.")
+        except Exception as error:  # noqa: BLE001 - keep the sweep moving across PRs.
+            print(f"::warning::Could not close #{issue['number']}: {error}")
+    print(f"Closed {closed} PR(s) labeled {LABEL}.")
+    return closed
+
+
+def run(
+    event_name: str,
+    payload: dict[str, Any],
+    api: GitHubAPI,
+    repo: str,
+    now: datetime | None = None,
+) -> None:
+    if repo != CANONICAL_REPO:
+        print(f"Skipping {repo}; waiting-on-author hygiene only runs for {CANONICAL_REPO}.")
+        return
+
+    if event_name in {"schedule", "workflow_dispatch"}:
+        close_stale_waiting_prs(api, now=now)
+        return
+
+    clear_on_author_activity(event_name, payload, api)
+
+
+def load_event_payload() -> dict[str, Any]:
+    path = os.environ.get("GITHUB_EVENT_PATH")
+    if not path:
+        return {}
+    with open(path, encoding="utf-8") as handle:
+        return json.load(handle)
+
+
+def main() -> int:
+    repo = os.environ.get("GITHUB_REPOSITORY", "")
+    token = os.environ.get("GITHUB_TOKEN")
+    if not token:
+        print("GITHUB_TOKEN is required", file=sys.stderr)
+        return 1
+    event_name = os.environ.get("GITHUB_EVENT_NAME", "")
+    run(event_name, load_event_payload(), GitHubAPI(token, repo), repo)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

.github/scripts/waiting_on_author_test.py

@@ -0,0 +1,235 @@
+#!/usr/bin/env python3
+"""Offline tests for waiting_on_author.py."""
+
+from __future__ import annotations
+
+import importlib.util
+import pathlib
+import unittest
+from datetime import UTC, datetime
+from typing import Any
+
+SCRIPT_PATH = pathlib.Path(__file__).with_name("waiting_on_author.py")
+SPEC = importlib.util.spec_from_file_location("waiting_on_author", SCRIPT_PATH)
+waiting_on_author = importlib.util.module_from_spec(SPEC)
+assert SPEC and SPEC.loader
+SPEC.loader.exec_module(waiting_on_author)
+
+
+def pr(
+    number: int = 12, author: str = "alice", labels: list[str] | None = None, state: str = "open"
+) -> dict[str, Any]:
+    labels = [waiting_on_author.LABEL] if labels is None else labels
+    return {
+        "number": number,
+        "state": state,
+        "user": {"login": author},
+        "labels": [{"name": label} for label in labels],
+    }
+
+
+def issue(number: int, labels: list[str] | None = None, is_pr: bool = True) -> dict[str, Any]:
+    labels = [waiting_on_author.LABEL] if labels is None else labels
+    item: dict[str, Any] = {"number": number, "labels": [{"name": label} for label in labels]}
+    if is_pr:
+        item["pull_request"] = {}
+    return item
+
+
+def labeled_at(iso: str, label: str | None = None) -> dict[str, Any]:
+    return {
+        "event": "labeled",
+        "label": {"name": label or waiting_on_author.LABEL},
+        "created_at": iso,
+    }
+
+
+class FakeAPI:
+    def __init__(
+        self,
+        *,
+        pull: dict[str, Any] | None = None,
+        issues: list[dict[str, Any]] | None = None,
+        timeline_by_issue: dict[int, list[dict[str, Any]]] | None = None,
+        issue_comments: dict[int, list[dict[str, Any]]] | None = None,
+        review_comments: dict[int, list[dict[str, Any]]] | None = None,
+        reviews: dict[int, list[dict[str, Any]]] | None = None,
+        commits: dict[int, list[dict[str, Any]]] | None = None,
+    ):
+        self.pull = pull or pr()
+        self.issues = issues or []
+        self.timeline_by_issue = timeline_by_issue or {}
+        self.issue_comments = issue_comments or {}
+        self.review_comments = review_comments or {}
+        self.reviews = reviews or {}
+        self.commits = commits or {}
+        self.removed: list[tuple[int, str]] = []
+        self.closed: list[int] = []
+        self.comments: list[tuple[int, str]] = []
+
+    def get_pull(self, pull_number: int) -> dict[str, Any]:
+        return self.pull | {"number": pull_number}
+
+    def remove_label(self, issue_number: int, label: str) -> bool:
+        self.removed.append((issue_number, label))
+        return True
+
+    def list_waiting_issues(self) -> list[dict[str, Any]]:
+        return self.issues
+
+    def list_timeline(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.timeline_by_issue.get(issue_number, [])
+
+    def list_issue_comments(self, issue_number: int) -> list[dict[str, Any]]:
+        return self.issue_comments.get(issue_number, [])
+
+    def list_review_comments(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.review_comments.get(pull_number, [])
+
+    def list_reviews(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.reviews.get(pull_number, [])
+
+    def list_commits(self, pull_number: int) -> list[dict[str, Any]]:
+        return self.commits.get(pull_number, [])
+
+    def close_pull(self, pull_number: int) -> None:
+        self.closed.append(pull_number)
+
+    def create_comment(self, issue_number: int, body: str) -> None:
+        self.comments.append((issue_number, body))
+
+
+class WaitingOnAuthorTest(unittest.TestCase):
+    def test_latest_waiting_label_at_uses_latest_matching_label(self) -> None:
+        self.assertEqual(
+            waiting_on_author.latest_waiting_label_at(
+                [
+                    labeled_at("2026-07-01T00:00:00Z"),
+                    labeled_at("2026-07-10T00:00:00Z", "other"),
+                    labeled_at("2026-07-12T00:00:00Z"),
+                ]
+            ),
+            "2026-07-12T00:00:00Z",
+        )
+
+    def test_author_issue_comment_removes_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="Alice"))
+        waiting_on_author.clear_on_author_activity(
+            "issue_comment",
+            {"issue": {"number": 12, "pull_request": {}}, "comment": {"user": {"login": "alice"}}},
+            api,
+        )
+        self.assertEqual(api.removed, [(12, waiting_on_author.LABEL)])
+
+    def test_author_review_thread_reply_removes_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="alice"))
+        waiting_on_author.clear_on_author_activity(
+            "pull_request_review_comment",
+            {"pull_request": {"number": 12}, "comment": {"user": {"login": "alice"}}},
+            api,
+        )
+        self.assertEqual(api.removed, [(12, waiting_on_author.LABEL)])
+
+    def test_maintainer_comment_keeps_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="alice"))
+        waiting_on_author.clear_on_author_activity(
+            "issue_comment",
+            {
+                "issue": {"number": 12, "pull_request": {}},
+                "comment": {"user": {"login": "maintainer"}},
+            },
+            api,
+        )
+        self.assertEqual(api.removed, [])
+
+    def test_new_commits_remove_waiting_label(self) -> None:
+        api = FakeAPI(pull=pr(author="alice"))
+        waiting_on_author.clear_on_author_activity(
+            "pull_request_target",
+            {"action": "synchronize", "pull_request": {"number": 12}},
+            api,
+        )
+        self.assertEqual(api.removed, [(12, waiting_on_author.LABEL)])
+
+    def test_scheduled_sweep_closes_pr_after_7_days(self) -> None:
+        api = FakeAPI(
+            issues=[issue(20)], timeline_by_issue={20: [labeled_at("2026-07-17T00:00:00Z")]}
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.closed, [20])
+        self.assertEqual(len(api.comments), 1)
+        self.assertIn(waiting_on_author.LABEL, api.comments[0][1])
+
+    def test_scheduled_sweep_removes_label_after_author_comment(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=23, author="alice"),
+            issues=[issue(23)],
+            timeline_by_issue={23: [labeled_at("2026-07-01T00:00:00Z")]},
+            issue_comments={
+                23: [{"user": {"login": "alice"}, "created_at": "2026-07-20T00:00:00Z"}]
+            },
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [(23, waiting_on_author.LABEL)])
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_keeps_label_after_maintainer_comment(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=24, author="alice"),
+            issues=[issue(24)],
+            timeline_by_issue={24: [labeled_at("2026-07-18T00:00:00Z")]},
+            issue_comments={
+                24: [{"user": {"login": "maintainer"}, "created_at": "2026-07-20T00:00:00Z"}]
+            },
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [])
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_removes_label_after_new_commit(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=25, author="alice"),
+            issues=[issue(25)],
+            timeline_by_issue={25: [labeled_at("2026-07-01T00:00:00Z")]},
+            commits={25: [{"commit": {"author": {"date": "2026-07-20T00:00:00Z"}}}]},
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [(25, waiting_on_author.LABEL)])
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_ignores_author_comment_before_label(self) -> None:
+        api = FakeAPI(
+            pull=pr(number=26, author="alice"),
+            issues=[issue(26)],
+            timeline_by_issue={26: [labeled_at("2026-07-17T00:00:00Z")]},
+            issue_comments={
+                26: [{"user": {"login": "alice"}, "created_at": "2026-07-10T00:00:00Z"}]
+            },
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.removed, [])
+        self.assertEqual(api.closed, [26])
+
+    def test_scheduled_sweep_leaves_6_day_pr_open(self) -> None:
+        api = FakeAPI(
+            issues=[issue(21)], timeline_by_issue={21: [labeled_at("2026-07-18T00:00:00Z")]}
+        )
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.closed, [])
+        self.assertEqual(api.comments, [])
+
+    def test_scheduled_sweep_skips_missing_label_timestamp(self) -> None:
+        api = FakeAPI(issues=[issue(22)], timeline_by_issue={22: []})
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(api.closed, [])
+
+    def test_scheduled_sweep_caps_closures_per_run(self) -> None:
+        issues = [issue(100 + idx) for idx in range(waiting_on_author.MAX_CLOSURES_PER_RUN + 3)]
+        timeline = {item["number"]: [labeled_at("2026-07-01T00:00:00Z")] for item in issues}
+        api = FakeAPI(issues=issues, timeline_by_issue=timeline)
+        waiting_on_author.close_stale_waiting_prs(api, now=datetime(2026, 7, 24, tzinfo=UTC))
+        self.assertEqual(len(api.closed), waiting_on_author.MAX_CLOSURES_PER_RUN)
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/workflows/android-bundle.yml

@@ -0,0 +1,64 @@
+name: Android Bundle
+
+# Builds an unsigned release AAB in CI and uploads it as a workflow artifact.
+# Download the artifact and sign it locally with your upload keystore — no
+# secrets on GitHub, no signing key in CI.
+
+on:
+  workflow_dispatch:
+    inputs:
+      version-code:
+        description: "versionCode (must be higher than the last uploaded to Play; starts at 3)"
+        required: true
+        type: string
+      version-note:
+        description: "Optional note appended to the artifact filename (e.g. rc1)"
+        required: false
+        default: ""
+  pull_request:
+    paths:
+      - ".github/workflows/android-bundle.yml"
+      - "web/android/**"
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build unsigned AAB
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: web/android
+
+    steps:
+      - name: Check out
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9  # v4
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947  # v4
+        with:
+          cache-read-only: false
+
+      - name: Build release AAB
+        run: ./gradlew bundleRelease --no-daemon --console=plain -PversionCode=${{ github.event.inputs.version-code }}
+
+      - name: Verify artifact
+        run: |
+          AAB=app/build/outputs/bundle/release/app-release.aab
+          test -f "$AAB" || { echo "::error::AAB not found at $AAB"; exit 1; }
+          echo "AAB size: $(du -h "$AAB" | cut -f1)"
+
+      - name: Upload artifact
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: omnigent-android-aab${{ inputs.version-note && format('-{0}', inputs.version-note) || '' }}
+          path: web/android/app/build/outputs/bundle/release/app-release.aab
+          retention-days: 30

.github/workflows/areas.test.js

@@ -32,9 +32,10 @@ for (const a of areas)
 for (const a of areas)
   assert(`area ${a.key} label ${a.label} is a real comp:*`, ALLOWED_LABELS.has(a.label));
 
-// Every area has >= 2 owners (the 2+ codeowner requirement).
+// Every area has >= 2 owners (the 2+ codeowner requirement). Paused owners
+// still count -- pausing someone must not force adding a new active owner.
 for (const a of areas) {
-  const n = (a.owners || []).length;
+  const n = (a.owners || []).length + (a.owners_paused || []).length;
   assert(`area ${a.key} has >= 2 owners`, n >= 2, `${n} owner(s)`);
 }
 

.github/workflows/auto-assign-reviewer.yml

@@ -83,11 +83,16 @@ jobs:
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          ROUTER_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
         run: |
           if [ -z "${LLM_API_KEY:-}" ] || [ -z "${GATEWAY_BASE_URL:-}" ]; then
             echo "::notice::No LLM credentials; reviewer ranking skipped (load-balanced fallback)."
             exit 0
           fi
+          if [ -z "${ROUTER_MODEL:-}" ]; then
+            echo "::warning::Repository variable OMNIGENT_CI_FAST_ANTHROPIC_MODEL is empty; reviewer ranking skipped (load-balanced fallback)."
+            exit 0
+          fi
           # Skip maintainer-authored PRs: the assign step (auto-assign-reviewer.js)
           # no-ops on them, so ranking them would spend a gateway call whose result
           # is discarded. Mirror that step's author-is-maintainer guard here
@@ -141,7 +146,7 @@ jobs:
           # /anthropic/messages + x-api-key path 401s / 400s on this gateway.)
           url = os.environ["GATEWAY_BASE_URL"].rstrip("/") + "/chat/completions"
           payload = json.dumps({
-              "model": "databricks-claude-sonnet-4-6",
+              "model": os.environ["ROUTER_MODEL"],
               "max_tokens": 512,
               "temperature": 0,
               "messages": [

.github/workflows/benchmark-pr.yml

@@ -0,0 +1,189 @@
+name: Benchmark (PR)
+
+# Runs a lightweight SQLite benchmark when a PR touches migration files or
+# store-layer code and compares against the latest nightly benchmark artifact
+# as a baseline. Posts results as a PR comment and blocks the PR if a
+# regression is detected.
+#
+# Only runs on PRs to the main repo (not forks without secrets). Skips
+# comparison if no nightly baseline artifact is available — the benchmark still
+# runs and reports results, it just won't block.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - "omnigent/db/migrations/**"
+      - "omnigent/stores/**"
+      - "dev/benchmarks/**"
+      - ".github/workflows/benchmark-pr.yml"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  OMNIGENT_SKIP_WEB_UI: "true"
+  UV_INDEX_URL: https://pypi.org/simple
+  PIP_INDEX_URL: https://pypi.org/simple
+
+concurrency:
+  group: benchmark-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  benchmark-pr:
+    name: Benchmark regression check (sqlite)
+    if: github.repository == 'omnigent-ai/omnigent' && !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v3
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --extra dev --extra databricks
+
+      # Use the same corpus size as the nightly so baseline numbers are
+      # directly comparable. Cache the seeded DB on the schema head + seed
+      # script hash to avoid re-seeding on every push (same contract as
+      # benchmark.yml).
+      - name: Resolve seed cache key
+        id: seedkey
+        run: |
+          HEAD="$(uv run --no-sync dev/benchmarks/omnigent/seed.py --print-head)"
+          echo "key=benchdb-sqlite-${HEAD}-5000x200-${{ hashFiles('dev/benchmarks/omnigent/seed.py') }}" \
+            >> "$GITHUB_OUTPUT"
+
+      - name: Restore seeded SQLite corpus
+        id: seedcache
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
+        with:
+          path: bench.db
+          key: ${{ steps.seedkey.outputs.key }}
+
+      - name: Seed SQLite corpus
+        if: steps.seedcache.outputs.cache-hit != 'true'
+        run: |
+          uv run --no-sync dev/benchmarks/omnigent/seed.py \
+            --database-uri "sqlite:///bench.db" \
+            --sessions 5000 --items-per-session 200
+
+      - name: Run benchmark (candidate)
+        run: |
+          uv run --no-sync dev/benchmarks/omnigent/run.py \
+            --database-uri "sqlite:///bench.db" \
+            --iterations 100 \
+            --runs 3 \
+            --output candidate.json
+
+      - name: Download latest nightly baseline (sqlite)
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set +e
+          RUN_ID=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/workflows/benchmark.yml/runs?status=success&branch=main&per_page=10" \
+            --jq '.workflow_runs[0].id // empty')
+          if [ -z "$RUN_ID" ]; then
+            echo "No successful nightly benchmark run found — skipping comparison."
+            echo "BASELINE_FOUND=false" >> "$GITHUB_ENV"
+            exit 0
+          fi
+          ARTIFACT_ID=$(gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}/artifacts" \
+            --jq '.artifacts[] | select(.name | startswith("benchmark-results-sqlite-")) | .id' \
+            | head -1)
+          if [ -z "$ARTIFACT_ID" ]; then
+            echo "No sqlite artifact found on run ${RUN_ID} — skipping comparison."
+            echo "BASELINE_FOUND=false" >> "$GITHUB_ENV"
+            exit 0
+          fi
+          gh api \
+            "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}/zip" \
+            > baseline.zip && \
+          unzip -q baseline.zip -d baseline_dir && \
+          mv baseline_dir/*.json baseline.json && \
+          echo "BASELINE_FOUND=true" >> "$GITHUB_ENV" || \
+          (echo "BASELINE_FOUND=false" >> "$GITHUB_ENV"; echo "Artifact download failed — skipping comparison.")
+
+      - name: Compare baseline vs candidate
+        if: env.BASELINE_FOUND == 'true'
+        id: compare
+        run: |
+          set +e
+          uv run --no-sync dev/benchmarks/omnigent/compare.py \
+            --baseline baseline.json \
+            --candidate candidate.json \
+            --backend sqlite \
+            --threshold 1.0 \
+            --output-markdown comparison.md
+          echo "EXIT_CODE=$?" >> "$GITHUB_ENV"
+
+      - name: Build PR comment body
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          {
+            echo "<!-- benchmark-pr-comment -->"
+            echo "## Benchmark results (SQLite, PR #${{ github.event.pull_request.number }})"
+            echo ""
+            echo "Commit: \`${{ github.event.pull_request.head.sha }}\`"
+            echo ""
+            if [ "$BASELINE_FOUND" = "true" ]; then
+              cat comparison.md
+            else
+              echo "No nightly baseline artifact found — comparison skipped."
+              echo ""
+              echo "Candidate results recorded in \`candidate.json\` artifact."
+            fi
+          } > comment_body.md
+
+      - name: Post PR comment
+        # Fork PRs have a read-only GITHUB_TOKEN so the comment may fail —
+        # that's acceptable; results are still available in the artifact.
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          COMMENT_MARKER="<!-- benchmark-pr-comment -->"
+          COMMENT_ID=$(gh api --paginate \
+            "repos/${REPO}/issues/${PR_NUMBER}/comments" \
+            --jq ".[] | select(.body | startswith(\"$COMMENT_MARKER\")) | .id" \
+            | head -1)
+          if [ -n "$COMMENT_ID" ]; then
+            gh api "repos/${REPO}/issues/comments/${COMMENT_ID}" \
+              -X PATCH -f body="$(cat comment_body.md)"
+          else
+            gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file comment_body.md
+          fi
+
+      - name: Upload candidate results
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: benchmark-results-sqlite-pr-${{ github.event.pull_request.number }}-${{ github.run_id }}
+          path: candidate.json
+          retention-days: 30
+          if-no-files-found: warn
+
+      - name: Fail on regression
+        if: env.BASELINE_FOUND == 'true' && env.EXIT_CODE == '1'
+        run: |
+          echo "Benchmark regression detected. See the PR comment for details."
+          exit 1

.github/workflows/benchmark.yml

@@ -17,6 +17,10 @@ on:
     - cron: "37 7 * * *" # 07:37 UTC nightly (off-peak, off the :00 mark)
   workflow_dispatch:
     inputs:
+      checkout_sha:
+        description: "Commit SHA to benchmark (blank = branch HEAD)"
+        required: false
+        default: ""
       iterations:
         description: "Requests per run"
         required: false
@@ -33,6 +37,10 @@ on:
         description: "Seeded items per session"
         required: false
         default: "200"
+      network_delay_ms:
+        description: "Simulated client→server latency per request (ms; 0 = loopback)"
+        required: false
+        default: "0"
 
 permissions:
   contents: read
@@ -47,11 +55,15 @@ env:
   RUNS: ${{ github.event_name == 'workflow_dispatch' && inputs.runs || '3' }}
   SESSIONS: ${{ github.event_name == 'workflow_dispatch' && inputs.sessions || '5000' }}
   ITEMS: ${{ github.event_name == 'workflow_dispatch' && inputs.items_per_session || '200' }}
+  # 0 on the nightly schedule (loopback, for stable trend data); dispatchable
+  # higher to model a real network hop when testing network optimizations.
+  NETWORK_DELAY_MS: ${{ github.event_name == 'workflow_dispatch' && inputs.network_delay_ms || '0' }}
 
 concurrency:
-  # Never cancel a scheduled run mid-flight (each is a distinct data point);
-  # coalesce manual dispatches per ref.
-  group: benchmark-${{ github.event_name }}-${{ github.ref }}
+  # Never cancel a scheduled run mid-flight (each is a distinct data point).
+  # Manual dispatches get a per-run group (unique run_id) so repeated ad-hoc
+  # runs — even on the same ref and same pinned sha — never cancel each other.
+  group: benchmark-${{ github.event_name }}-${{ github.ref }}-${{ github.run_id }}
   cancel-in-progress: ${{ github.event_name == 'workflow_dispatch' }}
 
 jobs:
@@ -98,6 +110,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
+          # Pin the benchmarked code to a specific commit when dispatched with
+          # checkout_sha; the workflow definition still comes from the trusted
+          # dispatch ref. Blank falls back to the ref's HEAD (schedule/default).
+          ref: ${{ inputs.checkout_sha || github.sha }}
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -170,6 +186,7 @@ jobs:
             --database-uri "${{ steps.db.outputs.uri }}" \
             --iterations "$ITERATIONS" \
             --runs "$RUNS" \
+            --network-delay-ms "$NETWORK_DELAY_MS" \
             --output "benchmark-results-${{ matrix.backend }}.json"
 
       - name: Upload benchmark results

.github/workflows/bump-version.yml

@@ -12,9 +12,11 @@ name: Bump Version
 # this workflow wraps it with `uv lock`, a consistency check, and an
 # auto-opened PR.
 #
-# NOTE: the PR is created with GITHUB_TOKEN, so by GitHub policy it does
-# NOT trigger other workflows (CI won't auto-run on it). Push an empty
-# commit or re-open the PR to kick CI, or swap in a PAT if that matters.
+# NOTE: when the omnigent-ci App is configured (vars.OMNIGENT_BOT_APP_ID),
+# the branch is pushed and the PR opened with a short-lived App token, so CI
+# runs on the bump PR automatically. Without it (e.g. in forks) the
+# GITHUB_TOKEN fallback applies and, by GitHub policy, CI does NOT auto-run —
+# re-open the PR or push to it to kick CI.
 
 on:
   workflow_dispatch:
@@ -82,14 +84,31 @@ jobs:
             python scripts/update_versions.py "$MODE" --new-version "$NEW_VERSION"
 
       - name: Regenerate lockfile
-        run: uv lock
+        run: |
+          uv lock
+          # uv may emit non-canonical lockfile fields (e.g. size on file
+          # entries); normalize like the pre-commit fixer, then hard-verify.
+          python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+          python3 scripts/normalize_uv_lock_registry.py --check uv.lock
 
       - name: Verify all locations agree
         run: uv run --no-project --python 3.12 --with packaging python scripts/update_versions.py check
 
+      # A bump PR pushed by the App identity gets CI runs; a GITHUB_TOKEN push
+      # would not (GitHub suppresses events from GITHUB_TOKEN-authored pushes).
+      - name: Mint App token (omnigent)
+        id: app-token
+        if: vars.OMNIGENT_BOT_APP_ID != ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent
+
       - name: Open bump PR
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
           MODE: ${{ github.event.inputs.mode }}
           NEW_VERSION: ${{ github.event.inputs.new_version }}
           BASE: ${{ github.event.inputs.base_branch }}
@@ -109,6 +128,9 @@ jobs:
             exit 0
           fi
           git commit -s -m "Bump version to ${resolved}"
+          # Push with the same token that opens the PR (see the App-token
+          # note above); the checkout's persisted credential is GITHUB_TOKEN.
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push --force-with-lease origin "$branch"
 
           existing="$(gh pr list --head "$branch" --base "$BASE" --json number --jq '.[0].number')"
@@ -122,6 +144,6 @@ jobs:
             --title "Bump version to ${resolved}" \
             --body "Automated version bump via \`.github/workflows/bump-version.yml\` (mode: \`${MODE}\`, input: \`${NEW_VERSION}\`).
 
-          Rewrote \`[project].version\` and sibling \`==\` pins across all three packages (\`pyproject.toml\`, \`sdks/python-client\`, \`sdks/ui\`), the runtime \`VERSION\` constant in \`omnigent/version.py\`, and regenerated \`uv.lock\`.
+          Rewrote \`[project].version\` and sibling \`==\` pins across all four packages (\`pyproject.toml\`, \`sdks/python-client\`, \`sdks/ui\`, \`integrations/slack\`), the runtime \`VERSION\` constant in \`omnigent/version.py\`, and regenerated \`uv.lock\`.
 
-          Generated by \`scripts/update_versions.py\`. CI does not auto-trigger on GITHUB_TOKEN PRs — re-open or push to run it."
+          Generated by \`scripts/update_versions.py\`. Opened via the omnigent-ci App when configured (CI runs automatically); on the GITHUB_TOKEN fallback, re-open or push to kick CI."

.github/workflows/ci.yml

@@ -16,6 +16,9 @@ on:
   push:
     branches:
       - main
+      # Release branches: release.yml's green-CI gate reads check runs off the
+      # branch head, so cherry-picks and release-bump commits must run CI.
+      - 'release/v[0-9]*'
     paths-ignore: ['web/**', 'tests/e2e_ui/**', 'CHANGELOG.md']
 
 permissions:
@@ -138,6 +141,17 @@ jobs:
             paths: tests/db tests/deploy
             extra: databricks
             markexpr: databricks
+          # Slack integration (integrations/slack). Its tests live outside the
+          # top-level tests/ tree and import the decoupled `omnigent_slack`
+          # package, so this lane installs the `slack` extra to pull it in. The
+          # tests are run from the repo root on purpose: they rely on the root
+          # pyproject's `asyncio_mode = auto` (rootdir resolution), and
+          # coverage of the omnigent package is a no-op here (the code under
+          # test is omnigent_slack, not omnigent) — harmless, kept for a
+          # uniform pytest step.
+          - group: slack
+            paths: integrations/slack/tests
+            extra: slack
 
     steps:
       - name: Check out repo
@@ -356,14 +370,14 @@ jobs:
           path: .tmp-codex-parity-target/debug/codex-parity-sidecar
           key: codex-parity-bin-${{ runner.os }}-${{ steps.rustc.outputs.version }}-${{ hashFiles('tests/codex_parity/sidecar/**') }}
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-        with:
-          node-version: 20
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install codex CLI
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm install --ignore-scripts --prefix .github/ci-deps
+          pnpm install --frozen-lockfile --ignore-scripts --filter e2e-ci-deps
           echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Cache virtualenv
@@ -411,8 +425,12 @@ jobs:
     # Combines per-shard coverage into a coverage-summary artifact. Runs in the
     # unprivileged pull_request context (read-only); code-coverage.yml consumes
     # the artifact and posts the status. Report-only.
+    #
+    # Only runs when every pytest shard passed: a failed shard drops its covered
+    # lines from the combine, so coverage off partial data would be misleading —
+    # and a red run gets re-run anyway, re-triggering this.
     needs: pytest
-    if: ${{ !cancelled() && !github.event.pull_request.draft }}
+    if: ${{ success() && !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:

.github/workflows/doc-sync.yml

@@ -254,16 +254,22 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Write Omnigent provider config
         if: steps.plan.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_AGENT_MODEL: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
         run: |
+          : "${OMNIGENT_AGENT_MODEL:?Set OMNIGENT_CI_ANTHROPIC_MODEL}"
           mkdir -p "$HOME/.omnigent"
           python3 -c "
           import pathlib, os, json
@@ -273,7 +279,7 @@ jobs:
               'anthropic': {
                   'base_url': gw + '/anthropic',
                   'api_key_ref': 'env:LLM_API_KEY',
-                  'models': {'default': 'databricks-claude-opus-4-8'},
+                  'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
               }}}}
           pathlib.Path.home().joinpath('.omnigent', 'config.yaml').write_text(json.dumps(cfg, indent=2))
           "

.github/workflows/docker-build.yml

@@ -31,7 +31,8 @@ on:
       - 'pyproject.toml'
       - 'setup.py'
       - 'uv.lock'
-      - 'web/package-lock.json'
+      - 'pnpm-lock.yaml'
+      - 'pnpm-workspace.yaml'
       - '.github/workflows/docker-build.yml'
 
 permissions:

.github/workflows/draft-release-notes.yml

@@ -89,14 +89,14 @@ jobs:
           base="${INPUT_BASE:-}"
           proceed=false; dry_run=false
 
-          # Does the tag look like a final release (vX.Y.Z, not rc/dev/alpha/beta)?
+          # Does the tag look like a final release (vX.Y.Z, not a pre-release)?
           is_version=true
           case "$tag" in
             v[0-9]*.[0-9]*.[0-9]*) ;;
             *) is_version=false ;;
           esac
           case "$tag" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_version=false ;;
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*) is_version=false ;;
           esac
 
           if [ "$EVENT_NAME" = "workflow_run" ]; then
@@ -199,52 +199,6 @@ jobs:
             echo "available=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Set up uv
-        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
-        with:
-          enable-cache: true
-
-      - name: Cache virtualenv
-        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: .venv
-          key: venv-${{ runner.os }}-${{ hashFiles('.python-version') }}-${{ hashFiles('uv.lock') }}
-
-      - name: Install dependencies
-        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
-        run: uv sync --extra all --extra dev
-
-      - name: Install Claude Code CLI
-        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
-        env:
-          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
-        run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
-          node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
-
-      - name: Write Omnigent provider config
-        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
-        env:
-          GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
-        run: |
-          mkdir -p "$HOME/.omnigent"
-          python3 -c "
-          import pathlib, os, json
-          gw = os.environ['GATEWAY_BASE_URL']
-          cfg = {'providers': {'databricks-gateway': {
-              'kind': 'gateway', 'default': ['anthropic'],
-              'anthropic': {
-                  'base_url': gw + '/anthropic',
-                  'api_key_ref': 'env:LLM_API_KEY',
-                  'models': {'default': 'databricks-claude-opus-4-8'},
-              }}}}
-          pathlib.Path.home().joinpath('.omnigent', 'config.yaml').write_text(json.dumps(cfg, indent=2))
-          "
-
       - name: Build drafter prompt
         if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
         env:
@@ -277,30 +231,21 @@ jobs:
           pathlib.Path("/tmp/draft_prompt.txt").write_text(prompt)
           PYEOF
 
+      # Runs the tools-less drafter and secret-scans its output; the mechanical
+      # scaffold (already in /tmp/release_notes.md) is the fallback if it can't run.
+      # Checked out at the workspace root, so the action's workdir is the default.
       - name: Run release-notes drafter
         id: draft
         if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
-        env:
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-        run: |
-          set -euo pipefail
-          prompt="$(cat /tmp/draft_prompt.txt)"
-          uv run --project "${GITHUB_WORKSPACE}" omnigent run \
-            "${GITHUB_WORKSPACE}/.github/agents/release-notes-drafter" \
-            -p "$prompt" --no-session \
-            2>draft-stderr.log | tee /tmp/draft_out.txt \
-            || { echo "::warning::drafter exited non-zero — keeping mechanical draft"; cat draft-stderr.log; }
-
-      - name: Scan drafter output for secrets
-        if: steps.draft.outcome == 'success'
-        env:
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-        run: |
-          set -euo pipefail
-          if [ -n "${LLM_API_KEY:-}" ] && grep -qF "$LLM_API_KEY" /tmp/draft_out.txt 2>/dev/null; then
-            echo "::error::Drafter output contains LLM_API_KEY — aborting."
-            exit 1
-          fi
+        uses: ./.github/actions/run-omnigent-agent
+        with:
+          agent: release-notes-drafter
+          prompt-file: /tmp/draft_prompt.txt
+          output-file: /tmp/draft_out.txt
+          stderr-file: /tmp/draft-stderr.log
+          gateway-base-url: ${{ secrets.GATEWAY_BASE_URL }}
+          llm-api-key: ${{ secrets.LLM_API_KEY }}
+          model: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
 
       - name: Extract synthesized notes (fall back to mechanical)
         if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
@@ -455,7 +400,7 @@ jobs:
           python3 - <<'PYEOF'
           import os, pathlib
           key = os.environ.get("LLM_API_KEY", "")
-          for f in ["draft-stderr.log", "/tmp/draft_out.txt", "/tmp/draft_prompt.txt",
+          for f in ["/tmp/draft-stderr.log", "/tmp/draft_out.txt", "/tmp/draft_prompt.txt",
                     "/tmp/release_notes.md"]:
               p = pathlib.Path(f)
               if not p.is_file() or not key:
@@ -472,7 +417,7 @@ jobs:
         with:
           name: draft-release-notes-${{ steps.guard.outputs.tag }}-${{ github.run_id }}
           path: |
-            draft-stderr.log
+            /tmp/draft-stderr.log
             /tmp/draft_out.txt
             /tmp/release_notes.md
             /tmp/mechanical_notes.md

.github/workflows/e2e-ui-required.yml

@@ -71,5 +71,7 @@ jobs:
           # OpenAI-compatible gateway (same secrets the e2e suites use).
           OPENAI_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
           OPENAI_API_KEY: ${{ secrets.LLM_API_KEY }}
-          E2E_UI_JUDGE_MODEL: databricks-gpt-5-4
-        run: bash .github/scripts/e2e-ui-required/check.sh
+          E2E_UI_JUDGE_MODEL: ${{ vars.OMNIGENT_CI_E2E_JUDGE_MODEL }}
+        run: |
+          : "${E2E_UI_JUDGE_MODEL:?Set OMNIGENT_CI_E2E_JUDGE_MODEL repository variable}"
+          bash .github/scripts/e2e-ui-required/check.sh

.github/workflows/e2e-ui.yml

@@ -168,8 +168,8 @@ jobs:
         with:
           python-version-file: ".python-version"
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -225,14 +225,11 @@ jobs:
       - name: Build web SPA
         # Build BEFORE pytest: Vite's emptyOutDir clobbers the static dir,
         # so never run it under xdist or alongside the live server.
-        # --legacy-peer-deps avoids re-resolving the known React 19 peer
-        # conflict under @emoji-mart/react.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       # Native coding-agent harness enablement: the next steps let the
       # native render-parity tests boot a real Claude Code / Codex CLI. The
@@ -241,15 +238,17 @@ jobs:
         # claude-code 2.1.170, NOT the 2.1.124 in .github/ci-deps: 2.1.124
         # doesn't recognise the hook events the native bridge configures and
         # shows a blocking startup modal that swallows the first message.
-        # --ignore-scripts then run install.cjs explicitly (audited: platform
-        # detect + same-tree hardlink, no network/exec) and put its bin on PATH.
+        # Runs the package's install script so the platform-specific binary is
+        # linked into the temporary CLI directory and put on PATH.
+        # (The install.cjs script was removed in the same version the upstream
+        # npm package no longer ships it, so lifecycle scripts are required.)
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
-          node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Install Codex CLI
         # @openai/codex at the .github/ci-deps pin (same build as e2e.yml's
@@ -259,9 +258,10 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
+          CODEX_CLI_DIR="${RUNNER_TEMP}/omnigent-codex-cli"
+          mkdir -p "$CODEX_CLI_DIR" && cd "$CODEX_CLI_DIR"
           npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
-          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CODEX_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Run UI e2e tests
         # --ui-skip-build: the SPA was built in the previous step.

.github/workflows/electron-build.yml

@@ -3,9 +3,12 @@ name: Electron Build
 # Manually-triggered build of the Electron desktop shell (web/electron) for
 # Linux and Windows. Each platform packages on its own native runner —
 # electron-builder does not reliably cross-compile installers — and uploads the
-# installers as downloadable workflow artifacts. Unsigned: no signing creds are
+# installers PLUS the electron-updater feed manifests (latest-linux.yml /
+# latest.yml) as downloadable workflow artifacts. Unsigned: no signing creds are
 # wired here, so `CSC_IDENTITY_AUTO_DISCOVERY=false` forces an unsigned build
-# rather than failing when a cert is absent. No publishing / release upload.
+# rather than failing when a cert is absent. No publishing to a provider / no
+# release upload (`--publish never`): the artifacts are captured here for manual
+# placement onto the omnigent.ai update feed (omnigent-site repo + artifact host).
 #
 # Run it from the Actions tab (Run workflow). macOS is intentionally omitted —
 # its signed/notarized build lives elsewhere.
@@ -52,37 +55,65 @@ jobs:
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
 
-      - name: Set up Node
-        uses: ./.github/actions/setup-node
-        with:
-          # Node 22.x per web/electron/README.md ("Prerequisites").
-          node-version: "22"
-          cache-dependency-path: web/electron/package-lock.json
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install dependencies
-        working-directory: web/electron
-        run: npm ci --no-audit --no-fund
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
+        run: |-
+          pnpm install --frozen-lockfile --filter @omnigent/electron
+          pnpm install --frozen-lockfile --filter web
 
       - name: Build ${{ matrix.platform }} app
         working-directory: web/electron
         env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
           # No signing credentials in CI: force an unsigned build instead of
           # letting electron-builder fail hunting for a certificate.
           CSC_IDENTITY_AUTO_DISCOVERY: "false"
           # electron-builder downloads Electron/tooling from GitHub; the token
           # lifts the anonymous rate limit that otherwise flakes downloads.
           GH_TOKEN: ${{ github.token }}
-        run: npm run ${{ matrix.build-script }} -- --publish never
+        run: pnpm run ${{ matrix.build-script }} -- --publish never
 
-      - name: Upload installers
+      # One artifact per platform bundling the COMPLETE electron-updater feed —
+      # the installer(s), the .blockmap electron-updater needs for differential
+      # downloads (referenced by path inside latest*.yml; the .deb has no
+      # blockmap since debs aren't differentially updated), and the feed
+      # manifest (latest-linux.yml / latest.yml). upload-artifact zips all
+      # matched files into a single download, so each platform yields one zip
+      # whose contents can be dropped straight onto a feed root (local HTTP
+      # server for testing, or public/_desktop/updates/ on the artifact host).
+      # Ship only the distributables + feed files, not electron-builder's
+      # unpacked intermediates (dist/*-unpacked).
+      #
+      # electron-builder writes the latest*.yml manifests to dist/ even under
+      # --publish never (a publish config exists in build.*.publish, so
+      # update-info generation runs; --publish only skips the provider upload).
+      # The manifest lists each artifact with sha512 + size + relative url.
+
+      - name: Upload Linux feed
+        if: matrix.platform == 'linux'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          name: omnigent-desktop-${{ matrix.platform }}
-          # Ship only the distributables, not electron-builder's unpacked
-          # intermediates (dist/linux-unpacked, dist/win-unpacked, blockmaps).
+          name: omnigent-desktop-linux
           path: |
             web/electron/dist/*.AppImage
+            web/electron/dist/*.AppImage.blockmap
             web/electron/dist/*.deb
-            web/electron/dist/*.exe
+            web/electron/dist/latest-linux.yml
+          if-no-files-found: error
+          retention-days: 14
+
+      - name: Upload Windows feed
+        if: matrix.platform == 'win'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: omnigent-desktop-win
+          path: |
+            web/electron/dist/*.exe
+            web/electron/dist/*.exe.blockmap
+            web/electron/dist/latest.yml
           if-no-files-found: error
           retention-days: 14

