Skip to content
Catalyst Catalyst Catalyst

All versions since 12.27.0
All versions

12.27.0

Jul 08, 2026

Recovery Loop Elimination & Escalation Fixes

This release closes five compounding loops that caused the recovery pass to silently discard verdicts, re-triage tickets indefinitely, and emit no-progress escalations forever. Recovery-pass sessions now persist a single verdict (fixed, leave-alone, or escalate) to the event log, ledger, and Linear in every case — and exhausted intents surface loudly as needs-human with a rendered brief instead of latching silently. Infinite escalation loops are capped and go terminal, triage re-dispatches are bounded per ticket, and the boot-resume approval gate finally has a CLI (boot-resume-approve.mjs --list / <ticket>) so gated recovery passes can actually be unblocked.

PRs

  • dev: CTL-1439 (P0a) — recovery-pass verdict persistence + surfacing (stop act-and-discard) (#2586) (af29551)
  • dev: CTL-1440 (P0b) — attempts-exhausted → loud escalation, RC3 defer-storm decoupling, truthful skip reasons (#2593) (1ef0e57)
  • dev: CTL-1443 (P1-loop-3) — operable boot-resume approval gate (approve CLI + 48h expiry into Needs-You + alert) (#2596) (a6aa271)
  • dev: CTL-1441 (P1-loop-2) — terminate the triage re-dispatch loop (cap + mismatch surfacing + WORKER_DIR hardening) (#2588) (9dd5309)
  • dev: CTL-1442 (P1-loop-1) — no-progress escalations go terminal after N asks (stop the every-10-min forever loop) (#2590) (001557c)

12.28.0

Jul 09, 2026

Liveness Off Linear

Cross-host dead-host detection now reads from Loki instead of Linear, eliminating the ~120 heartbeat writes per hour that were tripping the rate-limit breaker. Two live-deploy bugs in the initial reader were caught and fixed: stale streams no longer win the newest-host race, and in-flight ticket enrichment now runs as a separate fail-open query. The switch is gated behind CATALYST_LIVENESS_READ_SOURCE=loki — set it on all hosts simultaneously to enable; unset to revert instantly.

PRs

  • dev: CTL-1420 (#17) — move cross-host liveness off Linear → event log + Loki (PR1a: heartbeat carries in-flight tickets) (#2575) (ff99913)
  • dev: CTL-1420 (#17) — read cross-host liveness from Loki + retire the Linear heartbeat publish (PR1b) (#2604) (9924aa2)
  • dev: CTL-1420 (#17) follow-up — loki-liveness reader: newest-across-streams + two-query tickets (#2606) (4aa925b)
  • dev: CTL-1443 follow-up — sync CLI reference for boot-resume-approve (unblocks CI) (#2603) (7d34bd8)
  • dev: CTL-1451 (A4 final widening) — probeBackoff on the recovery-filter + reclaim terminal reads (kills the ADV-1433 read-storm) (#2608) (6d4928f)
  • dev: CTL-1452 — parity test exempts action:skip STALL_CATEGORY_MAP entries (restores exec-core CI on main) (#2610) (6e550ba)

12.29.0

Jul 13, 2026

Two-Axis Worker State Model

Worker state transitions now fan out through a single recordTransition chokepoint that writes to all five sinks — Linear Status, worker-status label, event log, OTLP, and broker table — on every confirmed state change, with per-sink fail-open isolation so one unavailable sink can’t block the others. A new convergeDispositionLabel function enforces full disposition precedence (needs-human > needs-input > blocked > queued), and the worker-status Linear label group is provisioned automatically by setup-execution-core-states.sh. The HUD queue UI now reflects the corrected disposition buckets, and waiting has been renamed to queued throughout.

PRs

  • dev: CTL-764 two-axis worker-state model — recordTransition chokepoint, worker-status labels, convergeDispositionLabel (#2597) (2ebbed3)
  • dev: CTL-764 follow-up — Codex round-3 emission gating + gitleaks allowlist (greens main) (#2631) (27781cf)
  • dev: CTL-764 follow-up — Codex round-4 emission/fallback edge cases (#2632) (3fa0429)
  • dev: CTL-764 follow-up — declare synthesizeOrphanTickets in board-data.d.mts (greens main quality gate) (#2630) (96ea021)

12.29.1

Jul 14, 2026

Thenable-Aware Removal Confirmation

The removeLabel async bug is fixed — previously, inspecting a Promise’s .removed property always returned undefined, so failed removals were silently treated as successful. The fix makes the result handler thenable-aware, deferring the admission clear emission until the async write actually resolves or rejects.

PRs

  • dev: CTL-764 follow-up — round-5: thenable-aware removal confirmation (#2636) (2df9d10)

12.30.0

Jul 15, 2026

Codex Executor & Worker Label Ownership

The daemon can now dispatch phase workers to OpenAI Codex via a new codex-exec executor adapter, routed per-phase through executorByPhase config with zero behavior change until you explicitly flip a phase to it. Linear boards now show which node owns each in-flight ticket via stamped worker:<host> labels — ownership is board-filterable and readable from the local replica without a live Linear call. Both worker-label provisioning paths (reconcile_worker_host_labels and reconcile_worker_status_labels) are hardened against the current Linear API’s isGroup:true requirement, which broke fresh-workspace installs; run the setup script on any new node to provision labels cleanly.

PRs

  • dev: CTL-1457 codex-exec executor adapter — daemon dispatches phase workers on Codex (#2639) (1ae616a)
  • dev: CTL-1481 worker:<host> label ownership — Linear board shows which node owns each ticket (#2650) (47946d7)
  • dev: CTL-1481 follow-up — worker group create needs isGroup:true (live API drift) (#2651) (f6099a9)
  • dev: CTL-1483 mirror isGroup:true fix to reconcile_worker_status_labels (#2653) (e1d5d0c)

12.30.1

Jul 17, 2026

Replica-Read Detector Fixed

The Linear replica-read detector introduced in a prior release was never actually firing, leaving agents free to burn the shared API quota on reads the replica could have served. The fix rewrites the command-word matching from a single anchored regex to a token walk that correctly resolves the real command past environment assignments, wrapper prefixes like direnv exec ., and shell keywords — and now recognizes both linear and linearis. The enforce mode remedy path is also corrected to an absolute location so it’s actually sourceable in the repos where the hook now fires.