.github/workflows/feature-blog.yml

@@ -0,0 +1,768 @@
+name: Draft feature blogs
+
+# At release CUT (a vX.Y.Z tag is pushed → the "GitHub Release" workflow creates
+# the draft), look over the release's features and DRAFT a feature-blog post on
+# omnigent-site for each one big enough to warrant it — usually none. Blog drafts
+# land alongside the release-notes draft (draft-release-notes.yml, same trigger)
+# so a maintainer reviews both together.
+#
+# Two agents, both running on already-released history from the trusted default
+# branch:
+#   1. feature-blog-scout   — no tools; picks 0–N blog-worthy features (ranked,
+#      capped at 3) from the same PR-range material draft-release-notes.yml
+#      harvests. Most releases → [].
+#   2. feature-blog-drafter — file access; writes one post per selected feature
+#      into an omnigent-site checkout. The workflow opens a DRAFT PR per post.
+#
+# Why `workflow_run` (not extending github-release.yml): that workflow runs NO
+# project code, only `gh release create`, so a malicious tagged commit can't
+# execute anything. We keep that guarantee by running the heavy work (LLM + git
+# harvest) here, from the trusted default branch (workflow_run always does), never
+# from the tagged commit. Same posture as draft-release-notes.yml.
+#
+# The LLM machinery (creds gate, Claude Code CLI, provider config, secret-scan,
+# token-minted-after-agents, artifact redaction) mirrors draft-release-notes.yml.
+# The output is always a DRAFT PR — the mandatory demo (a real recording/
+# screenshot) and hero art / byline are added by a human before merge.
+
+on:
+  workflow_run:
+    workflows: ["GitHub Release"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to draft blogs for, e.g. v0.3.0
+        required: true
+        type: string
+      base:
+        description: >-
+          Optional range-start override (tag/branch/sha). Needed when `tag` is
+          not a final vX.Y.Z. Providing it makes the run a preview unless
+          dry_run=false.
+        required: false
+        type: string
+      dry_run:
+        description: >-
+          Preview only:
+          auto (default) - preview for dev/rc tags, real PRs for final versions;
+          true - run the scout/drafter, print output, don't open PRs;
+          false - open real DRAFT PRs.
+        required: false
+        type: choice
+        options: [auto, "true", "false"]
+        default: auto
+      max_posts:
+        description: >-
+          Maximum number of blog posts to draft (the scout still only picks
+          features that clear the bar, so it may pick fewer). Default 3.
+        required: false
+        type: string
+        default: "3"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: feature-blog-${{ github.event.workflow_run.head_branch || inputs.tag }}
+  cancel-in-progress: false
+
+env:
+  SOURCE_REPO: omnigent-ai/omnigent
+  OMNIGENT_SKIP_WEB_UI: "true"
+  UV_INDEX_URL: https://pypi.org/simple
+  PIP_INDEX_URL: https://pypi.org/simple
+
+jobs:
+  draft:
+    name: Scout features and draft blogs
+    if: >-
+      github.repository == 'omnigent-ai/omnigent' &&
+      (github.event_name == 'workflow_dispatch' ||
+       github.event.workflow_run.conclusion == 'success')
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # --- Resolve the tag and decide whether to proceed (no code run yet) ---
+      - name: Resolve tag and guard
+        id: guard
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          # On tag push, workflow_run.head_branch is the tag name (v0.3.0).
+          RUN_BRANCH: ${{ github.event.workflow_run.head_branch }}
+          INPUT_TAG: ${{ inputs.tag }}
+          INPUT_BASE: ${{ inputs.base }}
+          INPUT_DRY_RUN: ${{ inputs.dry_run }}
+          INPUT_MAX_POSTS: ${{ inputs.max_posts }}
+        run: |
+          set -euo pipefail
+          tag="${INPUT_TAG:-$RUN_BRANCH}"
+          base="${INPUT_BASE:-}"
+          proceed=false; dry_run=false
+
+          # How many posts to draft at most. Only settable via manual dispatch;
+          # a real release cut (workflow_run) uses the default. Must be a positive
+          # integer, else fall back to the default.
+          max_posts="${INPUT_MAX_POSTS:-3}"
+          case "$max_posts" in
+            ""|*[!0-9]*|0) max_posts=3 ;;
+          esac
+
+          # Does the tag look like a final release (vX.Y.Z, not rc/dev/alpha/beta)?
+          is_version=true
+          case "$tag" in
+            v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) is_version=false ;;
+          esac
+          case "$tag" in
+            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_version=false ;;
+          esac
+
+          if [ "$EVENT_NAME" = "workflow_run" ]; then
+            # Real release cut: strict — only a final version tag proceeds.
+            [ "$is_version" = "true" ] && proceed=true
+          else
+            # Manual dispatch: proceed for a final version tag OR when a base
+            # override is given (arbitrary-ref preview/real run).
+            if [ "$is_version" = "true" ] || [ -n "$base" ]; then
+              proceed=true
+            fi
+            case "$INPUT_DRY_RUN" in
+              true)  dry_run=true ;;
+              false) dry_run=false ;;
+              *)     if [ "$is_version" != "true" ] || [ -n "$base" ]; then dry_run=true; fi ;;
+            esac
+          fi
+
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          echo "base=${base}" >> "$GITHUB_OUTPUT"
+          echo "proceed=${proceed}" >> "$GITHUB_OUTPUT"
+          echo "dry_run=${dry_run}" >> "$GITHUB_OUTPUT"
+          echo "max_posts=${max_posts}" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag=${tag} base=${base:-<none>} proceed=${proceed} dry_run=${dry_run} max_posts=${max_posts}" \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+
+      # Trusted default branch, full history + tags for the range computation.
+      - name: Checkout omnigent (main)
+        if: steps.guard.outputs.proceed == 'true'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: main
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+
+      - name: Set up Python
+        if: steps.guard.outputs.proceed == 'true'
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+
+      # --- Credentials gate: no LLM key → nothing to draft, exit cleanly ---
+      - name: Check LLM credentials
+        id: creds
+        if: steps.guard.outputs.proceed == 'true'
+        env:
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+        run: |
+          if [ -z "${LLM_API_KEY:-}" ]; then
+            echo "::warning::No LLM credentials — skipping feature-blog drafting."
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "::add-mask::${LLM_API_KEY}"
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # --- Harvest the same PR-range material as draft-release-notes.yml ---
+      - name: Harvest PR material
+        id: harvest
+        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.guard.outputs.tag }}
+          BASE: ${{ steps.guard.outputs.base }}
+        run: |
+          set -euo pipefail
+          python3 -m pip install --quiet --disable-pip-version-check packaging
+          args=(--tag "$TAG" --repo "$SOURCE_REPO"
+                --draft-notes-out /tmp/mechanical_notes.md
+                --pr-list-out /tmp/pr_list.txt
+                --no-changelog-update)
+          [ -n "${BASE:-}" ] && args+=(--base "$BASE")
+          python3 .github/scripts/changelog/generate.py "${args[@]}"
+
+      # --- 1) Scout: which features (if any) are blog-worthy? ---
+      - name: Build scout prompt
+        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
+        env:
+          TAG: ${{ steps.guard.outputs.tag }}
+          MAX_POSTS: ${{ steps.guard.outputs.max_posts }}
+        run: |
+          set -euo pipefail
+          python3 -u <<'PYEOF'
+          import os, pathlib
+          tag = os.environ["TAG"]
+          max_posts = int(os.environ.get("MAX_POSTS", "3"))
+          # `omnigent run -p` passes the whole prompt as one argv string, capped at
+          # ~128 KiB on Linux. Cap the PR list well under that.
+          MAX = 100_000
+          pr_list = pathlib.Path("/tmp/pr_list.txt").read_text(encoding="utf-8", errors="replace")
+          mech = pathlib.Path("/tmp/mechanical_notes.md").read_text(encoding="utf-8", errors="replace")
+          truncated = len(pr_list) > MAX
+          pr_list = pr_list[:MAX]
+          note = ("\n> NOTE: the PR list was truncated — select from what's visible.\n"
+                  if truncated else "")
+          prompt = f"""Select the blog-worthy features (if any) from {tag}.
+          Return AT MOST {max_posts} feature(s), ranked strongest-first — pick fewer
+          if fewer clear the bar. This overrides any other cap in your instructions.
+          {note}
+          ## Merged PRs (number, title, and author changelog entries)
+          {pr_list}
+
+          ## Mechanical draft (features grouped into sections — raw material)
+          {mech}
+
+          Produce the BLOG_CANDIDATES block per your instructions."""
+          pathlib.Path("/tmp/scout_prompt.txt").write_text(prompt)
+          PYEOF
+
+      # Sets up uv + Claude CLI + the gateway provider config, runs the tools-less
+      # scout on the prompt file, and secret-scans its stdout — the same runner
+      # scaffold draft-release-notes.yml / publish-changelog.yml share. The env it
+      # sets up (PATH, ~/.omnigent, .venv) persists into the drafter loop below, so
+      # only the scout needs to invoke the action.
+      - name: Run feature-blog scout
+        id: scout
+        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
+        uses: ./.github/actions/run-omnigent-agent
+        with:
+          agent: feature-blog-scout
+          prompt-file: /tmp/scout_prompt.txt
+          output-file: /tmp/scout_out.txt
+          stderr-file: ${{ github.workspace }}/scout-stderr.log
+          gateway-base-url: ${{ secrets.GATEWAY_BASE_URL }}
+          llm-api-key: ${{ secrets.LLM_API_KEY }}
+          model: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
+
+      - name: Parse candidates
+        id: candidates
+        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
+        env:
+          MAX_POSTS: ${{ steps.guard.outputs.max_posts }}
+        run: |
+          set -euo pipefail
+          python3 -u <<'PYEOF'
+          import json, os, pathlib, re
+          raw = pathlib.Path("/tmp/scout_out.txt").read_text(encoding="utf-8", errors="replace") \
+              if pathlib.Path("/tmp/scout_out.txt").is_file() else ""
+          m = re.search(r"<!--\s*BLOG_CANDIDATES\s*-->(.*?)<!--\s*/BLOG_CANDIDATES\s*-->", raw, re.DOTALL)
+          parsed = []
+          if m:
+              try:
+                  obj = json.loads(m.group(1).strip())
+                  if isinstance(obj, list):
+                      parsed = obj
+              except json.JSONDecodeError as e:
+                  print(f"::warning::Could not parse BLOG_CANDIDATES JSON — treating as none: {e}")
+
+          # The scout is an LLM fed author-written PR prose (an injection surface),
+          # so validate its output before any value becomes a path, branch name, or
+          # PR fetch. `slug` becomes a filesystem path and git branch → must be a
+          # strict kebab-case token (blocks `../`, slashes, spaces). `pr_refs` must
+          # intersect the PRs we actually harvested (blocks arbitrary `gh pr diff`).
+          harvested = set(int(n) for n in re.findall(r"(?m)^#(\d+):",
+              pathlib.Path("/tmp/pr_list.txt").read_text(encoding="utf-8", errors="replace")))
+          slug_re = re.compile(r"^[a-z0-9]+(?:-[a-z0-9]+)*$")
+          cands = []
+          for c in parsed:
+              if not isinstance(c, dict):
+                  continue
+              slug = str(c.get("slug", ""))
+              if not slug_re.match(slug) or len(slug) > 80:
+                  print(f"::warning::Dropping candidate with invalid slug {slug!r}.")
+                  continue
+              refs = []
+              for r in c.get("pr_refs", []):
+                  try:
+                      n = int(r)
+                  except (TypeError, ValueError):
+                      continue
+                  if n in harvested:
+                      refs.append(n)
+              if not refs:
+                  print(f"::warning::Dropping candidate {slug!r} — no pr_refs in the harvested range.")
+                  continue
+              c["slug"] = slug
+              c["pr_refs"] = refs
+              cands.append(c)
+
+          # Enforce the post cap defensively (the scout is told the limit too).
+          max_posts = int(os.environ.get("MAX_POSTS", "3"))
+          cands = cands[:max_posts]
+          pathlib.Path("/tmp/candidates.json").write_text(json.dumps(cands))
+          out = os.environ["GITHUB_OUTPUT"]
+          with open(out, "a") as f:
+              f.write(f"count={len(cands)}\n")
+          summary = os.environ.get("GITHUB_STEP_SUMMARY")
+          if summary:
+              with open(summary, "a") as f:
+                  if cands:
+                      f.write(f"## {len(cands)} blog candidate(s)\n")
+                      for c in cands:
+                          f.write(f"- **{c.get('headline','?')}** "
+                                  f"(`{c.get('slug','?')}`, {c.get('category','?')}) — "
+                                  f"{c.get('why_worthy','')}\n")
+                  else:
+                      f.write("## No blog-worthy features this release.\n")
+          print(f"Parsed {len(cands)} candidate(s).")
+          PYEOF
+
+      # --- 2) Draft one post per candidate into an omnigent-site checkout ---
+      # Checked out WITHOUT a write token — the drafter runs first; the token is
+      # minted only after all agents finish, then used to push.
+      - name: Checkout omnigent-site (draft target)
+        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true' && steps.candidates.outputs.count != '0'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: omnigent-ai/omnigent-site
+          ref: main
+          path: site
+          persist-credentials: false
+
+      - name: Draft posts
+        id: draftposts
+        if: steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true' && steps.candidates.outputs.count != '0'
+        env:
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.guard.outputs.tag }}
+        run: |
+          set -euo pipefail
+          SITE="${GITHUB_WORKSPACE}/site"
+          VERSION="${TAG#v}"
+          # Release date = the tag's commit date in the omnigent checkout (workspace
+          # root, full history + tags), NOT the site checkout's last-commit date.
+          DATE="$(git -C "${GITHUB_WORKSPACE}" log -1 --format=%cs "$TAG" 2>/dev/null || git -C "${GITHUB_WORKSPACE}" log -1 --format=%cs)"
+
+          # Build a per-feature material file (contributing PRs' entries + diffs),
+          # commit each post to its own LOCAL branch (no push, no token needed).
+          git -C "$SITE" config user.name "omnigent-ci[bot]"
+          git -C "$SITE" config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+
+          count=$(python3 -c "import json;print(len(json.load(open('/tmp/candidates.json'))))")
+          : > /tmp/drafted_branches.txt
+          for i in $(seq 0 $((count - 1))); do
+            slug=$(python3 -c "import json;print(json.load(open('/tmp/candidates.json'))[$i]['slug'])")
+            headline=$(python3 -c "import json;print(json.load(open('/tmp/candidates.json'))[$i]['headline'])")
+            category=$(python3 -c "import json;print(json.load(open('/tmp/candidates.json'))[$i].get('category',''))")
+
+            # Assemble the per-feature material: changelog entries for the
+            # candidate's PRs plus each PR's diff (capped). Quoted heredoc so the
+            # markdown code fences aren't shell-evaluated — index and repo come in
+            # via env (CAND_INDEX / SOURCE_REPO), never interpolated into the body.
+            CAND_INDEX="$i" python3 -u <<'PYEOF'
+          import json, os, pathlib, re, subprocess
+          repo = os.environ["SOURCE_REPO"]
+          idx = int(os.environ["CAND_INDEX"])
+          cand = json.load(open("/tmp/candidates.json"))[idx]
+          refs = [int(r) for r in cand.get("pr_refs", [])]
+          pr_list = pathlib.Path("/tmp/pr_list.txt").read_text(encoding="utf-8", errors="replace")
+          fence = "```"
+          parts = [f"# Feature: {cand.get('headline','')}", "",
+                   f"Contributing PRs: {refs}", "",
+                   "## Changelog entries (from the release harvest)", pr_list, "",
+                   "## PR diffs"]
+          BUDGET = 60_000
+          # Tally who merged the contributing PRs so we can request review from the
+          # maintainer with the most context on the feature (mirrors doc-sync, but a
+          # blog spans many PRs so we pick the most frequent merger). Authors fall
+          # back for it — outside contributors may lack site access, a maintainer
+          # always merges. Skip bots / the CI identity.
+          from collections import Counter
+          mergers, authors = Counter(), Counter()
+          def _usable(login):
+              return bool(login) and not login.endswith("[bot]") and login != "omnigent-ci"
+          # Detect a demo VIDEO already attached to a PR body so the reviewer can
+          # reuse it instead of re-recording. GitHub renders uploaded videos as bare
+          # asset links (user-attachments/assets or the older <owner>/<repo>/assets),
+          # and video files by extension. Images (user-images.githubusercontent /
+          # ![](...) / .png|.jpg) are NOT counted — the marker asks for a recording.
+          video_re = re.compile(
+              r"https?://github\.com/user-attachments/assets/[0-9a-f-]+"
+              r"|https?://github\.com/[^/\s)]+/[^/\s)]+/assets/\d+/[0-9a-f-]+"
+              r"|https?://[^\s)]+\.(?:mp4|mov|webm|m4v)\b"
+              r"|<video\b",
+              re.IGNORECASE)
+          def _title_cell(t):
+              # Keep the table one row per PR: collapse newlines and pipe chars.
+              return (t or "").replace("|", "\\|").replace("\n", " ").strip()
+          rows = []  # (number, title, url, has_video) for the reviewer table
+          for pr in refs:
+              try:
+                  diff = subprocess.run(
+                      ["gh", "pr", "diff", str(pr), "--repo", repo],
+                      capture_output=True, text=True, timeout=60).stdout
+              except Exception as e:
+                  diff = f"(diff unavailable: {e})"
+              parts += [f"### PR #{pr}", f"{fence}diff", diff[:BUDGET], fence]
+              title, url, has_video = "", f"https://github.com/{repo}/pull/{pr}", False
+              try:
+                  meta = json.loads(subprocess.run(
+                      ["gh", "pr", "view", str(pr), "--repo", repo,
+                       "--json", "title,body,url,mergedBy,author"],
+                      capture_output=True, text=True, timeout=60).stdout or "{}")
+                  mb = (meta.get("mergedBy") or {}).get("login", "")
+                  au = (meta.get("author") or {}).get("login", "")
+                  if _usable(mb):
+                      mergers[mb] += 1
+                  if _usable(au):
+                      authors[au] += 1
+                  title = _title_cell(meta.get("title", ""))
+                  url = meta.get("url") or url
+                  has_video = bool(video_re.search(meta.get("body") or ""))
+              except Exception as e:
+                  print(f"::notice::Could not read metadata for PR #{pr}: {e}")
+              rows.append((pr, title, url, has_video))
+          pathlib.Path(f"/tmp/material_{idx}.txt").write_text("\n".join(parts))
+          # Reviewer reference table: which contributing PRs already ship a demo
+          # video (✅, linked) vs. still need one (—). Written even when none have a
+          # video, so the reviewer always sees the source PRs behind the marker.
+          table = ["| PR | Title | Demo video? |", "| --- | --- | --- |"]
+          for pr, title, url, has_video in rows:
+              cell = f"[✅ video]({url})" if has_video else "—"
+              table.append(f"| [#{pr}]({url}) | {title} | {cell} |")
+          pathlib.Path(f"/tmp/demo_table_{idx}.md").write_text("\n".join(table))
+          # Most-frequent merger wins; ties broken by Counter insertion order (PR
+          # order). Fall back to the most-frequent author, then empty.
+          reviewer = (mergers.most_common(1)[0][0] if mergers
+                      else authors.most_common(1)[0][0] if authors else "")
+          pathlib.Path(f"/tmp/reviewer_{idx}.txt").write_text(reviewer)
+          PYEOF
+
+            # Start each candidate from a pristine tree: a prior candidate that
+            # failed AFTER writing its post would otherwise leave an untracked
+            # file that `switch -C` preserves and the next `add -A` would sweep
+            # into the wrong PR.
+            git -C "$SITE" reset --hard >/dev/null
+            git -C "$SITE" clean -fdx >/dev/null
+            branch="auto/blog/${VERSION}-${slug}"
+            git -C "$SITE" switch -C "$branch" origin/main
+
+            prompt="SITE_REPO=${SITE}
+          HEADLINE=${headline}
+          SLUG=${slug}
+          CATEGORY=${category}
+          DATE=${DATE}
+          MATERIAL_FILE=/tmp/material_${i}.txt
+
+          Draft the feature-blog post per your instructions."
+
+            # cwd = workspace root: the drafter reads MATERIAL_FILE (/tmp) and
+            # writes into SITE_REPO. Capture the exit status without aborting so
+            # the secret-scan below runs regardless of whether the drafter failed
+            # (tee already wrote its stdout to the file either way).
+            drafter_rc=0
+            uv run --project "${GITHUB_WORKSPACE}" omnigent run \
+              "${GITHUB_WORKSPACE}/.github/agents/feature-blog-drafter" \
+              -p "$prompt" --no-session \
+              2>>drafter-stderr.log | tee "/tmp/drafter_out_${i}.txt" || drafter_rc=$?
+
+            # Secret-scan the drafter output BEFORE it feeds the PR body, and
+            # fail-closed EVEN ON drafter failure — the drafter runs with
+            # LLM_API_KEY in env and its stdout is embedded in the PR description,
+            # so a hit must abort the whole step (artifact redaction runs only
+            # after PRs are open, too late to un-leak it).
+            if [ -n "${LLM_API_KEY:-}" ] && grep -qF "$LLM_API_KEY" "/tmp/drafter_out_${i}.txt" 2>/dev/null; then
+              echo "::error::Drafter output for ${slug} contains LLM_API_KEY — aborting."
+              exit 1
+            fi
+
+            if [ "$drafter_rc" -ne 0 ]; then
+              echo "::warning::drafter failed for ${slug} — skipping"
+              continue
+            fi
+
+            if [ -z "$(git -C "$SITE" status --porcelain)" ]; then
+              echo "::warning::drafter produced no edits for ${slug} — skipping"
+              continue
+            fi
+
+            # Also scan the drafted files (they get committed + pushed) for the
+            # key. --untracked covers the newly-created post, which git grep would
+            # otherwise skip.
+            if [ -n "${LLM_API_KEY:-}" ] && git -C "$SITE" grep --untracked -qF "$LLM_API_KEY" 2>/dev/null; then
+              echo "::error::Drafted content for ${slug} contains LLM_API_KEY — aborting."
+              exit 1
+            fi
+
+            # Append the fixed CTA footer to the drafted post (LLM never writes it).
+            # The post is a new, untracked file — find it via status (git diff
+            # can't see untracked paths). Use -uall: plain porcelain collapses a
+            # brand-new directory to "app/blog/<slug>/" and never names the file
+            # inside it, so grep 'page.mdx' would miss it. Porcelain lines are
+            # "XY path"; take the path field of the first added/modified page.mdx.
+            post="$(git -C "$SITE" status --porcelain -uall | grep -m1 'page.mdx' | awk '{print $NF}' || true)"
+
+            # Fail fast on HTML comments in the MDX: `<!-- ... -->` is invalid in
+            # MDX (only `{/* ... */}` works) and would break the site's `next build`
+            # only after the PR is opened. Catch it here so we never ship a red PR.
+            if [ -n "$post" ] && grep -qF '<!--' "${SITE}/${post}"; then
+              echo "::error::Drafted ${post} contains an HTML comment (<!-- -->); MDX requires {/* */}. Aborting."
+              exit 1
+            fi
+
+            if [ -n "$post" ]; then
+              printf '\n---\n\n**Enjoying Omnigent?** If this is useful to you, [give us a star on GitHub ⭐](https://github.com/omnigent-ai/omnigent). Come say hi on [Discord](https://discord.gg/omnigent), or [check the latest release](https://omnigent.ai/releases).\n' \
+                >> "${SITE}/${post}"
+            fi
+
+            # Generate the hero illustration from the drafter's IMAGE_PROMPT (the
+            # per-feature subject) plus a fixed brand style suffix, via the image
+            # model on the same gateway host. Fail-soft: any error leaves heroArt
+            # blank (the index falls back to a placeholder card), never blocking
+            # the draft. The scene is machine-drawn from the prompt, so no secret
+            # can reach it; the drafted-file secret scan above already ran.
+            image_prompt="$(sed -n 's/^IMAGE_PROMPT:[[:space:]]*//p' "/tmp/drafter_out_${i}.txt" | head -n1)"
+            if [ -n "$post" ] && [ -n "$image_prompt" ]; then
+              # GATEWAY_BASE_URL is scoped to THIS invocation only (not the step
+              # env), so the unsandboxed drafter run above never sees it and it
+              # can't reach the drafter's scanned stdout.
+              GATEWAY_BASE_URL='${{ secrets.GATEWAY_BASE_URL }}' \
+              IMAGE_MODEL='${{ vars.OMNIGENT_CI_IMAGE_MODEL }}' \
+              IMAGE_PROMPT="$image_prompt" SLUG="$slug" SITE="$SITE" POST="$post" \
+              python3 -u <<'PYEOF' || echo "::warning::hero image generation failed for ${slug}; leaving heroArt blank"
+          import base64, json, os, pathlib, re, urllib.request
+          gw = os.environ.get("GATEWAY_BASE_URL", "")
+          key = os.environ.get("LLM_API_KEY", "")
+          if not gw or not key:
+              raise SystemExit("no gateway/key for image generation")
+          # The image model lives on the same workspace host as the anthropic
+          # gateway (GATEWAY_BASE_URL = <host>/anthropic). Derive scheme://host.
+          m = re.match(r"(https?://[^/]+)", gw)
+          if not m:
+              raise SystemExit(f"cannot parse gateway host from {gw!r}")
+          model = os.environ.get("IMAGE_MODEL", "").strip()
+          if not model:
+              raise SystemExit("repository variable OMNIGENT_CI_IMAGE_MODEL is empty")
+          url = f"{m.group(1)}/serving-endpoints/{model}/invocations"
+          style = (" Flat vector illustration, dark navy tech background with subtle "
+                   "circuit lines, teal and pink accents, 16:9 wide, no text, no words, "
+                   "no logos.")
+          body = json.dumps({"messages": [{"role": "user",
+                 "content": os.environ["IMAGE_PROMPT"] + style}], "max_tokens": 4096}).encode()
+          req = urllib.request.Request(url, data=body, method="POST", headers={
+              "Authorization": f"Bearer {key}", "Content-Type": "application/json"})
+          with urllib.request.urlopen(req, timeout=120) as resp:
+              data = json.load(resp)
+          # The image is the content part of type image_url (a data: URI).
+          uri = None
+          for part in data["choices"][0]["message"]["content"]:
+              if isinstance(part, dict) and part.get("type") == "image_url":
+                  uri = part["image_url"]["url"]
+                  break
+          if not uri or "," not in uri:
+              raise SystemExit("no image in model response")
+          raw = base64.b64decode(uri.split(",", 1)[1])
+          if raw[:8] != b"\x89PNG\r\n\x1a\n":
+              raise SystemExit("model returned non-PNG data")
+          slug = os.environ["SLUG"]
+          # Defense-in-depth: slug is validated as strict kebab-case upstream, but
+          # this is the one place it names a new file — re-check before writing.
+          if not re.fullmatch(r"[a-z0-9]+(?:-[a-z0-9]+)*", slug):
+              raise SystemExit(f"unsafe slug for hero path: {slug!r}")
+          dest = pathlib.Path(os.environ["SITE"], "public", "images", "blog", f"{slug}.png")
+          dest.parent.mkdir(parents=True, exist_ok=True)
+          dest.write_bytes(raw)
+          # Point heroArt at the served path (public/ maps to site root).
+          post_path = pathlib.Path(os.environ["SITE"], os.environ["POST"])
+          text = post_path.read_text(encoding="utf-8")
+          text, n = re.subn(r'heroArt:\s*"[^"]*"', f'heroArt: "/images/blog/{slug}.png"', text, count=1)
+          if not n:
+              # No double-quoted heroArt to rewrite — drop the orphan PNG so we
+              # don't commit an image nothing references.
+              dest.unlink(missing_ok=True)
+              raise SystemExit("no heroArt: \"\" field to rewrite; discarding hero image")
+          post_path.write_text(text, encoding="utf-8")
+          print(f"generated hero image ({len(raw)} bytes) -> /images/blog/{slug}.png")
+          PYEOF
+            fi
+
+            # Prettier the drafter's changed files so they pass the site's
+            # `fmt:check` gate — LLM-generated MDX/JS (and the CTA footer appended
+            # above) are rarely prettier-clean. Run from inside $SITE so prettier
+            # discovers the site's .prettierrc.json + .prettierignore, and pin the
+            # site's major version. Formatting failures are non-fatal: a human
+            # reviews the draft PR and CI still reports any residual issue.
+            mapfile -t changed < <(git -C "$SITE" status --porcelain -uall | awk '{print $NF}')
+            if [ "${#changed[@]}" -gt 0 ]; then
+              ( cd "$SITE" && npx --yes prettier@3 --write --ignore-unknown "${changed[@]}" ) \
+                || echo "::warning::prettier --write failed for ${slug}; committing unformatted (CI will flag)"
+            fi
+
+            # Surface the drafted post itself: copy it to /tmp (uploaded as an
+            # artifact) and, on a dry run, render it into the job summary so the
+            # post body can be reviewed without opening a PR.
+            if [ -n "$post" ] && [ -f "${SITE}/${post}" ]; then
+              cp "${SITE}/${post}" "/tmp/post_${i}.mdx"
+              {
+                echo "<details><summary>Drafted post: ${slug}</summary>"
+                echo
+                echo '```mdx'
+                cat "${SITE}/${post}"
+                echo '```'
+                echo "</details>"
+              } >> "$GITHUB_STEP_SUMMARY"
+            fi
+
+            title=$(sed -n 's/^BLOG_PR_TITLE:[[:space:]]*//p' "/tmp/drafter_out_${i}.txt" | head -n1)
+            [ -z "$title" ] && title="add feature blog: ${headline}"
+
+            git -C "$SITE" add -A
+            git -C "$SITE" commit -m "blog: ${title}"
+            printf '%s\t%s\t%s\n' "$branch" "$title" "$i" >> /tmp/drafted_branches.txt
+          done
+
+          n=$(wc -l < /tmp/drafted_branches.txt | tr -d ' ')
+          echo "drafted=${n}" >> "$GITHUB_OUTPUT"
+          echo "Drafted ${n} post(s)." | tee -a "$GITHUB_STEP_SUMMARY"
+
+      # --- 3) Mint the write-token — ONLY now, after the agents have run ---
+      - name: Mint App token (omnigent-site)
+        id: app-token
+        if: steps.guard.outputs.proceed == 'true' && steps.guard.outputs.dry_run != 'true' && steps.draftposts.outcome == 'success' && steps.draftposts.outputs.drafted != '' && steps.draftposts.outputs.drafted != '0' && vars.OMNIGENT_BOT_APP_ID != ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent-site
+
+      # Make a misconfigured run (posts drafted but no App to push them) loud, so
+      # it isn't mistaken for a clean "no candidates" outcome.
+      - name: Warn if drafts can't be published
+        if: steps.guard.outputs.proceed == 'true' && steps.guard.outputs.dry_run != 'true' && steps.draftposts.outcome == 'success' && steps.draftposts.outputs.drafted != '' && steps.draftposts.outputs.drafted != '0' && steps.app-token.outputs.token == ''
+        run: |
+          echo "::warning::Drafted ${{ steps.draftposts.outputs.drafted }} post(s) but no omnigent-site App token (OMNIGENT_BOT_APP_ID unset?) — no PRs opened; drafts discarded." \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+
+      # --- 4) Push each drafted branch and open a DRAFT PR ---
+      - name: Open draft PRs (omnigent-site)
+        if: steps.guard.outputs.proceed == 'true' && steps.guard.outputs.dry_run != 'true' && steps.draftposts.outcome == 'success' && steps.draftposts.outputs.drafted != '' && steps.draftposts.outputs.drafted != '0' && steps.app-token.outputs.token != ''
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          SITE_TOKEN: ${{ steps.app-token.outputs.token }}
+          TAG: ${{ steps.guard.outputs.tag }}
+        run: |
+          set -euo pipefail
+          SITE="${GITHUB_WORKSPACE}/site"
+          SITE_REPO="${GITHUB_REPOSITORY_OWNER}/omnigent-site"
+          PUSH_URL="https://x-access-token:${SITE_TOKEN}@github.com/${SITE_REPO}.git"
+
+          # Ensure the triage label exists (gh pr create --label fails if absent).
+          # Idempotent: a no-op when it already exists.
+          gh label create automated-blog --repo "$SITE_REPO" \
+            --color 5319e7 --description "Auto-drafted feature-blog post" 2>/dev/null || true
+
+          # Request review from the maintainer with the most context on the
+          # feature — the person who merged the most of its contributing PRs
+          # (computed in the Draft posts step). The @-mention in the body is the
+          # durable ping (reaches concealed org members); the --add-reviewer /
+          # --add-assignee calls are best-effort (GitHub 422s non-collaborators),
+          # so tolerate their failure and never let it block the PR.
+          assign_reviewer() {
+            local pr_ref="$1" who="$2"
+            [ -n "$who" ] || return 0
+            gh pr edit "$pr_ref" --repo "$SITE_REPO" --add-reviewer "$who" \
+              || echo "::notice::Could not request review from ${who} (not addable); they're @-mentioned in the PR body."
+            gh pr edit "$pr_ref" --repo "$SITE_REPO" --add-assignee "$who" \
+              || echo "::notice::Could not assign ${who} (not addable); they're @-mentioned in the PR body."
+          }
+
+          echo "## Draft blog PRs" >> "$GITHUB_STEP_SUMMARY"
+          while IFS=$'\t' read -r branch title idx; do
+            [ -z "$branch" ] && continue
+            git -C "$SITE" push --force "$PUSH_URL" "$branch"
+
+            reviewer="$(cat "/tmp/reviewer_${idx}.txt" 2>/dev/null || true)"
+            mention=""
+            [ -n "$reviewer" ] && mention=" · most context @${reviewer}"
+
+            # Build the body once so the update path can refresh it too — the
+            # @-mention is the durable ping (--add-reviewer commonly 422s because
+            # the source-repo maintainer isn't an omnigent-site collaborator), so
+            # it must be written on BOTH the create and force-push-update paths.
+            summary="$(sed -n '/<!-- BLOG_DRAFT_SUMMARY -->/,$p' "/tmp/drafter_out_${idx}.txt" | tail -n +2 || true)"
+
+            # Reference table of the contributing PRs and whether each already
+            # ships a demo video (built in the Draft posts step). Reviewers can pull
+            # an existing recording from a ✅ PR to replace the `DEMO REQUIRED`
+            # marker instead of re-recording. Omitted if the table wasn't produced.
+            demo_table=""
+            if [ -f "/tmp/demo_table_${idx}.md" ]; then
+              demo_table="$(printf '\n\n### Source PRs — demo videos\nCheck a ✅ PR for a recording you can drop into the `DEMO REQUIRED` marker.\n\n%s\n' "$(cat "/tmp/demo_table_${idx}.md")")"
+            fi
+            body="$(printf 'Drafts a feature-blog post for **%s**, selected by `feature-blog-scout` at the %s release cut.\n\n> **This is a DRAFT.** Before merging, a human must: record the mandatory demo (replace the `DEMO REQUIRED` marker) and do a final voice pass. The hero image and `author: omnigent` byline are auto-generated — review and optionally replace them.\n\n%s%s\n\nSource release: %s%s\n<sub>Generated by omnigent `.github/workflows/feature-blog.yml`. Review for accuracy before merging.</sub>' "$title" "$TAG" "$summary" "$demo_table" "$TAG" "$mention")"
+
+            existing="$(gh pr list --repo "$SITE_REPO" --head "$branch" --state open --json url --jq '.[].url' | head -n1)"
+            if [ -n "$existing" ]; then
+              gh pr edit "$existing" --repo "$SITE_REPO" --body "$body" \
+                || echo "::notice::Could not refresh body for ${existing}."
+              assign_reviewer "$existing" "$reviewer"
+              echo "- [${title}](${existing})${mention} — updated existing draft (force-pushed)" \
+                >> "$GITHUB_STEP_SUMMARY"
+              continue
+            fi
+
+            url="$(gh pr create \
+              --repo "$SITE_REPO" \
+              --base main \
+              --head "$branch" \
+              --draft \
+              --title "blog: ${title}" \
+              --body "$body" \
+              --label automated-blog)"
+            assign_reviewer "$url" "$reviewer"
+            echo "- [${title}](${url})${mention}" >> "$GITHUB_STEP_SUMMARY"
+          done < /tmp/drafted_branches.txt
+
+      # ::add-mask:: redacts rendered logs, not artifact files — scrub the key
+      # from artifacts (incl. unscanned stderr) before upload.
+      - name: Redact secrets from artifacts
+        if: always() && steps.guard.outputs.proceed == 'true' && steps.creds.outputs.available == 'true'
+        env:
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+        run: |
+          set -euo pipefail
+          [ -n "${LLM_API_KEY:-}" ] || exit 0
+          python3 - <<'PYEOF'
+          import os, glob, pathlib
+          key = os.environ.get("LLM_API_KEY", "")
+          files = ["scout-stderr.log", "drafter-stderr.log", "/tmp/scout_out.txt",
+                   "/tmp/scout_prompt.txt"]
+          files += glob.glob("/tmp/drafter_out_*.txt") + glob.glob("/tmp/material_*.txt")
+          files += glob.glob("/tmp/post_*.mdx")
+          for f in files:
+              p = pathlib.Path(f)
+              if not p.is_file() or not key:
+                  continue
+              t = p.read_text(encoding="utf-8", errors="replace")
+              if key in t:
+                  p.write_text(t.replace(key, "***REDACTED***"), encoding="utf-8")
+                  print(f"redacted key from {f}")
+          PYEOF
+
+      - name: Upload logs and drafted posts
+        if: always() && steps.guard.outputs.proceed == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: feature-blog-${{ steps.guard.outputs.tag }}-${{ github.run_id }}
+          path: |
+            scout-stderr.log
+            drafter-stderr.log
+            /tmp/scout_out.txt
+            /tmp/candidates.json
+            /tmp/drafter_out_*.txt
+            /tmp/post_*.mdx
+            /tmp/demo_table_*.md
+          retention-days: 7
+          if-no-files-found: ignore

.github/workflows/finalize-release.yml

@@ -0,0 +1,241 @@
+# Publish a FINAL release's GitHub draft as Latest — the last release step,
+# run after the prod PyPI publish succeeded and the draft notes are curated
+# (designs/RELEASE-AUTOMATION.md).
+#
+# Deterministic gates first (each fails with actionable links):
+#   * the tag is a final vX.Y.Z (input is normalized: `0.7.0` -> `v0.7.0`)
+#     with an unpublished draft release; a draft whose tag binding was lost
+#     to a web-UI edit (tag_name became `untagged-…`) is rebound automatically,
+#   * PyPI serves all three lockstep packages at the version (never advertise
+#     a release that isn't installable),
+#   * the auto/changelog/vX.Y.Z CHANGELOG PR isn't sitting open.
+# The docs sweep (open PRs against omnigent-site's X.Y-docs staging branch) is
+# ADVISORY only: it lists what is still unmerged but never blocks the publish —
+# docs can land after the release, any time before the docs-publish PR merges.
+#
+# The publish job binds the `publish-release` environment (one-time setup:
+# create it in repo settings with required reviewers). Approving it is the
+# human attestation "I reviewed the draft notes". The publish itself uses the
+# App token — GITHUB_TOKEN-published releases emit no `release: published`
+# event, and publish-changelog.yml + update-homebrew.yml hang off it — and
+# sets make_latest explicitly, which API publishes don't do on their own.
+#
+# rc tags never finalize: their drafts deliberately stay unpublished.
+name: Finalize release
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Final release tag to publish as Latest, e.g. v0.6.0."
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: finalize-release-${{ inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  # Maintainer-only, same gate as release.yml.
+  authorize:
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require admin/maintain role
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          role="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq .role_name)"
+          case "$role" in
+            admin|maintain)
+              echo "Dispatcher ${ACTOR} has role ${role} — authorized." | tee -a "$GITHUB_STEP_SUMMARY" ;;
+            *)
+              echo "::error::Release workflows require the admin or maintain role (dispatcher ${ACTOR} has '${role}')."
+              exit 1 ;;
+          esac
+
+  checks:
+    needs: authorize
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      release_id: ${{ steps.draft.outputs.release_id }}
+      already_published: ${{ steps.draft.outputs.already_published }}
+      tag: ${{ steps.tag.outputs.tag }}
+    steps:
+      - name: Require a final vX.Y.Z tag
+        id: tag
+        env:
+          RAW_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          # Normalize the input: trim whitespace, add the leading v if omitted
+          # (`0.7.0` -> `v0.7.0`), so a bare version doesn't fail the dispatch.
+          TAG="$(printf '%s' "$RAW_TAG" | tr -d '[:space:]')"
+          case "$TAG" in v*) ;; *) TAG="v${TAG}" ;; esac
+          if ! [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::${RAW_TAG} is not a final vX.Y.Z tag — rc/dev/pre releases never finalize."
+            exit 1
+          fi
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
+      # Drafts are invisible to read-only tokens and unaddressable by tag
+      # (the get-by-tag endpoint 404s on drafts) — resolve by listing with the
+      # App token, same as draft-release-notes.yml. Scoped to BOTH repos: an
+      # installation token cannot reach outside its grant, and the docs sweep
+      # below queries omnigent-site.
+      - name: Mint App token (omnigent + omnigent-site)
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent,omnigent-site
+
+      - name: Resolve the draft release
+        id: draft
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          match="$(gh api "repos/${GITHUB_REPOSITORY}/releases" --paginate \
+            --jq 'map(select(.tag_name == env.TAG)) | first // empty')"
+          if [ -z "$match" ]; then
+            # Editing a draft in the web UI can silently drop its tag binding
+            # (tag_name becomes `untagged-…` while the name stays vX.Y.Z; bit
+            # v0.5.0 and v0.7.0). Recover: match the DRAFT by name and rebind —
+            # only ever onto a tag that already exists, so publishing can never
+            # mint a new tag at main.
+            match="$(gh api "repos/${GITHUB_REPOSITORY}/releases" --paginate \
+              --jq 'map(select(.draft == true and .name == env.TAG)) | first // empty')"
+            if [ -n "$match" ]; then
+              if ! gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq .object.sha >/dev/null 2>&1; then
+                echo "::error::Draft named ${TAG} exists but the git tag does not — push the tag before finalizing."
+                exit 1
+              fi
+              rebind_id="$(printf '%s' "$match" | jq -r '.id')"
+              gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${rebind_id}" \
+                -f tag_name="$TAG" > /dev/null
+              match="$(gh api "repos/${GITHUB_REPOSITORY}/releases/${rebind_id}")"
+              echo "Rebound draft ${rebind_id} to ${TAG} (tag binding was lost, usually to a web-UI edit)." \
+                | tee -a "$GITHUB_STEP_SUMMARY"
+            fi
+          fi
+          if [ -z "$match" ]; then
+            echo "::error::No GitHub release found for ${TAG}. Did the tag push run github-release.yml?"
+            exit 1
+          fi
+          is_draft="$(printf '%s' "$match" | jq -r '.draft')"
+          release_id="$(printf '%s' "$match" | jq -r '.id')"
+          already_published=false
+          if [ "$is_draft" != "true" ]; then
+            already_published=true
+            echo "Release ${TAG} is already published — nothing to do (idempotent no-op)." \
+              | tee -a "$GITHUB_STEP_SUMMARY"
+          fi
+          {
+            echo "release_id=${release_id}"
+            echo "already_published=${already_published}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Assert PyPI serves all three packages
+        if: steps.draft.outputs.already_published != 'true'
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          version="${TAG#v}"
+          for pkg in omnigent omnigent-client omnigent-ui-sdk; do
+            if ! curl -fsS "https://pypi.org/pypi/${pkg}/${version}/json" >/dev/null; then
+              echo "::error::${pkg}==${version} is not on PyPI — run the secure-repo publish first (never advertise an uninstallable release)."
+              exit 1
+            fi
+            echo "PyPI OK: ${pkg}==${version}"
+          done
+
+      - name: Assert the CHANGELOG PR is not open
+        if: steps.draft.outputs.already_published != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          open_pr="$(gh pr list --repo "$GITHUB_REPOSITORY" --head "auto/changelog/${TAG}" \
+            --state open --json url --jq '.[0].url // empty')"
+          if [ -n "$open_pr" ]; then
+            echo "::error::The CHANGELOG PR for ${TAG} is still open — merge it first: ${open_pr}"
+            exit 1
+          fi
+          echo "CHANGELOG PR for ${TAG}: merged or not needed."
+
+      # Advisory only: docs frequently land after the release. The list tells
+      # the coordinator what must merge into X.Y-docs before the docs-publish
+      # PR does — it never blocks the publish itself.
+      - name: Docs sweep — list open PRs against the X.Y-docs staging branch
+        if: steps.draft.outputs.already_published != 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          TAG: ${{ steps.tag.outputs.tag }}
+          SITE_REPO: ${{ github.repository_owner }}/omnigent-site
+        run: |
+          set -euo pipefail
+          version="${TAG#v}"
+          docs_branch="${version%.*}-docs"
+          open="$(gh pr list --repo "$SITE_REPO" --base "$docs_branch" --state open \
+            --json url,title --jq '.[] | "- \(.url)  \(.title)"')"
+          if [ -n "$open" ]; then
+            count="$(printf '%s\n' "$open" | grep -c .)"
+            {
+              echo "## Docs sweep for ${TAG} — ${count} open PR(s) still target \`${docs_branch}\`"
+              echo ""
+              echo "Advisory, not blocking. Merge/close these before merging the docs-publish PR:"
+              echo "$open"
+            } | tee -a "$GITHUB_STEP_SUMMARY"
+            echo "::warning::${count} open doc PR(s) still target ${docs_branch} (non-blocking) — see the run summary."
+          else
+            echo "Docs sweep clean: no open PRs against ${docs_branch}." | tee -a "$GITHUB_STEP_SUMMARY"
+          fi
+
+  # Approving this environment attests "I reviewed the curated draft notes".
+  publish:
+    needs: [authorize, checks]
+    if: needs.checks.outputs.already_published != 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: publish-release
+    steps:
+      - name: Mint App token (omnigent)
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent
+
+      - name: Publish the draft as Latest
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          TAG: ${{ needs.checks.outputs.tag }}
+          RELEASE_ID: ${{ needs.checks.outputs.release_id }}
+        run: |
+          set -euo pipefail
+          # Edit by id (drafts 404 by tag). -F sends real booleans; make_latest
+          # must be explicit — API publishes don't set it.
+          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/releases/${RELEASE_ID}" \
+            -F draft=false -f make_latest=true > /dev/null
+          {
+            echo "## Published ${TAG} as Latest"
+            echo ""
+            echo "The \`release: published\` event now fires (App-token publish):"
+            echo "- **publish-changelog.yml** opens the omnigent-site release-post PR and the docs-publish PR — review and merge both."
+            echo "- **update-homebrew.yml** opens the homebrew-tap bump PR — review the resource diff, then apply the \`pr-pull\` label."
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/flake-stress-e2e.yml

@@ -238,22 +238,26 @@ jobs:
         # executor adapters import at collection time.
         run: uv sync --extra all --extra dev
 
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
+
       - name: Install binary dependencies
         # Mirrors e2e.yml. ripgrep: Grep fallback for inner tests. tmux +
         # bubblewrap: the e2e runner runs real agents under the linux_bwrap
         # sandbox, which fails loud if `bwrap` is missing. The apparmor
         # sysctl mirrors ci.yml (Ubuntu 24.04 blocks unprivileged user
-        # namespaces, which bwrap's unshare(CLONE_NEWUSER) needs). npm install
-        # with --ignore-scripts blocks postinstall; the claude-code stub needs
-        # its audited install.cjs run explicitly (platform detect + same-tree
-        # hardlink, no network/exec) for claude-sdk harness rows.
-        working-directory: .github/ci-deps
+        # namespaces, which bwrap's unshare(CLONE_NEWUSER) needs). pnpm
+        # install with --ignore-scripts blocks postinstall; the claude-code
+        # stub needs its audited install.cjs run explicitly (platform detect +
+        # same-tree hardlink, no network/exec) for claude-sdk harness rows.
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
           sudo apt-get update
           sudo apt-get install -y ripgrep tmux bubblewrap
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-          npm install --ignore-scripts
-          node node_modules/@anthropic-ai/claude-code/install.cjs
+          pnpm install --frozen-lockfile --ignore-scripts --filter e2e-ci-deps
+          node .github/ci-deps/node_modules/@anthropic-ai/claude-code/install.cjs
           echo "${GITHUB_WORKSPACE}/.github/ci-deps/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Run pytest target
@@ -274,7 +278,7 @@ jobs:
           # low-quota gpt-5-4 model, so sustained 429s don't masquerade as
           # flakes (mirrors e2e.yml).
           OMNIGENT_TEST_MODEL_SPREAD: "1"
-          OMNIGENT_TEST_MODEL_POOL_GPT: "databricks-gpt-5-5,databricks-gpt-5-4-mini"
+          OMNIGENT_TEST_MODEL_POOL_GPT: ${{ vars.OMNIGENT_CI_E2E_MODEL_POOL_GPT }}
         run: |
           mkdir -p artifacts "artifacts/basetemp-${{ matrix.attempt }}"
           # --junitxml emits per-test results eagerly so diagnostics survive a

.github/workflows/flake-stress-ui.yml

@@ -162,8 +162,8 @@ jobs:
         with:
           python-version-file: ".python-version"
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -222,20 +222,20 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Install Claude Code CLI
         # Pinned to match e2e-ui.yml (2.1.170 recognises the native bridge
-        # hook events). --ignore-scripts then run the audited install.cjs.
+        # hook events). Runs lifecycle scripts so the platform-specific binary
+        # is linked and put on PATH.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
-          node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Install Codex CLI
         # @openai/codex pinned to match e2e-ui.yml; goal-mode app-server APIs
@@ -243,9 +243,10 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
+          CODEX_CLI_DIR="${RUNNER_TEMP}/omnigent-codex-cli"
+          mkdir -p "$CODEX_CLI_DIR" && cd "$CODEX_CLI_DIR"
           npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
-          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CODEX_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Run pytest target
         # Inputs validated by prep. Word-splitting on $TEST_TARGET / $EXTRA_ARGS

.github/workflows/github-release.yml

@@ -28,7 +28,10 @@ on:
   push:
     tags:
       # Version tags only (v0.2.0, v0.2.0rc1, …) — `v[0-9]*` avoids triggering
-      # on non-release tags like `v-infra-*`.
+      # on non-release tags like `v-infra-*`. Pre-release tags (rcN / devN /
+      # preN) still match the glob but are skipped in the job below — no
+      # GitHub release is created for them; their installable artifacts live
+      # only on PyPI, and a curated release page is reserved for the final cut.
       - "v[0-9]*"
 
 # Least privilege: creating a release requires `contents: write`; nothing here
@@ -43,9 +46,30 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      - name: Skip pre-release tags (rcN / devN / preN)
+        id: tag
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          # Pre-release tags (rcN / devN / preN) get NO GitHub release — they
+          # live on PyPI only, and a curated release page is reserved for the
+          # final cut. The tag glob above still matches them, so gate here.
+          # A trailing digit is required so a substring like 'dev' or 'pre' in a
+          # mistyped tag name can't trigger a skip by accident.
+          case "$TAG" in
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*)
+              echo "Pre-release tag ${TAG} — not creating a GitHub release (rc/dev/pre releases live on PyPI only)." \
+                | tee -a "$GITHUB_STEP_SUMMARY"
+              echo "skip=true" >> "$GITHUB_OUTPUT" ;;
+            *)
+              echo "skip=false" >> "$GITHUB_OUTPUT" ;;
+          esac
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        if: steps.tag.outputs.skip != 'true'
 
       - name: Draft release with a placeholder body
+        if: steps.tag.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ github.ref_name }}
@@ -57,20 +81,11 @@ jobs:
             echo "Release $TAG already exists — skipping." | tee -a "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
-          # rc / dev / alpha / beta tags are flagged as pre-releases.
-          pre=""
-          case "$TAG" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) pre="--prerelease" ;;
-          esac
-          # $pre is intentionally UNQUOTED: it word-splits to nothing when empty,
-          # and is only ever "" or "--prerelease" (set just above, never from
-          # external input). Quoting it would pass an empty positional arg.
           gh release create "$TAG" \
             --repo "$GITHUB_REPOSITORY" \
             --draft \
             --verify-tag \
             --notes "_Release notes are being drafted automatically — check back shortly._" \
-            --title "$TAG" \
-            $pre
+            --title "$TAG"
           echo "Drafted release $TAG — curated notes will be filled in by draft-release-notes.yml; review and publish from the Releases page." \
             | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/homebrew-tap-pr.yml

@@ -0,0 +1,200 @@
+name: Homebrew tap PR
+
+# When a final GitHub Release is PUBLISHED, open a PR to
+# omnigent-ai/homebrew-tap bumping the `omnigent` formula to the released
+# version. The PR regenerates the stable `url`/`sha256` and every dependency
+# `resource` stanza from the PyPI dependency tree of the just-published
+# `omnigent==X.Y.Z` (resolved with `uv pip compile` for the tap's macOS
+# arm/intel build matrix), splices them into the hand-tuned template at
+# `.github/scripts/homebrew/omnigent.rb.template`, and pushes a branch for
+# review. The tap's own `brew test-bot` then builds the bottles; a maintainer
+# labels the PR `pr-pull` so the tap's `brew pr-pull` workflow commits the
+# `bottle do` block and merges (see the tap's `.github/workflows/`).
+#
+# We trigger on `release: published` (not the tag push) for the same reason as
+# publish-changelog.yml: that's the moment the version is installable from PyPI
+# — the secure-release repo publishes to PyPI before the GitHub Release goes
+# public (see RELEASING.md), so the sdist we pin the formula to actually exists.
+#
+# Cross-repo writes can't use the workflow's own GITHUB_TOKEN (scoped to this
+# repo), so we mint a short-lived token from the omnigent-ci GitHub App scoped to
+# homebrew-tap — the same App used by publish-changelog.yml / doc-sync.yml. One
+# prerequisite: the omnigent-ci App must be installed on omnigent-ai/homebrew-tap
+# with contents:write + pull-requests:write.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Final release tag to (re)open the tap PR for, e.g. v0.3.0
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+# Serialize per tag so two triggers can't race the same formula PR.
+concurrency:
+  group: homebrew-tap-pr-${{ github.event.release.tag_name || inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    name: Resolve release tag
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.r.outputs.tag }}
+      version: ${{ steps.r.outputs.version }}
+      is_final: ${{ steps.r.outputs.is_final }}
+    steps:
+      - name: Resolve tag, version, and finality
+        id: r
+        env:
+          EVENT_TAG: ${{ github.event.release.tag_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          set -euo pipefail
+          tag="${INPUT_TAG:-$EVENT_TAG}"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
+          is_final=true
+          # Only final vX.Y.Z tags; exclude rcN/devN/preN pre-releases and
+          # the event's prerelease flag (homebrew users get stable releases).
+          case "$tag" in
+            v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) is_final=false ;;
+          esac
+          case "$tag" in
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*|*a[0-9]*|*b[0-9]*) is_final=false ;;
+          esac
+          if [ "${PRERELEASE}" = "true" ]; then is_final=false; fi
+          echo "is_final=${is_final}" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag=${tag} is_final=${is_final}" | tee -a "$GITHUB_STEP_SUMMARY"
+
+  pr:
+    name: Open homebrew-tap formula PR
+    needs: resolve
+    runs-on: ubuntu-latest
+    # Canonical repo only — forks/mirrors have no PyPI release or the App token.
+    if: needs.resolve.outputs.is_final == 'true' && github.repository == 'omnigent-ai/omnigent'
+    env:
+      TAG: ${{ needs.resolve.outputs.tag }}
+      VERSION: ${{ needs.resolve.outputs.version }}
+      TAP_REPO: ${{ github.repository_owner }}/homebrew-tap
+      BRANCH: auto/formula/${{ needs.resolve.outputs.tag }}
+    steps:
+      - name: Checkout omnigent (template + generator)
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: false
+
+      - name: Wait for the released sdist to land on PyPI
+        # The GitHub Release is published after the prod PyPI publish, but the
+        # secure-release publish can lag a few minutes; poll so a slightly-early
+        # release (or a rerun right at publish time) doesn't fail the whole job.
+        run: |
+          set -euo pipefail
+          python3 - "$VERSION" <<'PY'
+          import json, sys, time, urllib.request
+          ver = sys.argv[1]
+          url = f"https://pypi.org/pypi/omnigent/{ver}/json"
+          deadline = time.time() + 15 * 60
+          while time.time() < deadline:
+              try:
+                  with urllib.request.urlopen(url, timeout=20) as r:
+                      data = json.load(r)
+                  if any(f.get("packagetype") == "sdist" for f in data.get("urls", [])):
+                      print(f"omnigent=={ver} sdist is on PyPI.")
+                      sys.exit(0)
+              except Exception as e:
+                  print(f"waiting for {url}: {e}")
+              time.sleep(30)
+          print(f"::error::omnigent=={ver} sdist not found on PyPI after 15m")
+          sys.exit(1)
+          PY
+
+      - name: Generate the formula
+        run: |
+          set -euo pipefail
+          python3 .github/scripts/homebrew/generate_formula.py \
+            --version "$VERSION" \
+            --template .github/scripts/homebrew/omnigent.rb.template \
+            --out /tmp/omnigent.rb
+          {
+            echo "### Generated \`Formula/omnigent.rb\` for $TAG"
+            echo '```ruby'
+            cat /tmp/omnigent.rb
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Mint homebrew-tap App token
+        id: app-token
+        if: vars.OMNIGENT_BOT_APP_ID != ''
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: homebrew-tap
+
+      - name: Checkout homebrew-tap (PR target)
+        if: steps.app-token.outputs.token != ''
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: ${{ env.TAP_REPO }}
+          token: ${{ steps.app-token.outputs.token }}
+          path: tap
+
+      - name: Open or update the formula PR
+        if: steps.app-token.outputs.token != ''
+        working-directory: tap
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          set -euo pipefail
+          mkdir -p Formula
+          cp /tmp/omnigent.rb Formula/omnigent.rb
+
+          if [ -z "$(git status --porcelain -- Formula/omnigent.rb)" ]; then
+            echo "Formula already at $TAG — nothing to do." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+          git switch -C "$BRANCH"
+          git add Formula/omnigent.rb
+          git commit -m "omnigent $VERSION"
+          git push --force origin "$BRANCH"
+
+          if [ -n "$(gh pr list --repo "$TAP_REPO" --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
+            echo "Formula PR already open for $BRANCH — force-push updated it." \
+              | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          body="$(printf 'Bumps the **omnigent** formula to **%s**.\n\nRegenerates the stable `url`/`sha256` and every `resource` stanza from the PyPI dependency tree of `omnigent==%s` (resolved with `uv pip compile` for macOS arm + intel), spliced into the hand-tuned template in `omnigent-ai/omnigent` (`.github/scripts/homebrew/omnigent.rb.template`). The structural parts (`depends_on`, `install`, `test`) are unchanged.\n\nOnce `brew test-bot` builds the bottles, label this PR **`pr-pull`** so the tap'"'"'s `brew pr-pull` workflow commits the `bottle do` block and merges.\n\nGenerated by `omnigent-ai/omnigent` `.github/workflows/homebrew-tap-pr.yml` on the **%s** release.' "$VERSION" "$VERSION" "$TAG")"
+          gh pr create \
+            --repo "$TAP_REPO" \
+            --base main \
+            --head "$BRANCH" \
+            --title "omnigent $VERSION" \
+            --body "$body"
+
+      - name: Note skipped (no App token)
+        if: steps.app-token.outputs.token == ''
+        run: |
+          echo "::warning::OMNIGENT_BOT_APP_ID/KEY missing, or the omnigent-ci App isn't installed on $TAP_REPO with contents:write + pull-requests:write. The formula was generated (see the job summary) but the PR was not opened."
+          echo "### Homebrew tap PR skipped" >> "$GITHUB_STEP_SUMMARY"
+          echo "The omnigent-ci App token couldn't be minted — install the App on \`$TAP_REPO\` with contents:write + pull-requests:write and rerun." >> "$GITHUB_STEP_SUMMARY"

.github/workflows/issue-triage.yml

@@ -179,10 +179,14 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Set LLM credentials
         if: steps.creds.outputs.available == 'true'
@@ -210,7 +214,9 @@ jobs:
         if: steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_AGENT_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
         run: |
+          : "${OMNIGENT_AGENT_MODEL:?Set OMNIGENT_CI_FAST_ANTHROPIC_MODEL}"
           mkdir -p "$HOME/.omnigent"
           python3 -c "
           import pathlib, os, json
@@ -224,7 +230,7 @@ jobs:
                       'anthropic': {
                           'base_url': gw + '/anthropic',
                           'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-sonnet-4-6'},
+                          'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
                       },
                   }
               }

.github/workflows/lint.yml

@@ -1,9 +1,10 @@
 name: Lint
 
-# Runs the project's pre-commit hooks (ruff, mypy, custom anti-pattern grep
-# hooks, etc.) on every non-draft PR and on push to main. Surfaces as the
-# `Pre-commit checks` check, a REQUIRED gate entry in merge-ready.yml. Draft PRs
-# are skipped; `ready_for_review` refires so the check doesn't strand pending.
+# Runs the project's pre-commit hooks (ruff, Pyrefly, TypeScript lint, custom
+# anti-pattern grep hooks, etc.) on every non-draft PR and on push to main.
+# Surfaces as the `Pre-commit checks` check, a REQUIRED gate entry in
+# merge-ready.yml. Draft PRs are skipped; `ready_for_review` refires so the
+# check doesn't strand pending.
 
 on:
   pull_request:
@@ -11,6 +12,9 @@ on:
   push:
     branches:
       - main
+      # Release branches: release.yml's green-CI gate reads check runs off the
+      # branch head, so cherry-picks and release-bump commits must run checks.
+      - 'release/v[0-9]*'
 
 permissions:
   contents: read
@@ -73,35 +77,40 @@ jobs:
         # a stale lockfile). Fix locally with `uv lock`.
         run: uv sync --locked --extra dev
 
-      # Sets up Node 20 and pins npm to the same major that regenerates
-      # the lockfile in the OSS-regen workflows, so the freshness gate
-      # below doesn't flake on npm version-skew churn.
-      - name: Set up Node.js
-        uses: ./.github/actions/setup-node
+      # Sets up Node 20 + pnpm, with pnpm dependency caching keyed on the
+      # workspace lockfile. pnpm is pinned in .github/actions/setup-pnpm.
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install web dependencies
-        working-directory: web
-        # Pin the npm registry to the npmjs default.
+        # Pin the npm registry to the npmjs default; limit to the web package
+        # so Electron's large native devDependencies are not fetched.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
-        run: npm ci --legacy-peer-deps
+        run: pnpm install --frozen-lockfile --filter web
 
-      # The npm equivalent of the `uv sync --locked` gate above. `npm ci`
-      # only checks the lockfile is CONSISTENT with package.json; it
-      # tolerates cosmetic drift (dev/extraneous flags, metadata) that a
-      # fresh resolution would rewrite. Regenerate the lockfile and fail
-      # if it differs from the committed one.
-      - name: Check web/package-lock.json is up to date
-        working-directory: web
+      # The pnpm equivalent of the `uv sync --locked` gate above.
+      # `pnpm install --frozen-lockfile` only checks the lockfile is CONSISTENT
+      # with package.json; it tolerates cosmetic drift that a fresh resolution
+      # would rewrite. Regenerate the lockfile and fail if it differs from the
+      # committed one.
+      - name: Check pnpm-lock.yaml is up to date
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund
-          git diff --exit-code package-lock.json || {
-            echo "::error::web/package-lock.json is out of date. Run 'npm install --package-lock-only --legacy-peer-deps' in web/ and commit the result."
+          pnpm install --lockfile-only
+          git diff --exit-code pnpm-lock.yaml || {
+            echo "::error::pnpm-lock.yaml is out of date. Run 'pnpm install --lockfile-only' at the repo root and commit the result."
             exit 1
           }
 
+      # A `--frozen-lockfile` / lockfile-regen gate can't catch an override that
+      # pins a version outside a package.json range: overrides outrank
+      # package.json, so the declared version is silently ignored and the lock
+      # stays internally consistent for the pin. Check overrides directly.
+      - name: Check pnpm overrides satisfy declared ranges
+        run: .venv/bin/python dev/lint/lint_pnpm_override_consistency.py
+
       # ktlint is invoked by the android-ktlint-* pre-commit hooks. The wrapper
       # script (web/android/bin/ktlint.sh) exits 0 if ktlint is absent, so we
       # install it here before pre-commit runs to ensure the check is enforced.
@@ -119,9 +128,28 @@ jobs:
           chmod +x /tmp/ktlint
           sudo mv /tmp/ktlint /usr/local/bin/ktlint
 
-      - name: Run formatting, lint, and typing checks
+      - name: Run formatting, lint, and type checks
         run: uv run pre-commit run --all-files --show-diff-on-failure
 
-      - name: Type-check web
-        working-directory: web
-        run: npm run type-check
+  # The four packages release in lockstep (identical versions + `==` sibling
+  # pins). Assert agreement on every change so drift from a bad merge or
+  # cherry-pick — however it happened — is caught before it reaches a release.
+  version-lockstep:
+    name: Version lockstep check
+    needs: gate
+    if: ${{ !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: All version locations agree
+        run: |
+          python -m pip install --quiet --disable-pip-version-check packaging
+          python scripts/update_versions.py check

.github/workflows/merge-ready.yml

@@ -27,7 +27,9 @@ on:
   pull_request_target:
     types: [labeled]
   workflow_run:
-    workflows: [PR Template, CI, Lint, Docker build, E2E UI Tests, E2E Tests, Integration Tests]
+    workflows: [PR Template, CI, Lint, Docker build, E2E UI Tests, E2E Tests, Integration Tests, UI Snapshot]
+    types: [completed]
+  check_run:
     types: [completed]
   issue_comment:
     types: [created]
@@ -48,7 +50,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: merge-ready-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr || github.event.workflow_run.head_sha }}
+  group: merge-ready-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr || github.event.workflow_run.head_sha || github.event.check_run.head_sha }}
   cancel-in-progress: true
 
 jobs:
@@ -61,8 +63,9 @@ jobs:
       actions: read         # evaluate-checks.sh reads GET /actions/runs to classify missing checks
       statuses: write
     # Fire on automerge label adds, PR CI workflow_run completions (same-repo
-    # and fork), `/merge` comments, or a workflow_dispatch re-eval. Runs with no
-    # open PR (push to main, etc.) are dropped by the ctx step.
+    # and fork), DCO check_run completions, `/merge` comments, or a
+    # workflow_dispatch re-eval. Runs with no open PR (push to main, etc.) are
+    # dropped by the ctx step.
     if: >-
       (
         github.event_name == 'pull_request_target' &&
@@ -72,6 +75,11 @@ jobs:
         github.event_name == 'workflow_run' &&
         github.event.workflow_run.event == 'pull_request'
       ) ||
+      (
+        github.event_name == 'check_run' &&
+        github.event.check_run.name == 'DCO' &&
+        github.event.check_run.app.slug == 'dco'
+      ) ||
       github.event_name == 'workflow_dispatch' ||
       (
         github.event_name == 'issue_comment' &&
@@ -102,6 +110,7 @@ jobs:
           # Via env, not interpolated: author-controlled, so direct
           # interpolation would be a shell-injection vector.
           WF_PRS: ${{ toJSON(github.event.workflow_run.pull_requests) }}
+          CHECK_RUN_SHA: ${{ github.event.check_run.head_sha }}
           COMMENT_BODY: ${{ github.event.comment.body }}
           PR_INPUT: ${{ inputs.pr }}
           SHA_INPUT: ${{ inputs.sha }}
@@ -142,6 +151,14 @@ jobs:
             fi
             PR="${{ github.event.issue.number }}"
             SHA=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')
+          elif [[ "${{ github.event_name }}" == "check_run" ]]; then
+            SHA="$CHECK_RUN_SHA"
+            PR=$(resolve_pr_from_sha "$SHA")
+            if [[ -z "$PR" ]]; then
+              echo "::notice::Skipped: DCO check_run has no associated open PR"
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
           else
             PR=$(echo "$WF_PRS" | jq -r '.[0].number // empty')
             SHA="${{ github.event.workflow_run.head_sha }}"

.github/workflows/nightly-failure-monitor.yml

@@ -7,10 +7,13 @@ name: Nightly Failure Monitor
 # the maintainer; it comments-and-closes that issue when a later nightly is
 # green. A single flake (one red run) is ignored -- the real-LLM legs are
 # 429-sensitive -- so only a sustained break pages.
+#
+# Nightly Release is watched for the same reason: it is fully unattended, so a
+# broken cut blocks nobody and consumers just silently stop getting new builds.
 
 on:
   workflow_run:
-    workflows: ["E2E Tests", "E2E UI Tests"]
+    workflows: ["E2E Tests", "E2E UI Tests", "Nightly Release"]
     types: [completed]
 
 permissions:

.github/workflows/nightly-release.yml

@@ -0,0 +1,259 @@
+# Cut the nightly prerelease build: a stamped, tagged snapshot of main.
+#
+# Every night (or on manual dispatch) this picks the newest commit on main
+# with green CI, stamps the lockstep version to `X.Y.Z.devYYYYMMDD` (today's
+# UTC date appended to main's `X.Y.Z.dev0` line), commits that stamp DETACHED
+# on top of the base commit, tags it `vX.Y.Z.devYYYYMMDD`, and pushes ONLY the
+# tag with the omnigent-ci App token (GITHUB_TOKEN-pushed tags fire no
+# workflows; the image build hangs off the tag push).
+#
+# Deliberately NOT the release.yml flow: no release/vX.Y branch is created,
+# bump-version.yml is never dispatched (a nightly must not walk main's
+# version), and there is no benchmark gate (benchmark.yml already measures
+# main nightly). Downstream is already quiet for dev tags: github-release.yml
+# and draft-release-notes.yml skip `*dev[0-9]*` tags, update-check ignores
+# dev releases, a default `pip install` never resolves them, and
+# oss-publish-images.yml publishes the immutable
+# `:vX.Y.Z.devYYYYMMDD` image (only `:latest-rc` follows it, by design).
+#
+# The datestamp is FIXED-WIDTH (YYYYMMDD, one nightly per UTC day): PEP 440
+# compares the dev segment as a plain integer, so a longer stamp would sort
+# above every shorter one forever. A same-day re-run finds the tag and no-ops.
+#
+# Nightlies are NOT published to PyPI. Consumers install straight from the
+# tag with uv (scripts/update_nightly.sh resolves and installs the newest
+# one), which pins all lockstep packages to the tagged commit.
+name: Nightly Release
+
+on:
+  schedule:
+    # 04:30 UTC: after the 00:00 UTC scheduled suites drain, well before the
+    # 07:00 UTC image rebuild (its concurrency is per-SHA, so a tag build
+    # racing it would cold-race the layer cache).
+    - cron: "30 4 * * *"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Plan only: print the base commit and version, push nothing."
+        required: false
+        type: boolean
+        default: true
+
+# Nothing here writes with GITHUB_TOKEN; the tag push uses the App token.
+permissions:
+  contents: read
+
+# Share release.yml's group: a nightly cut must never interleave with a real
+# release dispatch.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  plan:
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      base_sha: ${{ steps.resolve.outputs.base_sha }}
+      version: ${{ steps.resolve.outputs.version }}
+      tag: ${{ steps.resolve.outputs.tag }}
+      should_cut: ${{ steps.resolve.outputs.should_cut }}
+    steps:
+      # Manual dispatches are maintainer-only, same rule as release.yml.
+      # Scheduled runs have no meaningful actor and skip the check.
+      - name: Require admin/maintain role (dispatch only)
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          role="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq .role_name)"
+          case "$role" in
+            admin|maintain)
+              echo "Dispatcher ${ACTOR} has role ${role} — authorized." | tee -a "$GITHUB_STEP_SUMMARY" ;;
+            *)
+              echo "::error::Nightly dispatches require the admin or maintain role (dispatcher ${ACTOR} has '${role}')."
+              exit 1 ;;
+          esac
+
+      - name: Checkout main history and tags
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Resolve base commit, version, and whether to cut
+        id: resolve
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          DRY_RUN_INPUT: ${{ inputs.dry_run }}
+        run: |
+          set -euo pipefail
+
+          # Boolean inputs arrive as strings on CLI dispatches and are empty
+          # on schedule — gate in shell, not in `if:` expressions. A schedule
+          # fire is always a real run; a dispatch is dry unless explicitly not.
+          if [ "$EVENT_NAME" = "workflow_dispatch" ] && [ "$DRY_RUN_INPUT" != "false" ]; then
+            dry_run=true
+          else
+            dry_run=false
+          fi
+
+          # Walk main newest-first to the first commit whose CI is complete
+          # and green. A fixed-hour cron can't demand HEAD be green (the last
+          # merge of the day is often mid-CI); walking back keeps the nightly
+          # cadence without ever building a red commit. Check runs from this
+          # workflow's own runs are excluded (a schedule run parks a pending
+          # check on the HEAD it triggered from — it must not mask HEAD).
+          base_sha=""
+          for sha in $(git rev-list -n 20 origin/main); do
+            own_runs="$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/nightly-release.yml/runs?head_sha=${sha}&per_page=100" \
+              --jq '.workflow_runs[].id' 2>/dev/null | paste -sd, -)"
+            runs="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${sha}/check-runs?per_page=100" \
+              --paginate --jq '.check_runs[] | [.name, .status, .conclusion // "-", .details_url] | @tsv')"
+            runs="$(printf '%s' "$runs" | awk -F'\t' -v rel="$own_runs" '
+              BEGIN { n=split(rel, a, ","); for (i=1; i<=n; i++) if (a[i]!="") own[a[i]]=1 }
+              { o=0; for (r in own) if (index($4, "/runs/" r "/")) { o=1; break }
+                if (!o) print $1 "\t" $2 "\t" $3 }')"
+            total="$(printf '%s' "$runs" | grep -c . || true)"
+            pending="$(printf '%s' "$runs" | awk -F'\t' '$2 != "completed"' || true)"
+            bad="$(printf '%s' "$runs" | awk -F'\t' '$3 ~ /^(failure|timed_out|action_required|startup_failure)$/' || true)"
+            if [ "$total" -gt 0 ] && [ -z "$bad" ] && [ -z "$pending" ]; then
+              base_sha="$sha"
+              break
+            fi
+            echo "skipping ${sha}: $([ "$total" -eq 0 ] && echo 'no check runs' || { [ -n "$bad" ] && echo 'failing checks' || echo 'checks still running'; })"
+          done
+
+          should_cut=false
+          version=""
+          tag=""
+          reason=""
+          if [ -z "$base_sha" ]; then
+            reason="no commit with completed green CI in the newest 20 on main"
+          else
+            # Main must carry the `X.Y.Z.dev0` marker (the repo's versioning
+            # invariant). The nightly replaces the dev segment with today's
+            # UTC date; anything else on main is a broken state to fail loudly on.
+            main_version="$(git show "${base_sha}:pyproject.toml" | sed -n 's/^version = "\(.*\)"$/\1/p' | head -1)"
+            if ! [[ "$main_version" =~ ^([0-9]+\.[0-9]+\.[0-9]+)\.dev0$ ]]; then
+              echo "::error::main's version at ${base_sha} is '${main_version}', expected X.Y.Z.dev0 — refusing to derive a nightly version."
+              exit 1
+            fi
+            version="${BASH_REMATCH[1]}.dev$(date -u +%Y%m%d)"
+            tag="v${version}"
+
+            if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
+              reason="tag ${tag} already exists (nightly already cut today)"
+            else
+              # Skip quiet nights: the newest nightly tag's commit is the
+              # stamp on top of its base, so parent = the base it built. If
+              # our base is that commit (or older, after a red-HEAD walk),
+              # there is nothing new to ship.
+              last_tag="$(git for-each-ref --sort=-creatordate --format='%(refname:short)' 'refs/tags/v[0-9]*' \
+                | grep -E '\.dev[0-9]{8}$' | head -1 || true)"
+              if [ -n "$last_tag" ] && { [ "$base_sha" = "$(git rev-parse "${last_tag}^")" ] \
+                  || git merge-base --is-ancestor "$base_sha" "$(git rev-parse "${last_tag}^")"; }; then
+                reason="no new commits on main since ${last_tag}"
+              elif [ "$dry_run" = "true" ]; then
+                reason="dry run — would cut ${tag} from ${base_sha}"
+              else
+                should_cut=true
+              fi
+            fi
+          fi
+
+          {
+            echo "## Nightly plan"
+            echo ""
+            echo "| | |"
+            echo "| --- | --- |"
+            echo "| Base commit | \`${base_sha:-—}\` |"
+            echo "| Version | \`${version:-—}\` |"
+            echo "| Cutting | ${should_cut} |"
+            [ -n "$reason" ] && echo "| Reason | ${reason} |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          {
+            echo "base_sha=${base_sha}"
+            echo "version=${version}"
+            echo "tag=${tag}"
+            echo "should_cut=${should_cut}"
+          } >> "$GITHUB_OUTPUT"
+
+  cut:
+    needs: plan
+    if: needs.plan.outputs.should_cut == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      # Clean public resolution for `uv lock` — the committed lockfile must
+      # reference https://pypi.org/simple (never a proxy).
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
+    steps:
+      - name: Mint App token (omnigent)
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent
+
+      - name: Checkout base commit
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ needs.plan.outputs.base_sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: false
+
+      - name: Stamp the lockstep version
+        env:
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          set -euo pipefail
+          uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py pre-release --new-version "$VERSION"
+          uv lock
+          # uv may emit non-canonical lockfile fields (e.g. size on file
+          # entries); normalize like the pre-commit fixer, then hard-verify.
+          python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+          python3 scripts/normalize_uv_lock_registry.py --check uv.lock
+          uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py check --expect "$VERSION"
+
+      - name: Commit, tag, and push the tag
+        env:
+          PUSH_TOKEN: ${{ steps.app-token.outputs.token }}
+          TAG: ${{ needs.plan.outputs.tag }}
+        run: |
+          set -euo pipefail
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+
+          # Stage everything the stamp touched: update_versions.py owns the
+          # file set (same staging as release.yml and bump-version.yml).
+          git add -A
+          git commit -s -m "nightly: ${TAG}"
+          git tag "$TAG"
+
+          # Tag only — the stamp commit stays off every branch, reachable via
+          # the tag. The App token push fires the tag-triggered workflows.
+          push_url="https://x-access-token:${PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git push "$push_url" "refs/tags/${TAG}"
+          echo "Pushed ${TAG} at $(git rev-parse HEAD) (base $(git rev-parse HEAD^))." \
+            | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/oss-publish-images.yml

@@ -50,8 +50,10 @@ permissions:
   contents: read
 
 concurrency:
-  # Key by SHA so back-to-back merges each build; don't cancel mid-push.
-  group: oss-publish-images-${{ github.sha }}
+  # One build at a time: rc and final tags land minutes apart at a release cut,
+  # and built concurrently they race each other's layer cache cold and blow the
+  # job timeout. Serialized, the later build reuses the earlier one's layers.
+  group: oss-publish-images
   cancel-in-progress: false
 
 jobs:
@@ -67,9 +69,10 @@ jobs:
     runs-on: ubuntu-latest
     # Multi-arch: the linux/arm64 leg cross-builds under QEMU emulation on this
     # amd64 runner, which roughly doubles the host-image build time (emulated
-    # npm/pip native steps). 30m was tight for two native amd64 builds; give the
-    # four-variant (server+host × amd64+arm64) build headroom.
-    timeout-minutes: 60
+    # npm/pip native steps). A cold-cache four-variant (server+host × amd64+
+    # arm64) build can exceed 60m, and hitting the timeout loses the release's
+    # images silently — give it real headroom.
+    timeout-minutes: 120
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

.github/workflows/oss-regen-on-comment.yml

@@ -1,11 +1,11 @@
 # A maintainer comments `/regen` on a PR to regenerate the repo's lockfiles
-# (uv.lock + web/package-lock.json) against public PyPI/npm and commit them
+# (uv.lock + pnpm-lock.yaml) against public PyPI/npmjs.org and commit them
 # ONTO that PR's branch. Use when the PR itself moved a dependency; complements
 # oss-regenerate-and-smoke.yml (standalone rolling PR on dispatch).
 #
 # Two forms:
-#   /regen                      re-resolve, preserving existing pins.
-#   /regen upgrade <pkg> [pkg]  additionally force uv to take the newest allowed
+#   /regen                      re-resolve BOTH lockfiles, preserving existing pins.
+#   /regen upgrade <pkg> [pkg]  uv.lock ONLY: force uv to take the newest allowed
 #                               version of each named package (uv lock
 #                               --upgrade-package). Use for a transitive pip
 #                               security bump Dependabot can't land on this uv
@@ -164,28 +164,14 @@ jobs:
         with:
           enable-cache: false
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
-      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`), recorded as
-      # a relative span; an env-var cutoff would stamp an absolute date and break
-      # later `uv sync --locked`. npm's cooldown (web/.npmrc min-release-age=7)
-      # is only honored by npm >= 11.10.0; node 20 ships npm 10.x which ignores it.
-      # Pin the EXACT version (not a range) and keep it in lockstep with
-      # .github/actions/setup-node (npm 11.12.1): this workflow generates the
-      # lockfile and that action verifies it, so a version gap would fail the
-      # freshness gate in lint.yml.
-      - name: Ensure npm honors the dependency cooldown
-        run: npm install -g npm@11.12.1
-      # Delete package-lock.json so npm RESOLVES from scratch: min-release-age
-      # only filters during resolution, and --package-lock-only keeps an existing
-      # in-range pin without re-applying the cooldown.
-      # --legacy-peer-deps is REQUIRED and MUST match the flag lint.yml verifies
-      # with (React 18 runtime vs React 19 peers would otherwise ERESOLVE-fail,
-      # and a flag mismatch rewrites dev/extraneous flags, failing the gate).
-      - name: Regenerate lockfiles against public PyPI/npm
+      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`) and from
+      # pnpm-workspace.yaml (`minimumReleaseAge: 10080`), recorded as a relative
+      # span; an env-var cutoff would stamp an absolute date and break later
+      # `uv sync --locked` / `pnpm install --frozen-lockfile`.
+      - name: Regenerate lockfiles against public PyPI/npmjs.org
         env:
           REGEN_MODE: ${{ needs.authorize.outputs.mode }}
           UPGRADE_PKGS: ${{ needs.authorize.outputs.pkgs }}
@@ -203,7 +189,17 @@ jobs:
           else
             uv lock
           fi
-          ( cd web && rm -f package-lock.json && npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund )
+          # uv may emit non-canonical lockfile fields (e.g. size on file
+          # entries); normalize like the pre-commit fixer, then hard-verify.
+          python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+          python3 scripts/normalize_uv_lock_registry.py --check uv.lock
+          # `/regen upgrade <py pkgs>` is a targeted Python bump: leave the npm
+          # lockfile alone so the PR diff stays reviewable. Plain `/regen`
+          # refreshes both lockfiles, as before.
+          if [ "$REGEN_MODE" != "upgrade" ]; then
+            rm -f pnpm-lock.yaml
+            pnpm install --lockfile-only
+          fi
 
       # Mint the App token only AFTER `uv lock` so untrusted PR build backends
       # never see it. Skipped when the App isn't configured (push then falls back
@@ -229,12 +225,12 @@ jobs:
           git config user.name "omnigent-ci[bot]"
           git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
           # --porcelain (not git diff) so first-time UNTRACKED lockfiles count too.
-          if [ -z "$(git status --porcelain -- uv.lock web/package-lock.json)" ]; then
+          if [ -z "$(git status --porcelain -- uv.lock pnpm-lock.yaml)" ]; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
             echo "Lockfiles already current — nothing to commit."
             exit 0
           fi
-          git add uv.lock web/package-lock.json
+          git add uv.lock pnpm-lock.yaml
           git commit -m "chore(oss): regenerate public lockfiles against public PyPI/npm"
           git push "https://x-access-token:${PUSH_TOKEN}@github.com/${REPO}.git" "HEAD:$HEAD_REF"
           echo "changed=true" >> "$GITHUB_OUTPUT"
@@ -256,7 +252,7 @@ jobs:
             upgraded=" (upgraded: $UPGRADE_PKGS)"
           fi
           if [ "$CHANGED" = "true" ]; then
-            base="✅ Regenerated \`uv.lock\`$upgraded + \`web/package-lock.json\` against public PyPI/npm and pushed to this PR."
+            base="✅ Regenerated \`uv.lock\`$upgraded + \`pnpm-lock.yaml\` against public PyPI/npmjs.org and pushed to this PR."
             if [ "$APP_USED" = "true" ]; then
               body="$base CI will re-run on the new commit."
             else

.github/workflows/oss-regenerate-and-smoke.yml

@@ -1,10 +1,15 @@
-# Regenerate the repo's lockfiles against PUBLIC PyPI/npm, then validate via
+# Keep the repo's public lockfiles consistent with the manifests, validated via
 # a Docker build + CLI smoke. Runs on GitHub-hosted ubuntu-latest so resolution
 # sees public registries directly (lockfiles must record public sources, never
 # a proxy). Exists because sync PRs land manifest changes without lockfile
-# updates and the Dockerfile COPYs web/package-lock.json, so the tree is not
-# Docker-buildable until lockfiles are (re)generated here. Runs every 12h (and
-# on manual dispatch); opens a PR with any regenerated lockfiles.
+# updates and the Dockerfile COPYs pnpm-lock.yaml, so the tree is not
+# Docker-buildable until lockfiles are (re)generated here.
+#
+# Check-first: a consistency check (`uv lock --check` / pnpm `--frozen-lockfile`)
+# gates the work. When the lockfiles already satisfy the manifests the job exits
+# clean and opens no PR — even if newer in-range versions exist upstream — so
+# routine transitive drift never becomes a churn PR. Only a real manifest/lock
+# desync triggers regeneration and a PR. Runs every 12h (and on manual dispatch).
 name: OSS regenerate lockfiles + smoke
 
 on:
@@ -40,43 +45,62 @@ jobs:
         with:
           enable-cache: false
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
-      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`), recorded as
-      # a relative span; an env-var cutoff would stamp an absolute date and break
-      # later `uv sync --locked`.
+      # Check-first: does each lockfile already satisfy its manifests? These
+      # checks pass on a consistent-but-not-latest lock, so routine in-range
+      # transitive drift does NOT trigger a regen; only a real manifest/lock
+      # desync (the case this job exists to catch) flips a flag.
+      #
+      # Per-ecosystem flags: gating each regen on its own flag keeps a desync in
+      # one ecosystem from forcing a from-scratch re-resolve of the other, which
+      # would reintroduce the in-range transitive churn this job avoids. `any`
+      # drives the shared token/PR steps below.
+      - name: Check lockfile consistency
+        id: check
+        run: |
+          drifted_uv=false
+          drifted_pnpm=false
+          uv lock --check || drifted_uv=true
+          # --lockfile-only: verify the lock satisfies the manifests without a
+          # full node_modules install; --frozen-lockfile fails on any desync.
+          pnpm install --frozen-lockfile --lockfile-only || drifted_pnpm=true
+          any=false
+          if [ "$drifted_uv" = "true" ] || [ "$drifted_pnpm" = "true" ]; then
+            any=true
+          fi
+          echo "drifted_uv=$drifted_uv" >> "$GITHUB_OUTPUT"
+          echo "drifted_pnpm=$drifted_pnpm" >> "$GITHUB_OUTPUT"
+          echo "drifted=$any" >> "$GITHUB_OUTPUT"
+          echo "uv.lock drifted=$drifted_uv, pnpm-lock.yaml drifted=$drifted_pnpm"
+
+      # 7-day cooldown comes from uv.toml (`exclude-newer = "P7D"`) and from
+      # pnpm-workspace.yaml (`minimumReleaseAge: 10080`), recorded as a relative
+      # span; an env-var cutoff would stamp an absolute date and break later
+      # `uv sync --locked` / `pnpm install --frozen-lockfile`.
       - name: Regenerate uv.lock
+        if: steps.check.outputs.drifted_uv == 'true'
         run: uv lock
 
-      # npm's cooldown (web/.npmrc `min-release-age=7`) is only honored by
-      # npm >= 11.10.0; node 20 ships npm 10.x which silently ignores it.
-      # Pin the EXACT version (not a range) and keep it in lockstep with
-      # .github/actions/setup-node: this workflow generates the lockfile and
-      # that action verifies it, so a version gap would fail the freshness
-      # gate in lint.yml. 11.12.1 satisfies the >= 11.10.0 cooldown floor.
-      - name: Ensure npm honors the dependency cooldown
-        run: npm install -g npm@11.12.1
-      # Delete the lockfile so npm RESOLVES from scratch: min-release-age only
-      # filters during resolution, and --package-lock-only keeps an existing
-      # in-range pin without re-applying the cooldown.
-      #
-      # --legacy-peer-deps is REQUIRED: the tree pins React 18 at runtime while
-      # much of the UI stack (and @types/react) peer-requires React 19, so npm's
-      # strict resolver would ERESOLVE-fail without it. It MUST match the flag the
-      # freshness gate in lint.yml verifies with; generating without it resolves
-      # the peer graph differently and rewrites the dev/devOptional/extraneous
-      # flags, failing that byte-exact gate.
-      - name: Regenerate package-lock.json
-        working-directory: web
+      # pnpm's cooldown is configured in pnpm-workspace.yaml and respected by
+      # the workspace root. Delete the lockfile so pnpm RESOLVES from scratch:
+      # --lockfile-only keeps an existing in-range pin without re-applying the
+      # cooldown, so we drop it first.
+      - name: Regenerate pnpm-lock.yaml
+        if: steps.check.outputs.drifted_pnpm == 'true'
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          rm -f package-lock.json
-          npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund
+          rm -f pnpm-lock.yaml
+          pnpm install --lockfile-only
 
-      # Validate BEFORE committing: the Docker build proves the regenerated
-      # locks + public registries produce a working image.
+      # Always run, on both paths: when drifted, this validates the freshly
+      # regenerated locks BEFORE they're committed; when not drifted, it's the
+      # ongoing 12h proof that the committed locks + public registries still
+      # build a working image (catches buildability regressions independent of
+      # manifest state — e.g. a yanked package that still satisfies the lock's
+      # specifiers, or a Dockerfile change).
       - name: Docker build (FE + Python, public registries)
         run: docker build -f deploy/docker/Dockerfile -t omnigent-smoke .
 