PRs

  • dev: CTL-1420 replica-read detector was blind to the linear alias + wrapper prefixes (#2658) (19f7ada)

12.31.0

Jul 19, 2026

Agent House Rules & Replica Read Fix

Two changes land together to make unattended agents less error-prone. A new “Working the Loop” block is now seeded into every project’s AGENTS.md via agents-house-rules.md, teaching agents to subscribe to the unified event log instead of polling GitHub or CI, detect automated review approvals via reactions, and read Linear tickets from the local replica rather than the live API. Alongside that, the replica-read instruction itself is corrected — background agents were silently falling through to bare linearis because linear_read_ticket is a shell function that never resolves in an unattended Bash session; the instruction now leads with the sqlite3 form that works in any shell. Run check-project-setup.sh to verify your projects have the new reflex markers in place.

PRs

  • dev: agent house-rules block + checkup (CTL general-instructions) (#2663) (e6e67db)
  • dev: CTL-1420 replica-read rule pointed bg/daemon agents at a shell function not on PATH (#2661) (efd9a2b)

12.32.0

Jul 21, 2026

Agent House-Rules Auto-Seeding & Inbox Polish

Any repo you enroll in Catalyst now automatically receives the “Working the Loop” agent house-rules block — seeded into AGENTS.md (or CLAUDE.md if that’s what the repo uses) without any manual setup. The block itself has been hardened: Linear reads must go through the catalyst-dev:linearis skill rather than raw API calls or hand-rolled sqlite, and a contradictory degraded escape that could reintroduce shared-quota burn has been removed. Inbox rows also get a cleaner look — favicon restored, unwrapped ID, two-line title, and corrected pane accent.

PRs

  • dev: auto-seed agent house-rules on every enrolled repo + Codex-hardened block (#2666) (97aa6de)
  • dev: CTL-1127 — inbox row: restore favicon, unwrap ID, two-line title, drop verb cluster, fix pane accent (#1991) (2cda8d5)
  • dev: CTL-682 — wait-watcher skips background agents; pin scheduler test live-count seam (#2670) (4fd98b2)
  • dev: drop the Linear-API degraded escape (contradicted the absolute replica rule) (#2668) (507b227)

12.33.0

Jul 22, 2026

Dispatch Roster Failover & Worktree Repair

Offline and never-live hosts no longer strand their share of the ticket backlog — dispatch ownership now hashes over a liveness-filtered roster with restore-side deflap hysteresis, so a live host picks up any slice whose owner has gone dark. A separate fix repairs worktrees whose thoughts/shared was left as a plain directory instead of a symlink, so handoffs and research written into reused worktrees actually sync instead of silently accumulating in a dead-end local dir.

PRs

  • dev: CTL-1091 Phase 1 — route dispatch gates through the surviving roster (#2671) (2fb23ee)
  • dev: CTL-1497 — repair thoughts/shared on the worktree reuse path; guards test -L not -d (#2685) (c4bf08c)

12.34.0

Jul 23, 2026

Autonomous PR Block Recovery

When a PR fails to merge, the recovery pass now probes GitHub live — checking CI status, unresolved bot review threads, and review decisions — and routes autonomously: bounded fixes get dispatched to a worker, while genuine human gates (CHANGES_REQUESTED from a person, no open PR found) escalate with specific context instead of an opaque failure message. A CATALYST_EXECUTOR_BY_PHASE JSON env var also lands in this release, letting you set durable per-phase executor routing in execution-core.env without it being wiped by the broker’s periodic git reset. The recovery pass feature ships behind CATALYST_RECOVERY_PASS=shadow|enforce and is off by default.

PRs

  • dev: CTL-1496 recovery-pass drives blocked PR to merge instead of escalating (#2689) (bec5e03)
  • dev: CTL-1457 follow-up — CATALYST_EXECUTOR_BY_PHASE env override (durable per-node routing) (#2655) (3afb50a)

12.35.0

Jul 23, 2026

Agent Browser Leak Fix & Scheduler Hardening

Leaked agent-browser Chrome processes that outlived their worker sessions — sometimes pegging a CPU core indefinitely — are now reaped automatically by a new vector in the hourly orphan sweep, which targets runaway or idle Chrome-for-Testing instances while leaving personal Chrome untouched. Workers also receive an idle-timeout environment variable at dispatch so agent-browser shuts itself down after 5 minutes of inactivity on supported versions. Two scheduler fixes round out the release: phantom ticket directories (like .catalyst) no longer poison board-health checks, and a transient source conflict during dispatch-time rebase now triggers a single retry against a fresh base before parking the ticket as needs-human.

PRs

  • dev: CTL-1500 reap leaked agent-browser Chrome + idle-timeout + setup-tooling ownership (#2702) (74fa0a8)
  • dev: CTL-1504 guard scheduler census sites + classify not-found (stop CTC-phantom board-health poison) (#2698) (6d6d154)
  • dev: CTL-1505 retry rebase against fresh origin/<base> before parking a source conflict (#2701) (17de576)

12.36.0

Jul 25, 2026

Cloud-Sync Self-Heal & Daemon Health Responder

Two fixes targeting the root causes of the 2026-07-23 replica-writer outage. The cloud-sync writer now exits cleanly within a bounded timeout on both stall and shutdown paths, writes a breadcrumb when it self-heals, and detects half-open sockets in roughly 2 ticks instead of 80+ minutes using SDK lastFrameAt. A new stateless launchd sweep runs every 3 minutes to catch the case where the writer dies and launchd fails to respawn it — kicking it back with a bounded, escalating retry rather than depending on KeepAlive alone. After merging, run catalyst-stack install-services on affected nodes and verify with catalyst doctor.

PRs

  • dev: CTL-1509 daemon-health responder — stateless launchd sweep kickstarts a dead/stale cloud-sync writer (bounded, escalating) (#2710) (6e0ec37)
  • dev: CTL-1508 exit-safe cloud-sync self-heal + selfheal breadcrumb + lastFrameAt stall classifier (#2709) (1e33520)

12.37.0

Jul 26, 2026

Daemon Stability & Memory Audit Remediation

This release fixes a cluster of runtime reliability issues discovered during a live memory and health audit on production nodes. The most impactful changes stop a 115-second scheduler stall caused by reading a 300 MB event log on every tick (now a bounded cursor scan), close a file-descriptor leak in the delegate-runner that was trending toward EMFILE, and silence ~300 spurious “daemon degraded” phone notifications per day by replacing a naked edge trigger in the notification filter with a 180-second sustained-state hold. Also included: per-process RSS/heap OTel gauges on every daemon so future leaks can be attributed to a specific service, edge-triggered fleet-health probes that fire once per degradation episode instead of on every tick, and a health-responder backstop that now supervises the host-metrics sampler so a silently dead agent gets auto-kickstarted rather than going unnoticed for days.