@@ -87,7 +111,7 @@ jobs:
       # own CI. Skipped when the App isn't configured (falls back to GITHUB_TOKEN).
       - name: Mint App token
         id: app-token
-        if: vars.OMNIGENT_BOT_APP_ID != ''
+        if: steps.check.outputs.drifted == 'true' && vars.OMNIGENT_BOT_APP_ID != ''
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
         with:
           app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
@@ -98,7 +122,7 @@ jobs:
       # blocked by the org PR-creation restriction and the PR runs its own CI;
       # falls back to GITHUB_TOKEN if the App isn't configured.
       - name: Open lockfile-regen PR
-        if: github.event_name != 'pull_request'
+        if: steps.check.outputs.drifted == 'true' && github.event_name != 'pull_request'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
           REPO: ${{ github.repository }}
@@ -106,15 +130,15 @@ jobs:
           git config user.name "omnigent-ci[bot]"
           git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
           # --porcelain (not git diff) so first-regen UNTRACKED lockfiles count too.
-          if [ -z "$(git status --porcelain -- uv.lock web/package-lock.json)" ]; then
+          if [ -z "$(git status --porcelain -- uv.lock pnpm-lock.yaml)" ]; then
             echo "Lockfiles already current — nothing to PR."
             exit 0
           fi
           # One rolling branch, force-pushed each run, so regens update a single PR.
           BRANCH="automation/oss-lockfile-regen"
           git checkout -b "$BRANCH"
-          git add uv.lock web/package-lock.json
-          git commit -m "chore(oss): regenerate public lockfiles against public PyPI/npm"
+          git add uv.lock pnpm-lock.yaml
+          git commit -m "chore(oss): regenerate public lockfiles against public PyPI/npmjs.org"
           git push --force "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" "$BRANCH"
           # An already-open PR just picks up the force-pushed update.
           if [ -n "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number // empty')" ]; then
@@ -126,7 +150,7 @@ jobs:
           # exempts gh from `set -e`, so a non-zero exit hits the else branch.)
           if gh pr create --base main --head "$BRANCH" \
               --title "chore(oss): regenerate public lockfiles against public PyPI/npm" \
-              --body "Automated: regenerated uv.lock + web/package-lock.json against public PyPI/npm, validated by a Docker build + omnigent --help smoke (run ${{ github.run_id }}). Merge to keep the public lockfiles current and buildable."; then
+              --body "Automated: the lockfiles were out of sync with the manifests, so uv.lock + pnpm-lock.yaml were regenerated against public PyPI/npm and validated by a Docker build + omnigent --help smoke (run ${{ github.run_id }}). Merge to keep the public lockfiles consistent and buildable."; then
             echo "Opened the regen PR."
           else
             echo "::warning::Could not open the regen PR automatically (the GITHUB_TOKEN may be disallowed from creating PRs). The branch '$BRANCH' is pushed with the regenerated lockfiles — open the PR by hand:"

.github/workflows/polly-review.yml

@@ -171,19 +171,26 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Install Codex CLI
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.codex-cli" && cd "${GITHUB_WORKSPACE}/.codex-cli"
+          # Install outside the checked-out tree so a repo-root package.json
+          # can't capture this bare `npm install` and hoist it away from here.
+          CODEX_CLI_DIR="${RUNNER_TEMP}/omnigent-codex-cli"
+          mkdir -p "$CODEX_CLI_DIR" && cd "$CODEX_CLI_DIR"
           npm install --ignore-scripts --no-audit --no-fund @openai/codex@0.139.0
-          echo "${GITHUB_WORKSPACE}/.codex-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CODEX_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Set LLM credentials
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
@@ -213,7 +220,11 @@ jobs:
         if: steps.trigger.outputs.skip != 'true' && steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_ANTHROPIC_MODEL: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
+          OMNIGENT_OPENAI_MODEL: ${{ vars.OMNIGENT_CI_OPENAI_MODEL }}
         run: |
+          : "${OMNIGENT_ANTHROPIC_MODEL:?Set OMNIGENT_CI_ANTHROPIC_MODEL}"
+          : "${OMNIGENT_OPENAI_MODEL:?Set OMNIGENT_CI_OPENAI_MODEL}"
           mkdir -p "$HOME/.omnigent"
           # Use python to write the config safely — avoids interpolating
           # secrets/URLs into a heredoc where special chars could break YAML.
@@ -231,13 +242,13 @@ jobs:
                       'anthropic': {
                           'base_url': gw + '/anthropic',
                           'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-opus-4-8'},
+                          'models': {'default': os.environ['OMNIGENT_ANTHROPIC_MODEL']},
                       },
                       'openai': {
                           'base_url': host + '/ai-gateway/codex/v1',
                           'api_key_ref': 'env:LLM_API_KEY',
                           'wire_api': 'responses',
-                          'models': {'default': 'databricks-gpt-5-5'},
+                          'models': {'default': os.environ['OMNIGENT_OPENAI_MODEL']},
                       },
                   }
               }

.github/workflows/publish-changelog.yml

@@ -17,6 +17,11 @@ name: Publish Changelog
 # Cross-repo writes can't use the workflow's own GITHUB_TOKEN (scoped to this
 # repo), so we mint a short-lived token from the omnigent-ci GitHub App scoped to
 # omnigent-site — the same App used by sync-openapi-to-site.yml.
+#
+# Manual dispatch with `dry_run: true` previews only — it renders the site page
+# and prints it to the run log + job summary, mints no token, and opens no PR (so
+# it runs from a fork too). Use it to eyeball the narrative reflow before a real
+# publish.
 
 on:
   release:
@@ -27,6 +32,13 @@ on:
         description: Final release tag to (re)publish, e.g. v0.3.0
         required: true
         type: string
+      dry_run:
+        description: >-
+          Preview only: render the site page and print it to the run log +
+          job summary, but do NOT mint a token or open any PR.
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -42,6 +54,7 @@ jobs:
     outputs:
       tag: ${{ steps.r.outputs.tag }}
       is_final: ${{ steps.r.outputs.is_final }}
+      dry_run: ${{ steps.r.outputs.dry_run }}
     steps:
       - name: Resolve tag and finality
         id: r
@@ -49,41 +62,55 @@ jobs:
           EVENT_TAG: ${{ github.event.release.tag_name }}
           PRERELEASE: ${{ github.event.release.prerelease }}
           INPUT_TAG: ${{ inputs.tag }}
+          # Only a manual dispatch can request dry-run; a real published release
+          # is never a preview.
+          INPUT_DRY_RUN: ${{ inputs.dry_run }}
         run: |
           set -euo pipefail
           tag="${INPUT_TAG:-$EVENT_TAG}"
           echo "tag=${tag}" >> "$GITHUB_OUTPUT"
 
+          dry_run=false
+          [ "${INPUT_DRY_RUN}" = "true" ] && dry_run=true
+          echo "dry_run=${dry_run}" >> "$GITHUB_OUTPUT"
+
           is_final=true
-          # Only final vX.Y.Z tags; exclude rc/dev/alpha/beta and the
-          # event's prerelease flag.
+          # Only final vX.Y.Z tags; exclude rcN/devN/preN pre-releases and
+          # the event's prerelease flag.
           case "$tag" in
             v[0-9]*.[0-9]*.[0-9]*) ;;
             *) is_final=false ;;
           esac
           case "$tag" in
-            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_final=false ;;
+            *rc[0-9]*|*dev[0-9]*|*pre[0-9]*) is_final=false ;;
           esac
           if [ "${PRERELEASE}" = "true" ]; then
             is_final=false
           fi
           echo "is_final=${is_final}" >> "$GITHUB_OUTPUT"
-          echo "Resolved tag=${tag} is_final=${is_final}" | tee -a "$GITHUB_STEP_SUMMARY"
+          echo "Resolved tag=${tag} is_final=${is_final} dry_run=${dry_run}" | tee -a "$GITHUB_STEP_SUMMARY"
 
   publish:
     name: Open release-post PR (omnigent-site)
     needs: resolve
     runs-on: ubuntu-latest
-    # Canonical repo only; skip cleanly where the App isn't configured.
+    # Canonical repo only, and only where the App is configured — EXCEPT a
+    # dry-run, which just renders + prints (no cross-repo write), so it runs
+    # anywhere (e.g. a fork) to preview the page.
     if: >-
       needs.resolve.outputs.is_final == 'true' &&
-      github.repository == 'omnigent-ai/omnigent' &&
-      vars.OMNIGENT_BOT_APP_ID != ''
+      (needs.resolve.outputs.dry_run == 'true' ||
+       (github.repository == 'omnigent-ai/omnigent' &&
+        vars.OMNIGENT_BOT_APP_ID != ''))
     env:
       TAG: ${{ needs.resolve.outputs.tag }}
+      DRY_RUN: ${{ needs.resolve.outputs.dry_run }}
       SOURCE_REPO: ${{ github.repository }}
       SITE_REPO: ${{ github.repository_owner }}/omnigent-site
       RELEASES_BRANCH: auto/releases/${{ needs.resolve.outputs.tag }}
+      OMNIGENT_SKIP_WEB_UI: "true"
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
     steps:
       - name: Checkout omnigent (for the render script)
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -95,7 +122,7 @@ jobs:
         with:
           python-version: "3.11"
 
-      - name: Render the curated release body to MDX
+      - name: Read the curated release body
         working-directory: omnigent
         # The release read uses the workflow's own token (scoped to this repo);
         # only the cross-repo site write needs the App token, minted below.
@@ -110,14 +137,309 @@ jobs:
             --json body,publishedAt > /tmp/release.json
           jq -r '.body' /tmp/release.json > /tmp/release_body.md
           date="$(jq -r '.publishedAt' /tmp/release.json | cut -c1-10)"
+          echo "RELEASE_DATE=${date}" >> "$GITHUB_ENV"
+          # The site post is the narrative reflow; the raw release body is the
+          # fallback if the formatter agent is unavailable or fails.
+          cp /tmp/release_body.md /tmp/site_body.md
+
+      # --- AI reflow (primary; degrades to the raw release body) ---
+      # The GitHub Release itself is untouched — this rewrites its body into the
+      # website's narrative, prose-driven post for the site page ONLY.
+      - name: Check LLM credentials
+        id: creds
+        env:
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+        run: |
+          if [ -z "${LLM_API_KEY:-}" ]; then
+            echo "::warning::No LLM credentials — publishing the raw release body."
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "::add-mask::${LLM_API_KEY}"
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Build a docs index (URL + title, one per line) from the live site so the
+      # formatter can link each feature to a real /docs page — or omit the link
+      # when nothing fits. omnigent-site is public; a blobless partial + sparse
+      # checkout of app/docs pulls only the page.mdx tree, no token needed. Best
+      # effort: on any failure the index is empty and every "Learn more" is dropped.
+      - name: Build docs index
+        if: steps.creds.outputs.available == 'true'
+        env:
+          SITE_REPO: ${{ env.SITE_REPO }}
+        run: |
+          set -euo pipefail
+          : > /tmp/docs_index.txt
+          tmp="$(mktemp -d)"
+          if git clone --depth 1 --filter=blob:none --sparse \
+              "https://github.com/${SITE_REPO}.git" "$tmp" 2>/dev/null \
+             && git -C "$tmp" sparse-checkout set app/docs 2>/dev/null; then
+            python3 -u - "$tmp" <<'PYEOF'
+          import pathlib, re, sys
+          root = pathlib.Path(sys.argv[1])
+          docs = root / "app" / "docs"
+
+          def slugify(text):
+              # Mirror components/HeadingAnchors.js so #anchors resolve on the site.
+              text = text.lower()
+              text = re.sub(r"[^a-z0-9\s-]", "", text)
+              text = re.sub(r"\s+", "-", text)
+              text = re.sub(r"-+", "-", text)
+              return text.strip()
+
+          lines, pages = [], 0
+          for page in sorted(docs.rglob("page.mdx")):
+              url = "/" + page.relative_to(root).parent.as_posix().removeprefix("app/")
+              title, sections, in_fence = "", [], False
+              for ln in page.read_text(encoding="utf-8", errors="replace").splitlines():
+                  if ln.lstrip().startswith("```"):  # skip fenced code blocks
+                      in_fence = not in_fence
+                      continue
+                  if in_fence:
+                      continue
+                  m = re.match(r"(#{1,3})\s+(.*\S)", ln)  # only h1-h3 get anchors
+                  if not m:
+                      continue
+                  level, text = len(m.group(1)), m.group(2).strip()
+                  # Reduce `[label](url)` to `label`: the site slugs rendered text.
+                  text = re.sub(r"\[([^\]]+)\]\([^)]*\)", r"\1", text)
+                  if level == 1 and not title:
+                      title = text
+                  elif level > 1:
+                      sections.append((slugify(text), text))
+              pages += 1
+              lines.append(f"{url}\t{title}" if title else url)
+              for slug, text in sections:
+                  lines.append(f"  {url}#{slug}\t{text}")
+          pathlib.Path("/tmp/docs_index.txt").write_text("\n".join(lines) + ("\n" if lines else ""))
+          print(f"Indexed {pages} docs pages, {len(lines) - pages} sections.")
+          PYEOF
+          else
+            echo "::warning::Could not fetch omnigent-site docs — 'Learn more' links will be omitted."
+          fi
+          rm -rf "$tmp"
+
+      - name: Build formatter prompt
+        if: steps.creds.outputs.available == 'true'
+        env:
+          TAG: ${{ env.TAG }}
+        run: |
+          set -euo pipefail
+          python3 -u <<'PYEOF'
+          import os, pathlib
+          tag = os.environ["TAG"]
+          # `omnigent run -p` passes the whole prompt as one argv string, capped at
+          # ~128 KiB on Linux (MAX_ARG_STRLEN). A release body is far smaller, but
+          # cap defensively; the raw body is the fallback if the agent can't run.
+          MAX = 100_000
+          body = pathlib.Path("/tmp/release_body.md").read_text(encoding="utf-8", errors="replace")[:MAX]
+          docs = pathlib.Path("/tmp/docs_index.txt")
+          docs_index = docs.read_text(encoding="utf-8", errors="replace").strip() if docs.is_file() else ""
+          docs_block = docs_index if docs_index else "(none available — omit every \"Learn more\" line)"
+          prompt = f"""Reformat the {tag} release notes into the website post.
+
+          ## Curated GitHub Release body (rewrite this — do not add or drop facts)
+          {body}
+
+          ## Available docs pages and sections (URL <TAB> title; indented = a
+          ## #section anchor within the page above) — link features to these only
+          {docs_block}
+
+          Produce the RELEASE_POST block per your instructions."""
+          pathlib.Path("/tmp/format_prompt.txt").write_text(prompt)
+          PYEOF
+
+      # Runs the tools-less formatter and secret-scans its output; degrades to the
+      # raw release body (below) if the agent can't run. Omnigent is checked out
+      # into omnigent/, so the action's workdir is that subdir.
+      - name: Run release-post formatter
+        id: format
+        if: steps.creds.outputs.available == 'true'
+        uses: ./omnigent/.github/actions/run-omnigent-agent
+        with:
+          workdir: omnigent
+          agent: release-post-formatter
+          prompt-file: /tmp/format_prompt.txt
+          output-file: /tmp/format_out.txt
+          stderr-file: /tmp/format-stderr.log
+          gateway-base-url: ${{ secrets.GATEWAY_BASE_URL }}
+          llm-api-key: ${{ secrets.LLM_API_KEY }}
+          model: ${{ vars.OMNIGENT_CI_ANTHROPIC_MODEL }}
+
+      - name: Extract narrative post (fall back to raw body)
+        if: steps.creds.outputs.available == 'true'
+        run: |
+          set -euo pipefail
+          python3 -u <<'PYEOF'
+          import pathlib, re
+          raw = pathlib.Path("/tmp/format_out.txt").read_text(encoding="utf-8", errors="replace") \
+              if pathlib.Path("/tmp/format_out.txt").is_file() else ""
+          m = re.search(r"<!--\s*RELEASE_POST\s*-->(.*?)<!--\s*/RELEASE_POST\s*-->", raw, re.DOTALL)
+          post = (m.group(1).strip() if m else "")
+          if post:
+              pathlib.Path("/tmp/site_body.md").write_text(post + "\n")
+              print("Using AI-formatted narrative release post.")
+          else:
+              print("::warning::No RELEASE_POST block parsed — publishing the raw release body.")
+          PYEOF
+
+      # Reviewer reference table of the PRs behind each feature and whether each
+      # already ships a demo video, so a human filling the `TODO` demo placeholders
+      # can reuse an existing recording instead of re-recording. Grouped to MATCH
+      # THE POST: when the formatter ran it curated the body down to a few headline
+      # features and emitted a per-feature RELEASE_POST_PRS map — group by that so
+      # the table covers only the PRs behind the features that made the post. With
+      # no map (raw-body fallback), the post keeps every feature, so fall back to
+      # the raw `## Major new features` / `## Breaking changes` sections. Runs
+      # unconditionally (helps the fallback too); best-effort, empty table on error.
+      - name: Build demo-video reference table
+        id: demotable
+        continue-on-error: true
+        working-directory: omnigent
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_REPO: ${{ env.SOURCE_REPO }}
+        run: |
+          set -euo pipefail
+          python3 -u <<'PYEOF'
+          import json, os, pathlib, re, subprocess
+          repo = os.environ["SOURCE_REPO"]
+          body = pathlib.Path("/tmp/release_body.md").read_text(encoding="utf-8", errors="replace")
+
+          # PR refs from the raw body's FEATURE sections, per section — the set of
+          # PRs the table is allowed to name (bug fixes are dropped from the post,
+          # so from the table too), and the fallback grouping when no formatter map.
+          # Match a feature section by its heading TEXT at any level (the release
+          # body uses ### here, older ones ##) — startswith, so "Bug fixes &
+          # hardening" is excluded but "Major new features" matches.
+          FEATURE = ("major new features", "breaking changes")
+          ref_re = re.compile(r"#(\d+)")
+          raw_sections, current, allowed = [], None, set()
+          for ln in body.splitlines():
+              h = re.match(r"#{2,}\s+(.*\S)", ln)
+              if h:
+                  name = h.group(1).strip()
+                  low = name.lower()
+                  current = (name, []) if any(low.startswith(f) for f in FEATURE) else None
+                  if current:
+                      raw_sections.append(current)
+                  continue
+              if current and ln.lstrip().startswith(("-", "*")):
+                  for n in ref_re.findall(ln):
+                      pr = int(n)
+                      allowed.add(pr)
+                      if pr not in current[1]:
+                          current[1].append(pr)
+
+          # Prefer the formatter's curated feature -> PRs map so the table's groups
+          # match the post's numbered features. The formatter is fed injectable PR
+          # prose, so validate: keep only pr_refs that appear in the harvested body.
+          groups = []  # (feature title, [pr, ...])
+          fmt = pathlib.Path("/tmp/format_out.txt")
+          if fmt.is_file():
+              raw = fmt.read_text(encoding="utf-8", errors="replace")
+              mm = re.search(r"<!--\s*RELEASE_POST_PRS\s*-->(.*?)<!--\s*/RELEASE_POST_PRS\s*-->",
+                             raw, re.DOTALL)
+              if mm:
+                  try:
+                      for feat in json.loads(mm.group(1).strip()):
+                          if not isinstance(feat, dict):
+                              continue
+                          title = str(feat.get("title", "")).strip()
+                          prs, seen = [], set()
+                          for r in feat.get("pr_refs", []):
+                              try:
+                                  n = int(r)
+                              except (TypeError, ValueError):
+                                  continue
+                              if n in allowed and n not in seen:
+                                  seen.add(n)
+                                  prs.append(n)
+                          if title and prs:
+                              groups.append((title, prs))
+                  except json.JSONDecodeError as e:
+                      print(f"::warning::Could not parse RELEASE_POST_PRS — falling back to raw sections: {e}")
+          if not groups:
+              print("::notice::No curated feature map — grouping the table by raw release sections.")
+              groups = [(name, prs) for name, prs in raw_sections if prs]
+
+          # Same demo-VIDEO detection as feature-blog.yml: GitHub uploaded-asset
+          # links, bare video URLs, and <video> tags. Images are NOT counted — the
+          # placeholder asks for a recording (a screenshot is a weaker fallback).
+          video_re = re.compile(
+              r"https?://github\.com/user-attachments/assets/[0-9a-f-]+"
+              r"|https?://github\.com/[^/\s)]+/[^/\s)]+/assets/\d+/[0-9a-f-]+"
+              r"|https?://[^\s)]+\.(?:mp4|mov|webm|m4v)\b"
+              r"|<video\b",
+              re.IGNORECASE)
+          def _cell(t):
+              return (t or "").replace("|", "\\|").replace("\n", " ").strip()
+
+          meta_cache = {}
+          def _meta(pr):
+              if pr in meta_cache:
+                  return meta_cache[pr]
+              m = {"title": "", "url": f"https://github.com/{repo}/pull/{pr}", "video": False}
+              try:
+                  d = json.loads(subprocess.run(
+                      ["gh", "pr", "view", str(pr), "--repo", repo,
+                       "--json", "title,body,url"],
+                      capture_output=True, text=True, timeout=60).stdout or "{}")
+                  m["title"] = _cell(d.get("title", ""))
+                  m["url"] = d.get("url") or m["url"]
+                  m["video"] = bool(video_re.search(d.get("body") or ""))
+              except Exception as e:
+                  print(f"::notice::Could not read metadata for PR #{pr}: {e}")
+              meta_cache[pr] = m
+              return m
+
+          out, total = [], 0
+          for name, prs in groups:
+              out += [f"### {_cell(name)}", "", "| PR | Title | Demo video? |",
+                      "| --- | --- | --- |"]
+              for pr in prs:
+                  total += 1
+                  m = _meta(pr)
+                  cell = f"[✅ video]({m['url']})" if m["video"] else "—"
+                  out.append(f"| [#{pr}]({m['url']}) | {m['title']} | {cell} |")
+              out.append("")
+          pathlib.Path("/tmp/demo_table.md").write_text("\n".join(out).rstrip() + ("\n" if out else ""))
+          print(f"Built demo table for {total} PR(s) across {len(groups)} feature(s).")
+          PYEOF
+
+      - name: Render the release post to MDX
+        working-directory: omnigent
+        run: |
+          set -euo pipefail
           mkdir -p /tmp/site_page
           python3 .github/scripts/changelog/release_to_mdx.py \
-            --tag "$TAG" --repo "$SOURCE_REPO" --date "$date" \
-            --body-file /tmp/release_body.md \
+            --tag "$TAG" --repo "$SOURCE_REPO" --date "$RELEASE_DATE" \
+            --body-file /tmp/site_body.md \
             --out "/tmp/site_page/page.mdx"
 
+      # Dry-run stops here: print the generated page (and the intermediate
+      # narrative body) to the log and the job summary. No token is minted and no
+      # PR is opened — every step below is gated on DRY_RUN != 'true'.
+      - name: Preview rendered page (dry-run)
+        if: env.DRY_RUN == 'true'
+        run: |
+          set -euo pipefail
+          {
+            echo "## Dry-run — release post for \`${TAG}\` at \`/releases/${VERSION}\`"
+            echo "### Narrative body (pre-MDX)"
+            echo '```markdown'; cat /tmp/site_body.md; echo '```'
+            echo "### Rendered \`app/releases/${VERSION}/page.mdx\`"
+            echo '```mdx'; cat /tmp/site_page/page.mdx; echo '```'
+            if [ -s /tmp/demo_table.md ]; then
+              echo "### Source PRs — demo videos (for the \`TODO\` demo placeholders)"
+              cat /tmp/demo_table.md
+            fi
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+          echo "Dry-run: no token minted, no PR opened."
+
       - name: Mint App token (omnigent-site)
         id: app-token
+        if: env.DRY_RUN != 'true'
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
@@ -126,6 +448,7 @@ jobs:
           repositories: omnigent-site
 
       - name: Checkout omnigent-site (sync target)
+        if: env.DRY_RUN != 'true'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: ${{ env.SITE_REPO }}
@@ -133,6 +456,7 @@ jobs:
           path: site
 
       - name: Open or update the release-post PR (omnigent-site)
+        if: env.DRY_RUN != 'true'
         working-directory: site
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -158,7 +482,12 @@ jobs:
             echo "Release-post PR already open for ${RELEASES_BRANCH} — force-push updated it."
             exit 0
           fi
-          body="$(printf 'Publishes the **%s** release post at `/releases/%s`, mirroring the curated GitHub Release notes.\n\nGenerated by omnigent `.github/workflows/publish-changelog.yml`. Edit the GitHub Release, not this file.' "$TAG" "$VERSION")"
+          body="$(printf 'Publishes the **%s** release post at `/releases/%s` — the curated GitHub Release notes reformatted into the site'"'"'s narrative, prose-driven style.\n\nGenerated by omnigent `.github/workflows/publish-changelog.yml`. Edit the GitHub Release, not this file.' "$TAG" "$VERSION")"
+          # Append the demo-video reference table: which feature PRs already ship a
+          # recording a reviewer can drop into the post'"'"'s `TODO` demo placeholders.
+          if [ -s /tmp/demo_table.md ]; then
+            body="$(printf '%s\n\n### Source PRs — demo videos\nCheck a ✅ PR for a recording to replace a `TODO` demo placeholder in the post.\n\n%s' "$body" "$(cat /tmp/demo_table.md)")"
+          fi
           gh pr create \
             --repo "$SITE_REPO" \
             --base main \
@@ -173,6 +502,7 @@ jobs:
       # when the branch doesn't exist or carries nothing beyond main (e.g. a patch
       # release with no staged docs).
       - name: Open docs-branch → main PR (omnigent-site)
+        if: env.DRY_RUN != 'true'
         working-directory: site
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -206,3 +536,39 @@ jobs:
             --head "$DOCS_BRANCH" \
             --title "docs: publish ${VERSION%.*} docs to the live site" \
             --body "$body"
+
+      # ::add-mask:: redacts rendered logs, not artifact files — scrub the key
+      # from artifacts (incl. the unscanned stderr) before upload.
+      - name: Redact secrets from artifacts
+        if: always() && steps.creds.outputs.available == 'true'
+        env:
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+        run: |
+          set -euo pipefail
+          [ -n "${LLM_API_KEY:-}" ] || exit 0
+          python3 - <<'PYEOF'
+          import os, pathlib
+          key = os.environ.get("LLM_API_KEY", "")
+          for f in ["/tmp/format-stderr.log", "/tmp/format_out.txt",
+                    "/tmp/format_prompt.txt", "/tmp/site_body.md"]:
+              p = pathlib.Path(f)
+              if not p.is_file() or not key:
+                  continue
+              t = p.read_text(encoding="utf-8", errors="replace")
+              if key in t:
+                  p.write_text(t.replace(key, "***REDACTED***"), encoding="utf-8")
+                  print(f"redacted key from {f}")
+          PYEOF
+
+      - name: Upload logs on failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: publish-changelog-${{ env.TAG }}-${{ github.run_id }}
+          path: |
+            /tmp/format-stderr.log
+            /tmp/format_out.txt
+            /tmp/site_body.md
+            /tmp/demo_table.md
+          retention-days: 7
+          if-no-files-found: ignore

.github/workflows/release-omnigent.yml

@@ -71,24 +71,21 @@ jobs:
         with:
           enable-cache: false
 
-      - name: Set up Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       # 1. Build the web UI FIRST into the package tree, clean. Ordering is
       #    load-bearing: the wheel packages on-disk files, so the bundle must
       #    exist before `uv build`. `rm -rf` backstops Vite's emptyOutDir
-      #    against stale bundles; `npm ci` installs the exact locked deps.
-      #    `--legacy-peer-deps` matches how web's lockfile is generated and
-      #    validated everywhere else (lint, e2e-ui, web-tests, the regen
-      #    jobs) — required for the React 19 peer conflict; without it `npm ci`
-      #    rejects the lockfile ("Missing: yaml@1.10.3 from lock file").
+      #    against stale bundles; `pnpm install --frozen-lockfile --filter web`
+      #    installs the exact locked deps for the web workspace package.
       - name: Build web UI (clean, fresh)
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
           rm -rf omnigent/server/static/web-ui
-          npm --prefix web ci --legacy-peer-deps
-          npm --prefix web run build # Vite outDir -> omnigent/server/static/web-ui
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build # Vite outDir -> omnigent/server/static/web-ui
 
       # 2. Tag-driven: the tag must match the version in all three pyprojects
       #    and the core package's `==` sibling-SDK pins, so the lockstep

.github/workflows/release.yml

@@ -0,0 +1,709 @@
+# Cut or advance a release deterministically (designs/RELEASE-AUTOMATION.md):
+#
+#   dispatch with version=0.6.0rc1  ->  create release/v0.6.0 from `ref`, stamp the
+#   lockstep version (scripts/update_versions.py + `uv lock`), tag v0.6.0rc1,
+#   push branch + tag. Later dispatches (0.6.0rc2, 0.6.0, 0.6.1) reuse the
+#   existing release/v0.6.0 head and ignore `ref`.
+#
+# The branch + tag are pushed with the omnigent-ci App token, NOT GITHUB_TOKEN:
+# GITHUB_TOKEN-pushed tags trigger no workflows by GitHub policy, and the whole
+# release chain (github-release.yml -> draft-release-notes.yml, and
+# oss-publish-images.yml) hangs off the tag push.
+#
+# PyPI publishing does NOT happen here — after this run, dispatch the secure
+# release repo on the tag (see RELEASING.md). Everything here is idempotent:
+# re-dispatch with identical inputs after any failure and it converges
+# (branch exists -> reused; version stamped -> no new commit; tag at the
+# converged commit -> no-op; tag anywhere else -> loud failure).
+#
+# `dry_run` defaults TRUE (repo convention, same as the vscode release
+# workflows): the plan job prints exactly what would happen; nothing is pushed.
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release, e.g. 0.6.0rc1 or 0.6.0 (no leading v)."
+        required: true
+        type: string
+      ref:
+        description: "Branch/tag/SHA to cut release/vX.Y.0 from. Only consulted when the branch does not exist yet (rc1); later phases build from the existing branch head."
+        required: false
+        default: main
+        type: string
+      dry_run:
+        description: "Plan only: validate + print what would happen, push nothing."
+        required: false
+        type: boolean
+        default: true
+      skip_ci_check:
+        description: "Skip the green-CI assertion on the base commit (flaky-check escape hatch — use deliberately)."
+        required: false
+        type: boolean
+        default: false
+      skip_benchmark:
+        description: "Skip the pre-cut benchmark regression check (escape hatch — use deliberately)."
+        required: false
+        type: boolean
+        default: false
+
+# Nothing here writes with GITHUB_TOKEN; pushes use the App token.
+permissions:
+  contents: read
+
+# Serialize all release runs: two concurrent cuts (even of different versions)
+# could race the same release/vX.Y.0 head.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  # Releases are maintainer-only. `workflow_dispatch` is open to anyone with
+  # write access, so gate on the dispatcher's actual repo role instead of a
+  # hand-kept list. `github.actor` on a dispatch is the dispatcher.
+  authorize:
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require admin/maintain role
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          role="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq .role_name)"
+          case "$role" in
+            admin|maintain)
+              echo "Dispatcher ${ACTOR} has role ${role} — authorized." | tee -a "$GITHUB_STEP_SUMMARY" ;;
+            *)
+              echo "::error::Release workflows require the admin or maintain role (dispatcher ${ACTOR} has '${role}')."
+              exit 1 ;;
+          esac
+
+  # Resolve everything and validate BEFORE mutating anything. Runs checkout-free
+  # (pure API reads) and also serves as the whole dry run.
+  plan:
+    needs: authorize
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      version: ${{ steps.derive.outputs.version }}
+      tag: ${{ steps.derive.outputs.tag }}
+      branch: ${{ steps.derive.outputs.branch }}
+      prerelease: ${{ steps.derive.outputs.prerelease }}
+      branch_exists: ${{ steps.state.outputs.branch_exists }}
+      base_sha: ${{ steps.state.outputs.base_sha }}
+      already_done: ${{ steps.state.outputs.already_done }}
+    steps:
+      - name: Validate version and derive names
+        id: derive
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          # Final X.Y.Z or a PEP 440 pre-release (rc). No dev/post/alpha/beta here.
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(rc[0-9]+)?$ ]]; then
+            echo "::error::Invalid release version: ${VERSION} (expect 0.6.0 or 0.6.0rc1)"; exit 1
+          fi
+          major="${VERSION%%.*}"; rest="${VERSION#*.}"; minor="${rest%%.*}"
+          prerelease=false
+          case "$VERSION" in *rc[0-9]*) prerelease=true ;; esac
+          {
+            echo "version=${VERSION}"
+            echo "tag=v${VERSION}"
+            echo "branch=release/v${major}.${minor}.0"
+            echo "prerelease=${prerelease}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Resolve branch, base commit, and tag state
+        id: state
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.derive.outputs.version }}
+          TAG: ${{ steps.derive.outputs.tag }}
+          BRANCH: ${{ steps.derive.outputs.branch }}
+          REF: ${{ inputs.ref }}
+        run: |
+          set -euo pipefail
+
+          # `gh api` prints the error body to STDOUT on 404, so capturing with
+          # `|| true` would treat the "Not Found" JSON as an existing ref —
+          # gate on the exit code instead.
+          if branch_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/heads/${BRANCH}" --jq .object.sha 2>/dev/null)"; then
+            branch_exists=true
+            base_sha="$branch_sha"
+            # `ref` only applies at branch creation. An explicit non-default ref
+            # that disagrees with the branch head is a mistake, not a retarget.
+            if [ "$REF" != "main" ]; then
+              ref_sha="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${REF}" --jq .sha)"
+              if [ "$ref_sha" != "$branch_sha" ]; then
+                echo "::error::${BRANCH} already exists at ${branch_sha}; ref=${REF} (${ref_sha}) would not be used. Re-dispatch without ref, or delete the branch if this is recovery."
+                exit 1
+              fi
+            fi
+          else
+            branch_exists=false
+            base_sha="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${REF}" --jq .sha)"
+          fi
+
+          # Tag state: absent -> normal; at the converged release commit ->
+          # no-op; anywhere else -> refuse (never silently move a tag).
+          already_done=false
+          if tag_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq .object.sha 2>/dev/null)"; then
+            tag_type="$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq .object.type)"
+            if [ "$tag_type" = "tag" ]; then
+              tag_sha="$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${tag_sha}" --jq .object.sha)"
+            fi
+            stamped="$(gh api -H "Accept: application/vnd.github.raw+json" \
+              "repos/${GITHUB_REPOSITORY}/contents/pyproject.toml?ref=${TAG}" \
+              | sed -n 's/^version = "\(.*\)"$/\1/p' | head -1)"
+            if [ "$tag_sha" = "$base_sha" ] && [ "$stamped" = "$VERSION" ]; then
+              already_done=true
+              echo "Tag ${TAG} already at the converged release commit ${base_sha} — nothing to do." \
+                | tee -a "$GITHUB_STEP_SUMMARY"
+            else
+              echo "::error::Tag ${TAG} already exists at ${tag_sha} (stamped version: ${stamped:-unknown}), which is not the converged branch head ${base_sha}. Delete the tag first if this is recovery (see RELEASING.md)."
+              exit 1
+            fi
+          fi
+
+          {
+            echo "branch_exists=${branch_exists}"
+            echo "base_sha=${base_sha}"
+            echo "already_done=${already_done}"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Assert green CI on the base commit
+        if: steps.state.outputs.already_done != 'true' && !inputs.skip_ci_check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BASE_SHA: ${{ steps.state.outputs.base_sha }}
+        run: |
+          set -euo pipefail
+          # This gate is meta-CI, not CI itself. Every job this Release workflow
+          # spawns (plan, benchmark, cut, bump-main, …) leaves a check-run on
+          # the base commit; a single premature failure on a prior dispatch
+          # would otherwise poison the SHA and block every retry in a
+          # self-sustaining loop. Exclude *all* check-runs that belong to a run
+          # of this workflow, identified by run ID in details_url — not by job
+          # name, so a real nightly `benchmark` regression (different workflow)
+          # is still gated.
+          own_runs="$(gh api "repos/${GITHUB_REPOSITORY}/actions/workflows/release.yml/runs?head_sha=${BASE_SHA}&per_page=100&status=completed" \
+            --jq '.workflow_runs[].id' 2>/dev/null | paste -sd, -)"
+          runs="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${BASE_SHA}/check-runs?per_page=100" \
+            --paginate --jq '.check_runs[] | [.name, .status, .conclusion // "-", .details_url] | @tsv')"
+          # Drop check-runs whose details_url references one of this
+          # workflow's own runs (e.g. .../actions/runs/<id>/job/<id>).
+          runs="$(printf '%s' "$runs" | awk -F'\t' -v rel="$own_runs" '
+            BEGIN { n=split(rel, a, ","); for (i=1; i<=n; i++) if (a[i]!="") runs[a[i]]=1 }
+            { own=0; for (r in runs) if (index($4, "/runs/" r "/")) { own=1; break }
+              if (!own) print $1 "\t" $2 "\t" $3 }')"
+          total="$(printf '%s' "$runs" | grep -c . || true)"
+          pending="$(printf '%s' "$runs" | awk -F'\t' '$2 != "completed"' || true)"
+          # Cancelled runs are chronically present on main (superseded
+          # benchmark/eval runs) — warn, don't block; real failures still gate.
+          bad="$(printf '%s' "$runs" | awk -F'\t' '$3 ~ /^(failure|timed_out|action_required|startup_failure)$/' || true)"
+          cancelled="$(printf '%s' "$runs" | awk -F'\t' '$3 == "cancelled"' || true)"
+          if [ -n "$bad" ]; then
+            echo "::error::Failing check runs on ${BASE_SHA}:"; printf '%s\n' "$bad"; exit 1
+          fi
+          if [ -n "$pending" ]; then
+            echo "::error::Check runs still running on ${BASE_SHA} — wait for CI:"; printf '%s\n' "$pending"; exit 1
+          fi
+          if [ "$total" -eq 0 ]; then
+            echo "::error::No check runs found on ${BASE_SHA}. Wait for CI on that commit, or re-dispatch with skip_ci_check=true if you are sure."
+            exit 1
+          fi
+          if [ -n "$cancelled" ]; then
+            echo "::warning::Cancelled (superseded) check runs on ${BASE_SHA} — not blocking:"
+            printf '%s\n' "$cancelled"
+          fi
+          echo "CI green on ${BASE_SHA} (${total} completed check runs, none failing)." \
+            | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Write the plan
+        env:
+          DRY_RUN: ${{ inputs.dry_run }}
+          VERSION: ${{ steps.derive.outputs.version }}
+          TAG: ${{ steps.derive.outputs.tag }}
+          BRANCH: ${{ steps.derive.outputs.branch }}
+          BRANCH_EXISTS: ${{ steps.state.outputs.branch_exists }}
+          BASE_SHA: ${{ steps.state.outputs.base_sha }}
+          ALREADY_DONE: ${{ steps.state.outputs.already_done }}
+        run: |
+          set -euo pipefail
+          {
+            echo "## Release plan for ${TAG}"
+            echo ""
+            echo "| | |"
+            echo "| --- | --- |"
+            echo "| Version | \`${VERSION}\` |"
+            echo "| Branch | \`${BRANCH}\` ($([ "$BRANCH_EXISTS" = "true" ] && echo "exists — reused" || echo "will be created")) |"
+            echo "| Base commit | \`${BASE_SHA}\` |"
+            echo "| Converged already | ${ALREADY_DONE} |"
+            echo "| Mode | $([ "$DRY_RUN" = "true" ] && echo "DRY RUN — nothing pushed" || echo "EXECUTE") |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # Seed the corpus at the OLDER release's schema head so both servers can
+  # boot: the baseline (older code) reads it natively, and the candidate (newer
+  # code) auto-migrates it forward on startup. Migrations are forward-only, so
+  # seeding at the newer schema would leave a DB the older code can't read.
+  # The seeded bench.db is passed to baseline + candidate as an artifact so
+  # they run in parallel on separate runners (each migrates/reads its own copy).
+  benchmark-seed:
+    needs: [authorize, plan]
+    if: ${{ !inputs.dry_run && needs.plan.outputs.already_done != 'true' && !inputs.skip_benchmark }}
+    outputs:
+      prev_tag: ${{ steps.prev.outputs.tag }}
+      has_prev: ${{ steps.prev.outputs.found }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      OMNIGENT_SKIP_WEB_UI: "true"
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
+    steps:
+      - name: Check out release base
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ needs.plan.outputs.branch_exists == 'true' && needs.plan.outputs.branch || needs.plan.outputs.base_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v3
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Find previous stable release tag
+        id: prev
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          PREV_TAG=$(gh api "repos/${GITHUB_REPOSITORY}/releases?per_page=20" \
+            --jq '[.[] | select(.prerelease == false and .draft == false)] | .[0].tag_name // empty')
+          if [ -z "$PREV_TAG" ]; then
+            echo "No previous stable release found — skipping regression check." | tee -a "$GITHUB_STEP_SUMMARY"
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Previous stable release: ${PREV_TAG}" | tee -a "$GITHUB_STEP_SUMMARY"
+            echo "found=true" >> "$GITHUB_OUTPUT"
+            echo "tag=${PREV_TAG}" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Seed at the OLDER schema head so both servers can boot. When there is
+      # no previous release (first cut) seed at the current schema instead.
+      - name: Seed at previous release schema
+        if: steps.prev.outputs.found == 'true'
+        run: |
+          git checkout "${{ steps.prev.outputs.tag }}"
+          uv sync --extra dev
+          uv run --no-sync dev/benchmarks/omnigent/seed.py \
+            --database-uri "sqlite:///bench.db" \
+            --sessions 5000 --items-per-session 200
+
+      - name: Seed at current schema (no previous release)
+        if: steps.prev.outputs.found != 'true'
+        run: |
+          uv run --no-sync dev/benchmarks/omnigent/seed.py \
+            --database-uri "sqlite:///bench.db" \
+            --sessions 5000 --items-per-session 200
+
+      - name: Upload seeded corpus
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bench-db-${{ github.run_id }}
+          path: bench.db
+          retention-days: 1
+          if-no-files-found: error
+
+  # Benchmark the previous release. Skipped on the first cut (no prev tag).
+  benchmark-baseline:
+    needs: [benchmark-seed]
+    if: ${{ needs.benchmark-seed.outputs.has_prev == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      OMNIGENT_SKIP_WEB_UI: "true"
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
+    steps:
+      - name: Check out previous release
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ needs.benchmark-seed.outputs.prev_tag }}
+          persist-credentials: false
+
+      - name: Download seeded corpus
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bench-db-${{ github.run_id }}
+          path: .
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v3
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Run baseline benchmark
+        run: |
+          uv run --no-sync dev/benchmarks/omnigent/run.py \
+            --database-uri "sqlite:///bench.db" \
+            --iterations 100 --runs 3 --output baseline.json
+          echo "Baseline benchmark complete." | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload baseline results
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: baseline-results-${{ github.run_id }}
+          path: baseline.json
+          retention-days: 7
+          if-no-files-found: error
+
+  # Benchmark the release candidate. Always runs (even on first cut, solo).
+  benchmark-candidate:
+    needs: [authorize, plan, benchmark-seed]
+    if: ${{ !inputs.dry_run && needs.plan.outputs.already_done != 'true' && !inputs.skip_benchmark }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      OMNIGENT_SKIP_WEB_UI: "true"
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
+    steps:
+      - name: Check out release base
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ needs.plan.outputs.branch_exists == 'true' && needs.plan.outputs.branch || needs.plan.outputs.base_sha }}
+          persist-credentials: false
+
+      - name: Download seeded corpus
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: bench-db-${{ github.run_id }}
+          path: .
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v3
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      # The seeded bench.db is at the previous release's schema head. The
+      # candidate (newer code) auto-migrates on server boot, but the z7
+      # binary-UUID conversion is a per-row Python loop over ~1M items that
+      # takes >90s — longer than the benchmark harness's health-check window.
+      # Pre-migrate explicitly so the server boots against an already-current DB.
+      - name: Migrate corpus to release-base schema
+        run: |
+          uv run --no-sync omni debug db-upgrade "sqlite:///bench.db"
+          echo "Corpus migrated to release-base schema head." | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Run candidate benchmark
+        run: |
+          uv run --no-sync dev/benchmarks/omnigent/run.py \
+            --database-uri "sqlite:///bench.db" \
+            --iterations 100 --runs 3 --output candidate.json
+          echo "Candidate benchmark complete." | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload candidate results
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: candidate-results-${{ github.run_id }}
+          path: candidate.json
+          retention-days: 7
+          if-no-files-found: error
+
+  # Compare baseline vs candidate. Downloaded as artifacts from the parallel
+  # jobs. A detected regression surfaces as an output flag that gates the
+  # benchmark-approve job (requiring manual sign-off) rather than failing
+  # outright. Skipped on the first cut (no baseline).
+  benchmark:
+    needs: [authorize, plan, benchmark-seed, benchmark-baseline, benchmark-candidate]
+    if: ${{ !inputs.dry_run && needs.plan.outputs.already_done != 'true' && !inputs.skip_benchmark && needs.benchmark-seed.outputs.has_prev == 'true' }}
+    outputs:
+      regression: ${{ steps.compare.outputs.regression }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      OMNIGENT_SKIP_WEB_UI: "true"
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
+    steps:
+      - name: Check out release base
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ needs.plan.outputs.branch_exists == 'true' && needs.plan.outputs.branch || needs.plan.outputs.base_sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v3
+        with:
+          enable-cache: true
+
+      - name: Install dependencies
+        run: uv sync --extra dev
+
+      - name: Download results
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: "{baseline,candidate}-results-${{ github.run_id }}"
+          merge-multiple: true
+          path: .
+
+      - name: Compare results
+        id: compare
+        run: |
+          set +e
+          uv run --no-sync dev/benchmarks/omnigent/compare.py \
+            --baseline baseline.json \
+            --candidate candidate.json \
+            --threshold 1.0 \
+            --output-markdown comparison.md
+          RC=$?
+          set -e
+          echo "regression=$([ $RC -ne 0 ] && echo 'true' || echo 'false')" >> "$GITHUB_OUTPUT"
+
+      - name: Write step summary
+        run: |
+          REGRESSION="${{ steps.compare.outputs.regression }}"
+          {
+            if [ "$REGRESSION" != "true" ]; then
+              echo "### Benchmark: PASS ✓"
+            else
+              echo "### Benchmark: REGRESSION DETECTED ✗"
+              echo ""
+              echo "> A regression exceeding the threshold was found."
+              echo "> The **benchmark-approve** job is awaiting maintainer sign-off before cut proceeds."
+            fi
+            echo ""
+            cat comparison.md 2>/dev/null || echo "_No comparison report generated._"
+            echo ""
+            echo "_Candidate vs ${{ needs.benchmark-seed.outputs.prev_tag }} · 100 iterations × 3 runs · SQLite · threshold 100% on P50/P95_"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload comparison artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        if: always()
+        with:
+          name: benchmark-release-${{ github.run_id }}
+          path: |
+            candidate.json
+            baseline.json
+            comparison.md
+          retention-days: 90
+          if-no-files-found: ignore
+
+  # Pauses for a maintainer to review and approve in the GitHub UI when the
+  # benchmark job detected a regression. Uses an environment with required
+  # reviewers — configure "benchmark-regression-gate" in repo Settings →
+  # Environments. Skipped (passes through) when there is no regression.
+  benchmark-approve:
+    needs: [authorize, plan, benchmark]
+    if: |
+      !inputs.dry_run &&
+      needs.plan.outputs.already_done != 'true' &&
+      !inputs.skip_benchmark &&
+      needs.benchmark.result == 'success' &&
+      needs.benchmark.outputs.regression == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment: benchmark-regression-gate
+    steps:
+      - name: Regression approved by maintainer
+        run: |
+          echo "Benchmark regression approved. Proceeding with cut." | tee -a "$GITHUB_STEP_SUMMARY"
+
+  # Stamp + tag + push. Only reached on a real run that isn't already converged.
+  cut:
+    needs: [authorize, plan, benchmark-candidate, benchmark, benchmark-approve]
+    # benchmark (compare) + benchmark-approve are skipped on the first cut (no
+    # previous release to compare against); benchmark-candidate always runs and
+    # is the real gate. `!cancelled` lets the optional compare/approve jobs be
+    # skipped without blocking, while still failing the run if they actually fail.
+    if: ${{ !inputs.dry_run && needs.plan.outputs.already_done != 'true' && !cancelled() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      # Clean public resolution for `uv lock` — the committed lockfile must
+      # reference https://pypi.org/simple (never a proxy).
+      UV_INDEX_URL: https://pypi.org/simple
+      PIP_INDEX_URL: https://pypi.org/simple
+    steps:
+      - name: Mint App token (omnigent)
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: omnigent
+
+      - name: Checkout base
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Existing branch: its head. New branch: the resolved base commit.
+          ref: ${{ needs.plan.outputs.branch_exists == 'true' && needs.plan.outputs.branch || needs.plan.outputs.base_sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version-file: ".python-version"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: false
+
+      - name: Stamp the lockstep version
+        env:
+          VERSION: ${{ needs.plan.outputs.version }}
+        run: |
+          set -euo pipefail
+          current="$(uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py check 2>/dev/null || true)"
+          if [ "$current" = "$VERSION" ]; then
+            echo "Already stamped at ${VERSION} — skipping bump (idempotent re-run)."
+          else
+            uv run --no-project --python 3.12 --with packaging \
+              python scripts/update_versions.py pre-release --new-version "$VERSION"
+            uv lock
+            # uv may emit non-canonical lockfile fields (e.g. size on file
+            # entries); normalize like the pre-commit fixer, then hard-verify.
+            python3 scripts/normalize_uv_lock_registry.py uv.lock || true
+            python3 scripts/normalize_uv_lock_registry.py --check uv.lock
+          fi
+          uv run --no-project --python 3.12 --with packaging \
+            python scripts/update_versions.py check --expect "$VERSION"
+
+      - name: Commit, tag, and push
+        env:
+          PUSH_TOKEN: ${{ steps.app-token.outputs.token }}
+          VERSION: ${{ needs.plan.outputs.version }}
+          TAG: ${{ needs.plan.outputs.tag }}
+          BRANCH: ${{ needs.plan.outputs.branch }}
+        run: |
+          set -euo pipefail
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+
+          # Stage everything the stamp touched: update_versions.py owns the
+          # file set, and a hand-kept path list here goes stale whenever a
+          # package joins the lockstep (bump-version.yml stages the same way).
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No version changes to commit (already stamped)."
+          else
+            git commit -s -m "release: ${TAG}"
+          fi
+
+          git tag "$TAG"
+          # One push for branch + tag, via the App token so the tag-push
+          # workflows fire. Non-fast-forward on the branch fails loudly.
+          push_url="https://x-access-token:${PUSH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git push "$push_url" "HEAD:refs/heads/${BRANCH}" "refs/tags/${TAG}"
+          echo "Pushed ${BRANCH} + ${TAG} at $(git rev-parse HEAD)." | tee -a "$GITHUB_STEP_SUMMARY"
+
+      - name: Next steps
+        env:
+          TAG: ${{ needs.plan.outputs.tag }}
+          PRERELEASE: ${{ needs.plan.outputs.prerelease }}
+        run: |
+          set -euo pipefail
+          {
+            echo "## Next steps"
+            echo ""
+            echo "1. Dispatch the secure-release repo on this tag:"
+            echo '   ```'
+            echo "   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \\"
+            echo "     -f ref=${TAG} -f destination=pypi -f dry-run=true    # gates rehearsal"
+            echo "   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \\"
+            echo "     -f ref=${TAG} -f destination=pypi -f dry-run=false   # real publish"
+            echo '   ```'
+            if [ "$PRERELEASE" = "true" ]; then
+              echo "2. Validate the rc from PyPI (see RELEASING.md). No GitHub release is created for rc tags (rcs live on PyPI only) — skip straight to the next rc or the final cut."
+            else
+              echo "2. Merge the CHANGELOG PR, curate the ${TAG} draft notes, then dispatch finalize-release.yml (tag=${TAG})."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # First cut of a cycle (rc1) immediately moves main to the next .dev0 so main
+  # never re-freezes and doc-sync keeps deriving the right X.Y-docs branch.
+  bump-main:
+    needs: [authorize, plan, cut]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+    steps:
+      - name: Dispatch the post-release main bump
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.plan.outputs.version }}
+          DRY_RUN: ${{ inputs.dry_run }}
+          BRANCH_EXISTS: ${{ needs.plan.outputs.branch_exists }}
+        run: |
+          set -euo pipefail
+          # Gate in shell, not a job-level `if`: a CLI/API dispatch delivers
+          # boolean inputs as the STRING "false", which is truthy in an
+          # expression, so `!inputs.dry_run` silently skipped this job at the
+          # v0.7.0 cut. Shell string comparison is dispatch-channel-proof and
+          # logs its decision instead of vanishing from the run.
+          if [ "$DRY_RUN" = "true" ]; then
+            echo "Dry run — not dispatching the main bump." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          if [ "$BRANCH_EXISTS" != "false" ]; then
+            echo "Release branch pre-existed (not the first cut of this cycle) — main bump not needed." \
+              | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          # A cut below main's current line (a throwaway rehearsal rc, or
+          # resurrecting an old series for a backport) must not walk main's
+          # version backwards.
+          MAIN_VERSION="$(gh api -H "Accept: application/vnd.github.raw+json" \
+            "repos/${GITHUB_REPOSITORY}/contents/pyproject.toml?ref=main" \
+            | sed -n 's/^version = "\(.*\)"$/\1/p' | head -1)"
+          export MAIN_VERSION
+          python3 -m pip install --quiet --disable-pip-version-check packaging
+          if ! python3 -c 'import os, sys; from packaging.version import Version; sys.exit(0 if Version(os.environ["VERSION"]) > Version(os.environ["MAIN_VERSION"]) else 1)'; then
+            echo "Released ${VERSION} sorts below main's ${MAIN_VERSION} — skipping the main bump." \
+              | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          gh workflow run bump-version.yml --repo "$GITHUB_REPOSITORY" \
+            -f mode=post-release -f "new_version=${VERSION}" -f base_branch=main
+          echo "Dispatched bump-version.yml (post-release ${VERSION}) — review and merge the main bump PR." \
+            | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/rerun-ci.yml

@@ -0,0 +1,134 @@
+# A contributor comments `/rerun` on a PR to re-run its failed CI **on the
+# existing head commit** -- no empty commit, no rebase, so no push event and
+# thus no dismissed approvals (branch protection keeps dismiss-stale-reviews
+# on to block approve-then-swap). Use for flaky-test recovery instead of
+# pushing a throwaway commit to re-trigger checks.
+#
+# CI here runs entirely against the in-process mock LLM (no gateway spend), so
+# a re-run costs only Actions minutes; `cancel-in-progress` on each suite caps
+# concurrent burn. Polly AI Review (the one real-LLM path) is gated by
+# maintainer approval elsewhere and is intentionally NOT re-run here.
+#
+# Authorization: the PR author (so fork contributors can re-run their own PR)
+# OR a write-access commenter (OWNER/MEMBER/COLLABORATOR). `issue_comment` runs
+# from the base repo, so its token is writable even for fork PRs and is not
+# held behind the fork-approval gate -- unlike `pull_request_target`, this
+# needs no privileged `workflow_run` relay (cf. rerun-security-gate*.yml).
+name: Rerun CI on /rerun comment
+
+on:
+  issue_comment:
+    types: [created]
+
+# Read-only at the top level; write scopes live on the job below.
+permissions:
+  contents: read
+
+concurrency:
+  # One re-run in flight per PR; a second `/rerun` supersedes the first.
+  group: rerun-ci-${{ github.event.issue.number }}
+  cancel-in-progress: false
+
+jobs:
+  rerun:
+    name: Re-run failed CI for the PR head
+    permissions:
+      actions: write        # gh run rerun
+      pull-requests: read   # resolve the PR head SHA
+      issues: write         # react to the comment + post the result
+    # PR comment, body starts with `/rerun`, not a bot, in this repo, AND the
+    # commenter is the PR author or has write access. `issue.user.login` is the
+    # PR author; `comment.user.login` is the commenter.
+    if: >-
+      github.repository == 'omnigent-ai/omnigent'
+      && github.event.issue.pull_request != null
+      && startsWith(github.event.comment.body, '/rerun')
+      && !endsWith(github.actor, '[bot]')
+      && (
+        github.event.comment.author_association == 'OWNER'
+        || github.event.comment.author_association == 'MEMBER'
+        || github.event.comment.author_association == 'COLLABORATOR'
+        || github.event.comment.user.login == github.event.issue.user.login
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # The job `if` startsWith() also matches `/rerunfoo`; re-validate `/rerun`
+      # as a command (first non-space token is exactly `/rerun`, optional args).
+      - name: Validate command
+        id: cmd
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          if ! grep -qE '^[[:space:]]*/rerun([[:space:]]|$)' <<<"$COMMENT_BODY"; then
+            echo "::notice::Comment mentions '/rerun' but not as a command; skipping."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Acknowledge
+        if: steps.cmd.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          COMMENT_ID: ${{ github.event.comment.id }}
+        run: |
+          gh api "repos/$REPO/issues/comments/$COMMENT_ID/reactions" \
+            -f content=eyes --silent || true
+
+      - name: Re-run failed CI runs for the PR head
+        if: steps.cmd.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          # Integer from the payload, but sanitised to digits before shell use.
+          PR_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          set -euo pipefail
+          PR_NUMBER="$(tr -dc '0-9' <<<"$PR_NUMBER")"
+          [ -n "$PR_NUMBER" ] || { echo "::error::Empty PR number."; exit 1; }
+
+          # Resolve the PR's CURRENT head SHA (a push could have superseded any
+          # SHA recorded at comment time).
+          SHA="$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')"
+          echo "PR #$PR_NUMBER head $SHA"
+
+          # Latest run per workflow for this SHA, restricted to `pull_request`
+          # events -- this is the test-suite set (CI, Lint, E2E, E2E UI,
+          # Integration, Docker build, web Tests). It deliberately EXCLUDES the
+          # merge machinery (Merge Ready, Maintainer Approval, Polly) which run
+          # on pull_request_target / workflow_run / issue_comment, so `/rerun`
+          # never re-triggers a gate or the real-LLM review.
+          mapfile -t FAILED < <(
+            gh api "repos/$REPO/actions/runs?head_sha=$SHA&per_page=100" --paginate \
+              --jq '[.workflow_runs[] | select(.event=="pull_request")]
+                    | group_by(.name)
+                    | map(sort_by(.created_at) | last)
+                    | .[] | select(.conclusion=="failure")
+                    | "\(.id)\t\(.name)"'
+          )
+
+          if [ "${#FAILED[@]}" -eq 0 ]; then
+            echo "No failed pull_request CI runs for $SHA."
+            gh pr comment "$PR_NUMBER" --repo "$REPO" \
+              --body "🔁 \`/rerun\`: no failed CI runs on the current head (\`${SHA:0:7}\`) to re-run. If a check is stuck *pending*, it needs a push or a maintainer, not a re-run."
+            exit 0
+          fi
+
+          RERAN=""
+          while IFS=$'\t' read -r id name; do
+            [ -n "$id" ] || continue
+            echo "• Re-running failed jobs in '$name' (run $id)"
+            # --failed: re-run only the failed jobs (cheapest path for a flake).
+            # --repo is REQUIRED: this job has no checkout, so `gh run rerun`
+            # cannot infer the repo from a git remote and would fail client-side.
+            if gh run rerun "$id" --repo "$REPO" --failed; then
+              RERAN="$RERAN"$'\n'"- $name"
+            else
+              echo "::warning::Could not re-run '$name' (run $id) -- may be in progress."
+              RERAN="$RERAN"$'\n'"- $name ⚠️ (skipped: already running or not re-runnable)"
+            fi
+          done < <(printf '%s\n' "${FAILED[@]}")
+
+          NOTE="The \`Merge Ready\` gate re-evaluates automatically when these complete."
+          gh pr comment "$PR_NUMBER" --repo "$REPO" \
+            --body "🔁 \`/rerun\`: re-running failed jobs on \`${SHA:0:7}\`:${RERAN}"$'\n\n'"$NOTE"

.github/workflows/review-sla.yml

@@ -1,18 +1,16 @@
 name: Reviewer SLA
 
-# Daily (weekday) sweep that enforces a 5-working-day reviewer SLA: any open PR
+# Manual-only sweep that enforces a 5-working-day reviewer SLA: any open PR
 # awaiting review from a maintainer -- or open issue awaiting a maintainer
 # assignee -- with no reply in 5 working days gets the assignee re-pinged in a
 # comment plus a second reviewer (PR) / second assignee (issue), then a one-shot
 # `review-sla-escalated` label so it's never nudged twice. All logic + safety
 # notes live in review-sla.js (offline unit test: review-sla.test.js).
 #
-# Scheduled -> runs on the trusted default branch with the repo GITHUB_TOKEN; it
-# reads no PR-authored code, only .github/ config + the issues/PRs API.
+# Runs on the trusted default branch with the repo GITHUB_TOKEN; it reads no
+# PR-authored code, only .github/ config + the issues/PRs API.
 
 on:
-  schedule:
-    - cron: "0 8 * * 1-5" # 08:00 UTC, Mon-Fri (weekday SLA -> no weekend pings)
   workflow_dispatch:
 
 permissions:

.github/workflows/security-triage.yml

@@ -195,10 +195,14 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          mkdir -p "${GITHUB_WORKSPACE}/.cc-cli" && cd "${GITHUB_WORKSPACE}/.cc-cli"
-          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.170
+          # Install outside the checked-out tree: a repo-root package.json would
+          # otherwise capture this bare `npm install` and hoist it there, leaving
+          # this dir's node_modules empty.
+          CC_CLI_DIR="${RUNNER_TEMP}/omnigent-cc-cli"
+          mkdir -p "$CC_CLI_DIR" && cd "$CC_CLI_DIR"
+          npm install --ignore-scripts --no-audit --no-fund @anthropic-ai/claude-code@2.1.212
           node node_modules/@anthropic-ai/claude-code/install.cjs
-          echo "${GITHUB_WORKSPACE}/.cc-cli/node_modules/.bin" >> "$GITHUB_PATH"
+          echo "$CC_CLI_DIR/node_modules/.bin" >> "$GITHUB_PATH"
 
       - name: Write gateway profile (~/.databrickscfg)
         if: steps.creds.outputs.available == 'true'
@@ -222,7 +226,9 @@ jobs:
         if: steps.creds.outputs.available == 'true'
         env:
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          OMNIGENT_AGENT_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
         run: |
+          : "${OMNIGENT_AGENT_MODEL:?Set OMNIGENT_CI_FAST_ANTHROPIC_MODEL}"
           mkdir -p "$HOME/.omnigent"
           python3 -c "
           import pathlib, os, json
@@ -235,7 +241,7 @@ jobs:
                       'anthropic': {
                           'base_url': gw + '/anthropic',
                           'api_key_ref': 'env:LLM_API_KEY',
-                          'models': {'default': 'databricks-claude-sonnet-4-6'},
+                          'models': {'default': os.environ['OMNIGENT_AGENT_MODEL']},
                       },
                   }
               }

.github/workflows/server-compat.yml

@@ -4,7 +4,7 @@ name: Backwards-Compat
 # suites, over the FULL pairwise (server, runner) version matrix.
 #
 # The version universe is `main` (the checked-out code = client + tests, always)
-# plus every non-rc release tag; we cross every server version with every runner
+# plus every final (non-prerelease) release tag; we cross every server version with every runner
 # version. Each cell pins the server and/or runner subprocess to that build
 # (a "main" axis value leaves that component on the checked-out code) while the
 # client and tests stay on main. The (main, main) cell is omitted — it pins
@@ -18,13 +18,13 @@ name: Backwards-Compat
 #
 # Triggers:
 #   workflow_dispatch   manual; optional `versions` CSV overrides the set.
-#   schedule            every 12h; full pairwise over main + all non-rc tags.
+#   schedule            every 12h; full pairwise over main + all final tags.
 
 on:
   workflow_dispatch:
     inputs:
       versions:
-        description: "Comma-separated version set for BOTH axes (e.g. 'main,v0.2.0'). Empty = main + all non-rc tags."
+        description: "Comma-separated version set for BOTH axes (e.g. 'main,v0.2.0'). Empty = main + all final (non-prerelease) tags."
         required: false
         default: ""
   schedule:

.github/workflows/ui-preview.yml

@@ -106,7 +106,7 @@ jobs:
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
         with:
           enable-cache: true
-      - uses: ./.github/actions/setup-node
+      - uses: ./.github/actions/setup-pnpm
 
       - name: Build wheels (no UI)
         # Build the wheels WITHOUT the SPA so they stay small (Databricks Apps
@@ -120,10 +120,11 @@ jobs:
         run: bash deploy/databricks/build.sh
 
       - name: Build UI
-        working-directory: web
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Package UI assets
         run: |

.github/workflows/ui-snapshot-update.yml

@@ -80,8 +80,18 @@ jobs:
           ref: ${{ github.event.pull_request.head.ref }}
           persist-credentials: false
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      # The pinned Playwright image doesn't ship Node, so install Node before
+      # the pnpm action (pnpm/action-setup's self-installer needs a Node binary).
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.15.1
+          standalone: true
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -106,9 +116,8 @@ jobs:
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Compare the baselines (no --update-snapshots)
         # Deliberately NOT --update-snapshots: that rewrites EVERY PNG, churning

.github/workflows/ui-snapshot.yml

@@ -95,7 +95,7 @@ jobs:
           if ! files=$(gh api "repos/$REPO/pulls/$PR/files" --paginate --jq '.[].filename'); then
             echo "ui=true" >> "$GITHUB_OUTPUT"; echo "file list unavailable -> render"; exit 0
           fi
-          pattern='^(web/|tests/e2e_ui/visual/|tests/e2e_ui/conftest\.py|\.github/actions/setup-node/|\.github/workflows/ui-snapshot\.yml|pyproject\.toml|uv\.lock)'
+          pattern='^(web/|tests/e2e_ui/visual/|tests/e2e_ui/conftest\.py|\.github/actions/setup-pnpm/|\.github/workflows/ui-snapshot\.yml|pnpm-lock\.yaml|pnpm-workspace\.yaml|pyproject\.toml|uv\.lock)'
           if printf '%s\n' "$files" | grep -qE "$pattern"; then
             echo "ui=true" >> "$GITHUB_OUTPUT"
             echo "render-affecting files changed:"
@@ -106,7 +106,7 @@ jobs:
           fi
 
   ui-snapshot:
-    name: UI Snapshot (visual baselines) [non-blocking]
+    name: UI Snapshot (visual baselines)
     needs: detect
     # Skipped (not failed) when no render input changed -> reports SUCCESS, so a
     # non-UI PR neither runs the render nor blocks a required check.
@@ -130,8 +130,18 @@ jobs:
         with:
           ref: ${{ github.event.inputs.ref || github.ref }}
 
-      - name: Set up Node 20
-        uses: ./.github/actions/setup-node
+      # The pinned Playwright image doesn't ship Node, so install Node before
+      # the pnpm action (pnpm/action-setup's self-installer needs a Node binary).
+      - name: Set up Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "22"
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.15.1
+          standalone: true
 
       - name: Install uv
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
@@ -156,14 +166,12 @@ jobs:
 
       - name: Build web SPA
         # Build BEFORE pytest: Vite's emptyOutDir clobbers the static dir, so
-        # never run it alongside the live server. --legacy-peer-deps avoids
-        # re-resolving the known React 19 peer conflict under @emoji-mart/react.
+        # never run it alongside the live server.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          cd web
-          npm ci --legacy-peer-deps --no-audit --no-fund
-          npm run build
+          pnpm install --frozen-lockfile --filter web
+          pnpm --filter web run build
 
       - name: Compare (PR) or regenerate (dispatch) the visual snapshots
         id: snapshot

.github/workflows/update-homebrew.yml

@@ -0,0 +1,303 @@
+# Open the omnigent-ai/homebrew-tap version-bump PR when a FINAL release is
+# published (designs/RELEASE-AUTOMATION.md). This is the missing link that let
+# the tap freeze while PyPI moved on: the tap already builds bottles on every
+# PR (brew test-bot) and publishes them on the `pr-pull` label — nobody was
+# opening the bump PR.
+#
+# What it does: wait for the new sdist on PyPI, rewrite the formula's
+# url/sha256 (dropping any bottle `revision`), regenerate the pinned Python
+# resources with `brew update-python-resources`, sanity-check that the
+# hand-maintained sections survived, and open the tap PR. A human reviews the
+# resource diff and applies `pr-pull`; the tap's own automation bottles and
+# merges. The omnigent-desktop cask is `version :latest` and needs nothing.
+#
+# Pre-releases never reach the tap. The `release: published` trigger fires
+# from finalize-release.yml's App-token publish; `workflow_dispatch` covers
+# retries and catch-up (e.g. jumping the formula straight to the newest
+# version after a missed cycle).
+#
+# brew resolves resources through pip's `--uploaded-prior-to=P1D` window, so a
+# run within 24h of the PyPI upload cannot see the new sdist and used to go
+# red every release day (v0.6.0, v0.7.0). Now: runs inside that window defer
+# (green, with a warning), and the nightly `schedule` catch-up — which targets
+# the latest published release and no-ops when the formula is already
+# current — opens the tap PR once the window has passed.
+name: Update Homebrew tap
+
+on:
+  release:
+    types: [published]
+  schedule:
+    # Nightly catch-up for the P1D window (see header). No-ops when current.
+    - cron: "45 23 * * *"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Final release tag to bump the tap to, e.g. v0.6.0."
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: update-homebrew-${{ github.event.release.tag_name || inputs.tag || 'nightly' }}
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    name: Resolve release tag
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      tag: ${{ steps.r.outputs.tag }}
+      is_final: ${{ steps.r.outputs.is_final }}
+    steps:
+      - name: Resolve tag and finality
+        id: r
+        env:
+          GH_TOKEN: ${{ github.token }}
+          EVENT_TAG: ${{ github.event.release.tag_name }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+          INPUT_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          tag="${INPUT_TAG:-$EVENT_TAG}"
+          if [ -z "$tag" ]; then
+            # Scheduled catch-up: target the latest published final release
+            # (empty when the repo has none yet — resolves to is_final=false).
+            tag="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq .tag_name 2>/dev/null || echo "")"
+          fi
+          is_final=true
+          case "$tag" in
+            v[0-9]*.[0-9]*.[0-9]*) ;;
+            *) is_final=false ;;
+          esac
+          case "$tag" in
+            *rc*|*dev*|*a[0-9]*|*b[0-9]*) is_final=false ;;
+          esac
+          if [ "${PRERELEASE}" = "true" ]; then
+            is_final=false
+          fi
+          {
+            echo "tag=${tag}"
+            echo "is_final=${is_final}"
+          } >> "$GITHUB_OUTPUT"
+          echo "Resolved tag=${tag} is_final=${is_final}" | tee -a "$GITHUB_STEP_SUMMARY"
+
+  bump:
+    name: Open tap bump PR
+    needs: resolve
+    # Canonical repo only; skip cleanly where the App isn't configured. The
+    # release-event path is already gated by finalize-release's environment
+    # approval; only manual dispatches need the role check below.
+    if: >-
+      needs.resolve.outputs.is_final == 'true' &&
+      github.repository == 'omnigent-ai/omnigent' &&
+      vars.OMNIGENT_BOT_APP_ID != ''
+    # macOS: `brew update-python-resources` evaluates the formula (with its
+    # on_macos blocks) in a real Homebrew.
+    runs-on: macos-latest
+    timeout-minutes: 30
+    env:
+      TAG: ${{ needs.resolve.outputs.tag }}
+      TAP_REPO: ${{ github.repository_owner }}/homebrew-tap
+    steps:
+      - name: Require admin/maintain role (manual dispatches)
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          role="$(gh api "repos/${GITHUB_REPOSITORY}/collaborators/${ACTOR}/permission" --jq .role_name)"
+          case "$role" in
+            admin|maintain)
+              echo "Dispatcher ${ACTOR} has role ${role} — authorized." ;;
+            *)
+              echo "::error::Release workflows require the admin or maintain role (dispatcher ${ACTOR} has '${role}')."
+              exit 1 ;;
+          esac
+
+      - name: Wait for the sdist on PyPI
+        id: sdist
+        run: |
+          set -euo pipefail
+          version="${TAG#v}"
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          for _ in $(seq 1 30); do
+            if json="$(curl -fsS "https://pypi.org/pypi/omnigent/${version}/json" 2>/dev/null)"; then
+              url="$(printf '%s' "$json" | jq -r '.urls[] | select(.packagetype == "sdist") | .url')"
+              sha="$(printf '%s' "$json" | jq -r '.urls[] | select(.packagetype == "sdist") | .digests.sha256')"
+              if [ -n "$url" ] && [ -n "$sha" ]; then
+                {
+                  echo "url=${url}"
+                  echo "sha=${sha}"
+                } >> "$GITHUB_OUTPUT"
+                echo "sdist for ${version}: ${url}"
+                exit 0
+              fi
+            fi
+            echo "omnigent==${version} not visible on PyPI yet — retrying in 20s…"
+            sleep 20
+          done
+          echo "::error::omnigent==${version} never appeared on PyPI (is the secure-repo publish done?)."
+          exit 1
+
+      - name: Mint App token (homebrew-tap)
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ vars.OMNIGENT_BOT_APP_ID }}
+          private-key: ${{ secrets.OMNIGENT_BOT_APP_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: homebrew-tap
+
+      - name: Checkout the tap
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: ${{ env.TAP_REPO }}
+          token: ${{ steps.app-token.outputs.token }}
+          path: tap
+          persist-credentials: false
+
+      - name: Skip when the formula is already at this version
+        id: current
+        working-directory: tap
+        env:
+          VERSION: ${{ steps.sdist.outputs.version }}
+        run: |
+          set -euo pipefail
+          # Nightly catch-up no-op: the stable url already points at this sdist.
+          if grep -q "omnigent-${VERSION}\.tar\.gz" Formula/omnigent.rb; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Formula already at ${VERSION} — nothing to do." | tee -a "$GITHUB_STEP_SUMMARY"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Homebrew
+        if: steps.current.outputs.skip != 'true'
+        uses: Homebrew/actions/setup-homebrew@18fcb8e3e06b4247c676c506750dc95ea7226479 # 2026-07-10
+        with:
+          token: ${{ github.token }}
+
+      - name: Rewrite the formula's stable url/sha256
+        if: steps.current.outputs.skip != 'true'
+        working-directory: tap
+        env:
+          SDIST_URL: ${{ steps.sdist.outputs.url }}
+          SDIST_SHA: ${{ steps.sdist.outputs.sha }}
+        run: |
+          set -euo pipefail
+          python3 - <<'PYEOF'
+          import os, pathlib, re
+          path = pathlib.Path("Formula/omnigent.rb")
+          text = path.read_text(encoding="utf-8")
+          # The formula's own url/sha256 sit at 2-space indent; resource and
+          # bottle entries are deeper, so first-match at this indent is safe.
+          text, n_url = re.subn(r'(?m)^  url ".*"$', f'  url "{os.environ["SDIST_URL"]}"', text, count=1)
+          text, n_sha = re.subn(r'(?m)^  sha256 ".*"$', f'  sha256 "{os.environ["SDIST_SHA"]}"', text, count=1)
+          text, _ = re.subn(r'(?m)^  revision \d+\n', "", text, count=1)
+          assert n_url == 1 and n_sha == 1, f"unexpected formula shape (url={n_url}, sha={n_sha})"
+          path.write_text(text, encoding="utf-8")
+          PYEOF
+          git diff --stat
+
+      - name: Regenerate the pinned Python resources
+        id: regen
+        if: steps.current.outputs.skip != 'true'
+        env:
+          HOMEBREW_NO_AUTO_UPDATE: "1"
+          HOMEBREW_NO_INSTALL_FROM_API: "1"
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # Make the checkout visible to brew as the real tap.
+          tap_root="$(brew --repository)/Library/Taps/omnigent-ai"
+          mkdir -p "$tap_root"
+          ln -sfn "${GITHUB_WORKSPACE}/tap" "${tap_root}/homebrew-tap"
+          # Excluded packages stay hand-maintained in the formula: the brewed
+          # deps (certifi/cryptography/pydantic/rpds-py and their transitive
+          # cffi/pycparser) and the platform-conditional google-antigravity
+          # wheel stanzas.
+          if ! brew update-python-resources \
+            --exclude-packages=certifi,cryptography,pydantic,rpds-py,cffi,pycparser,google-antigravity \
+            omnigent-ai/tap/omnigent; then
+            # brew resolves through pip's --uploaded-prior-to=P1D window: a
+            # release <24h old is invisible and resolution ALWAYS fails. Defer
+            # to the nightly catch-up instead of going red; older releases are
+            # real failures.
+            published_at="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${TAG}" --jq .published_at 2>/dev/null || echo "")"
+            age_h=999
+            if [ -n "$published_at" ]; then
+              age_h="$(python3 -c 'import datetime, sys; d = datetime.datetime.fromisoformat(sys.argv[1].replace("Z", "+00:00")); print(int((datetime.datetime.now(datetime.timezone.utc) - d).total_seconds() // 3600))' "$published_at")"
+            fi
+            if [ "$age_h" -lt 24 ]; then
+              echo "deferred=true" >> "$GITHUB_OUTPUT"
+              echo "::warning::Resource resolution failed with ${TAG} only ${age_h}h old — inside pip's --uploaded-prior-to=P1D window. The nightly catch-up will open the tap PR."
+              echo "Deferred to the nightly catch-up (${TAG} is ${age_h}h old, inside the 24h PyPI window)." >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+            fi
+            exit 1
+          fi
+          echo "deferred=false" >> "$GITHUB_OUTPUT"
+          brew style omnigent-ai/tap/omnigent
+
+      - name: Assert the hand-maintained sections survived
+        if: steps.current.outputs.skip != 'true' && steps.regen.outputs.deferred != 'true'
+        working-directory: tap
+        run: |
+          set -euo pipefail
+          fail=0
+          for needle in 'resource "google-antigravity"' 'depends_on "pydantic"' 'depends_on "cryptography"'; do
+            if ! grep -qF "$needle" Formula/omnigent.rb; then
+              echo "::error::update-python-resources dropped: ${needle} — fix the formula by hand this cycle."
+              fail=1
+            fi
+          done
+          [ "$fail" -eq 0 ]
+          # The lockstep siblings must have moved with the release. Match the
+          # sdist filename (PEP 503-normalized name + version) in the resource
+          # url, not a bare version substring.
+          version="${TAG#v}"
+          for sib in omnigent-client omnigent-ui-sdk; do
+            if ! grep -A2 "resource \"${sib}\"" Formula/omnigent.rb | grep -q "${sib//-/_}-${version}"; then
+              echo "::error::resource ${sib} did not update to ${version}."
+              exit 1
+            fi
+          done
+
+      - name: Open or update the tap bump PR
+        if: steps.current.outputs.skip != 'true' && steps.regen.outputs.deferred != 'true'
+        working-directory: tap
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          VERSION: ${{ steps.sdist.outputs.version }}
+        run: |
+          set -euo pipefail
+          if [ -z "$(git status --porcelain -- Formula/omnigent.rb)" ]; then
+            echo "Formula already at ${VERSION} — nothing to do." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          BRANCH="bump-omnigent-${VERSION}"
+          git config user.name "omnigent-ci[bot]"
+          git config user.email "294685417+omnigent-ci[bot]@users.noreply.github.com"
+          PUSH_URL="https://x-access-token:${GH_TOKEN}@github.com/${TAP_REPO}.git"
+          git switch -C "$BRANCH"
+          git add Formula/omnigent.rb
+          git commit -m "omnigent ${VERSION}"
+          git push --force "$PUSH_URL" "$BRANCH"
+
+          if [ -n "$(gh pr list --repo "$TAP_REPO" --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
+            echo "Bump PR already open for ${BRANCH} — force-push updated it." | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          body="$(printf 'Bumps the omnigent formula to **%s** (new sdist url/sha256, resources regenerated via `brew update-python-resources`).\n\ntest-bot builds the bottles on this PR. Review the resource diff — especially that the extras'"'"' deps survived — then apply the `pr-pull` label to publish bottles and merge.\n\nOpened by omnigent `.github/workflows/update-homebrew.yml`.' "$VERSION")"
+          gh pr create \
+            --repo "$TAP_REPO" \
+            --base main \
+            --head "$BRANCH" \
+            --title "omnigent ${VERSION}" \
+            --body "$body"
+          echo "Opened tap bump PR for omnigent ${VERSION}." | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/vscode-extension-release.yml

@@ -68,15 +68,16 @@ jobs:
         with:
           ref: release/vscode-v${{ inputs.version }}
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: "20"
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install, build, and package
+        env:
+          NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
         run: |
-          npm ci
-          npm run build
-          npm run package
+          pnpm install --frozen-lockfile --filter omnigent-vscode
+          pnpm --filter omnigent-vscode run build
+          pnpm --filter omnigent-vscode run package
 
       - name: Resolve tag and verify package.json version
         id: meta

.github/workflows/vscode-release-pr.yml

@@ -62,6 +62,9 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
+
       - name: Validate version
         env:
           VERSION: ${{ inputs.version }}
@@ -80,10 +83,10 @@ jobs:
         working-directory: editors/vscode
         env:
           VERSION: ${{ inputs.version }}
-        # `npm pkg set` edits ONLY package.json (unlike `npm version`, which also
-        # rewrites package-lock.json). Keeps the release PR to package.json +
+        # `pnpm pkg set` edits ONLY package.json (unlike `pnpm version`, which
+        # also rewrites the lockfile). Keeps the release PR to package.json +
         # CHANGELOG.md.
-        run: npm pkg set version="$VERSION"
+        run: pnpm pkg set version="$VERSION"
 
       - name: Add the CHANGELOG section (placeholder)
         working-directory: editors/vscode
@@ -167,6 +170,7 @@ jobs:
         env:
           LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
           GATEWAY_BASE_URL: ${{ secrets.GATEWAY_BASE_URL }}
+          DRAFTER_MODEL: ${{ vars.OMNIGENT_CI_FAST_ANTHROPIC_MODEL }}
           VERSION: ${{ inputs.version }}
         run: |
           set -euo pipefail
@@ -174,6 +178,10 @@ jobs:
             echo "::warning::No LLM credentials — keeping the CHANGELOG placeholder."
             exit 0
           fi
+          if [ -z "${DRAFTER_MODEL:-}" ]; then
+            echo "::warning::Repository variable OMNIGENT_CI_FAST_ANTHROPIC_MODEL is empty — keeping the CHANGELOG placeholder."
+            exit 0
+          fi
           echo "::add-mask::${LLM_API_KEY}"
           python3 - "$VERSION" <<'PY'
           import json, os, re, pathlib, sys, urllib.request
@@ -201,7 +209,7 @@ jobs:
 
           url = os.environ["GATEWAY_BASE_URL"].rstrip("/") + "/chat/completions"
           payload = json.dumps({
-              "model": "databricks-claude-sonnet-4-6",
+              "model": os.environ["DRAFTER_MODEL"],
               "max_tokens": 1024,
               "temperature": 0,
               "messages": [

.github/workflows/waiting-on-author-test.yml

@@ -0,0 +1,31 @@
+name: Waiting on Author Test
+
+# Offline unit test for waiting-on-author hygiene. Runs on PR head without
+# secrets or network and only when the workflow logic changes.
+
+on:
+  pull_request:
+    paths:
+      - .github/scripts/waiting_on_author.py
+      - .github/scripts/waiting_on_author_test.py
+      - .github/workflows/waiting-on-author.yml
+      - .github/workflows/waiting-on-author-test.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: waiting-on-author-test-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run waiting-on-author unit test
+        run: python3 .github/scripts/waiting_on_author_test.py

.github/workflows/waiting-on-author.yml

@@ -0,0 +1,46 @@
+name: Waiting on Author Hygiene
+
+# Keeps the `waiting-on-author` PR label actionable: author activity clears it,
+# and PRs that sit in that state for 7 days are closed. The workflow runs from
+# trusted default-branch code and never checks out PR-authored files.
+
+on:
+  pull_request_target:
+    types: [synchronize]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+  schedule:
+    - cron: "0 */12 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: waiting-on-author-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  hygiene:
+    if: github.repository == 'omnigent-ai/omnigent'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Check out .github
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          sparse-checkout: .github
+          persist-credentials: false
+      - name: Update waiting-on-author state
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: python3 .github/scripts/waiting_on_author.py

.github/workflows/web-tests.yml

@@ -24,14 +24,14 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Security precondition gate: npm ci/test runs the PR's own install hooks and
+  # Security precondition gate: pnpm install/test runs the PR's own install hooks and
   # test code, so untrusted PRs are held until the scan passes (security-gate.yml).
   # Trusted authors and non-PR events pass through.
   gate:
     uses: ./.github/workflows/security-gate.yml
 
-  npm-test:
-    name: npm test
+  web-test:
+    name: web test
     needs: gate
     if: ${{ !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
@@ -41,31 +41,29 @@ jobs:
       - name: Check out repo
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      - name: Set up Node.js
-        uses: ./.github/actions/setup-node
+      - name: Set up pnpm
+        uses: ./.github/actions/setup-pnpm
 
       - name: Install dependencies
-        working-directory: web
-        # Pin the npm registry to the npmjs default.
+        # Pin the npm registry to the npmjs default; limit to the web package
+        # so the Electron package's large native devDependencies are not fetched.
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org/
-        run: npm ci --legacy-peer-deps
+        run: pnpm install --frozen-lockfile --filter web
 
       - name: Check formatting
-        working-directory: web
-        run: npm run format:check
+        run: pnpm --filter web run format:check
 
       - name: Run tests with coverage
-        working-directory: web
-        run: npm run test:coverage
+        run: pnpm --filter web run test:coverage
 
       # Distill the v8 json-summary into a single total.txt, mirroring the
       # backend's coverage-report job. ui-code-coverage.yml (privileged
       # workflow_run) consumes this artifact and posts the report-only status.
       - name: Summarize coverage
         if: always()
-        working-directory: web
         run: |
+          cd web
           mkdir -p ui-coverage-summary
           if [[ ! -f coverage/coverage-summary.json ]]; then
             echo "::warning::No coverage-summary.json; skipping UI coverage report."

.gitignore

@@ -2,6 +2,8 @@
 build/
 dist/
 node_modules/
+.pnpm-store/
+.pnpm-debug.log*
 reviews/
 
 # Generated artifact; never committed.
@@ -57,6 +59,7 @@ dev/omnidev/target/
 
 # Playwright test run output (screenshots, traces, videos).
 test-results/
+output/playwright/
 
 # Visual-snapshot failure output (actual/expected/diff PNGs from the UI diff
 # gate). Regenerated each run; only the baseline under

.pre-commit-config.yaml

@@ -1,6 +1,5 @@
-# Pre-commit hooks for this repository: ruff (format + check) plus standard
-# file-hygiene checks. Heavier validation (typing, lockfile freshness,
-# OpenAPI drift) runs in CI rather than as commit-time hooks.
+# Pre-commit hooks for this repository: ruff, Pyrefly, project-specific lint,
+# and standard file-hygiene checks.
 #
 # A built web-UI bundle may be committed at this path (vendored, minified
 # JS/CSS) — never lint or "fix" it.
@@ -20,6 +19,13 @@ repos:
         entry: .venv/bin/python -m ruff check --fix --force-exclude
         types: [python]
 
+      - id: pyrefly
+        name: pyrefly
+        language: system
+        entry: .venv/bin/pyrefly check
+        pass_filenames: false
+        files: ^(omnigent/.*\.pyi?|pyproject\.toml|pyrefly\.toml|uv\.lock)$
+
       # Project-specific test-quality lint rules (dev/lint/). Run on test
       # files only — the patterns never occur in production code.
       - id: no-global-asyncio-patch
@@ -36,16 +42,31 @@ repos:
         types: [python]
         files: ^tests/
 
+      - id: no-hardcoded-models
+        name: no new hardcoded LLM model ids
+        language: system
+        entry: .venv/bin/python dev/lint/lint_no_hardcoded_models.py
+        pass_filenames: false
+        files: \.(py|ya?ml|json|toml|sh)$
+        exclude: (^|/)tests/|^openapi\.json$
+
       - id: web-prettier
         name: web prettier
         language: system
-        entry: npm --prefix web exec -- prettier --write
+        entry: bash -c 'test -x web/node_modules/.bin/prettier && web/node_modules/.bin/prettier --write "$@"' --
         files: ^web/.*\.(css|html|js|jsx|json|md|mdx|ts|tsx|yaml|yml)$
         # Exclude generated assets: web-ui build output, Xcode asset catalogs,
         # and Apple Icon Composer `.icon` bundles (machine-formatted; prettier
         # fights the tooling).
         exclude: ^(omnigent/server/static/web-ui/assets/|web/.*\.xcassets/|web/.*\.icon/)
 
+      - id: web-oxlint
+        name: web oxlint
+        language: system
+        entry: bash -c 'test -x web/node_modules/.bin/oxlint && cd web && node_modules/.bin/oxlint --deny-warnings .'
+        files: ^(web/.*\.[cm]?[jt]sx?|web/\.oxlintrc\.json|web/package\.json|pnpm-lock\.yaml)$
+        pass_filenames: false
+
       # Android Kotlin formatting + linting via ktlint (config:
       # web/android/.editorconfig). The wrapper no-ops when ktlint is absent,
       # so local machines without ktlint installed skip cleanly. CI installs

AGENTS.md

@@ -9,6 +9,17 @@ Run the `pre-commit` hook before committing (`pre-commit run --all-files`, or
 let it run on staged files via `git commit`). Fix any issues it reports so the
 commit lands clean — CI runs the same checks.
 