PRs

  • dev: CTL-1503 edge-triggered fleet-health probe (hysteresis band + recovered event + durable latch) (#2704) (a4dc53e)
  • dev: CTL-1517 per-process RSS/heap OTel gauge on every daemon (leak attribution) (#2732) (8c85824)
  • dev: CTL-1518 health-responder supervises com.catalyst.agent sampler (self-heal backstop) (#2731) (b3ae705)
  • dev: CTL-1510 health-responder hardening — token-aware exit-0 gate, sweep lock, cron backstop + 5 more edges (#2714) (92ac2ec)
  • dev: CTL-1513 bash-3.2 comment-parsing crash in _token_provisioned (production hotfix) (#2719) (ffd7da1)
  • dev: CTL-1514 tail event log by cursor in execution-core (stop 115s scheduler stalls) (#2729) (ac009d9)
  • dev: CTL-1515 bound orch-monitor readBacklog/readTunnelEventStats fallbacks (chunked scan) (#2730) (9ea4502)
  • dev: CTL-1516 bound broker _emittedWakeCache + heartbeat/orchestrator maps (#2728) (2001242)
  • dev: CTL-1519 close delegate-runner log fd after detached spawn (fd leak → EMFILE) (#2727) (5709d17)
  • dev: CTL-1522 hold daemon-degraded notifications so a transient heartbeat stall never pushes (#2739) (5b56cef)
  • dev: CTL-1523 stop the broker reporting daemon-degraded on an idle fleet (#2740) (4a58ddd)

12.38.0

Jul 27, 2026

Dual-Harness Migration & Event Loop Fix

Run migrate-dual-harness.sh to migrate a single-harness repo (Claude-only or Codex-only) to the vendor-neutral dual-harness layout where both Claude Code and Codex share the same instructions and skills — checkup §10 and a new foundry skill handle the split automatically. A daemon event loop stall that caused 72–97 second heartbeat gaps during worktree cleanup bursts is also resolved, along with a fix that stamps provider delivery IDs onto webhook envelopes so the smee-vs-cloud parity harness can actually join on them.

PRs

  • dev: CTL-1530 dual-harness migration (migrate-dual-harness.sh + checkup §10 + foundry skill) (#2753) (0afc204)
  • dev: CTL-1524 unblock the daemon event loop in wt-cleanup-drain (free provenance gate first + bounded burst) (#2747) (d31c9c6)
  • dev: CTL-1532 stamp the provider delivery id on webhook envelopes (#2751) (708437b)

12.39.0

Jul 29, 2026

Supervised Watchers, Orphan Reaper & Board Health

Channel-watchers now run as supervised launchd daemons that emit a heartbeat every interval and trigger a broker dead-man’s switch alert when a watcher goes silent for more than three intervals. The orphan reaper drops its node/bun/turbo allowlist and now reaps any process whose cwd sits under a deleted worktree, batching the cwd lookups into a single lsof call to keep sweep cost under 730 ms. Two new board-health checks round out the release: one flags in-flight tickets with no worker, no signal file, and no open PR, and one bounds every read of the monthly event log to a time-covering tail — cutting a 341 MB scan from 1,114 MB peak RSS to 143 MB flat.

PRs

  • dev: CTL-1423 — supervised background channel-watchers with (6701521)
  • dev: CTL-1423 — Supervised background channel-watchers with heartbeat + dead-man’s-switch alerting (#2557) (6701521)
  • dev: CTL-1475 flag work that claims to be in flight while nothing owns it (#2763) (d022893)
  • dev: CTL-1531 reap orphaned processes by ownership evidence, not a node/bun allowlist (#2756) (c0267ba)
  • dev: CTL-1529 bound every read of the monthly event log (time-covering tail + shared per-tick scan) (#2757) (ab49964)

12.39.1

Jul 30, 2026

Needs-Human Clears on Reply

When a developer responds to a parked ticket, it now immediately drops off the “Needs you” list — no matter whether the worker directory still exists. Previously, most parked tickets were permanently stuck in that state because the clear was gated on a local directory that gets cleaned up after a worker is reaped.

PRs

  • dev: CTL-1567 clear needs-human the moment a human responds (#2796) (2f71e13)

12.40.0

Jul 31, 2026

Inbox Conversation Surface & Linear API Burn Fixes

The inbox is now a full conversation surface: you can read a parked ticket’s ask summary, thread, and suggested replies — and post a response as yourself without leaving the inbox. Alongside this, a cluster of Linear API quota fixes lands together: the Workers page now reads peer liveness and capacity from Loki instead of a stale Linear anchor, the broker authenticates as the app actor so reconcile reads no longer bill your personal API bucket, and several scheduler paths that were firing live Linear probes on every tick now use the replica or a cooldown window instead.

PRs

  • dev: CTL-1569 make the inbox a conversation surface (ask summary + thread + inline reply) (#2801) (1d59e75)
  • dev: CTL-1574 ticket activity feed (Discussion) in monitor inbox + ticket page (#2815) (d22b757)
  • dev: CTL-1551 budget the peer-liveness live window for transport lag (#2809) (8ad9ff5)
  • dev: CTL-1551 Workers page reads peer liveness+capacity from Loki, not the dead Linear anchor (#2808) (3b095af)
  • dev: CTL-1570 stop the phantom sweep spending a live Linear read per tick on workerless dirs (#2803) (8028469)
  • dev: CTL-1571 cache-reconcile reads the replica, not live Linear (#2824) (59fa625)
  • dev: CTL-1577 broker authenticates to Linear as the app-actor (#2814) (0a209a1)
  • dev: CTL-1580 stop per-tick live probes of stuck tickets; instrument the invisible reads (#2825) (ea6db1b)

12.41.0

Jul 31, 2026

Slot Deck Fixes & Direnv Profile Sync

The slot deck now correctly shows which slots are occupied — SDK/executor workers are visible to the deck, held tickets are separated into a “Held — awaiting you” section rather than ranked as imminent dispatches, and header counts derive from the deck’s own boxes so the two can never contradict each other. Triage admission is now level-triggered, meaning tickets already sitting in Triage when a worker dir vanishes get picked up on the next sweep instead of stranded. cluster-sync also gains a new syncProfileFiles step that materializes direnv profiles from a SOPS bundle, so worker repos get the right environment variables on every host without hand-provisioning files.