+## Local development shortcuts
+
+Use `just` for common tasks; run `just --list` for grouped recipes.
+
+- `just ensure` — install/check prerequisites
+- `just run-ios` / `just run-android` — build/run mobile apps
+- `just dev` / `just dev-mobile` — start the omnigent dev pod
+- `just electron-dev` / `just electron-build` — Electron desktop shell
+- `just lint` / `just lint-all` — run pre-commit
+- `just normalize-locks` — rewrite lockfile registries to PyPI/npmjs.org
+
 ## Pull requests
 
 When you open a pull request, fill in the repo's PR template at
@@ -30,6 +41,20 @@ Generate the description from the actual diff and this session's context — lea
 with the motivation, then the change. Don't pass a `--body` that skips these
 sections.
 
+## Finishing a task
+
+When you finish a task, print instructions to the user on how to test it: the
+commands to run, the inputs to provide, or the steps to reproduce so they can
+verify the result themselves. Don't leave the user guessing how to confirm the
+work — tell them exactly what to do.
+
+## Deprecating features
+
+When deprecating a feature, note the version in which it is expected to be
+removed so we can clean it up when that version ships. Call out the deprecation
+version in code (e.g. a `@deprecated` tag or comment naming the target release)
+and in the PR/commit description, so there's a clear marker to act on later.
+
 ## Code comments
 
 Keep comments short and focused on the code, not on the change history.
@@ -41,3 +66,17 @@ Keep comments short and focused on the code, not on the change history.
   *why* it exists, in terms a future reader needs. Don't reference PR numbers,
   issue numbers, or ticket IDs (e.g. `#1646`, `fixes JIRA-123`); the scenario
   should be clear without chasing external links.
+
+## Framework-owned instructions
+
+Keep runtime lifecycle and metadata instructions separate from portable agent
+instructions:
+
+- Agent-spec and per-request instructions are user-authored. Framework-owned
+  instructions are additive runtime behavior and are appended after them in
+  `omnigent/runtime/prompt.py`.
+- Keep the canonical instruction text and lifecycle gate in the owning framework
+  module. Harness adapters should only transport the composed instructions; do
+  not duplicate policy across adapters or add lifecycle metadata to `AgentSpec`.
+- If framework instructions grow beyond a small ordered list, introduce a
+  structured `FrameworkInstructions` value at the prompt-composition boundary.

CHANGELOG.md

@@ -5,6 +5,477 @@ generated at release time from each PR's `## Changelog` section, tagged by the
 PR's `Type of change` (e.g. `[UI]`); the concise, curated highlights live on the
 website under `/releases`.
 
+## [v0.8.1] — 2026-08-03
+
+- [UI] Reverted the v0.8.0 "Chat/Terminal switcher in the header" change; the
+  switcher returns to its previous location. (#3931)
+
+## [v0.8.0] — 2026-08-03
+
+- [Bug fix] Cursor YOLO sessions no longer stall piloted parents on mirrored tool-approval cards when Cursor leaves a lingering pending gate. (#2338)
+- [Feature] codex-native startup-timeout errors now name the resolved provider/model routing (and the login-fallback case) instead of pointing at the runner log (#2843)
+- [UI / Bug fix / Feature] Pi can now create task plans and display them in the shared Tasks panel without requiring an optional Pi extension. (#2884)
+- [Feature] `detect_loop` builtin policy catches agents stuck retrying the same tool call and prompts for approval to break the loop (#3158)
+- [Feature] New `detect_thrashing` builtin policy detects when an agent is stuck in a failure loop and alerts the user to intervene. (#3160)
+- [Bug fix] kimi sub-agents now report completion to a parent orchestrator instead of leaving the fan-out waiting forever. (#3166)
+- [UI / Bug fix / Chore / Test/CI] Conversations show their newest messages immediately, pin the latest turn below the header, and load older context smoothly near the top. (#3228)
+- [Docs / Chore / Breaking] The `run_<x>_native` launchers accept a uniform `extra_args`; the per-harness `<x>_args` keyword is deprecated and will be removed in 0.9.0. (#3244)
+- [Bug fix] Intelligent routing no longer drops the first message on a new claude-native session (#3257)
+- [Feature] `linux_bwrap` sandboxes and their egress rules now run on the Databricks Lakebox backend. (#3258)
+- [Feature] `sandbox.kubernetes.secret_mounts` projects a Secret as a rotation-friendly read-only file volume on the runner (#3280)
+- [Bug fix] Session cost panel now shows a per-model breakdown for sub-agents/second heads (e.g. Debby's GPT head, Polly's codex sub-agents) running on an unpinned codex model, instead of folding their usage into the total with no per-model entry. (#3287)
+- [Bug fix] Fix `antigravity-native` readiness detection for `agy` CLI installs on macOS where OAuth credentials live in Keychain (#3289)
+- [Bug fix] Fixed a race condition where deleting two admins at nearly the same time could leave a deployment with zero admins and no way to recover through the API. (#3304)
+- [Docs / Chore] Resuming a goose / hermes / antigravity / qwen / opencode native session now attaches to the live TUI instead of double-posting each message through the Omnigent REPL. (#3314)
+- [UI / Feature] Workspace rail now shows files and shells as editor-style tabs, opens shells in-rail instead of replacing the chat, adds a full-screen toggle, and adds a "+" menu for creating shells with a remembered type picker (#3333)
+- [UI / Bug fix / Feature / Test/CI] `omnigent setup` can import OpenClaw/acpx coding agents from an auto-detected or user-selected config into the generic ACP harness picker, and `omnigent run --from-openclaw <agent>` can try one without saving it. (#3354)
+- [Feature] Polly can launch supported Claude and Codex implementation children in goal mode. (#3362)
+- [Bug fix] Claude sessions started with a model alias (e.g. Opus) no longer fail on gateway setups that can't pin the alias — the launch resolves to a routable model id. (#3378)
+- [Feature] `omni setup` now supports signing in to Antigravity with Google OAuth through `agy`, alongside Gemini API keys. (#3391)
+- [UI / Feature] Archived sessions in Settings are now grouped by date (Today, Yesterday, Previous 7/30 days, month/year) for easier browsing. (#3394)
+- [UI / Bug fix] Subagent graph view nodes are now clickable and navigate to the selected session. (#3395)
+- [Bug fix] Dedupe codex-native's per-session plugin cache to reclaim disk (#3401)
+- [Bug fix / Test/CI] Shared-session sub-agent completion notices are attributed to the collaborator who dispatched the sub-agent. (#3409)
+- [Bug fix / Test/CI] N/A — test-only change. (#3410)
+- [Bug fix / Test/CI] Codex sessions keep their selected permission mode when resumed on a replacement host. (#3411)
+- [Bug fix] Only session owners can approve tools that run with owner credentials in shared sessions. (#3416)
+- [Bug fix] Fixed a bug where a malformed or unrecognized tool-call payload on certain harnesses (notably OpenCode) could silently bypass a configured tool-call policy instead of being blocked or asked. (#3418)
+- [Bug fix / Feature / Docs / Test/CI] ACP agents can opt out of Omnigent’s MCP relay with `omnigent_mcp: false`, enabling compatible OpenClaw Gateway ACP registrations. (#3420)
+- [Feature / Docs] Shared-session agents can distinguish who wrote each message without changing whose credentials execute the session; operators can hide model-visible author labels with an environment flag. (#3422)
+- [Bug fix] `/model` and the startup header no longer name an Omnigent provider and model for ACP-backed sessions, which run on the agent's own auth and model. (#3431)
+- [Bug fix] Session tokens saved by `omnigent login` are now created owner-only, so a JWT is never briefly world-readable on first login, and an interrupted write no longer discards every stored token. (#3441)
+- [Feature / Docs / Chore / Test/CI] Model selection can now represent provider choices through stable intents and normalized capability metadata. (#3443)
+- [UI / Feature] Session owners can grant trusted collaborators permission to approve privileged actions without transferring ownership; ordinary editors can reject but cannot approve. (#3446)
+- [Bug fix / Feature / Docs / Chore / Test/CI] Default model selection now follows the active provider catalog instead of release-specific model names baked into runtime harnesses, while retaining general-purpose selection policy and Databricks gateway routability. In cold-cache Databricks environments without GitHub egress, configure `executor.model` or a provider `models.default`. (#3448)
+- [Feature / Docs / Chore / Test/CI] Smart routing now chooses only from models discovered on the active runner instead of falling back to release-specific model names. (#3450)
+- [Feature / Docs / Chore / Test/CI] The Kiro model picker now follows the models and metadata reported by the installed Kiro CLI. (#3452)
+- [Feature / Docs] Minimal `omnigent run` agents now discover their default model instead of using a release-specific built-in endpoint. (#3455)
+- [Feature / Docs / Test/CI] Provider setup and unconfigured provider runtimes now select current catalog models instead of release-specific built-in defaults, and fail with explicit configuration guidance when discovery is unavailable. (#3456)
+- [Docs / Chore] The Kimi launcher example now respects the default model configured in Kimi Code. (#3457)
+- [Bug fix] `omni resume` now accepts a conversation id pasted with stray punctuation (trailing period, quotes, backticks) instead of crashing (#3465)
+- [UI / Bug fix] Sidebar New session, Automations, and Inbox icons now sit on the same left column (#3468)
+- [Chore] Android app now targets Android 16 (API 36) to stay compliant with Google Play's (#3470)
+- [Feature / Test/CI] Nightly prerelease builds: every night a `X.Y.Z.devYYYYMMDD` tag of main is cut automatically; install or update with `scripts/update_nightly.sh` or `omni upgrade --nightly` (#3475)
+- [Bug fix / Breaking] Agent CLIs (qwen, goose, kimi, hermes, and generic ACP agents) no longer receive unrelated host credentials such as cloud tokens and other providers' API keys; an agent that authenticates from a variable outside its own family now declares it in `os_env.sandbox.env_passthrough`. (#3479)
+- [UI / Bug fix] Conversation sidebar text now scales with the Interface font size setting (#3480)
+- [Bug fix] Fixed two `claude-sdk` steering bugs: messages sent during an active turn were answered one turn late (a permanent chat desync), and steering several messages at once dropped all but the last. Steered messages are now buffered correctly and all of them reach the model. (#3484)
+- [Bug fix] Fix the first message being silently dropped when a session resumes on a managed sandbox / lakebox (#3488)
+- [UI / Bug fix] The workspace file view keeps its scroll position — both the file tree and the open file — when you switch between sessions (#3490)
+- [UI / Bug fix] Deleting a pinned session now removes it from the sidebar's Pinned section immediately, and sidebar rows no longer grow or shift while being deleted or renamed (#3492)
+- [Chore] Faster initial load — syntax-highlighting language grammars now load on demand instead of all upfront. (#3496)
+- [UI / Feature] Markdown file previews render fenced Mermaid diagrams. (#3498)
+- [Bug fix / Feature] Antigravity (`agy`) sub-agents now reliably receive their first turn, get their approvals dismissed in the terminal, and stop showing as still-running after they have finished. (#3499)
+- [Docs / Chore] qwen-native's terminal-start error label now reads "Qwen Code" (consistent with the other native harnesses) instead of "qwen". (#3500)
+- [UI / Bug fix] Terminal view scrolling now works with macOS trackpads and with TUIs that enable mouse tracking at startup (OpenCode, Claude Code) (#3510)
+- [Bug fix] Runners now retry login-page redirects with refreshed credentials instead of exiting, so a hosted session survives an expired bearer (e.g. after the machine slept through a token's lifetime) and reconnects on its own. (#3511)
+- [UI / Bug fix] The chat view shows the "Starting up…" spinner while a message is waking a disconnected runner, instead of nothing until the runner boots; the sidebar row shows a spinner while a session is starting up (#3514)
+- [UI / Bug fix] Renaming a session in the sidebar no longer hits the wrong row when the list reorders — row order holds while the pointer is over the list or a rename is in progress (#3515)
+- [UI] Collapsed tool runs in the chat view are labeled by what they did ("Ran 1 shell command, read 2 files") instead of "See N steps" (#3518)
+- [Feature] Sandbox dotfile hiding is now top-level only by default (opt into the full-tree walk with `cwd_hidden_scan_recursive: true`), and `mask_paths` hides named files or folders. Untrusted-tree sandboxes that relied on recursive masking should set `cwd_hidden_scan_recursive: true` on upgrade. (#3519)
+- [UI / Bug fix] Cloning a session that runs in a git worktree now pre-fills the original repo with the worktree branch (instead of the worktree path as the working directory), and the clone dialog blocks creation when the picked working directory doesn't exist on the host (#3521)
+- [Bug fix] `omnigent sandbox create --provider openshell` no longer crashes against openshell SDK >=0.0.86; workspace is configurable via `sandbox.openshell.workspace` or `$OMNIGENT_OPENSHELL_WORKSPACE` (defaults to `"default"`). (#3524)
+- [Bug fix] Shared-session agents distinguish speakers without treating claimed roles as authorization. (#3527)
+- [Bug fix] Direct `omnigent.llms.Client` Anthropic reasoning requests now select adaptive or fixed-budget thinking from live model capabilities. (#3529)
+- [Chore / Test/CI] N/A — internal lint cleanup. (#3545)
+- [Bug fix / Chore / Test/CI] N/A — internal lint cleanup. (#3546)
+- [Chore / Test/CI] N/A — internal lint cleanup. (#3548)
+- [Chore / Test/CI] N/A — internal lint cleanup. (#3549)
+- [Bug fix / Docs / Chore] Model context limits now follow live provider catalog maximum-input metadata instead of adding output capacity or relying on stale built-in model IDs. (#3551)
+- [Test/CI] N/A — internal CI enforcement only. (#3552)
+- [Bug fix] User messages no longer risk a React hook-order crash when changing from a system marker to regular content. (#3553)
+- [Chore] N/A — internal code-quality cleanup only. (#3554)
+- [UI / Feature / Test/CI] Choose a Codex model before starting a Web UI session (#3556)
+- [Chore] N/A — internal code-quality cleanup only. (#3571)
+- [Bug fix / Docs / Chore] Pi now routes Databricks models through the API advertised by the live model catalog instead of a release-specific model allowlist. (#3572)
+- [Bug fix] Bulk conversation actions now report structured errors when only some items fail. (#3573)
+- [Chore] N/A — internal code-quality cleanup only. (#3574)
+- [Chore] N/A — internal code-quality cleanup only. (#3575)
+- [Feature] `omnigent import --force` replaces a previously imported chat with the latest local transcript. (#3576)
+- [UI / Feature] Subagent graph panel now has zoom in, zoom out, and fit-to-view buttons for easier navigation of large agent trees (#3583)
+- [UI / Bug fix] Change a session's model and effort from the config gear while the session is asleep — the change is saved immediately and applies when the next message wakes it. (#3584)
+- [Feature / Test/CI] Add a Locust WebSocket load test (`dev/loadtest/`) with a one-command runner and result summary (#3591)
+- [Feature] Sandbox now hides dotfiles (`.env`, `.aws`, `.ssh`, ...) under `write_paths` roots, not just `cwd` and `read_paths` (#3596)
+- [Test/CI] N/A — internal CI enforcement only. (#3600)
+- [Feature] GitHub policy blocks destructive operations (deletes) by default across MCP tools, `git push --delete`, and `gh * delete`; opt in with `allow_destructive: true`. (#3622)
+- [Feature / Chore] The Cursor model picker now follows the models advertised by your installed Cursor CLI. (#3624)
+- [Feature / Docs / Chore] Pi gateway sessions now list the models currently available from the workspace instead of a release-specific bundled menu. (#3629)
+- [Docs / Chore] Setup and tool help no longer recommend release-specific model ids. (#3630)
+- [Feature / Docs / Chore] Static model catalog responses now identify fallback ownership and advertise the current GPT 5.6 Sol, Luna, Terra, and GPT 5.5 Codex aliases. (#3632)
+- [Feature] Catalog-backed model defaults now reuse a validated last-known-good provider catalog during transient upstream outages or empty responses. (#3641)
+- [Chore] N/A — internal typing cleanup only. (#3643)
+- [Chore] N/A — internal typing cleanup only. (#3645)
+- [Chore] N/A — internal typing cleanup only. (#3646)
+- [Docs / Chore / Test/CI] Repository lint now permits unavoidable static model aliases only through auditable owned fallback records. (#3647)
+- [Chore] N/A — internal typing cleanup only. (#3649)
+- [Chore] N/A — internal typing cleanup only. (#3650)
+- [Chore] N/A — internal typing cleanup only. (#3651)
+- [Chore] N/A — internal type cleanup only. (#3652)
+- [Chore] N/A — internal type cleanup only. (#3653)
+- [Chore] N/A — internal type-safety refactor. (#3655)
+- [Chore] N/A — internal type-safety refactor. (#3657)
+- [Chore] N/A — internal type-safety refactor. (#3659)
+- [Bug fix] An undeclared sub-agent name on session create is now rejected instead of silently running the child as the parent agent (#3662)
+- [Chore] N/A — internal type-safety refactor. (#3663)
+- [Chore] N/A — internal type-safety cleanup. (#3664)
+- [Chore] N/A — internal type-safety refactor. (#3665)
+- [Chore] N/A — internal type-safety cleanup. (#3666)
+- [Chore] N/A — internal type-safety cleanup. (#3667)
+- [Bug fix] The Codex model picker now hides OpenAI models that the installed Codex CLI cannot run. (#3668)
+- [Chore] N/A — internal type-safety cleanup. (#3669)
+- [Chore] N/A — internal type-safety cleanup. (#3671)
+- [Chore] N/A — internal type-safety cleanup. (#3674)
+- [Chore] N/A — internal type-safety cleanup. (#3675)
+- [Chore] N/A — internal type-safety cleanup. (#3676)
+- [UI / Feature] Redesigned the sidebar's bulk-select bar and added per-section selection: pick sessions from the flat list or from within project folders (#3677)
+- [Chore] N/A — internal type-safety cleanup. (#3678)
+- [Chore] N/A — internal type-safety cleanup. (#3679)
+- [Chore] N/A — internal type-safety cleanup. (#3680)
+- [Chore] N/A — internal type-safety cleanup. (#3681)
+- [Chore] N/A — internal type-safety cleanup. (#3683)
+- [Chore] N/A — internal type-safety cleanup. (#3684)
+- [Chore] N/A — internal type-safety cleanup. (#3686)
+- [Chore] N/A — internal type-safety cleanup. (#3687)
+- [Chore] N/A — internal type-safety cleanup. (#3689)
+- [Chore] N/A — internal type-safety cleanup. (#3691)
+- [Chore] N/A — internal type-safety cleanup. (#3695)
+- [Chore] N/A — internal type-safety cleanup. (#3696)
+- [Chore] Malformed tools, retry, and MCP YAML now fails with actionable parser errors instead of leaking untyped values. (#3705)
+- [Chore] N/A — internal type-safety cleanup with no user-facing behavior change. (#3706)
+- [Chore] N/A — internal ASGI type cleanup with no user-facing behavior change. (#3707)
+- [Chore] N/A — internal migration decoding hardening with no supported-input behavior change. (#3708)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3729)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3734)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3735)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3736)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3737)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3739)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3740)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3741)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3742)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3743)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3744)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3745)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3746)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3747)
+- [Bug fix / Chore] Managed Islo hosts now receive configured provider gateways during startup. (#3748)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3751)
+- [Chore] N/A — internal type cleanup with no user-facing behavior change. (#3752)
+- [Bug fix] Antigravity sessions without an explicit model now follow the installed SDK's current default. (#3762)
+- [UI / Bug fix] Moving a session into a project updates the sidebar instantly instead of after a multi-second wait (#3784)
+- [UI / Feature] `omnigent --help` now groups launch commands under a **Harnesses** section, colorizes the output, hides harnesses whose optional extra isn't installed (with a notice pointing at `omnigent setup`), drops the duplicate `update` alias line, and tidies the command descriptions (#3795)
+- [Feature] `omni upgrade` now preserves requested extras for `uv tool` and `pipx` installs, supports `--extra`, `--target-version`, and `--dry-run`, and refuses to auto-upgrade `pip` / `uv pip` installs because those installers don't record extras. (#3796)
+- [UI / Chore] `omnigent --help` command descriptions are tidied (harness rows read "Launch <Name> with Omnigent"), and the duplicate `update` alias line is hidden from the listing (#3797)
+- [Bug fix] Prevent `list_files` from running without a conversation scope. (#3804)
+- [Bug fix] Reject stale harness continuation requests that cannot resolve an agent model. (#3806)
+- [Chore] N/A (internal type cleanup) (#3830)
+- [Chore] N/A (internal type cleanup) (#3831)
+- [Chore] N/A (internal type cleanup) (#3832)
+- [Chore] N/A (internal type cleanup) (#3833)
+- [Chore] N/A (internal type cleanup) (#3835)
+- [Chore] N/A (internal type cleanup) (#3836)
+- [Chore] N/A (internal type cleanup) (#3837)
+- [Chore] N/A (internal type cleanup) (#3838)
+- [UI / Bug fix] New sessions created inside a project appear under that project immediately instead of briefly showing under "Sessions" (#3869)
+- [Bug fix / Breaking] The "GitHub Repo & Branch Access" and "Block Working Directory & Worktree (#3888)
+- [Feature] claude-native sessions now derive their Working/idle status from Claude Code's own session file for faster, more accurate turn-edge detection (falls back to the terminal watcher on older Claude versions) (#3906)
+- [UI] Tightened the sidebar's spacing so nav, sections, and session rows sit on a consistent vertical rhythm (#3908)
+- [UI / Bug fix] Sidebar rows no longer stay highlighted in "Select sessions" mode unless explicitly selected (#3912)
+- [UI / Feature] Opening a shell on a sleeping session now wakes its runner automatically instead of failing with "no runner available" (#3919)
+- [Bug fix] Pi-native sessions now retain Omnigent system tools and the comment relay. (#3920)
+- [Chore] N/A — no user-facing behavior change. (#3923)
+- [Bug fix] Fixed a leak where native Codex sub-agents left orphaned `codex app-server` processes after idle reaping, TUI exit, runner shutdown, or a hard host/runner death (#3925)
+- [Bug fix / Chore] OpenCode-native model options now fall back to the authenticated server catalog when CLI discovery fails. (#3926)
+- [UI / Bug fix] The sidebar's My sessions / Shared with me switch stays visible while bulk-selecting sessions (#3927)
+- [Feature] `omnigent diagnose` prints a secret-free environment snapshot (CLI/server versions, OS, auth mode) for bug reports (#3928)
+- [UI / Bug fix] Hide the empty Projects header menu (⋯) when you have no projects (#3930)
+- [UI] Moved the Chat/Terminal switcher for terminal-first sessions from the composer into the session header (#3931)
+- [UI / Bug fix / Feature] Recent conversations reopen instantly while catching up without reordering live response output. (#3932)
+- [Bug fix] `pip install` / `uv sync` no longer hangs when pnpm is provided by a corepack (#3986)
+
+## [v0.7.0] — 2026-07-27
+
+- [Bug fix] Hermes thinking now appears in mirrored web conversations. (#1645)
+- [Bug fix] Image and file attachments now survive session relaunches on remote host runners; attachments that fail to load show a visible marker instead of silently disappearing. (#2085)
+- [UI / Feature] Voice dictation in the composer now works in Electron, Firefox, and Chromium via optional server-side transcription (`omnigent[dictation]`) — local models, live streaming partials, audio never leaves your server. (#2093)
+- [UI / Bug fix / Test/CI] Hide Claude task completion control messages from conversation history while preserving them for resume context. (#2104)
+- [Bug fix / Feature / Docs] Operators can mount pre-created PersistentVolumeClaims (NFS/SMB/SAN) into Kubernetes sandbox runners via `sandbox.kubernetes.pvc_mounts` (read-only by default) (#2435)
+- [Bug fix / Test/CI] `/compact` no longer races when multiple compact requests hit the same session at once (#2585)
+- [Bug fix / Test/CI] `sys_call_async` / `sys_cancel_async` now consistently use `handle_id` as the cancel identifier. (#2586)
+- [Bug fix / Test/CI] Runner idle timeout no longer kills sessions waiting on async tools, timers, or approval prompts (#2588)
+- [Bug fix] Misconfigured runner tool policies deny tool calls instead of silently allowing them (#2589)
+- [UI / Feature] Slash-command menus now match any part of a command's name, so `/using-superpowers` finds `/superpowers:using-superpowers` (#2655)
+- [Bug fix] Host-launched runners now reuse delegated credentials instead of repeating Databricks authentication during startup. (#2762)
+- [Feature] Projects are now a first-class entity with a `/v1/projects` CRUD API (create, list, rename, delete) and per-session membership. (#2765)
+- [Bug fix] Hermes forwarder introspects state.db columns to survive cross-version schema drift (#2774)
+- [Feature] `omni usage` reports your LLM cost for today / the last 7 / 30 days, with a per-session per-model cost breakdown (#2787)
+- [Feature / Chore] Native Claude sessions start faster by coalescing runner initialization into one handshake. (#2793)
+- [UI / Bug fix / Feature / Docs / Test/CI] Claude-native launch and in-session pickers now share the selected host's live model catalog, including Claude Code's managed routes. (#2831)
+- [Bug fix] Managed BoxLite sandboxes remain available after provisioning so agent launches can execute commands reliably. (#2846)
+- [Feature] Server-side smart routing can now call an external `routes:select` router via `routing.provider: external`, with provider-agnostic auth (`api_key`) and model-name mapping (`model_prefix`) (#2864)
+- [UI] Chat code blocks no longer load the syntax-highlighter engine until the first (#2886)
+- [UI / Bug fix] The main chat "Working…" indicator now clears reliably when the session goes idle, instead of occasionally staying lit after a reply completes. (#2900)
+- [Bug fix] The performance benchmark harness now records HTTP failures and continues the rest of the suite instead of aborting, and excludes fully-failed runs from the summary averages. (#2917)
+- [Feature / Test/CI] Scheduled tasks can now be created without a workspace or a pinned host for non-code work (research, summaries, chat-only, MCP-only); an unset host runs on your live host at fire time, and an unset workspace defaults to the host's home directory. A pinned host is now authorized (existence + ownership) at create time rather than only at fire time. (#2946)
+- [Chore / Test/CI] N/A — internal benchmark/dev tooling; no user-facing impact. (#2947)
+- [Feature] Set `OMNIGENT_CONTAINER_RUNTIME=podman` to use Podman (or another supported runtime) globally instead of Docker, without editing every agent's YAML. (#2949)
+- [Bug fix] Sending a message to a session whose Claude Code terminal crashed no longer (#2951)
+- [Bug fix] The desktop app now always quits within a few seconds even if its background cleanup stalls or the OS re-quit is dropped. (#2972)
+- [UI / Bug fix] Messages send immediately when a session's only remaining work is a background job, instead of being held in the queue until it finishes (#2974)
+- [UI / Feature] Desktop update notifications now appear in a native corner toast that works (#2975)
+- [Bug fix / Chore] Runner startup no longer waits several seconds for Git's optional untracked-file cache probe. (#2976)
+- [Feature / Test/CI] `omnigent` benchmark harness gains `--network-delay-ms` and per-journey HTTP request counts (#2977)
+- [UI / Bug fix] Pi sessions now show reasoning while it streams and after conversation history reloads. (#2979)
+- [Feature] The runner log now records why the runner exited (crash traceback, signal, idle timeout, tunnel close, or parent death) (#2985)
+- [UI / Feature] Set up a missing agent from the New Chat dialog with a guided, step-by-step checklist (#2987)
+- [UI / Bug fix / Feature] HTTP headers can now be set and edited for HTTP MCP servers in the session agent info panel. (#2989)
+- Capped unbounded DB list queries in the permission store and reduced session opens in `check_access`/`get_permission_level` from 2–3 to 1. (#2995)
+- Deleting a conversation with many descendants now issues a single FTS DELETE instead of one per descendant. (#2999)
+- [UI / Bug fix] Android auto theme and system-bar icons now stay readable with both device themes and explicit in-app theme overrides. (#3006)
+- [UI / Feature] 3D model files (STL, 3MF, OBJ) now render an interactive preview in the file browser (#3007)
+- [UI / Bug fix] Subagents panel Graph View now shows the same status dot colors as List View (#3009)
+- [Feature / Test/CI] Scheduled-task runs now transition to a terminal state (`succeeded`/`failed`) as soon as the dispatched turn finishes, instead of staying `running` forever; run history is readable at `GET /v1/scheduled-tasks/{id}/runs`. (#3014)
+- [Feature / Chore] When enabled, new sessions receive concise semantic titles in the background without adding work or latency to the active agent turn. (#3024)
+- [Feature] Offload dictation speech-to-text to a remote worker with (#3025)
+- [Bug fix / Docs / Test/CI] Codex-native subagents now appear in the Agents panel with their live conversations. (#3028)
+- [Bug fix] Credential proxy no longer attaches injected credentials to TRACE/OPTIONS requests, and the egress proxy now honors Max-Forwards as a conformant intermediary. (#3029)
+- [Docs] N/A — internal documentation cleanup. (#3031)
+- [Feature] Import local Qwen, Kiro, Pi, and Kimi coding chats into Omnigent (#3032)
+- [UI / Feature] Press ⌘⌥V (Ctrl+Alt+V) to toggle voice dictation from anywhere; while dictating, Enter keeps the text and Esc discards it (#3044)
+- [UI / Feature] Added: "Auto · smart routing" harness option in the new-chat picker — lets the intelligent router pick both harness and model based on the task description (#3045)
+- [Feature] Import existing OpenCode chats, including files and tool activity, with `omnigent import` (#3046)
+- [Bug fix] Dictation streams now reliably release their worker slot when a browser disconnects abruptly. (#3048)
+- [UI] New-session composer moves harness configuration into a gear-icon modal, with a cleaner agent picker (needs-setup and custom agents folded into flyouts) and Smart Routing offered as a model option. (#3050)
+- [Bug fix / Feature] The Slack bot can now run against an Omnigent server deployed on Databricks Apps, (#3051)
+- [Feature] Sessions can now be filed into first-class projects via `PATCH /v1/sessions/{id}` and listed with `GET /v1/sessions?project=<name>`, which dual-reads first-class membership and legacy project labels. (#3053)
+- [Bug fix / Test/CI] Fixed SDK session telemetry always recording `harness: null` in server deployments not started via the CLI. (#3054)
+- [Test/CI] N/A — test-only reliability change. (#3056)
+- [Bug fix] Databricks OAuth CLI profiles no longer fail with a misleading "malformed profile" error; the message now explains the real fix (install `omnigent[databricks]` or refresh the OAuth session). (#3059)
+- [Bug fix] An idle runner shutting down after inactivity no longer shows a scary "disconnected" error — just send a message to wake it back up. (#3060)
+- [UI / Feature] The sidebar now uses first-class projects: create empty projects, rename and delete them, and file sessions into them — while existing label-based projects keep working. (#3061)
+- [UI / Bug fix] The "Host is offline — click to reconnect" prompt now appears in the composer's host badge instead of a separate banner below the composer (#3062)
+- [Test/CI] N/A (test-only change) (#3063)
+- [Feature / Docs / Test/CI] New `databricks_cli` credential-proxy type lets sandboxed agents use the Databricks CLI without the real token entering the sandbox (#3080)
+- [UI / Feature / Test/CI] Polly sessions running on Claude SDK can start Goal mode from the chat composer. (#3084)
+- [UI / Bug fix] The Configure agent modal's footer no longer shows a gray background band behind Cancel/Save (#3089)
+- [UI / Feature] The Sidebar is more compact and polished, with clearer status indicators and richer session details on hover. (#3092)
+- [UI] Reordered the project-folder header buttons (new-session before the menu), (#3096)
+- [Chore / Breaking] `omni server start` is removed; use `omni server --background` to launch the (#3105)
+- [Bug fix] `omnigent server --host 0.0.0.0` now enables accounts (login) mode automatically instead of silently 401-ing every request (#3107)
+- [Feature] Projects can store default session settings (host, workspace, harness, model, …) via a new `config` field on the projects API. (#3108)
+- [Bug fix] Databricks-served Claude models no longer break non-streaming responses (prompt-policy and smart routing) when returning typed content blocks (#3109)
+- [Feature] `omnidev omnigent <args…>` runs an omnigent command against the current checkout's pod via `uv run omnigent`, with the pod's isolated env applied (#3110)
+- [UI / Feature] Configure a session's model, effort, and smart routing mid-chat from a new gear icon in the composer (#3111)
+- [UI / Feature / Test/CI] Add the `/tasks` Scheduled Tasks page with sidebar navigation, task rows, empty states, suggestion chips, create-dialog entry points, and Playwright E2E coverage. (#3112)
+- [Bug fix] Reading image files in a Claude Code native session no longer bloats conversation history and breaks resume/compaction on large sessions (#3113)
+- [Bug fix / Test/CI] The iOS app no longer follows cross-origin redirects when probing a newly approved server for the Databricks workspace mount, so a consented host can't redirect the probe to a different origin. (#3115)
+- [Bug fix] Forked native sessions (Claude Code, Codex, Pi, Qwen) again resume with their prior conversation history. (#3116)
+- [UI / Feature / Test/CI] Workspace pane icons now explain themselves on hover, with a cleaner right-side session layout and compact Share action. (#3122)
+- [UI / Bug fix / Feature] Add a dialog for creating recurring scheduled agent tasks. (#3123)
+- [UI] Sidebar session hover flyouts and rows now align with the project rows — matching flyout style, title size, and right-edge padding. (#3124)
+- [Bug fix] Resuming a session with large images stored in history no longer overflows the context window or breaks compaction, on both the SDK and native Claude Code paths (#3133)
+- [Feature] `omnigent session import` loads a `session export` JSONL back into a server as a new session (#3141)
+- [Feature] Telemetry now records the agent name for Polly and Debby sessions. (#3152)
+- [Chore / Breaking] `omni integration slack start` is removed; use `omni integration slack --background` to launch the (#3153)
+- [UI / Bug fix / Docs / Chore] Slack device login now requires a fresh password at the consent screen, closing a device-code phishing gap where an already-signed-in user could approve a login by reflex. (#3156)
+- [Feature] `omnigent claude` keeps tool search enabled when launched with `CLAUDE_CODE_USE_GATEWAY=1`. (#3161)
+- [Test/CI] Fix `test_session_stream_emits_heartbeat_on_idle` after `_session_labels_for_runner_spawn` was extracted into `omnigent.runner.native.orchestration`; patch the heartbeat cadence on `omnigent.runner.app` where it is defined and consumed. (#3163)
+- [Bug fix] Crash reports are no longer lost when a process crashes more than once in the same second. (#3173)
+- [Bug fix] Custom codex-native agents launch on the model declared in the agent spec (`executor.model`) instead of silently falling back to the provider default (#3175)
+- [Bug fix] Single-file agent YAMLs that nest the executor under `type:`/`config:` (the bundle config.yaml shape) now fail at load time with the correct flat spelling, instead of silently running a harness inferred from the model prefix (#3178)
+- [UI / Bug fix / Feature] Use native Codex goal mode from Polly's Goal control (#3181)
+- [UI / Bug fix] Renaming a session now updates the name in the sidebar instantly instead of after a short delay. (#3185)
+- [UI / Bug fix / Feature / Test/CI] Edit scheduled tasks and type exact run times, with a scrollable time picker and a consistent, fully-visible dialog. (#3186)
+- [UI / Feature] Pinned sessions now persist server-side per user, so pins follow you across devices and browsers. (#3189)
+- [Feature] New sessions now receive concise semantic titles automatically without additional configuration. (#3191)
+- [Test/CI] `/rerun` PR comment re-runs failed CI on the current commit without dismissing approvals (#3195)
+- [Feature] Native Codex sessions can now receive concise automatic background titles. (#3199)
+- [Bug fix] Qwen3, inkling, and other non-OpenAI models now work in the Pi SDK executor harness (#3203)
+- [Chore / Breaking] Slack-on-Databricks deploy: renamed `OMNIGENT_SLACK_WEBAUTH_BASE_URL` to `OMNIGENT_SLACK_DATABRICKS_APP_URL` (`--app-url`), removed the `WEBAUTH_PORT` / `DATABRICKS_WORKSPACE_HOST` overrides, and dropped deploy-time `uv lock` in favor of in-container `uv run`. (#3206)
+- [UI / Bug fix] Sidebar session titles use the available space cleanly and reveal branch and action details only when needed. (#3208)
+- [UI / Bug fix] Removed the redundant "Create new project" option from the sidebar project picker — create projects with the + icon next to Projects (#3210)
+- [Feature] Smart routing now activates automatically when a server `llm:` block or an external `routing:` block is configured — no `OMNIGENT_SMART_ROUTING` env var needed (#3215)
+- [UI / Feature / Test/CI] Scheduled task rows now show when each task will next run ("Next run in 15h") and a "Run now" action in the ⋯ menu to fire a task immediately, with refreshed row styling. (#3218)
+- [UI / Feature] Projects now carry default session settings (host, working directory, agent, optional git worktree) that pre-fill the new-session composer. (#3221)
+- [Bug fix] Fixed per-model cost attribution for native harnesses so a session's per-model (#3223)
+- [UI / Bug fix] Codex task plans now stay in Tasks instead of being duplicated in chat. (#3249)
+- [UI / Bug fix] Smart Routing no longer appears in the model dropdown for native terminal sessions (Claude Code, Codex, Pi), where it had no effect (#3259)
+- [Bug fix] Sandboxed agents can now run tools managed by update-alternatives (awk, python3, editor, and similar) on Linux. (#3263)
+- [Bug fix] Egress proxy now trusts corporate/MDM CA roots installed under the system `capath` directory, so TLS to hosts behind a corporate MITM works from a sandboxed agent. (#3264)
+- [Bug fix] Large historical attachments no longer inflate replay and compaction context as inline base64 text. (#3267)
+- [Docs] Contributors can now use `omnidev` as the documented worktree-safe local testing flow. (#3277)
+- [Bug fix] Custom OpenAI Agents can use Unity AI Gateway Model Services with fully qualified model names when a Databricks provider or profile is configured. (#3288)
+- [UI / Bug fix / Feature] Configure recoverable dangerous shell commands to ask for approval or deny execution, while always blocking catastrophic operations. (#3297)
+- [Bug fix / Feature] Pi harness now routes kimi, inkling, GLM, qwen3, Gemini 3+, and Llama through the correct AI Gateway endpoints, fixing "Stream ended without finish_reason" errors and ensuring `system.ai.*` ids are used throughout. (#3307)
+- [Feature] Add a top-level `justfile` with recipes for launching the iOS Simulator, running the Android debug build, starting the omnigent dev pod, and running pre-commit/lockfile normalization. (#3310)
+- [UI / Bug fix] Sidebar header action buttons are now vertically centered with section titles. Session row hover is smoother, and active items no longer flash when hovered. (#3311)
+- [UI / Bug fix] Aligns project folder icons and color with the rest of the sidebar. (#3317)
+- [Bug fix] Unsupported Claude Code slash commands are now escaped and sent as regular user messages instead of leaving the native terminal in an undriveable state. (#3319)
+- [Feature] `omnigent server` now tells users they can set `OMNIGENT_AUTH_ENABLED=0` to override automatic multi-user mode when binding to a non-loopback interface. (#3320)
+- [Chore / Breaking] [Breaking] The deprecated `OMNIGENT_ACCOUNTS_ENABLED` environment variable has been removed; use `OMNIGENT_AUTH_ENABLED` instead. (#3322)
+- [UI / Bug fix] Fixed pinned sessions being lost when the web UI was updated before the server. (#3323)
+- [UI / Feature] Automations list: tasks now render as cards and show a live-updating relative next-run time ("Next run in 3 hours"). (#3324)
+- [UI] Settings → Appearance no longer has a separate Sidebar font size control, and a new "Reset to defaults" button restores every appearance preference after confirmation. (#3326)
+- [UI] Starting a session inside a project now names the project in the new-session (#3327)
+- [UI] The Files workspace tab now uses a stacked-files icon. (#3329)
+- [UI / Feature] Automations: scheduled tasks can now pick a model and reasoning effort in the create/edit dialog (defaults to the agent's settings). (#3331)
+- [UI / Bug fix] Fixed sessions pinned in the updated web UI being lost after the server was updated. (#3332)
+- [UI / Feature] Native harness setup now checks the installed CLI version and prompts to upgrade if it is too old. Cursor's missing-binary case is normalized to the same structured `binary-missing` signal as the other CLI-backed native harnesses. (#3335)
+- [Bug fix] Pi sessions now show a clear error when their Databricks login has expired, instead of silently accepting messages with no reply (#3336)
+- [Test/CI] N/A (internal CI change). (#3338)
+- [Bug fix] claude-sdk harness now surfaces harness-level failures (expired login, auth error) as structured errors instead of storing them as assistant messages. (#3342)
+- [UI] Align the sidebar brand row with the rest of the navigation. (#3346)
+- [UI / Bug fix] Short links like `#3090` in chat markdown tables no longer stack one character per line (#3350)
+
+## [v0.6.0] — 2026-07-21
+
+- [Bug fix] `sys_os_shell` commands no longer inherit omnigent's own `PYTHONPATH` entry, so project subprocesses resolve their own installed packages instead of omnigent's. (#1861)
+- [Bug fix] Stopping a Goose turn no longer leaves stale ACP session state behind when the subprocess is terminated. (#1928)
+- [Bug fix] Cancelling or deleting a session during agent cold start no longer leaks the harness subprocess. (#1982)
+- [Bug fix] macOS sign-in with a hardware security key (e.g. YubiKey) works again. (#2036)
+- [UI / Bug fix] Tool-call cards keep their live spinner when a superseded response terminates mid-turn (fixes a first-turn "no spinner" on native-terminal harnesses). (#2045)
+- [Bug fix] hermes-native tool-call cards now show a live spinner and elapsed timer while a tool runs, including on the first turn. (#2046)
+- [Bug fix] Fix blank white page on Safari/iPadOS older than 16.4 caused by regex lookbehinds on the web UI boot path (#2105)
+- [UI / Feature / Chore] A project's "new session" pencil now prefills the composer from the project's latest session — host, repo, agent, and a fresh git worktree branch — so starting a new chat in a project is one prompt away. (#2133)
+- [UI / Feature] Filter the Archived sessions view by project (#2134)
+- [Bug fix / Docs / Test/CI] Polly now verifies pytest test-count discrepancies against collected cases before recording miscount/fabrication claims. (#2140)
+- [Bug fix] Evict the cached claude-sdk client when a turn is cancelled so the session recovers on the next turn (#2169)
+- [UI / Bug fix] Tapping an Android notification now opens the waiting session (or the inbox). (#2210)
+- [Bug fix] Fixed the headless Hermes harness registering no Omnigent MCP server (agent had no builtin tools). (#2216)
+- [Feature / Breaking] Ids are now bare 32-character hex (no `conv_`/`ag_`/`host_` prefixes) stored as 16-byte binary; existing prefixed ids in URLs, configs, and clients keep working. (#2228)
+- [Bug fix] `sys_list_models` no longer misreports codex `cli-config` providers and cursor workers as having no usable model provider. (#2237)
+- [Bug fix] Cursor sessions now run shell tools in the declared workspace directory instead of the runner's working directory (#2244)
+- [UI / Bug fix / Feature] Conversation view gains a turn-rail minimap for jumping between messages (#2285)
+- [Feature / Docs] `sandbox.host_config` in the server config injects verbatim host `config.yaml` content (e.g. a `providers:` gateway block) into managed sandboxes before the host starts (#2306)
+- [Bug fix] `omnigent server` now accepts documented boolean server-config values like `sandbox.kubernetes.in_cluster: false` instead of rejecting them at startup. (#2314)
+- [Bug fix] Chat sessions now recover automatically from a brief reverse-proxy 404 during a backend restart, instead of freezing until a manual page refresh. (#2316)
+- [UI / Bug fix] Bulk select-all/delete/archive in the sidebar now correctly handles collapsed sections (#2377)
+- [Bug fix / Feature] `omnigent run --harness <name>-native` now launches every registered native harness with matching prompt and model behavior. (#2379)
+- [Feature / Docs / Test/CI] Harness bench now reports Omnigent MCP relay support separately from vendor-native tool calling. (#2380)
+- [Bug fix] Sessions are now stopped server-side before archive or delete, so SDK and API callers get the same stop-first behavior the web UI provides. (#2400)
+- [UI / Bug fix / Test/CI] Sidebar session tabs no longer overflow their background on narrow widths. (#2425)
+- [Bug fix] Local server startup now works when a system proxy intercepts loopback traffic. (#2433)
+- [Bug fix] Native TUI harnesses (opencode, pi, hermes) no longer render multibyte UTF-8 as mojibake on deployments whose environment lacks a UTF-8 `LANG`/`LC_ALL`. (#2440)
+- [Bug fix] Claude native sessions now back off rejected cost updates instead of retrying on every poll. (#2453)
+- [Feature] Server now collects opt-out usage telemetry for session created, stopped, and deleted events to help understand product usage patterns. (#2457)
+- [UI / Bug fix] Confirming a Japanese IME conversion with Enter no longer submits the session rename or new-project name inputs (#2459)
+- [Feature] Server `llm:` config accepts an optional `fallback_models:` list; LLM-backed policies now retry alternate models before failing closed. (#2462)
+- [Feature] Harden the LLM prompt-classifier policy against prompt injection by spotlighting untrusted content behind an unguessable per-evaluation marker. (#2463)
+- [Feature / Docs / Test/CI] Harness bench now reports whether forked sessions retain and replay their source conversation history. (#2472)
+- [Bug fix / Test/CI] Harness benchmark live tables now distinguish not-applicable capabilities from skipped probes. (#2475)
+- [UI / Bug fix] New sessions respond faster to their first message, and the "Working…" indicator now appears immediately on the first turn instead of staying dark while the runner finishes connecting (#2478)
+- [Bug fix] A policy-denied message (e.g. hitting the cost budget) now shows immediately instead of only after a page refresh (#2481)
+- [Bug fix / Feature / Docs / Test/CI] Codex sessions using Databricks custom model aliases can surface reasoning summaries, and the harness benchmark now reports observable reasoning support. (#2482)
+- [Feature / Docs / Test/CI] The harness benchmark can run selected capability dimensions and pin an exact model directly in each harness argument. (#2485)
+- [Bug fix / Test/CI] Polly Cursor workers no longer ask for tool permissions by default (YOLO / auto) (#2493)
+- [Feature] Polly defaults to Sonnet 5 for its brain and Claude Code workers, and Cursor Grok 4.5 for Cursor workers (#2500)
+- [Bug fix] Polly Cursor workers default to grok-4.5 (#2503)
+- [Bug fix] Polly Claude brain and Claude Code workers default to the sonnet alias (#2504)
+- [Bug fix] Polly Claude brain and Claude Code workers inherit the provider default model again (#2507)
+- [Bug fix] Codex-harness sub-agents no longer crash on macOS when the runner inherits a read-only working directory (e.g. `/` from the desktop app). (#2512)
+- [UI / Feature / Test/CI] New chats can start with the Workspace panel collapsed via Appearance settings (#2516)
+- [Bug fix] `sys_advise_models` is only offered to agents when intelligent routing is configured on the server. (#2517)
+- [UI / Feature / Test/CI] OpenCode-native sessions now show their available models in the web model picker. (#2519)
+- [Bug fix] Pi's `/model` command now shows all LLM models available on your Databricks workspace (fetched live from the serving-endpoints API) instead of a hardcoded list (#2525)
+- [UI / Feature] The changed-files panel now shows a per-file line-change count (`+N −M`) beside each file. (#2526)
+- [Bug fix] Telemetry rollout percentages now honor 0% and 100% exactly. (#2528)
+- [Bug fix] Pi no longer shows a blocking "Trust project folder?" dialog when launched via Omnigent in a project with `.pi/` settings or extensions (requires Pi 0.79+) (#2529)
+- [Feature / Docs / Test/CI] Harness metadata can now declare resume, steering, live queue, image, and compaction support for capability conformance checks. (#2530)
+- [UI] Admin Settings pages (Members, Policies, Sharing) now share the same left and top alignment as the rest of Settings. (#2532)
+- [Bug fix] Pi's `/model` command now shows GLM, Llama, Qwen, and other non-GPT Databricks models alongside Claude and GPT models (#2534)
+- [UI / Bug fix] The Members and Sharing settings pages and the Share buttons are hidden in single-user mode (#2536)
+- [Bug fix] Pi's `/model` command now correctly lists all available Databricks models when using the AI Gateway (cli-config) setup — the NXDOMAIN error that caused single-model fallback is fixed (#2540)
+- [UI / Feature] Native Pi sessions can now switch model mid-session from the web composer, with the picker scoped to your logged-in models and synced to in-terminal `/model` changes (#2543)
+- [UI / Feature] Add an opt-in "Hide unconfigured harnesses" setting that filters the new-chat picker to harnesses set up on the selected host (#2544)
+- [Bug fix] Sending a message to an idle native Pi session no longer gets stuck in the "queued" state until you switch tabs (#2545)
+- [Feature / Docs / Test/CI] Add `omnigent uninstall` for safely removing the CLI, installer-managed shell/config edits, and optionally local Omnigent state. (#2550)
+- [Bug fix] Pi's `/model` command now shows all available Databricks models for ucode / Codex app profile-switched setups (#2552)
+- [UI / Feature] Added a Nord color theme (arctic frost-blue palette) to the Appearance settings palette picker. (#2561)
+- [Bug fix] Fix `uv tool install` of the `databricks` extra failing to build pyarrow from source on Python 3.14 (#2563)
+- [Bug fix] Sessions list no longer does a workspace-wide id pre-fetch for the archived filter, restoring the single indexed query on the sidebar path. (#2568)
+- [Bug fix] The CLI now shows a clear error instead of a raw traceback when the server is too slow or unreachable while starting a session. (#2572)
+- [Bug fix] Pi harness: Databricks GLM/DeepSeek reasoning models no longer fail with "Stream ended without finish_reason" (#2573)
+- [UI / Bug fix] Clicking a pinned session that belongs to a project no longer re-opens the project section after you've collapsed it. (#2583)
+- [Bug fix] Claude-native messages that fail to reach Claude (or stall unsent) now surface the failure instead of silently disappearing. (#2591)
+- [UI / Bug fix] The file editor now follows Omnigent's selected web and desktop color theme instead of the operating-system theme. (#2594)
+- [UI / Feature] Hovering a pinned session now shows its project name in a flyout (#2595)
+- [UI] Sidebar rows, section headers, and nav items now line up on a consistent grid (#2596)
+- [Bug fix] Queued follow-up messages in the Pi web UI now dispatch immediately when Pi finishes replying (#2597)
+- [UI / Bug fix] Pinned-session project flyout no longer opens (and gets stuck over the chat) when tapping a session on mobile (#2599)
+- [UI / Feature] Diff viewer gains a "Wrap lines" toggle, and Find / Download / diff toggles now live in a single "⋯" View settings menu (#2600)
+- [UI / Bug fix] Mobile session menu opens the project picker in place instead of an off-screen side flyout (#2602)
+- [Bug fix] `sys_session_send` now reliably accepts model overrides when spawning named sub-agent sessions with a specific model (#2603)
+- [Chore / Breaking] `omnigent[memory]` is renamed to `omnigent[hindsight]`; the Hindsight memory extra is now the canonical name. (#2605)
+- [Bug fix] `omnigent host status` now hides the session table by default (use `--sessions` to show it), making the command significantly faster. (#2606)
+- [Feature] `omnigent://<hostname>/c/<session_id>` links open that session in the desktop app, reusing an open window on that server in-place (#2607)
+- [Bug fix] Fix native Claude sessions overflowing the context limit on reconnect when the conversation contained screenshots (#2609)
+- [Feature] Session creation requests from the web UI now send an explicit `X-Omnigent-Client` header, enabling the server to record the exact client surface (web/desktop/ios/android) in telemetry without relying on User-Agent parsing. (#2615)
+- [UI / Bug fix] Mobile: the Chat/Terminal toggle no longer reappears over the sidebar when opening a session's kebab menu (#2617)
+- [UI] Project sidebar headers show a chevron in place of the folder icon on hover instead of a persistent caret next to the name (#2618)
+- [UI / Feature] PDF files now preview inline in the file viewer, with scrollable pages and zoom (#2619)
+- [UI / Bug fix] Find in file now toggles the editor's find bar closed on a second click, and its close button no longer shows a stray keyboard-hint tooltip (#2621)
+- [UI / Bug fix / Feature] Find in file now works in the markdown editor — highlights and cycles matches, including terms split across bold/italic formatting (#2628)
+- [Bug fix] Clicking an Omnigent session URL printed inside the embedded terminal now stays in the web app instead of opening a duplicate browser tab/window. (#2639)
+- [Docs] Clarify optional install extras in the quick-start docs. (#2640)
+- [Bug fix] `use_responses: false` now correctly selects the Chat Completions API in standard `config.yaml` bundles. (#2641)
+- [Bug fix / Feature] Import existing Claude Code or Codex chats with `omni import`. (#2649)
+- [UI / Feature] Customize a built-in color theme with shared light/dark accent, tint, contrast, and two-rail sidebar translucency controls. (#2650)
+- [UI / Bug fix] Pinned sessions no longer show duplicate rows after upgrading — legacy pin ids are migrated to the new id format automatically. (#2651)
+- [UI / Feature] Long-running Codex commands now stream their output into the web tool card while they run. (#2652)
+- [UI / Feature] Randomize accent and background tint colors with a playful new dice button. (#2653)
+- [Feature] `omnigent://<hostname>/c/<session_id>` links open that session in the iOS app, reusing the open window on that server in-place (#2661)
+- [Bug fix] Pi's `/model` command now shows and correctly routes GPT, Kimi, Llama, GLM, and Gemini 3.x models alongside Claude (#2665)
+- [UI / Bug fix] The Add Global Policy dialog now shows all available policies, including ones already applied. (#2668)
+- [UI / Bug fix] The Add Policy dialog for sessions now shows all available policies, including ones already applied. (#2670)
+- [Bug fix] Deleting or archiving a session now also stops any still-running sub-agent children, instead of leaving them running as unreachable orphans. (#2673)
+- [UI / Feature] Find in file now works in the markdown and notebook preview — highlights and cycles matches in the rendered document (#2674)
+- [Bug fix] Codex sessions through a Databricks gateway profile no longer fail with "Invalid Token" when the environment's `DATABRICKS_HOST` points at a different workspace than the profile (#2675)
+- [UI / Feature] The file panel (changed files, browsing, diffs, and file contents) stays viewable when a session's runner is offline but its host is still connected — no need to send a message to wake it. (#2676)
+- [UI / Feature] Select text in a PDF preview to add review comments with inline highlight overlays. (#2677)
+- [UI / Feature] Codex plans now show up in the Tasks panel, the same way Claude Code todos do (#2678)
+- [UI / Bug fix] Token expiration and other harness startup errors now appear immediately in the chat transcript instead of requiring a page reload. (#2681)
+- [UI / Feature] Switching back to a recently-opened chat now renders instantly from cache instead of blanking and reloading over the network. (#2688)
+- [UI / Bug fix] Fixed the comment box being hidden behind the keyboard when commenting on a file in the iOS app (#2694)
+- [Bug fix] Host-bound sessions relaunch immediately after a Stop or host restart instead of waiting out the runner-connect grace. (#2699)
+- [Test/CI] Add a `checkout_sha` input to the Benchmark workflow so nightly benchmarks can be run ad-hoc against a specific commit. (#2700)
+- [Bug fix / Test/CI] Fresh installs no longer resolve an OpenAI SDK combination that crashes every OpenAI Agents harness turn. (#2713)
+- [Feature] `omni import --harness <claude|codex> --last N` can now import up to 50 recent local chats at once. (#2724)
+- [UI / Bug fix] Cursor setup now distinguishes CLI readiness from SDK API-key configuration and shows install/login guidance before web chat launch. (#2733)
+- [UI] The Gateway option in model setup no longer cites OpenRouter as an example — use the dedicated OpenRouter option instead (#2738)
+- [Bug fix] Sandboxed (`darwin_seatbelt`) agents now boot when the helper interpreter or the wrapped CLI is reached through symlinks — uv-installed Pythons and the standalone Claude CLI no longer die with `Operation not permitted`. (#2743)
+- [Bug fix] A sandboxed claude-sdk agent no longer dies at connect time when its sandbox can't wrap the Claude CLI — it starts with native tools disabled (file/shell access stays sandboxed via the `sys_os_*` tools) and logs why. (#2749)
+- [Feature] `omnigent setup` can now install Hermes directly before configuring its model provider. (#2751)
+- [Bug fix] Sandboxed (`darwin_seatbelt`) agents no longer die at startup with "No usable temporary directory" — the private scratch tmpdir is now granted in the sandbox profile before the process is jailed. (#2759)
+- [Feature / Docs / Test/CI] Benchmark reports now measure cold restarts of existing sessions whose runner is offline. (#2761)
+- [Docs / Chore / Test/CI] Website release posts now use the narrative, prose-driven MLflow style (#2764)
+- [Bug fix] opencode-native carries the user config's model default into the synthesized config when no model is pinned (#2775)
+- [Feature] New sessions automatically get concise, useful titles generated by the agent already handling the conversation. (#2778)
+- [Bug fix] Forking a Claude Code session onto pi (or other CLIs) no longer fails to start with `required_terminal_exited` (#2780)
+- [Bug fix] Native Codex and Claude now resolve their CLI from common global install dirs and an `OMNIGENT_CODEX_PATH` / `OMNIGENT_CLAUDE_PATH` override when it isn't on the host daemon's PATH (#2788)
+- [Feature] Nightly benchmark report now includes server CPU% and RSS memory usage (mean/min/max) alongside latency metrics. (#2795)
+- [Bug fix] The changed-files panel now shows per-file line-change counts even when the list is served by the host (runner offline). (#2802)
+- [Bug fix] Harness readiness now finds CLIs installed in common global dirs (nvm/npm/homebrew) that aren't on the host daemon's PATH, matching what the launch resolves (#2805)
+- [UI / Bug fix / Feature] Config-file policies (declared via `omni server -c`) now appear in the admin Global Policies page as read-only entries labeled "Config". (#2807)
+- [Bug fix] Codex sessions now inherit global `AGENTS.md` instructions. (#2809)
+- [UI / Feature] Switching back to a recently-opened chat now renders instantly from cache instead of blanking and reloading over the network. (#2810)
+- [Bug fix] Allow the ACP prompt deadline to be configured without changing its default. (#2817)
+- [Feature] The Slack bot now handles tool approvals and questions inline — Approve/Deny (#2820)
+- [UI / Feature] The Share dialog now shows a QR code so you can open a session in the mobile app by scanning it with your phone. (#2824)
+- [Bug fix] Harness setup warnings now clear automatically without reconnecting the host. (#2828)
+- [UI / Feature] Android app shows a floating server switcher pill with a dropdown menu for quick server switching (#2829)
+- [Feature] Crash reports now show a calm, branded screen with a compact traceback and a one-tap prompt to file a pre-filled GitHub issue (#2841)
+- [UI / Bug fix] Parallel sub-agent dispatch now explains when to use distinct task titles instead of accidentally reusing and serializing one child session. (#2860)
+- [Bug fix] Fixed a context-window overflow on a live-streamed turn, leaking its harness process instead of ending the turn cleanly. (#2869)
+- [Bug fix] Fixed `/model show` (and `list`/`status`/`current`) bricking the session. (#2888)
+- [Bug fix] Clicking "Stop session" no longer shows a spurious "runner disconnected" error (#2903)
+- [UI / Bug fix] New-session Send button shows a spinner while the session is being created, instead of looking frozen (#2907)
+- [Feature / Breaking] Per-harness startup command/args overrides via a polymorphic `harness:` config key + `OMNIGENT_<NAME>_PATH` env-var standardization (legacy `HARNESS_*_PATH` deprecated, slated for v0.8.0 removal) (#2933)
+- [Bug fix] `omnigent[memory]` is restored as a backwards-compat alias for `omnigent[hindsight]` (the `memory` extra was dropped by #2605); it will be removed in 0.70. (#2938)
+- [Feature] `OMNIGENT_SESSION_RENAME=on` re-enables the automatic first-turn session rename (disabled by default) (#2944)
+
+## [v0.5.1] — 2026-07-10
+
+- [UI] The desktop Browser tab is now hidden on older desktop builds that don't support the embedded browser, instead of showing a tab that does nothing (#2393)
+
 ## [v0.5.0] — 2026-07-10
 