PRs

  • dev: CTL-1585 discussion newest-first in inbox, inline on detail page, Spec tab renamed Detail (#2832) (bc34131)
  • dev: CTL-1595 cluster-sync materializes direnv profiles from a SOPS bundle (#2849) (a0daa05)
  • dev: CTL-1581 slot deck renders occupancy, not ownership — counts derive from the boxes (#2826) (719bc9a)
  • dev: CTL-1588 queue humanHold falls back to replica labels when the webhook-fed store has gaps (#2845) (9d40a77)
  • dev: CTL-1588 slot deck sees SDK-executor workers; queue partitions human-held tickets (#2840) (df05fa6)
  • dev: CTL-1589 level-triggered triage sweep — pick up tickets already sitting in Triage (#2843) (4fc6993)
  • dev: CTL-1593 capture the recovery cursor before reconcileAll so boot telemetry can’t shift it (#2844) (45343f8)

12.42.0

Aug 02, 2026

Worktree Guard & DNS Rebinding Fix

The monitor’s reply endpoint now validates Origin against a trusted allowlist of loopback addresses, local hostnames, and non-loopback IPs — closing a DNS rebinding hole where an attacker-controlled page could post Linear comments as the operator. Separately, every shell-side git worktree remove --force call now runs a safety check that refuses removal if your current directory is inside the target or any process holds an open handle under it, protecting against accidental self-deletion that the Node reaper never covered.

PRs

  • dev: CTL-1417 — worktree-removal self-protection guard (#2556) (24b9a76)
  • dev: CTL-1573 validate reply Origin against a trusted allowlist, not the request Host (#2857) (10ecce7)

12.43.0

Aug 03, 2026

Deployment Mode Resolver & Credential Hardening

This release introduces a unified deployment-mode resolver (single-host, cluster, or cloud) that reads identically in bash and JS, with advisory doctor checks and gated tunnel/webhook behavior wired across execution-core, orch-monitor, and catalyst-join.sh. It also fixes a live credential outage: daemon processes now re-arm their GitHub token from disk on every cluster-sync tick rather than inheriting a frozen env at boot, and linear-reconcile-cli correctly falls back to LINEAR_API_KEY when LINEAR_API_TOKEN is absent. Several reliability fixes round out the release: stale needs-human/blocked labels can no longer be re-applied to tickets already terminal in Linear, escalated recovery intents no longer latch permanently past their 7-day TTL, and the board no longer shows zero tickets for teams registered only in cluster.json.

PRs

  • dev: CTL-1603 — fix board showing zero tickets for cluster-only teams (#2868) (47a8c78)
  • dev: CTL-1610 — fix escalated-intent permanent latch and actuation-liveness blind spot (#2882) (69dd8ad)
  • dev: CTL-1616 secret-contract registry pair + cluster-sync derivation (PR1) (#2902) (1275440)
  • dev: CTL-1617 deployment-mode resolver in isolation (PR1 of 7) (#2895) (581ad4f)
  • dev: CTL-1617 doctor deployment-mode tunnel-consistency check (PR6 of 7) (#2906) (4ac3bea)
  • dev: CTL-1617 execution-core wiring + advisory deployment-mode doctor checks (PR2 of 7) (#2899) (374c1b3)
  • dev: CTL-1617 gate catalyst-join webhook wiring on declared deployment mode (PR5 of 7) (#2913) (1b983f3)
  • dev: CTL-1617 gate orch-monitor smee tunnels on deployment mode (PR3 of 7) (#2900) (a73ce21)
  • dev: CTL-1605 — route worker-status labels through a terminal-aware chokepoint (#2872) (8855c10)
  • dev: CTL-1612 arm daemon credentials from the shared secret files at boot (#2884) (ea5d031)
  • dev: CTL-1617 jq-exact lone-surrogate acceptance in the deployment-mode reader (#2907) (84e7682)
  • dev: CTL-1617 whole-document lone-surrogate parity + architecture-doc precision (#2904) (6b1cfd8)
  • dev: CTL-1619 adopt LINEAR_API_KEY fallback in linear-reconcile-cli —graphql (#2893) (bb0fff5)
  • dev: CTL-1620 resolve the rescue prompt template from plugins/dev/templates (#2892) (cf13213)

12.44.0 (2026-08-04)

Features

  • dev: CTL-1616 cloud-token name-resolver unification + Groq resolveApiKey adoption (PR5) (#2927) (be673ea)
  • dev: CTL-1616 doctor cloud-guard escalation + shadow-diffed Layer-2 stragglers (PR6) (#2929) (56fbe72)
  • dev: CTL-1616 doctor secret-contract shadow pass (PR2, zero grade change) (#2916) (0377813)
  • dev: CTL-1616 fold the 9-file Linear read into the secret contract + doctor cutover (PR3) (#2919) (01294fc)
  • dev: CTL-1616 fold the OAuth-mint trio + read-only 4th onto the secret contract (PR4) (#2924) (22afee0)
  • dev: CTL-1622 setup-catalyst prompts for and persists catalyst.deployment.mode (#2912) (3af40d2)
  • dev: CTL-1628 catalyst-runtime-root resolver — fold Tier 1 duplicates + 4 latent resolver bugs (Phase A2) (#2946) (c01ef76)
  • dev: CTL-1628 root bun workspace + turbo (Phase A1) (#2945) (a61c8a8)

Bug Fixes

  • dev: CTL-1616 clear the sticky export attribute on the value breadcrumb (#2926) (ea1e474)
  • dev: CTL-1616 declare the split-brain Layer-2 layout unsupported + finish the observe-only story (#2931) (ca7ec68)
  • dev: CTL-1616 divergence check round 3 — reject relative paths, per-service remedy, no committed ticket prefix (#2939) (6c134b1)
  • dev: CTL-1616 divergence check round 4 — prefix-agnostic assertion + no dead-end remedy (#2941) (b811eb0)
  • dev: CTL-1616 harden the layer2-path-divergence check (#2931 round-2 Codex x2) (#2938) (694dc20)
  • dev: CTL-1616 keep the resolved secret VALUE out of child-process environments (#2925) (2c6901c)
  • dev: CTL-1616 PR6 follow-up — observe-only Layer-2 shadow + doctor coherence (#2929 Codex x4) (#2930) (64dddf5)
  • dev: CTL-1617 align doctor webhook-ingestion with the declared deployment mode (#2918) (d1d66e9)
  • dev: CTL-1617 close the three late #2918 Codex findings on the mode-aligned doctor grant (#2920) (905dbaa)
  • dev: CTL-1617 harden the join webhook-wiring gate (Codex follow-up to #2913) (#2914) (0bd14f8)
  • dev: CTL-1628 A1 isolate bun sniff from project config (Codex #2966 post-merge) (#2967) (ef09cb4)
  • dev: CTL-1628 A1 multiline-tolerant jq-less packageManager sniff (Codex #2948 post-merge) (#2964) (bac5434)
  • dev: CTL-1628 A1 post-merge hardening (Codex #2945 threads) (#2948) (c3f6944)
  • dev: CTL-1628 A1 retry TMPDIR when safe-cache mktemp fails (Codex #2972 post-merge) (#2975) (14bd0b6)
  • dev: CTL-1628 A1 sniff scratch-dir hardening + tier fallthrough (Codex #2967 post-merge) (#2972) (92226cb)
  • dev: CTL-1628 A1 tiered packageManager detection (Codex #2964 post-merge) (#2966) (1f22f0e)
  • dev: CTL-1628 A1 verify TMPDIR parent + scratch-dir before trusting it (Codex #2975 post-merge) (#2977) (27517ec)
  • dev: CTL-1628 A2 post-merge hardening (Codex #2946 threads) (#2947) (831a469)
  • dev: CTL-1628 comment-wake emission accounting + cross-host dedup reset (Codex #2970 post-merge) (#2973) (36e4cf4)
  • dev: CTL-1628 credit survives throw + early-path needs-input dedup clear (Codex #2974 post-merge) (#2976) (666044d)
  • dev: CTL-1628 delete unreachable catalyst-filter daemon body (keep alias) (#2949) (6a7d4cd)
  • dev: CTL-1628 freeze-cause telemetry mirror, legacy hydration default, persist retry (#2968) (8fffff5)
  • dev: CTL-1628 heartbeat publisher — require Linear anchor only in linear read-source mode (#2958) (3247e76)
  • dev: CTL-1628 orch-monitor roster readers → cluster.json roster (stop-worker fence + cross-node tail) (#2959) (7d5b93d)
  • dev: CTL-1628 retire ADR-018 JSON-shadow scaffolding + unused recordWorkerTransition module; document CTL-532 as the live projection (#2961) (3600198)
  • dev: CTL-1628 single-consume early-write credit + disposition-scoped dedup reset (Codex #2973 post-merge) (#2974) (c877a25)
  • dev: CTL-1628 surface eligible-set projection-write failure as health event (#2960) (c04f1a7)
  • monitor: mint app-actor Linear token on monitor start (supersedes #2905) (#2978) (f6fdeb9)
  • monitor: post-merge hardening — scan reachability, stop-cancels-remint, bash probe status (#2979) (34c5467)

12.45.0

Aug 05, 2026

Claude Account Switching Command

The new catalyst-stack claude-account command handles the full Claude SDK account rotation workflow in one step: status shows per-account utilization and reset times, switch <handle> validates the target, flips the SOPS secret, commits, pushes, and verifies the new account is active and error-free. A sync subcommand lets a second node adopt a pushed switch without repeating the full procedure. The release also fixes the orchestration monitor surfacing “unknown reason” for stalled tickets that actually had a specific attentionReason like sdk-overloaded-exhausted, and patches a broker bug where pre-workspace node_modules debris could shadow root installs and leave daemons running stale dependency versions.

PRs

  • dev: CTL-1650 catalyst-stack claude-account subcommand + commit the accounts-usage tool (#3004) (779ef08)
  • broker: CTL-1646 — prune pre-workspace member node_modules before a root install (#2997) (598e3c8)
  • dev: CTL-1623 export the canonical malformed-file validators instead of duplicating them (#2984) (c2b070e)
  • dev: CTL-1623 make the github-token rearm hook reject malformed files + run the bash parity suite in CI (#2983) (160abbf)
  • dev: CTL-1623 resolve github-token/webhook-secret through the secret contract (#2981) (94de78a)
  • dev: CTL-1648 — surface attentionReason in board stalled-phase derivation (#3003) (778b92d)
  • dev: CTL-1650 harden claude-account for BSD sed, stale selectors, and rate-limited targets (#3006) (4f6fb68)

12.46.0

Aug 06, 2026

Account Health Visibility & Worktree Resume

The orch-monitor now surfaces Claude account health everywhere you look: a new accounts-probe library (TTL-cached, edge-triggered) backs a GET /api/accounts endpoint and /api/accounts/stream SSE feed, with a live strip in the Ink HUD and a banner in the web dashboard that fires loudly when an account degrades. Worktree creation now seeds from origin/<ticket> when that remote branch exists, so a resumed or reclaimed worktree picks up where the previous worker left off instead of silently orphaning pushed commits. Board-scan events also now carry per-host slot counts (recovery.slot.capacity, recovery.slot.in_use, recovery.slot.free) as chartable Loki attributes, making fleet-wide free-capacity queries like sum(recovery.slot.free) possible for the first time.

PRs

  • dev: board-scan events now carry per-host worker-slot counts as (602d1f2)
  • dev: CTL-1607 promote board-scan slot scalars to chartable Loki attributes (#2985) (602d1f2)
  • dev: CTL-1653 accounts-probe lib (probe runner + async TTL cache) (#3011) (32b6d07)
  • dev: board-health-seam test expects capacity.admissionGated (CTL-1607) (#3028) (1105e67)
  • dev: CTL-1640 resume worktree from origin/<ticket> instead of orphaning pushed commits (#3025) (898e02e)
  • dev: CTL-1655 — consumer-side coordination-mirror comment tail (#3015) (042d321)
  • monitor: CTL-1653 accept https-configured trusted origins in the refresh Host check (#3020) (b72a53a)
  • monitor: CTL-1653 document MONITOR_TLS_PROXY_PEERS + normalize IPv4-mapped peers (#3023) (fbcaffb)
  • monitor: CTL-1653 operator-declared TLS-proxy peers replace header-derived scheme (#3022) (e2746dc)
  • monitor: CTL-1653 post-merge hardening — stale-strip clear, Bun execPath, non-simple refresh, EOF reconnect, empty-env contract (#3017) (9eb083a)
  • monitor: CTL-1653 post-merge hardening r3 — unavailable transition, Host validation, unreadable-env error (#3019) (b4b7496)
  • monitor: CTL-1653 scheme-aware Host check — never treat an https-only trusted host as plaintext (#3021) (c081851)