 - [Bug fix] Messaging a long-idle session no longer risks the new turn being killed mid-flight by the idle reaper (#1834)

CONTRIBUTING.md

@@ -28,7 +28,9 @@ Install local prerequisites first:
 - `bubblewrap` (`bwrap`), **Linux only**, used to OS-sandbox those native
   Claude/Codex/Pi terminals (`apt install bubblewrap` on Debian/Ubuntu). macOS
   uses the built-in `seatbelt` sandbox and needs nothing extra.
-- Node.js 22 LTS or newer with `npm` when working on `web/`.
+- Node.js 22 LTS or newer with `pnpm` (install via `corepack enable` or
+  `npm install -g pnpm`) when working on `web/`.
+- A Rust toolchain for the recommended `omnidev` local development supervisor.
 
 ```bash
 git clone https://github.com/omnigent-ai/omnigent.git
@@ -42,33 +44,85 @@ source .venv/bin/activate    # or prefix commands with `uv run`
 
 Common checks:
 
+Pyrefly is the canonical Python type checker for the repository.
+
 ```bash
 uv run pytest                      # Python tests (e2e/live skipped by default)
 uv run ruff check . && uv run ruff format --check .
+uv run --no-sync pyrefly check     # Python type checking (omnigent/)
 uv run pre-commit run --all-files
 ```
 
 When touching `web/`:
 
 ```bash
-cd web && npm install && npm run lint && npm run build
+cd web && pnpm install && pnpm run lint && pnpm run build
 ```
 
 ## Running locally
 
-To try your changes, start a local server, register your machine as a host,
-and run the frontend dev server. Use three separate terminals:
+Start with the smallest relevant automated test described in [Tests](#tests).
+For full-stack manual testing, use `omnidev`.
+
+### Recommended: worktree-safe testing with `omnidev`
+
+`omnidev` runs the current checkout's server, host, and Vite frontend in one
+terminal. Each checkout path, including each worktree, gets isolated state,
+configuration, database, artifacts, logs, and automatically allocated ports,
+so it can run alongside your normal Omnigent installation and other worktrees.
+
+Install the supervisor once from an up-to-date checkout:
+
+```bash
+cargo install --path dev/omnidev --force
+```
+
+Then run it from anywhere inside the branch checkout or worktree you want to
+test. A fresh worktree needs its own Python environment first:
+
+```bash
+cd /path/to/omnigent-worktree
+uv sync --extra all --extra dev
+omnidev
+```
+
+Open the exact `ui` URL displayed in the header; do not assume the Vite port is
+`5173`. Python changes under `omnigent/` reload the server and host, while
+frontend changes use Vite HMR.
+
+Run CLI commands against the development pod through the passthrough so they
+use that checkout and its isolated state instead of a globally installed
+`omnigent`:
+
+```bash
+omnidev omnigent config show
+omnidev omnigent agent list
+```
+
+Keep `omnidev` in the foreground and quit with `q` or `Ctrl-C` so it tears down
+all three processes. An interactive terminal inside an existing Omnigent
+session also works; use `git rev-parse --show-toplevel` to confirm that its
+current checkout is the one you intend to test.
+
+See [`dev/omnidev/README.md`](dev/omnidev/README.md) for log controls,
+clean-state testing, backend-only and LAN modes, and other options.
+
+### Manual three-terminal fallback
+
+Use the manual flow when you need to run or debug each component separately.
+Unlike `omnidev`, it does not isolate state or allocate ports. These commands
+assume the default ports are free:
 
 ```bash
 # Terminal 1: local server on :6767
-omnigent server
+uv run omnigent server
 
 # Terminal 2: register your machine as a host
-omnigent host --server http://localhost:6767
+uv run omnigent host --server http://localhost:6767
 
 # Terminal 3: frontend dev server
 cd web
-npm run dev
+pnpm run dev
 ```
 
 Open the Vite URL from the frontend dev server, usually
@@ -81,7 +135,7 @@ The host URL can also be passed positionally (`omnigent host
 http://localhost:6767`). See the [README](README.md) for more on hosts,
 harnesses, and credentials.
 
-### Backend-only local development validation
+### Disposable backend-only validation
 
 Use this when you want to validate the Python backend and local API server from
 a source checkout without building the web UI, configuring provider
@@ -169,7 +223,7 @@ Two cross-cutting suites sit on top of these:
 Frontend changes follow the same expectation with a different toolchain:
 
 - Add or update a **colocated Vitest test** — a `*.test.ts`/`*.test.tsx` file
-  next to the component or module you changed — and run it with `npm test`.
+  next to the component or module you changed — and run it with `pnpm test`.
 - A change to **user-facing UI behaviour** also needs a Playwright test under
   `tests/e2e_ui/`. This one is enforced mechanically by the `E2E UI Required`
   check, so a UI PR won't merge without a covering test (or a maintainer
@@ -177,10 +231,27 @@ Frontend changes follow the same expectation with a different toolchain:
 - Styling/formatting-only changes, copy tweaks with no flow change, and
   refactors with no behaviour change are exempt, same as the backend.
 
+## Developer Certificate of Origin
+
+To contribute to this repository, you must sign off your commits to certify
+that you have the right to contribute the code and that it complies with the
+open source license. If you can certify the contents of the [DCO](DCO), add a
+`Signed-off-by` line to each commit message:
+
+```
+Signed-off-by: Joe Smith <joe.smith@email.com>
+```
+
+Please use your real name — pseudonymous/anonymous contributions are not
+accepted. If your `user.name` and `user.email` git configs are set, `git
+commit -s` adds the sign-off automatically. The DCO check on every pull
+request enforces this, so unsigned commits will block merging.
+
 ## Pull requests
 
 - Branch from `main`, keep changes focused, and include tests or docs when relevant.
-- Sign off your commits with `git commit -s` (Developer Certificate of Origin).
+- Sign off your commits with `git commit -s` (see
+  [Developer Certificate of Origin](#developer-certificate-of-origin) above).
 - Fill in the PR template. For **UI / frontend changes**, check the
   "UI / frontend change" box and attach a **video or images** in the `Demo`
   section showing the new behaviour, so reviewers can see it without checking

DCO

@@ -0,0 +1,34 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.

NOTICE

@@ -45,8 +45,8 @@ Copyright 2016 Google LLC.
 opentelemetry-instrumentation-openai-agents-v2 - https://pypi.org/project/opentelemetry-instrumentation-openai-agents-v2/
 Copyright The OpenTelemetry Authors.
 
-cel-expr-python - https://github.com/cel-expr/cel-python/
-Copyright The Cel Expr Python Authors.
+cel-python - https://github.com/cloud-custodian/cel-python/
+Copyright The cel-python Authors.
 
 modal - https://pypi.org/project/modal/
 Copyright Modal Labs 2022.

README.md

@@ -67,6 +67,26 @@ One command installs Omnigent and everything it needs:
 curl -fsSL https://raw.githubusercontent.com/omnigent-ai/omnigent/main/scripts/install_oss.sh | sh
 ```
 
+<details>
+<summary>Optional integrations and extras</summary>
+
+Need an optional integration? Pass one or more extras to the installer:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/omnigent-ai/omnigent/main/scripts/install_oss.sh | sh -s -- --extra databricks
+curl -fsSL https://raw.githubusercontent.com/omnigent-ai/omnigent/main/scripts/install_oss.sh | sh -s -- --extra modal,e2b
+```
+
+Available user-facing extras include:
+
+- **Model providers:** `databricks`, `bedrock`, `vertex`
+- **Sandbox providers:** `modal`, `daytona`, `boxlite`, `cwsandbox`, `e2b`,
+  `openshell`, `kubernetes`
+- **SDK harnesses:** `antigravity`, `copilot`, `cursor`, `agents-sdk`
+- **Storage and memory:** `s3`, `hindsight`
+
+</details>
+
 <details>
 <summary>Prefer to install manually?</summary>
 
@@ -76,6 +96,12 @@ Omnigent needs **Python 3.12+**. Install the `omnigent` package:
 uv tool install omnigent        # or: pip install "omnigent"
 ```
 
+Manual installs use the same extras syntax, for example:
+
+```bash
+uv tool install "omnigent[databricks,modal]"
+```
+
 Or with [Homebrew](https://github.com/omnigent-ai/homebrew-tap):
 
 ```bash
@@ -96,10 +122,10 @@ uv tool install -q --python 3.12 git+https://github.com/omnigent-ai/omnigent.git
 - **`uv`** (required). https://docs.astral.sh/uv/getting-started/installation/
   The installer offers to set this up for you.
 - **`git`** (required).
-- **Node.js 22 LTS or newer** with **`npm`**, for the npm-installed coding
-  harnesses (Claude, Codex, OpenCode, Pi). `omnigent run` installs the
-  harness CLI you pick.
-  https://docs.npmjs.com/downloading-and-installing-node-js-and-npm
+- **Node.js 22 LTS or newer** with **`npm`** (for the coding-harness CLIs
+  installed by `omnigent run`) and **`pnpm`** (for the web UI). You can get
+  both from a single Node install; pnpm is available via
+  `corepack enable` or `npm install -g pnpm`.
 - **Kiro CLI** (optional), for `omnigent kiro`: install with
   `curl -fsSL https://cli.kiro.dev/install | bash`, then sign in with Kiro.
   Kiro tool approvals stay answerable in the embedded Terminal; supported
@@ -173,6 +199,41 @@ mirrors work out of the box; override with `OMNIGENT_INDEX_URL` if needed.
 
 </details>
 
+<details>
+<summary>Uninstalling Omnigent</summary>
+
+Preview the CLI/profile cleanup that would run by default:
+
+```bash
+omnigent uninstall
+```
+
+Remove the CLI and installer-managed PATH entries while keeping your local
+history, credentials, and projects:
+
+```bash
+omnigent uninstall --yes
+```
+
+To also remove Omnigent state under `~/.omnigent`, pass `--purge`; Omnigent
+backs it up outside the target before deletion. Your `~/omnigent` workspace is
+kept unless you explicitly add `--purge-workspace`.
+
+```bash
+omnigent uninstall --purge --yes
+```
+
+If the installed wheel is broken or `omnigent` is not on `PATH`, run the
+standalone script instead:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/omnigent-ai/omnigent/main/scripts/uninstall_oss.sh | sh
+```
+
+Add `--yes` to the standalone script to perform the previewed CLI cleanup.
+
+</details>
+
 ### 2. Start your first agent
 
 `omnigent` picks a model with you and starts a session in your terminal. It
@@ -206,6 +267,9 @@ omnigent hermes                      # Hermes Agent (Nous Research)
 omnigent pi                          # Pi
 ```
 
+Using OpenClaw? See the [OpenClaw integration guide](docs/openclaw.md) to import
+its coding agents or drive a live OpenClaw Gateway session over ACP.
+
 #### 🐙 Polly and 🟠🔵 Debby
 
 Two example agents ship with the repo, and they make good first sessions:
@@ -233,7 +297,7 @@ see step 3.)
 **Prefer the browser?** Start a server and register your machine as a host:
 
 ```bash
-omnigent server start   # start the local server and web UI in the background
+omnigent server --background   # start the local server and web UI in the background
 omnigent host           # (separate terminal) register this machine as a host
 ```
 
@@ -313,7 +377,7 @@ Omnigent supports **multi-user accounts**, controlled by one environment
 variable:
 
 ```bash
-OMNIGENT_AUTH_ENABLED=1 omnigent server start
+OMNIGENT_AUTH_ENABLED=1 omnigent server --background
 ```
 
 The **Docker deploy in [step 4](#4-deploy-a-server-and-use-it-from-your-phone)
@@ -353,6 +417,11 @@ and they're in. Signup is invite-only.
   omnigent run --fork <session_id>
   ```
 
+Shared sessions identify model-visible messages with `[account]:` labels by
+default. Set `OMNIGENT_SHARED_MESSAGE_ATTRIBUTION_ENABLED=0` to hide those
+labels. This does not change stored authors, UI avatars, or who may approve or
+run privileged actions.
+
 > [!TIP]
 > Want your team to sign in with the logins they already have (**Google,
 > GitHub, Okta, Microsoft**)? Set `OMNIGENT_OIDC_ISSUER` plus a client ID
@@ -447,6 +516,17 @@ Polly at [`examples/polly/`](https://github.com/omnigent-ai/omnigent/tree/main/e
 
 ---
 
+## Telemetry
+
+Omnigent collects anonymized usage data (telemetry) by default. This data
+contains no sensitive or personally identifiable information. If you're using
+Omnigent through a managed service or distribution, please consult your managed
+service agreement to determine any data collection that may impact your use of
+the service. To opt out, follow our instructions in
+[Usage Telemetry](https://omnigent.ai/docs/deploy/telemetry).
+
+---
+
 ## Contributing
 
 Contributions are welcome. See [CONTRIBUTING.md](https://github.com/omnigent-ai/omnigent/blob/main/CONTRIBUTING.md) for how to set up your environment, run the checks, and open a pull request.
@@ -463,4 +543,3 @@ Thanks to all of our amazing contributors!
 <a href="https://github.com/omnigent-ai/omnigent/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=omnigent-ai/omnigent" />
 </a>
-

RELEASING.md

@@ -13,6 +13,11 @@ omnigent ships **three PyPI packages that version-lock together**:
 pin each other with `==`), so every release builds and publishes **all three at
 one identical version**.
 
+Releases are driven by **workflow dispatches, not by hand** (design:
+`designs/RELEASE-AUTOMATION.md`). Every workflow below is idempotent —
+re-dispatch with identical inputs after any failure and it converges — and
+every dispatch requires the **admin or maintain** role on this repo.
+
 ## Where things run
 
 - **Source of truth** (versions, tags, GitHub Releases): **`omnigent-ai/omnigent`**
@@ -20,31 +25,31 @@ one identical version**.
   on the public repo).
 - **Publishing to PyPI**: the central **secure-release repo**
   **`databricks/secure-public-registry-releases-eng`**, `omnigent` workflow —
-  use the **Databricks EMU account**. Publishing runs on hardened runner
+  use whichever account has access to that repo. Publishing runs on hardened runner
   groups with **OIDC Trusted Publishing (no stored secrets)** and a **mandatory
-  dependency scan**. This is why we don't publish from `omnigent-ai/omnigent`.
+  dependency scan**. This is why we don't publish from `omnigent-ai/omnigent`,
+  and why the pipeline is two dispatches per phase rather than one.
 
 > The exact account handles — and how to request publish access — live in the
 > internal release wiki; this public runbook refers to them only by role.
-> Substitute your own handles for `<oss-account>` / `<emu-account>` in the
-> `gh auth switch --user …` commands below.
 
 The legacy `.github/workflows/release-omnigent.yml` in this repo is a
 **deprecated manual fallback only** — its tag-push trigger was removed so a tag
 never double-publishes. Use the secure repo for real releases.
 
-> The secure `omnigent` workflow is **manual `workflow_dispatch`** — it can't see
-> this repo's tag pushes. You bump + tag here, then dispatch it with that tag.
-
 ## Versioning model
 
 - `main` always carries the **next** version with a `.dev0` suffix
-  (e.g. `0.2.0.dev0`) — never a clean released number. This matches
+  (e.g. `0.6.0.dev0`) — never a clean released number. This matches
   MLflow / Delta / Unity Catalog and keeps every `main` build PEP 440-ordered as
   "ahead of the last release, not yet the next one".
-- Releases are cut on **per-minor release branches** (`branch-X.Y`) and tagged
-  there (`vX.Y.Z`); patches (`vX.Y.1`, `vX.Y.2`, …) are cherry-picked onto the
-  same `branch-X.Y`. `main` is never tagged.
+- Releases are cut on **per-minor release branches** (`release/vX.Y.0`) and tagged
+  there (`vX.Y.Z`, rc tags `vX.Y.ZrcN`); patches (`vX.Y.1`, `vX.Y.2`, …) are
+  cherry-picked onto the same `release/vX.Y.0`. `main` is never tagged.
+- Every release ships as an **rc first** (`0.6.0rc1` → … → `0.6.0`). rcs go to
+  **real PyPI** as PEP 440 pre-releases — a default `pip install omnigent`
+  never resolves them, and testers install with exact pins. TestPyPI is no
+  longer part of the standard flow.
 
 ## Docs staging
 
@@ -56,221 +61,280 @@ branch** on `omnigent-site` instead of `main`:
 - **`doc-sync.yml`** — drafts prose docs for each merged PR that needs them.
 - **`sync-openapi-to-site.yml`** — syncs the API reference (`openapi.json`).
 
-Both derive the branch name from `omnigent/version.py` (`0.5.0.dev0` → `0.5-docs`)
+Both derive the branch name from `omnigent/version.py` (`0.6.0.dev0` → `0.6-docs`)
 and create it off site `main` the first time a doc PR lands in the cycle. All docs
-for the `0.5` line — including patches — accumulate on `0.5-docs`. Each PR still
+for the `0.6` line — including patches — accumulate on `0.6-docs`. Each PR still
 gets its own review, but merging one only lands it on the staging branch, not the
-live site.
-
-At release, publishing the GitHub Release fires `publish-changelog.yml`, which
-opens the **`0.5-docs → main`** PR (see step 5). Merging that publishes the whole
-cycle's docs at once. Nothing to create or retarget by hand — the branch name
-tracks `main`'s version automatically.
+live site. At finalize time, the whole batch goes live at once (step 4 below).
 
 ---
 
-## Release steps (example: `v0.2.0`)
+## Standard flow
 
-### 1. Cut the release branch + tag — `omnigent-ai/omnigent` (OSS account)
+### rc phase (example: `0.6.0rc1`)
 
-Only tag a commit that already has **green CI** — verify `main` is green before
-branching:
+**1. Cut + tag — dispatch `Release` (`release.yml`), OSS account.**
 
 ```bash
-gh auth switch --user <oss-account>
-git fetch origin
-gh run list --repo omnigent-ai/omnigent --branch main --status success --limit 1
-git checkout -b branch-0.2 origin/main
+gh workflow run release.yml --repo omnigent-ai/omnigent \
+  -f version=0.6.0rc1 -f dry_run=false
+# optional: -f ref=<sha> to cut release/v0.6.0 from a specific commit (rc1 only);
+# dry_run defaults to true — run once without -f dry_run to preview the plan.
 ```
 
-Set the release version in **all three** `pyproject.toml` files — the
-`version` field **and** the cross-package `==` pins — plus `uv.lock`
-(`0.2.0.dev0` → `0.2.0`):
+What it does (all idempotent):
 
-- `pyproject.toml` (`version`, `omnigent-client==`, `omnigent-ui-sdk==`)
-- `sdks/python-client/pyproject.toml` (`version`, `omnigent==`)
-- `sdks/ui/pyproject.toml` (`version`, `omnigent-client==`)
-- `uv.lock` — **hand-edit** the three `version = "…"` lines (omnigent,
-  omnigent-client, omnigent-ui-sdk) and the one cross-pin `specifier = "==…"`
-  (`omnigent-ui-sdk`'s dep on `omnigent-client`). The three packages are
-  **editable workspace members** (`source = { editable = … }`), so uv records
-  **no wheel `hash` entries** for them, and the other two cross-deps appear as
-  `editable = "…"` with no `==` specifier — so only those version/specifier
-  strings change, nothing else (no hashes to touch).
-  **Do not run `uv lock`** locally: it rewrites every registry URL to the
-  internal proxy and that leaks into the lockfile (breaks CI). The published
-  lock must use `https://pypi.org/simple`.
+- asserts green CI on the base commit (escape hatch: `-f skip_ci_check=true`,
+  use deliberately — needed for a flaky check, or when the base commit ran no
+  checks at all, e.g. a cherry-pick that only touched `paths-ignore`d files);
+- creates `release/v0.6.0` from `ref` (rc1) or reuses the existing branch head
+  (rc2+, final, patches — `ref` is ignored then);
+- stamps the lockstep version via `scripts/update_versions.py` and regenerates
+  `uv.lock` with a clean public-PyPI resolution — **never hand-edit `uv.lock`
+  or run `uv lock` behind a proxy**; the workflow owns this now;
+- commits `release: v0.6.0rc1`, tags, and pushes branch + tag with the
+  omnigent-ci App token, which fires the downstream automation:
+  `oss-publish-images.yml` (Docker; publishes the immutable version image tag),
+  `github-release.yml` (skips rc — no GitHub release is created for
+  pre-releases; rcs live on PyPI only), and `draft-release-notes.yml` (skips rc);
+- on the **first** cut of a cycle (rc1), dispatches `bump-version.yml`
+  (post-release) — **review and merge the `main → 0.7.0.dev0` bump PR
+  promptly**, so `doc-sync` keeps staging to the right docs branch.
 
-Stage exactly the version files (don't `-a`, which would sweep in any stray
-local edits), then commit, tag, and push **the branch + only this tag**:
+**2. Publish to PyPI — dispatch the secure repo (EMU account).**
 
 ```bash
-git add pyproject.toml sdks/python-client/pyproject.toml sdks/ui/pyproject.toml uv.lock
-git commit -m "release: v0.2.0"
-git tag v0.2.0
-git push -u origin branch-0.2 v0.2.0        # explicit tag, NOT --tags; pushing the tag drafts the GitHub Release (step 5)
-```
-
-> Pushing the tag also kicks off the **changelog automation** (see step 5):
-> `github-release.yml` drafts the Release, then `draft-release-notes.yml` opens a
-> `CHANGELOG.md` PR and fills the draft with curated notes — both ready by the time
-> you get to step 5.
-
-Keep `main` from re-freezing — bump it to the next dev marker and push:
-
-```bash
-git checkout main
-# set 0.2.0.dev0 -> 0.3.0.dev0 in the 3 pyprojects (+ pins) and uv.lock.
-# Hand-edit uv.lock here too — same rule, do NOT run `uv lock` (it leaks the proxy URL).
-git add pyproject.toml sdks/python-client/pyproject.toml sdks/ui/pyproject.toml uv.lock
-git commit -m "chore: bump main to 0.3.0.dev0"
-git push
-```
-
-### 2. Dry-run the gates — secure repo (EMU account)
-
-```bash
-gh auth switch --user <emu-account>
+gh auth switch --user <secure-repo-account>
 gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
-  -f ref=v0.2.0 -f destination=test-pypi -f dry-run=true
-```
-
-Runs build + dependency scan + the gates (lockstep version/pins, web-UI-in-wheel,
-`twine check`, smoke-install) and the OIDC token exchange — **without uploading**.
-
-### 3. Publish to TestPyPI + validate
-
-```bash
+  -f ref=v0.6.0rc1 -f destination=pypi -f dry-run=true    # gates rehearsal
 gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
-  -f ref=v0.2.0 -f destination=test-pypi -f dry-run=false
+  -f ref=v0.6.0rc1 -f destination=pypi -f dry-run=false   # real publish
 ```
 
-Validate in a clean venv. **Don't** use `--extra-index-url` with TestPyPI: pip
-resolves each name across *both* indexes and picks the highest version, so anyone
-squatting `omnigent` / `omnigent-client` / `omnigent-ui-sdk` on real PyPI at a
-higher version wins the resolution (dependency confusion). Instead, take **deps
-from real PyPI only** and the **candidates from TestPyPI only**, exact-pinned with
-`--no-deps`:
+The dry run exercises build + dependency scan + the gates (lockstep
+version/pins, web-UI-in-wheel, `twine check`, smoke-install) and the OIDC
+token exchange without uploading. The real run binds the per-package
+Trusted-Publisher environments (may gate on reviewer approval) and re-verifies
+that `ref` is exactly the tag and points at the built commit.
+
+**3. Validate from PyPI** (clean venv; exact pins resolve pre-releases;
+behind a corporate network, point `--index-url` at your PyPI mirror
+instead — this is a manual step on purpose: the secure repo's runners
+cannot see a fresh index view, so no CI job can do it):
 
 ```bash
-python -m venv /tmp/omni-rc
-# 1) seed the dependency closure from REAL PyPI (the last released omnigent):
-/tmp/omni-rc/bin/pip install --index-url https://pypi.org/simple/ omnigent
-# 2) overlay the candidates from TestPyPI ONLY, exact-pinned, no deps:
-/tmp/omni-rc/bin/pip install --index-url https://test.pypi.org/simple/ --no-deps \
-  omnigent==0.2.0 omnigent-client==0.2.0 omnigent-ui-sdk==0.2.0
-/tmp/omni-rc/bin/omnigent --version    # expect 0.2.0
+python -m venv /tmp/omni-rc && /tmp/omni-rc/bin/pip install \
+  --index-url https://pypi.org/simple/ \
+  omnigent==0.6.0rc1 omnigent-client==0.6.0rc1 omnigent-ui-sdk==0.6.0rc1
+/tmp/omni-rc/bin/omnigent --version    # expect 0.6.0rc1
 ```
 
-> If this release **adds a new runtime dependency** the previous release didn't
-> have, install it explicitly from real PyPI first
-> (`/tmp/omni-rc/bin/pip install --index-url https://pypi.org/simple/ <dep>`) —
-> never let a `--no-deps` TestPyPI install pull third-party deps from TestPyPI.
+No GitHub release is created for the rc — pre-releases live on PyPI only,
+and a curated release page is reserved for the final cut.
+Need another candidate? Repeat with `0.6.0rc2` (fixes land on `release/v0.6.0`
+first, via cherry-pick PRs or direct pushes; CI runs on `release/v*` pushes).
 