12.47.0

Aug 06, 2026

Stranded Ticket Recovery & Monitoring Node Substrate

The board-health delegate now detects mid-pipeline tickets that have gone dark — no worker, no live job, no recent recovery intent — and routes each one to the appropriate revival path (open PR remediation, remote branch resume, or fresh restart). Separately, monitor and developer nodes now run a proper event-mirror substrate instead of the execution core, so observation-only machines no longer accidentally join the dispatch roster; catalyst doctor and verify-node both surface a dead mirror as a real failure rather than silently passing. Several correctness fixes ship alongside: stranded-ticket evidence was previously never populated due to a map key mismatch, recovery-pass reclaim was silently failing on non-FSM phases, and queued/blocked labels now clear reliably once a ticket starts running.

PRs

  • dev: CTL-1644 board-health delegate detects stranded mid-pipeline tickets and routes each to revival or escalation (#3043) (e807fd5)
  • dev: CTL-1654 interactive nodes carry event/monitoring substrate without execution layer (#3016) (42a623c)
  • dev: address upstream review findings on PR #2851 (#3052) (6414e01)
  • dev: CTL-1571 make queued/blocked labels retractable once a ticket starts (#3045) (aa5fe53)
  • dev: CTL-1657 guard reclaim supersede-check against non-FSM phases (#3027) (58a3849)
  • dev: CTL-1662 event-mirror survives reboot + doctor catches it dead (#3038) (89a0e0b)
  • dev: fix bash 3.2 syntax error in setup-plugin-source.sh (#3049) (6dc6e22)

12.48.0

Aug 07, 2026

Escalation Visibility & Stalled-PR Detection

The unstuck sweep now actually reaches the operator: stalled tickets get a needs-human label and a Linear comment instead of silently logging an event that nobody sees. A new periodic timer probes in-flight PRs for CI failures, review latency, and no-push signals, writing stall stamps that board-health reads to emit nudges — enable it with orchestration.stalledPrSweep.enabled in your config. This release also closes two fleet-wide triage bugs where host-local dispatch caps let ownership churn multiply real spawns across nodes, and the orch-monitor sidebar nav is restored for mobile viewports.

PRs

  • dev: CTL-1381 auto-install new catalyst-* CLIs after updater pull (#2847) (215b85a)
  • dev: CTL-1608 board-health stalled-PR detection — review-latency + CI-health sweep (#2908) (e290fb0)
  • dev: CTL-1609 delegate-first escalation + explanation-required chokepoint (#2909) (e8643b4)
  • dev: CTL-1641 — wire unstuck-sweep escalation to reach the operator (#3005) (74f99c9)
  • dev: CTL-708 opt-in bounded-LLM resolver for source conflicts (#3051) (21327cb)
  • dev: dependabot-escalate — file a ticket for the two Dependabot signals no PR ever surfaces (#3053) (a41578b)
  • dev: CTL-1649 — fleet-wide triage cap + exclude launch-failure tickets from board-health recovery (#3030) (50b5510)
  • dev: orch-monitor — mobile nav trigger + Linear reply-token identity walk (#3054) (d9ae8a7)
  • execution-core: close test-hermeticity gaps that only fail on a live, configured host (#3047) (2858769)

12.49.0

Aug 08, 2026

Escalation Durability & Premature Done Guards

Escalations now survive GC via a durable per-ticket store, so Needs-You cards no longer vanish when a ticket goes terminal. Three independent guards close the false-Done/false-advance family: a dispatch freshness gate, a live GitHub merged check in teardown, and a PR-merged gate in the scheduler’s terminal Done writer. Worker nodes can also now set CATALYST_DRAIN_DISABLED=1 to permanently ignore drain requests, emitting a node.drain.ignored tripwire event instead of silently halting new-work admission.

PRs

  • dev: CTL-1473 — codify four laptop-audit failure modes (#2638) (0783e71)
  • dev: CTL-1494 — wire coordination-publish into catalyst-stack lifecycle (#3066) (6f3f5df)
  • dev: CTL-1502 — stuck-but-alive daemon watchdog (detect + auto-restart wedged otel-forward) (#2703) (5c6c02f)
  • dev: CTL-1552 Phase 1 — parked-by-human label + isParkedByHuman reader (#2791) (0b561cd)
  • dev: CTL-1606 — persist PR status from webhooks; fix board-health phantom/orphan detection (#2878) (43f6ee0)
  • dev: CTL-1643 escalation durability — verified-or-loud labels + GC-surviving attention store (#3009) (13e06a2)
  • dev: CTL-1645 add canonical onboarding planner (#3001) (28f9092)
  • dev: CTL-1667 — root fix for premature Done / monitor-deploy false-advance family (#3061) (c27dedd)
  • dev: CTL-1668 coordination-publish cloud endpoint wiring + ADR-023 parity harness (#3105) (2640720)
  • dev: CTL-1678 — worker nodes can permanently ignore drain requests (#3073) (d9bd6c6)
  • dev: CTL-1081 make match_thoughts_artifact shell-agnostic (zsh/shopt bug) (#3108) (bcafa4f)
  • dev: CTL-1415 — age-gate and auto-clear a stale plugin-source .git/index.lock (#2530) (2740458)
  • dev: CTL-1660 defer P2+ automated-review findings after round one (#3035) (b5592bb)
  • dev: CTL-1680 Phases 2+3 — confirm merge SHA + reviewer-arrival window (#3079) (3850648)
  • dev: fenceGuard fails OPEN on a missing generation at the terminal-sweep needs-human escalation site (#3048) (522e178)
  • dev: isTicketInFlight supersede guard for stale phase signals (#3081) (6accd27)
  • dev: remove hardcoded org name from provision-thoughts convention (#3080) (9cea441)
  • execution-core: close two remaining codex-exec thoughts-symlink escape gaps (#3098) (00374f1)
  • execution-core: codex-exec thoughts symlink resolution + no-progress escalation count (#3082) (4d672d5)
  • execution-core: preserve 0600 on Layer-2 config across autotune write-back (supersedes #3074) (#3106) (5369b6f)

12.50.0

Aug 09, 2026

Skills-Dir Plugin Loading & Reliability Fixes

Plugins now load exclusively from a live ~/catalyst/plugin-source checkout via ~/.claude/skills/ symlinks, retiring the version-keyed marketplace cache that caused merged changes to stay invisible until the next release bump. This release also fixes the otel-forward DLQ amplification loop (terminal 4xx errors now drop cleanly instead of cycling), ensures worktree salvage snapshots unpushed commits before any destructive removal, and makes escalation comment + needs-human label an atomic operation so tickets actually appear in the inbox. Run setup-plugin-source.sh on any fleet node not yet cut over — until then, doctor will report a worker-FAIL on skills-dir-plugins.

PRs

  • dev: CAT-52 — enforce registry team identity contract + doctor drift check (#3158) (8c12284)
  • dev: CTL-1506 otel-forward HTTP status classification + DLQ-loop fix (#2742) (ab62f2d)
  • dev: CTL-1639 salvage worktree unpushed work before destructive removal (#3026) (0560821)
  • dev: load catalyst plugins in-place via skills-dir; retire marketplace (#2664) (12c454f)
  • dev: add otel-forward to the post-merge stack-reload chain (#3164) (edc0ae2)
  • dev: CAT-29 refuse execution-core blindness to Linear (#3139) (4761b9e)
  • dev: CTL-1240 census tests never ran their census (isTicketKey skip) (#3148) (7a04cff)
  • dev: CTL-1568 make the escalation comment and the needs-human label one atomic act (#2861) (357a53c)
  • execution-core: fall back to credentials file when Keychain read fails (#3130) (62e4401)

12.51.0

Aug 10, 2026

Triage Aging PRs & Orphaned Worktree Adoption

A new triage-aging-prs skill encodes a proven method for driving a stale PR backlog to zero — including traps around fork CI secrets, ruleset queries, and reviewer signal interpretation that aren’t obvious until they’ve cost you time. Operators also get a new adopt command for claiming orphaned worktrees. Several main-branch test and lint failures that were blocking every open PR from reaching a green check set are fixed as well.

PRs

  • dev: add triage-aging-prs skill (#3173) (0fa37c9)
  • dev: CTL-1642 operator adopt command for orphaned worktrees (#3175) (8180c80)
  • dev: CAT-47 reconcile orphan-stale recovery seams (#3169) (97d63a4)
  • dev: clear the 7 lint errors red on main in pr-status-backfill (#3179) (4d43b2e)
  • dev: unbreak main — inject the skills-dir seam in the install-profile tests (#3180) (90a9967)

12.52.0

Aug 10, 2026

Durable Phase Artifacts & Cross-Host Recovery

Six phase skills now write durable thought docs to the shared repo before emitting complete, enabling reconstruct-ticket-state.mjs to rebuild any in-flight ticket’s history from scratch on a fresh host. The sync gate rolls out behind catalyst.phaseArtifactSync.mode — default off is behavior-identical to today; set shadow to observe without blocking, or enforce to make sync failures fatal. This release also fixes orphaned worker directories that held tickets in-flight indefinitely, corrects claude-accounts.env sourcing on bg-executor nodes where it was silently never loading, and resolves a ps truncation bug that caused the forwarder identity check to fail on Linux CI.

PRs

  • dev: CAT-31 resolve ticket worktrees before dispatch (#3141) (5b40163)
  • dev: CTL-1490 — durable phase artifacts + cross-host ticket-state reconstruction (#2697) (797dfdc)
  • dev: CAT-24 reclaim empty and signal-less worker directories (#3176) (228fb4f)
  • dev: CAT-90 — source claude-accounts.env unconditionally, not gated on CATALYST_EXECUTOR (#3186) (27670c7)
  • dev: confirm SIGKILL reap before returning in forward-stop (CTL-1502) (#3172) (ec9f51b)
  • dev: CTL-1701 move synthetic test pids above the real-pid ceiling (#3197) (c051400)
  • dev: unbreak main — stop ps truncating the forwarder identity check (#3196) (e8ab2e4)

12.53.0

Aug 12, 2026

Daemon Reliability & Pipeline Hardening

Daemon logs are now rotated on restart instead of truncated — the previous run’s output is preserved as daemon.log.1 through .5 (configurable via CATALYST_LOG_RETAIN) so you have evidence when diagnosing a wedge. Two daemon-killing bugs are also fixed: an async EAGAIN spawn failure that could take down execution-core, and a zsh local path variable that silently emptied $PATH and caused phantom artifact_not_gate_visible phase failures. Automated merges from linked worktrees no longer fail with fatal: 'main' is already used by worktree — the merge now splits into a REST merge and a checkout-free remote ref delete.

PRs

  • dev: CTL-1755 preserve daemon logs across restarts (#3231) (9acf3c5)
  • dev: CTL-1774 — thread appendDelegateEvent through delegate-first routing seam (#3280) (4cb5ca0)
  • dev: CTL-1789 — emit phase.advance.applied and attribute who asserted each terminal (#3268) (52984b6)
  • dev: bound board-health delegate-lands grace (#3206) (6ec4226)
  • dev: CTL-1764 handle async spawn ‘error’ so EAGAIN cannot kill the daemon (#3230) (3a03870)
  • dev: CTL-1777 — fix write_phase_thoughts_doc under zsh (rename local path vars + static lint) (#3238) (05a10a5)
  • dev: CTL-1791 — delete claim.mjs dispatch-claim, the high-water+1 generation the CTL-736 fence forbids (#3269) (3a9025f)
  • dev: CTL-56 — worktree-safe merge (drop —delete-branch, checkout-free ref cleanup) (#3277) (f9690b5)

12.54.0

Aug 13, 2026

Scheduler Hardening & Diagnostic Truthfulness

Work-done probes now carry timeouts so a hung gh or git child cannot wedge the scheduler tick indefinitely, and probe matches are tightened to prevent one ticket’s document from falsely satisfying another’s done check. The config dump tool now reports each setting’s actual in-force value and where it came from, rather than echoing what the config file says — every row is bound to the reader that actually decides it. A torn first line in the event log no longer silently retires the rest of the month alongside it, and raw NUL bytes in five source files have been replaced with escape sequences so grep and project-wide searches no longer skip them.