-### 4. Publish to PyPI (prod)
+### Final phase (example: `0.6.0`)
 
-Requires **admin/maintain** on the secure repo (if you hit a 403, request access
-via the secure-release owning team / internal release wiki before proceeding);
-binds the per-package `pypi-omnigent`, `pypi-omnigent-client`,
-`pypi-omnigent-ui-sdk` Trusted-Publisher environments (may gate on reviewer
-approval). The prod path also re-verifies that
-`ref` is exactly the `vX.Y.Z` tag and that the tag points at the built commit.
+1. **Cut + tag**: `gh workflow run release.yml -f version=0.6.0 -f dry_run=false`
+   — same as above; builds from the `release/v0.6.0` head.
+2. **Publish to PyPI**: same secure-repo dispatches on `ref=v0.6.0`.
+3. **Curate**: merge the `CHANGELOG.md` PR that `draft-release-notes.yml`
+   opened, and review/trim the curated notes in the `v0.6.0` draft on the
+   Releases page — whatever you leave becomes the website post.
+4. **Finalize — dispatch `Finalize release` (`finalize-release.yml`)**:
 
-```bash
-gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
-  -f ref=v0.2.0 -f destination=pypi -f dry-run=false
+   ```bash
+   gh workflow run finalize-release.yml --repo omnigent-ai/omnigent -f tag=v0.6.0
+   ```
 
-uv tool install omnigent==0.2.0        # final sanity from real PyPI
-```
+   It verifies PyPI serves all three packages, the CHANGELOG PR isn't open,
+   and the **docs sweep**: no open PRs against `0.6-docs` on `omnigent-site`
+   (it lists any stragglers — get them reviewed and merged/closed, then
+   re-dispatch). Then it pauses on the **`publish-release` environment**;
+   approving it attests "I reviewed the draft notes". It publishes the release
+   as **Latest**, which fires:
+   - `publish-changelog.yml` → the site **release-post PR** and the
+     **`0.6-docs → main` docs-publish PR** — review and merge both;
+   - `update-homebrew.yml` → the **homebrew-tap bump PR** (new sdist pin +
+     regenerated resources; test-bot builds the bottles on it) — review the
+     resource diff, then apply the **`pr-pull`** label to bottle + merge.
 
-> Note: the dispatch's `-f ref=v0.2.0` is the **omnigent source ref**; it is
-> distinct from `gh workflow run --ref`, which selects the branch the *workflow
-> definition* runs from (the secure repo's default).
+### Patch release (example: `0.6.1`)
 
-### 5. Publish the GitHub Release — `omnigent-ai/omnigent` (OSS account)
-
-Pushing the `v0.2.0` tag (step 1) set the **changelog automation** in motion —
-two workflows have already done the prep for you:
-
-- `github-release.yml` created a **draft** release.
-- `draft-release-notes.yml` (fires right after) then:
-  1. opened a **`CHANGELOG.md` PR to `main`** — the granular, feature-level log,
-     harvested mechanically from each merged PR's `## Changelog` section; and
-  2. **filled the draft's body** with concise, curated notes (Major new features /
-     Breaking changes / Bug fixes — user-facing only), synthesized by an agent from
-     the merged PRs, with the original auto-notes tucked into a collapsed
-     `<details>` for reference. Security and CI/internal fixes are deliberately left
-     out of the highlights.
-
-Now:
-
-1. **Merge the `CHANGELOG.md` PR** as part of cutting the release, so the draft's
-   `Full Changelog` link (which points at `CHANGELOG.md` on `main`) resolves.
-2. Open <https://github.com/omnigent-ai/omnigent/releases>, find the `v0.2.0`
-   draft, and **review/trim the curated notes** — they're a strong starting point,
-   not the final word. Lead with user-facing highlights; call out breaking changes.
-   Whatever you leave here becomes the website post, so curate it well.
-3. **Publish the release** (ideally only after the prod PyPI publish in step 4 has
-   succeeded, so you never advertise a version that isn't installable).
-
-Publishing a **final** release fires `.github/workflows/publish-changelog.yml`,
-which opens **two** PRs to review and merge (pre-releases are skipped):
-
-- **`omnigent-site` `/releases/<version>`** — a per-version post mirroring the
-  notes you just curated (PR refs and angle/brace characters are made MDX-safe for
-  you). Targets `main`.
-- **`omnigent-site` `X.Y-docs → main`** — publishes the docs staged this cycle
-  (see [Docs staging](#docs-staging) below). Skipped if that branch doesn't exist
-  or has nothing beyond `main`. Review the batch and merge to take the version's
-  docs live.
-
-To re-run either half for an already-cut tag: dispatch `draft-release-notes.yml`
-with the `tag` (re-opens the CHANGELOG PR; it leaves the notes alone once the
-release is published), or `publish-changelog.yml` with the `tag` (re-opens the
-site post PR).
-
-If the draft wasn't created (e.g. the workflow was disabled), do it manually:
-
-```bash
-gh auth switch --user <oss-account>
-gh release create v0.2.0 --repo omnigent-ai/omnigent \
-  --draft --verify-tag --generate-notes --title "v0.2.0"
-# review/edit, then publish from the Releases page (or `gh release edit v0.2.0 --draft=false`)
-```
+Cherry-pick the fixes onto `release/v0.6.0` (CI runs on the push), then run the
+same flow with `version=0.6.1` — an rc first if the patch warrants one. `main`
+does not change for a patch, and a patch never needs a new branch.
 
 ---
 
-## Patch release (e.g. `v0.2.1`)
+## Nightly builds
 
-Cherry-pick the fix onto the existing `branch-0.2`, then:
+`nightly-release.yml` runs at 04:30 UTC: it finds the newest commit on `main`
+with green CI, stamps the lockstep version to `X.Y.Z.devYYYYMMDD` (today's UTC
+date on main's `X.Y.Z.dev0` line), commits that stamp detached (`main` never
+moves and no release branch is created), and pushes only the tag. Quiet nights
+and same-day re-runs no-op. The tag push publishes the immutable Docker image
+tag; no GitHub release, changelog, or homebrew automation fires for dev tags,
+and a default `pip install omnigent` never resolves them.
 
-1. Confirm CI is green on `branch-0.2` after the cherry-pick
-   (`gh run list --repo omnigent-ai/omnigent --branch branch-0.2 --status success --limit 1`).
-2. Bump the three versions/pins + `uv.lock` to `0.2.1` (same hand-edit rules as above).
-3. Stage explicitly, commit, and tag **on `branch-0.2`**:
-   `git add <version files> && git commit -m "release: v0.2.1" && git tag v0.2.1 && git push origin branch-0.2 v0.2.1`.
-4. Repeat steps 2–5.
+Nightlies do not go to PyPI. Consumers install straight from the tag with uv
+(requires git, uv, Node 22+, and pnpm):
 
-`main` does **not** change for a patch, and a patch never needs a new
-`branch-0.Y` — patches always ship from the existing minor branch.
+```bash
+curl -fsSL https://raw.githubusercontent.com/omnigent-ai/omnigent/main/scripts/update_nightly.sh | bash
+```
+
+The script is idempotent (cron-safe) and pins all three lockstep packages to
+one tagged commit; `omnigent --version` prints that commit. An existing
+install moves onto (or along) the channel with `omni upgrade --nightly`.
+
+A bad nightly needs no recovery: fix `main` and the next night's tag
+supersedes it. For an ad-hoc cut, dispatch `nightly-release.yml` (dry-run by
+default; `-f dry_run=false` cuts for real, and it no-ops when today's tag
+already exists). Sustained failures of the cut file a tracking issue via
+`nightly-failure-monitor.yml`.
 
 ---
 
+## One-time setup (repo admin)
+
+- **`publish-release` environment** on `omnigent-ai/omnigent` with required
+  reviewers = the release managers. Without it the finalize publish job runs
+  ungated.
+- **omnigent-ci App** installed on `omnigent-ai/homebrew-tap` (it already
+  covers `omnigent` and `omnigent-site`).
+- **Tag ruleset** (recommended): restrict `v[0-9]*` create/update/delete to
+  the omnigent-ci App + admins, so no write-access account can start the
+  tag-push automation by hand.
+
 ## If a publish goes wrong (recovery)
 
 **PyPI releases can't be deleted, only _yanked_**, and a version number once used
 can never be reused. So:
 
-- **TestPyPI failed / candidate is bad:** bump to the next number (don't reuse the
-  version) and re-run — TestPyPI is disposable.
+- **Any workflow failed mid-run:** fix the cause and **re-dispatch with the
+  same inputs** — every step converges (branch exists → reused; version
+  stamped → no new commit; tag at the converged commit → no-op) or fails
+  loudly (tag elsewhere) rather than duplicating work.
+- **Wrong commit tagged, nothing published yet:** delete the tag and, for a
+  final `vX.Y.Z` (which has a draft), the draft too —
+  `gh release delete vX.Y.Z`, `git push origin :refs/tags/vX.Y.Z` — then
+  re-dispatch `release.yml`. (rc tags have no draft to delete.)
+- **rc is bad:** just cut the next rc — rcs are cheap and invisible to
+  default installs.
 - **Prod publish partially succeeded** (e.g. two of three packages uploaded):
   **yank** the published version(s) on PyPI (each affected project → *Manage* →
-  *Releases* → *Yank*) so installs don't resolve a half-published set, then cut the
-  next patch with the fix. Don't try to overwrite — Trusted Publishing / `twine`
-  rejects re-uploading an existing version.
-- **GitHub Release** for a version you abandoned:
-  `gh release delete vX.Y.Z --repo omnigent-ai/omnigent`, and drop the tag if it
-  shouldn't exist (`git push origin :refs/tags/vX.Y.Z`); re-tag only the corrected
-  commit.
-- Publishing uses **OIDC Trusted Publishing (no stored secrets)**, so a failed run
-  leaks nothing — just fix forward to the next version.
+  *Releases* → *Yank*) so installs don't resolve a half-published set, then cut
+  the next version with the fix. Don't try to overwrite — Trusted Publishing /
+  `twine` rejects re-uploading an existing version.
+- Publishing uses **OIDC Trusted Publishing (no stored secrets)**, so a failed
+  run leaks nothing — fix forward to the next version.
+
+---
+
+## Rehearsing the pipeline (throwaway rc release)
+
+To exercise the whole flow end to end without touching users, release a
+deliberately **below-latest** rc on the dead `0.0` line. A below-latest rc is
+inert everywhere that matters: no GitHub release is created for rc tags, Docker
+publishes only the immutable version image tag (`:latest` / `:latest-rc` only
+move for the highest version), the notes/site/homebrew workflows ignore rc
+tags, `bump-main` skips itself (the version sorts below main's), and a
+PEP 440 pre-release is never resolved by a default `pip install` — on real
+PyPI or TestPyPI alike.
+
+**Pick a version that has never touched the destination index.** PyPI
+filenames are burned forever — even for yanked releases — so reusing a number
+fails the upload with "File already exists". (`0.0.1rc1` itself is spent: it
+reserved the PyPI project names in June 2026.) Confirm before starting; a 404
+means the version is free:
+
+```bash
+curl -fsS https://pypi.org/pypi/omnigent/0.0.1rc2/json   # expect 404
+```
+
+The examples below use `0.0.1rc2`; substitute the next free number.
+
+1. **Plan (read-only)** — dry run is the default:
+
+   ```bash
+   gh workflow run release.yml --repo omnigent-ai/omnigent -f version=0.0.1rc2
+   ```
+
+2. **Execute**: re-run with `-f dry_run=false`. Expect `release/v0.0.0` + tag
+   `v0.0.1rc2` pushed, the tag firing the image workflow (`github-release.yml`
+   runs but skips the rc — no draft), and CI running on the branch push. If the CI gate rejects main's head
+   (failing or still-pending checks), that's the gate working — wait, or
+   re-dispatch with `-f ref=<green sha>` / `-f skip_ci_check=true`.
+   Cancelled (superseded) runs only warn.
+3. **Idempotency**: dispatch the exact same command again — it must no-op
+   ("already at the converged release commit").
+4. **Secure-repo publish.** Real PyPI is safe for a below-latest rc and
+   exercises the full prod path (the tag gate + the per-package reviewer
+   environments; approve all three) — so rehearse against
+   `destination=pypi`. `destination=test-pypi` also works, but skips the
+   prod tag gate and needs TestPyPI Trusted Publishers configured. Then
+   validate the published rc manually, exactly like a real release (step 3
+   of the standard flow).
+
+   ```bash
+   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
+     -f ref=v0.0.1rc2 -f destination=pypi -f dry-run=true    # gates only
+   gh workflow run omnigent.yml --repo databricks/secure-public-registry-releases-eng \
+     -f ref=v0.0.1rc2 -f destination=pypi -f dry-run=false   # real publish
+   ```
+
+5. **No-double-publish check** (optional): re-dispatching step 4's second
+   command must FAIL every leg with "File already exists" — PyPI
+   immutability doing its job. The publish is deliberately **write-only**:
+   the release runners cannot read the index, so there is no
+   already-published skip (a curl probe and twine's `--skip-existing` both
+   failed live for exactly that reason). A real partial publish is recovered
+   by yank + next version (see "If a publish goes wrong").
+6. **Finalize gates (no side effects)**:
+   `gh workflow run finalize-release.yml -f tag=v0.0.1rc2` must fail fast
+   ("not a final tag"), and `-f tag=v0.5.1` (any already-published release)
+   must no-op as already published.
+
+Cleanup — delete everything the rehearsal minted on GitHub:
+
+```bash
+gh api -X DELETE 'repos/omnigent-ai/omnigent/git/refs/heads/release/v0.0.0'
+```
+
+No `gh release delete` is needed: pre-release tags no longer create a GitHub
+release. Optionally delete the rehearsal image versions from GHCR. The PyPI side needs
+no cleanup: the rc is invisible to default installs and only the version
+number is spent — optionally yank it (*Manage → Releases → Yank*) for
+tidiness.
+
+---
+
+## Break-glass appendix (manual fallback)
+
+If the workflows are unavailable, the flow can be driven by hand — but keep two
+rules even then:
+
+1. **Never hand-edit `uv.lock` and never run `uv lock` behind a proxy.** Use
+   `bump-version.yml` (mode `pre-release`, `base_branch=release/vX.Y.0`) to
+   produce the bump as a PR with a cleanly regenerated lockfile, and merge it.
+2. **Push tags from an account, not automation you improvised** — the tag push
+   must fire `github-release.yml` et al., which a `GITHUB_TOKEN`-authored push
+   would not.
+
+```bash
+gh auth switch --user <oss-account>
+git fetch origin && git checkout -b release/v0.6.0 origin/main   # rc1 only
+gh workflow run bump-version.yml -f mode=pre-release -f new_version=0.6.0rc1 \
+  -f base_branch=release/v0.6.0                                  # then merge the PR
+git fetch origin && git checkout release/v0.6.0 && git pull
+git tag v0.6.0rc1 && git push origin release/v0.6.0 v0.6.0rc1    # explicit tag, NOT --tags
+```
+
+Then continue from step 2 of the standard flow (secure-repo dispatches). For
+a final `vX.Y.Z`, if the GH draft wasn't created, `gh release create vX.Y.Z
+--draft --verify-tag --title vX.Y.Z` recreates it (rc tags get no draft by
+design). To re-run the notes/site halves for an existing
+tag, dispatch `draft-release-notes.yml` or `publish-changelog.yml` with the
+`tag` input; for the tap, dispatch `update-homebrew.yml`.

config.yaml

@@ -1,3 +0,0 @@
-llm:
-  model: databricks-claude-haiku-4-5
-  profile: oss

deploy/README.md

@@ -177,6 +177,39 @@ remote DB.
 256 MB default does not, so the Fly config pins a 1 GB machine, and the
 Modal app pins `memory=1024` for the same reason.
 
+## Serving: put an HTTP/2 proxy in front for many concurrent views
+
+Each open session in the web UI holds a long-lived streaming HTTP
+response (`GET /v1/sessions/{id}/stream`, `text/event-stream`) for as
+long as the view is on screen. Over **HTTP/1.1 browsers cap concurrent
+connections at ~6 per origin**, and every open stream occupies one of
+those slots. Open a handful of windows or tabs against the same server
+and the pool fills with held-open streams — then every *other* request
+the UI makes (sending a message, the session list, `/health`, auth)
+queues behind the cap and never fires. The symptom is the whole UI
+appearing to freeze across all windows while the server itself is idle;
+in DevTools → Network the stuck requests sit in **Stalled/Queued**, not
+"waiting for server".
+
+**Fix: serve over HTTP/2.** HTTP/2 multiplexes every stream over one
+connection, so the per-origin cap stops mattering. `uvicorn` (the
+server's ASGI server) speaks HTTP/1.1 only, so HTTP/2 comes from a
+reverse proxy that terminates TLS in front of it — which most real
+deploys already have:
+
+- **The bundled Caddy overlay** (`docker/docker-compose.https.yaml`)
+  gives you this for free — Caddy negotiates HTTP/2 (and HTTP/3) over
+  TLS via ALPN with no extra config. See
+  [`docker/README.md`](docker/README.md#multi-user-mode-oidc).
+- **The one-click platforms** (Render, Railway, Fly, Cloudflare) and
+  managed **Databricks** terminate TLS with HTTP/2 at their edge, so
+  they're already covered.
+
+The gap is only when you expose the raw `:8000` HTTP/1.1 port directly
+to browsers (e.g. `docker compose up` with no proxy, reached over
+plain HTTP). That's fine for a single window; put a proxy in front once
+you or your team routinely open several.
+
 ## Execution model
 
 Omnigent runs in two pieces that talk to each other over a

deploy/boxlite/README.md

@@ -59,6 +59,18 @@ sandbox:
   server_url: https://omnigent.example.com   # the in-box host dials this back
 ```
 
+A top-level `sandbox.host_config:` (provider-agnostic) holds verbatim
+in-sandbox `~/.omnigent/config.yaml` content — e.g. a `providers:`
+block routing a harness through a self-hosted gateway — installed into
+the sandbox before `omnigent host` starts. The block is server-managed:
+entries injected by a previous launch are replaced or removed on the
+next launch/resume, while config created inside the sandbox survives.
+Keep secrets out via
+`api_key_ref: env:VAR` (resolved in the sandbox against the injected
+env). See the [sandbox-runners config
+table](../kubernetes/overlays/sandbox-runners/README.md#configuration-sandbox-configyaml)
+for the shape.
+
 `provider` + `server_url` is a complete config: the image defaults to
 the official prebaked host image and boxes run locally.
 

deploy/cloudflare/README.md

@@ -68,8 +68,8 @@ browser ───────────────►  Worker (src/index.js)
 
 ```bash
 cd deploy/cloudflare
-npm install
-npx wrangler login
+pnpm install
+pnpm exec wrangler login
 ```
 
 ## Deploy

deploy/cwsandbox/README.md

@@ -136,6 +136,18 @@ sandbox:
   server_url: https://your-host    # public URL sandboxes dial back to
 ```
 
+A top-level `sandbox.host_config:` (provider-agnostic) holds verbatim
+in-sandbox `~/.omnigent/config.yaml` content — e.g. a `providers:`
+block routing a harness through a self-hosted gateway — installed into
+the sandbox before `omnigent host` starts. The block is server-managed:
+entries injected by a previous launch are replaced or removed on the
+next launch/resume, while config created inside the sandbox survives.
+Keep secrets out via
+`api_key_ref: env:VAR` (resolved in the sandbox against the injected
+env). See the [sandbox-runners config
+table](../kubernetes/overlays/sandbox-runners/README.md#configuration-sandbox-configyaml)
+for the shape.
+
 `provider` + `server_url` is a complete config. `server_url` **must be reachable
 from CoreWeave** — the host inside the sandbox opens an outbound WebSocket to it,
 not `localhost`. For local testing, expose your server with a tunnel

deploy/databricks/build.sh

@@ -28,10 +28,8 @@ rm -rf omnigent/server/static/web-ui dist build omnigent.egg-info
 
 if [[ "${SKIP_WEB_UI:-}" != "1" ]]; then
     echo "==> Building web SPA into omnigent/server/static/web-ui/"
-    cd web
-    npm install
-    npm run build
-    cd "${REPO_ROOT}"
+    pnpm install --frozen-lockfile --filter web
+    pnpm --filter web run build
 else
     echo "==> SKIP_WEB_UI=1: skipping web build"
 fi

deploy/databricks/src/app.py

@@ -153,6 +153,9 @@ try:
         SqlAlchemyPermissionStore,
     )
     from omnigent.stores.policy_store.sqlalchemy_store import SqlAlchemyPolicyStore
+    from omnigent.stores.scheduled_task_store.sqlalchemy_store import (
+        SqlAlchemyScheduledTaskStore,
+    )
 
     DB_URI = f"postgresql+psycopg://{PGUSER}@{PGHOST}:{PGPORT}/{PGDATABASE}"
     ARTIFACT_URI = f"dbfs:{VOLUME_PATH}"
@@ -180,6 +183,7 @@ try:
     permission_store = SqlAlchemyPermissionStore(DB_URI)
     policy_store = SqlAlchemyPolicyStore(DB_URI)
     host_store = HostStore(DB_URI)
+    scheduled_task_store = SqlAlchemyScheduledTaskStore(DB_URI)
 
     agent_cache = AgentCache(artifact_store=artifact_store, cache_dir=CACHE_DIR)
 
@@ -212,6 +216,7 @@ try:
         permission_store=permission_store,
         policy_store=policy_store,
         host_store=host_store,
+        scheduled_task_store=scheduled_task_store,
         auth_provider=auth_provider,
     )
 

deploy/daytona/README.md

@@ -151,6 +151,18 @@ sandbox:
     env: [OPENAI_API_KEY, ANTHROPIC_API_KEY, GIT_TOKEN]
 ```
 
+A top-level `sandbox.host_config:` (provider-agnostic) holds verbatim
+in-sandbox `~/.omnigent/config.yaml` content — e.g. a `providers:`
+block routing a harness through a self-hosted gateway — installed into
+the sandbox before `omnigent host` starts. The block is server-managed:
+entries injected by a previous launch are replaced or removed on the
+next launch/resume, while config created inside the sandbox survives.
+Keep secrets out via
+`api_key_ref: env:VAR` (resolved in the sandbox against the injected
+env). See the [sandbox-runners config
+table](../kubernetes/overlays/sandbox-runners/README.md#configuration-sandbox-configyaml)
+for the shape.
+
 ## Credentials for the sandbox (LLM keys, git tokens)
 
 Daytona has no provider-side named-secret store to attach at sandbox

deploy/docker/.env.example

@@ -34,13 +34,19 @@ POSTGRES_PASSWORD=change-me-please
 # instance.
 #
 #   A) Built-in accounts (DEFAULT — no env needed for laptop testing).
-#      First boot auto-creates an admin user (named after the OS
-#      user, falling back to "admin"), prints the password to
-#      `docker compose logs omnigent`, and saves it to
-#      /data/admin-credentials on the persistent volume. Admin
-#      invites teammates via the web UI Members page.
+#      No credentials are auto-generated. First boot prints a
+#      "No admin yet" line pointing at the base URL; you create the
+#      first admin (username + password) via the web Create-admin
+#      form, or pre-seed it with OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD.
+#      Admin invites teammates via the web UI Members page.
 #      For any deploy behind a public domain you MUST set
 #      OMNIGENT_ACCOUNTS_BASE_URL — see below.
+#      Security note for public deployments: POST /auth/setup is
+#      intentionally unauthenticated while no password-bearing account
+#      exists, so an instance exposed before its operator reaches the
+#      form can be claimed by the first visitor. Pre-seed
+#      OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD, or keep the service
+#      private until setup completes.
 #
 #   B) Native OIDC (for shops with an existing IdP).
 #      Set the OMNIGENT_OIDC_* vars below (at minimum
@@ -82,9 +88,14 @@ POSTGRES_PASSWORD=change-me-please
 # omnigent:8000 container address.
 # OMNIGENT_ACCOUNTS_BASE_URL=https://omnigent.example.com
 #
-# Optional: pre-seed the initial admin password instead of the
-# auto-generated one. Useful for headless / CI deploys where
-# the operator can't read `docker compose logs`.
+# Optional: pre-seed the initial admin password so bootstrap creates
+# the first admin directly, instead of waiting for someone to claim it
+# through the web Create-admin form. Useful for headless / CI deploys
+# where that form can't be reached interactively. Nothing is ever
+# auto-generated: without this (and without an OIDC issuer) a fresh
+# instance stays in the needs-setup state and prints the setup URL to
+# stderr — no password appears in the logs. See the security note under
+# section A above for public deployments.
 # OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD=
 #
 # Optional: session/invite/magic TTLs. Defaults shown.
@@ -151,6 +162,14 @@ POSTGRES_PASSWORD=change-me-please
 # trusted enterprise directory — it makes any signed email claim the
 # user's identity. Off by default.
 # OMNIGENT_OIDC_SKIP_EMAIL_VERIFICATION=1
+#
+# Read the email identity from a different id_token claim. Some IdPs
+# omit the email claim entirely — Microsoft Entra ID commonly issues
+# only preferred_username (the UPN) — which fails login with
+# "Could not determine user email". A custom claim carries no
+# email_verified marker, so set OMNIGENT_OIDC_SKIP_EMAIL_VERIFICATION
+# alongside it. Default: email.
+# OMNIGENT_OIDC_EMAIL_CLAIM=preferred_username
 
 # ── Server config file (admins, allowed domains, …) ──────
 # Non-secret settings live in a YAML config file — the same one

deploy/docker/Caddyfile

@@ -5,6 +5,13 @@
 # over the internal docker network — the omnigent container is no
 # longer directly exposed to the host.
 #
+# Fronting the server with Caddy also gives you HTTP/2 (negotiated over
+# TLS via ALPN, no extra config). That matters beyond HTTPS: each open
+# session in the web UI holds a long-lived event-stream connection, and
+# HTTP/1.1's ~6-connections-per-origin cap makes the UI stall once a
+# user opens several windows/tabs. HTTP/2 multiplexes them over one
+# connection, so this proxy is the fix. See ../README.md ("Serving").
+#
 # No ACME email is required: Let's Encrypt allows anonymous account
 # registration, so the cert issues without one. If you WANT expiry /
 # renewal notices, add a global email option above the site block:

deploy/docker/Dockerfile

@@ -55,7 +55,7 @@
 
 # Must satisfy pyproject requires-python (>=3.12); 3.11 fails dependency resolution.
 ARG PYTHON_VERSION=3.12
-ARG NODE_VERSION=20
+ARG NODE_VERSION=22
 
 # ── Web UI builder ──────────────────────────────────────
 # Builds the web SPA so `docker build` works from a clean checkout —
@@ -70,12 +70,20 @@ ARG NODE_VERSION=20
 FROM node:${NODE_VERSION}-slim AS web-builder
 ARG NPM_CONFIG_REGISTRY=
 ENV NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}
-WORKDIR /web/web
-# Manifests first so the install layer caches across pure source edits.
-COPY web/package.json web/package-lock.json ./
-RUN npm install --no-audit --no-fund
-COPY web/ ./
-RUN npm run build
+WORKDIR /web
+
+# Workspace manifests + lockfile first so the install layer caches across pure
+# source edits. The electron package JSON is included so the root workspace is
+# structurally complete, but we --filter web to avoid downloading Electron.
+COPY pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY web/package.json ./web/
+COPY web/electron/package.json ./web/electron/
+
+RUN npm install -g pnpm@11.15.1
+RUN pnpm install --frozen-lockfile --filter web
+
+COPY web/ ./web/
+RUN pnpm --filter web run build
 
 # ── Python builder (shared: server + host) ──────────────
 # Installs the package (and its transitive native-extension deps) into

deploy/docker/Dockerfile.ubi

@@ -13,7 +13,7 @@
 #                -f deploy/docker/Dockerfile.ubi .
 
 ARG PYTHON_VERSION=3.12
-ARG NODE_VERSION=20
+ARG NODE_VERSION=22
 
 # ── Web UI builder ──────────────────────────────────────
 FROM registry.access.redhat.com/ubi9/nodejs-${NODE_VERSION} AS web-builder
@@ -21,11 +21,20 @@ ARG NPM_CONFIG_REGISTRY=
 ENV NPM_CONFIG_REGISTRY=${NPM_CONFIG_REGISTRY}
 
 USER 0
-WORKDIR /web/web
-COPY web/package.json web/package-lock.json ./
-RUN npm install --no-audit --no-fund
-COPY web/ ./
-RUN npm run build
+WORKDIR /web
+
+# Workspace manifests + lockfile first so the install layer caches across pure
+# source edits. The electron package JSON is included so the root workspace is
+# structurally complete, but we --filter web to avoid downloading Electron.
+COPY pnpm-workspace.yaml pnpm-lock.yaml ./
+COPY web/package.json ./web/
+COPY web/electron/package.json ./web/electron/
+
+RUN npm install -g pnpm@11.15.1
+RUN pnpm install --frozen-lockfile --filter web
+
+COPY web/ ./web/
+RUN pnpm --filter web run build
 
 # ── Python builder (shared: server + host) ──────────────
 FROM registry.access.redhat.com/ubi9/python-312 AS builder

deploy/docker/README.md

@@ -43,40 +43,47 @@ docker compose down -v
 
 Built-in accounts auth: no IdP to register, no proxy to host.
 This is the default — `docker compose up -d` brings it up with no
-extra env wiring. First boot creates an admin user (named after the
-operator's OS user, falling back to `admin` in headless containers)
-with a random password that lands in the container logs and on the
-persistent volume at `/data/admin-credentials`.
+extra env wiring. No credentials are auto-generated. On first boot,
+when no admin exists yet and none was pre-seeded, the server creates
+nothing and prints:
+
+```
+→ No admin yet. Open <base_url> to create the first admin account (choose a username + password).
+```
+
+You then open the web UI's **Create admin** form (it appears while no
+admin exists) and pick your own username + password.
 
 For any deploy reachable through a public domain, also set the
-external URL so invite links resolve correctly:
+external URL so the printed link and invite links resolve correctly:
 
 ```bash
 # Add to .env (bootstrap.sh already minted the cookie secret for you):
 OMNIGENT_ACCOUNTS_BASE_URL=https://omnigent.example.com
 
 docker compose up -d
-docker compose logs omnigent | grep -A4 "Created initial admin"
+docker compose logs omnigent      # shows the "No admin yet" line with your base URL
 ```
 
-Copy the random `password` from the log line into the web UI's
-login form, then:
+Once you've created the admin and signed in:
 
 - Click your username in the top-right → **Members** → **Invite member**.
 - Share the single-use URL with the teammate; they pick their own
   username and password when they redeem it.
 - Sign-out lives in the same account menu.
 
-Headless deploy (CI, Cloud Run, etc.) where you can't read the
-logs? Pre-seed the password:
+Headless deploy (CI, Cloud Run, etc.) where you can't reach the
+Create-admin form? Pre-seed the admin password so first boot creates
+the admin directly:
 
 ```bash
 OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD=<your-strong-password>
 ```
 
-The persistent password file is at `/data/admin-credentials` on
-the `artifact-data` volume — survives `docker compose restart`,
-deleted by `docker compose down -v`.
+`OMNIGENT_ADMIN_CREDENTIALS_PATH` (set to `/data/admin-credentials`
+in `docker-compose.yaml`) anchors the persistent state directory on
+the `artifact-data` volume — it survives `docker compose restart` and
+is deleted by `docker compose down -v`.
 
 ## Multi-user mode (OIDC)
 

deploy/docker/bootstrap.sh

@@ -94,8 +94,9 @@ echo
 echo "✓ deploy/docker/.env is ready. Next:"
 echo "    docker compose up -d && docker compose logs omnigent"
 echo
-echo "  Accounts mode is the default — the first-boot admin password"
-echo "  lands in the logs and in /data/admin-credentials on the"
-echo "  persistent volume. For any public-domain deploy also set:"
+echo "  Accounts mode is the default — no credentials are auto-generated."
+echo "  First boot prints a 'No admin yet' line; open that URL and create"
+echo "  the first admin (username + password) via the web form. For any"
+echo "  public-domain deploy also set:"
 echo "    OMNIGENT_ACCOUNTS_BASE_URL=<your public URL>"
-echo "  in .env so invite links resolve to the right host."
+echo "  in .env so that link and invite links resolve to the right host."

deploy/docker/docker-compose.yaml

@@ -8,9 +8,11 @@
 #   open http://localhost:8000  # web UI; start a local runner per the prompt
 #
 # Auth modes (OMNIGENT_AUTH_PROVIDER):
-#   - accounts (DEFAULT) — built-in accounts, no IdP needed. First
-#     boot prints the admin password to `docker compose logs` and
-#     saves it to /data/admin-credentials. Set
+#   - accounts (DEFAULT) — built-in accounts, no IdP needed. No
+#     credentials are auto-generated; first boot prints a "No admin
+#     yet" line and you create the first admin (username + password)
+#     via the web Create-admin form, or pre-seed it with
+#     OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD. Set
 #     OMNIGENT_ACCOUNTS_BASE_URL for any deploy reachable behind
 #     a public domain (defaults to http://<HOST>:<PORT> otherwise).
 #   - oidc — bring your own IdP. Set OMNIGENT_OIDC_* vars — see
@@ -60,9 +62,15 @@ services:
       ARTIFACT_DIR: /data/artifacts
       HOST: 0.0.0.0
       PORT: "8000"
-      # Pin the admin-credentials path to the persistent volume so
-      # the file survives container restarts. Empty/unset would
-      # write to /root/.omnigent/ inside the ephemeral container.
+      # Anchor the server's data dir on the persistent volume so
+      # file-backed operator config survives container restarts:
+      # the admin roster (/data/admins) and allowed-domains file
+      # (/data/allowed_domains), plus artifacts mounted elsewhere
+      # in the same volume. Account rows and password hashes live in
+      # PostgreSQL (the postgres-data volume), not here. The server
+      # resolves its data dir from this path's parent (/data);
+      # empty/unset would fall back to /root/.omnigent/ inside the
+      # ephemeral container.
       OMNIGENT_ADMIN_CREDENTIALS_PATH: /data/admin-credentials
 
       # ── Auth ─────────────────────────────────────────
@@ -101,6 +109,10 @@ services:
       # without API Access Management) that omit the claim for
       # directory-provisioned users. Off unless set; see .env.example.
       OMNIGENT_OIDC_SKIP_EMAIL_VERIFICATION: "${OMNIGENT_OIDC_SKIP_EMAIL_VERIFICATION:-}"
+      # Read the email identity from a different id_token claim — for
+      # IdPs (e.g. Microsoft Entra ID) that issue preferred_username
+      # instead of email. Empty means the default (email); see .env.example.
+      OMNIGENT_OIDC_EMAIL_CLAIM: "${OMNIGENT_OIDC_EMAIL_CLAIM:-}"
       # Opt-in OIDC invites (admin pre-authorizes one off-domain email).
       # Off unless set. The admin list (/data/admins) and the optional
       # allowed-domains file (/data/allowed_domains) need no env var —

deploy/docker/entrypoint.py

@@ -254,6 +254,25 @@ def _select_artifact_store(resolved_config: _ResolvedConfig) -> ArtifactStore:
     return LocalArtifactStore(str(resolved_config.artifact_dir))
 
 
+def _build_local_llm_routing_client(
+    server_llm: Any,  # type: ignore[explicit-any]  # LLMConfig | None
+) -> Any | None:  # type: ignore[explicit-any]  # LLMRoutingClient | None
+    if server_llm is None:
+        return None
+    from omnigent.runtime.policies.builder import (
+        _build_policy_llm_client,
+        _resolve_server_llm_connection,
+    )
+
+    conn = _resolve_server_llm_connection(server_llm)
+    policy_client = _build_policy_llm_client(server_llm, conn)
+    if policy_client is None:
+        return None
+    from omnigent.server.smart_routing import LLMRoutingClient
+
+    return LLMRoutingClient(policy_client)
+
+
 def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
     """Resolve config if needed, wire the stores, and build the app.
 
@@ -289,6 +308,11 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
     from omnigent.stores.permission_store.sqlalchemy_store import (
         SqlAlchemyPermissionStore,
     )
+    from omnigent.stores.policy_store.sqlalchemy_store import SqlAlchemyPolicyStore
+    from omnigent.stores.project_store.sqlalchemy_store import SqlAlchemyProjectStore
+    from omnigent.stores.scheduled_task_store.sqlalchemy_store import (
+        SqlAlchemyScheduledTaskStore,
+    )
 
     telemetry.init()
 
@@ -298,6 +322,9 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
     comment_store = SqlAlchemyCommentStore(database_url)
     permission_store = SqlAlchemyPermissionStore(database_url)
     host_store = HostStore(database_url)
+    policy_store = SqlAlchemyPolicyStore(database_url)
+    scheduled_task_store = SqlAlchemyScheduledTaskStore(database_url)
+    project_store = SqlAlchemyProjectStore(database_url)
     # Fail startup loud on a malformed `sandbox:` section (an operator
     # typo should not surface as a runtime 502 on the first managed
     # session); the startup catch-all below logs it.
@@ -309,14 +336,62 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
         cache_dir=artifact_dir / ".cache",
     )
 
+    from omnigent.spec import parse_default_policies, parse_server_llm
+
+    server_llm = parse_server_llm(cfg.get("llm"))
+
+    routing_cfg = cfg.get("routing")
+    if isinstance(routing_cfg, dict) and routing_cfg.get("provider") == "external":
+        from omnigent.server.smart_routing import ExternalRoutingClient, _bearer_auth
+
+        base_url = (routing_cfg.get("base_url") or "").strip()
+        router_name = (routing_cfg.get("router_name") or "").strip()
+        api_key_raw = (routing_cfg.get("api_key") or "").strip()
+        profile = (routing_cfg.get("profile") or "").strip()
+        raw_prefixes = routing_cfg.get("model_prefix")
+        if isinstance(raw_prefixes, str):
+            raw_prefixes = [raw_prefixes]
+        model_prefixes = (
+            [p.strip() for p in raw_prefixes if isinstance(p, str) and p.strip()]
+            if isinstance(raw_prefixes, list)
+            else []
+        )
+        if base_url and router_name:
+            auth = None
+            databricks_profile: str | None = None
+            if api_key_raw:
+                from omnigent.spec import expand_env_vars
+
+                auth = _bearer_auth(expand_env_vars({"api_key": api_key_raw})["api_key"])
+            elif profile:
+                databricks_profile = profile
+            routing_client = ExternalRoutingClient(
+                base_url=base_url,
+                router_name=router_name,
+                auth=auth,
+                databricks_profile=databricks_profile,
+                model_prefixes=model_prefixes,
+            )
+        else:
+            routing_client = None
+    else:
+        routing_client = _build_local_llm_routing_client(server_llm)
+
+    caps = RuntimeCaps(
+        default_policies=parse_default_policies(cfg.get("policies")),
+        llm=server_llm,
+        routing_client=routing_client,
+    )
+
     init_runtime(
         agent_cache=agent_cache,
-        caps=RuntimeCaps(),
+        caps=caps,
         agent_store=agent_store,
         file_store=file_store,
         conversation_store=conversation_store,
         artifact_store=artifact_store,
         comment_store=comment_store,
+        policy_store=policy_store,
     )
 
     # Build the auth provider from the live env (header/oidc/accounts).
@@ -343,7 +418,10 @@ def build_app(resolved_config: _ResolvedConfig | None = None) -> _BuiltApp:
         agent_cache=agent_cache,
         comment_store=comment_store,
         permission_store=permission_store,
+        policy_store=policy_store,
         host_store=host_store,
+        scheduled_task_store=scheduled_task_store,
+        project_store=project_store,
         auth_provider=auth_provider,
         account_store=account_store,
         # Non-secret auth settings from the config file (admins are the

deploy/e2b/README.md

@@ -138,6 +138,18 @@ sandbox:
   server_url: https://your-host    # public URL sandboxes dial back to
 ```
 
+A top-level `sandbox.host_config:` (provider-agnostic) holds verbatim
+in-sandbox `~/.omnigent/config.yaml` content — e.g. a `providers:`
+block routing a harness through a self-hosted gateway — installed into
+the sandbox before `omnigent host` starts. The block is server-managed:
+entries injected by a previous launch are replaced or removed on the
+next launch/resume, while config created inside the sandbox survives.
+Keep secrets out via
+`api_key_ref: env:VAR` (resolved in the sandbox against the injected
+env). See the [sandbox-runners config
+table](../kubernetes/overlays/sandbox-runners/README.md#configuration-sandbox-configyaml)
+for the shape.
+
 `server_url` must be reachable *from E2B's cloud* — a public HTTPS URL,
 not `localhost`. Sessions created with `host_type: "managed"` (the API
 call or the Web UI's New Sandbox option) then run on a fresh E2B sandbox;

deploy/fly/README.md

@@ -35,14 +35,23 @@ Then:
 1. **Memory** — `fly.toml` pins a **1 GB** machine (`[[vm]] memory = "1gb"`).
    The server idles around ~275 MB RSS, so Fly's 256 MB default OOM-loops.
    Keep it at 1 GB (or `fly scale memory 1024 -a <your-app>` if you changed it).
-2. **Admin password** prints once in the first-boot logs:
+2. **Create the first admin.** No credentials are auto-generated. First boot
+   prints a "No admin yet" line pointing at your `*.fly.dev` URL:
    ```bash
    fly logs -a <your-app>
    ```
-   Look for `Created initial admin account ... password: <generated>` (also
-   written to `/data/admin-credentials` on the volume).
-3. Open `https://<your-app>.fly.dev`, log in as `admin`. The cookie secret and
-   base URL (`FLY_APP_NAME` -> `<app>.fly.dev`) are handled automatically.
+   Open `https://<your-app>.fly.dev` and use the web Create-admin form to pick
+   your own username + password. For a headless deploy, pre-seed
+   `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` (`fly secrets set …`) before first
+   boot to create the admin directly instead.
+3. Log in with the admin you just created. The cookie secret and base URL
+   (`FLY_APP_NAME` -> `<app>.fly.dev`) are handled automatically.
+
+> **Security note for public deployments:** `POST /auth/setup` is
+> unauthenticated while no password-bearing account exists, so an instance
+> exposed before you reach the Create-admin form can be claimed by the first
+> visitor. Pre-seed `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD`, or complete setup
+> promptly after the deploy goes live.
 
 ## Deploy (Fly web-UI Launch)
 

deploy/hf-spaces/README.md

@@ -35,15 +35,21 @@ files plus two secrets.
    | `DATABASE_URL` | variable | `sqlite:////data/artifacts/chat.db` |
    | `OMNIGENT_ACCOUNTS_COOKIE_SECRET` | secret | `openssl rand -hex 32` (pin it: ephemeral disk would otherwise drop sessions on restart) |
 
-4. The Space builds + boots. Admin password is in the Space **Logs** on first
-   boot. The base URL is auto-detected from `SPACE_HOST`, so it needs no manual
-   set.
+4. The Space builds + boots. No admin credential is auto-generated: first boot
+   prints a "No admin yet" line to the Space **Logs**, and the Space serves a
+   web Create-admin form where you pick your own username + password. The base
+   URL is auto-detected from `SPACE_HOST`, so it needs no manual set. To create
+   the admin directly instead, add `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` as a
+   Space secret before first boot.
 5. **Log in via the direct URL** `https://<user>-<space>.hf.space` in its own
    tab — not HF's embedded preview. The session cookie is `SameSite=Lax`, which
    browsers won't send inside HF's cross-origin iframe, so logging in from the
    embedded view loops back to `/login`. The direct URL is top-level
    (same-site), so login sticks. Make the Space **Public** so the direct URL
-   isn't gated.
+   isn't gated — but note the Create-admin form is unauthenticated until the
+   first admin is claimed, so a public Space can be claimed by the first
+   visitor. Pre-seed `OMNIGENT_ACCOUNTS_INIT_ADMIN_PASSWORD` (step 4) or claim
+   the admin immediately after it goes public.
 
 ## Want persistence / multi-user later?