PRs

  • dev: CTL-1793 — catalyst config dump that cannot assert what the reader would not produce (#3276) (77633e7)
  • dev: CTL-1801 — checks that cannot report a clean result from a check that never ran (#3285) (eb70d61)
  • dev: CTL-1808 — the fast-forward becomes a subscriber, not a call (part 1: the scanner) (#3316) (d190e87)
  • dev: CTL-1790 PR-1 — a work-done probe must not match another ticket’s document (#3286) (e785a6e)
  • dev: CTL-1804 — make the forwarder identity check say what it saw (#3317) (6ba92e5)
  • dev: CTL-1810 — bound every work-done probe spawn so a hung gh cannot wedge the scheduler tick (#3307) (37de564)
  • dev: CTL-1811 — make every source file visible to grep (#3312) (0636a0b)
  • dev: CTL-1813 — a torn first line must not retire the month beside it (#3318) (92f37be)
  • dev: unbreak main — CTL-56 guard scanned CHANGELOG prose as a call site (#3284) (6c86fd3)

12.54.1

Aug 14, 2026

Event Pipeline Integrity Fixes

This release addresses a cluster of reliability issues in the event pipeline: torn lines from concurrent bash appends, degenerate records destroyed in transit to Loki, double-counted drop metrics, and terminal events that went invisible to the worker-state projection when the primary emit path failed. Dependency installs that silently no-op’d after a transitive resolution change — leaving daemons running stale code — now detect the skew and force a relink. The commits-behind gauge is also fixed to measure the roots daemons actually run from rather than always reporting zero.

PRs

  • dev: CTL-1659 — a dependency fix that lands on main must reach the running cloud-sync writer (#3344) (1ce1c5a)
  • dev: CTL-1795 — dual-emit the v2 envelope from every v1 site, so a consumer filtering on event.name stops seeing a smaller universe (#3343) (b724db9)
  • dev: CTL-1809 — make a bash event append exactly one write(2), so a concurrent producer cannot splice two events into one line (#3350) (388edf4)
  • dev: CTL-1814 — stamp the orchestrator on fallback terminals, so worker state is not blind exactly when the primary path failed (#3342) (a834c9a)
  • dev: CTL-1817 — carry every envelope shape off-machine, so a rescue escalation is not destroyed in transit (#3325) (d14e477)
  • dev: CTL-1818 — count the events the forwarder throws away, on a surface that survives the throwing-away (#3341) (e60321f)
  • dev: CTL-1823 — count degenerate RECORDS at batch accept, so the detector cannot inflate during the outage that makes someone read it (#3347) (2e6cc71)
  • dev: CTL-1825 — measure code currency at every executing root, so a 24-behind node cannot report zero (#3345) (e4401a6)
  • dev: CTL-1831 — prove the install RELINKED, so a merged lockfile is not installed in name only (#3349) (3f60190)
  • dev: CTL-1832 — a triage escalation must carry its question, not an empty object (#3340) (0e92516)
  • dev: CTL-1835 — close the four residual gaps from #3349, and prove each closure (#3353) (725922a)

12.55.0

Aug 15, 2026

Event Schema Hardening & Installer Cloud Path

Every event flowing through the daemon is now validated against a measured schema derived from 1.1 million real log lines, so envelope drift fails loudly in CI rather than silently dropping data at runtime. The installer gains a --cloud-token / --cloud-account path that completes a full cloud-connected setup in one step — and deliberately refuses to guess your tenant if the account is omitted. Two supporting fixes land alongside: supplemental Linear reads now route through the local replica to stop burning shared API quota, and event name resolution is unified through a single shared boundary so no envelope shape can be visible to some readers and invisible to others.

PRs

  • dev: CTL-1819 — validate every event against one measured schema, so envelope drift fails loudly instead of silently losing data (#3380) (aec4886)
  • dev: CTL-1836 — give the installer a cloud path, and make it refuse to guess the tenant (#3365) (13d8a07)
  • dev: CTL-1806 — serve the board’s supplemental reads from the local replica, so a display render stops spending the shared Linear quota (#3355) (effcbc8)
  • dev: CTL-1834 — resolve every event’s name through one shared boundary, so a new envelope shape cannot be visible to some readers and invisible to others (#3356) (953d53e)
  • execution-core,orch-monitor: CTL-1723 item 1 + OTEL attribute manifest — phase-signal mtime ties break by pipeline ordinal; 17 v2-envelope keys manifested (b8cb40b)

12.56.0

Aug 15, 2026

Phase Agent Yield & Advancement Reliability

Phase agents can now declare a bounded wait with --status yield when delegating to a background job, so finishing work is no longer recorded as abandonment. The advancement sweep gains a durable once-per-edge idempotency guard keyed on the predecessor’s identity, preventing the same phase edge from firing multiple times in a single tick. Two supporting fixes round out the release: the Linear webhook monitor now detects 401 authentication failures via route-comparison against the GitHub control, and connected replicas report the schema bundle they actually loaded rather than a version string that may not reflect what’s in memory.

PRs

  • dev: CTL-1805 — durable once-per-edge advancement idempotency guard (#3404) (0d9e25f)
  • dev: CTL-1841 — Linear webhook 401 alarm (route-comparison detector) (#3364) (dfae529)
  • dev: CTL-1854 — let a phase agent declare a bounded wait, so finishing work is not recorded as abandonment (#3383) (3ebbf30)
  • dev: CTL-1869 — report the schema bundle the replica actually loaded (#3399) (309966f)

12.57.0 (2026-08-17)

Features

  • dev: CTL-1847 — the cloud feed can drive dispatch, behind off/shadow/enforce (#3439) (9193042)
  • dev: CTL-1891 inc 1 — a host recognises its own Linear write without asking who wrote it (#3437) (1c6f44f)

Bug Fixes

  • dev: CTL-1847 — restore DEFAULT_SETTLE_SEC; execute the parity CLI in tests (#3444) (385c9a2)
  • dev: CTL-1892 — the fleet has TWO app identities and both rotated; only one was seeded (#3436) (9ac3e07)
  • dev: CTL-1892 — the self-echo guard survives an app-actor rotation (#3428) (4e601ef)
  • dev: CTL-1901 — a mid-sweep readiness drop strands an already-stamped edge (#3448) (5f84a2b)
  • dev: CTL-1902 — readiness required the writer to be alive, not the feed to be arriving (#3449) (e530c25)
  • dev: CTL-1904 — the feed sees label changes the updated_at cursor cannot reach (#3446) (51a7f6a)
  • dev: pin @catalyst-cloud/sdk 0.8.4, closing the migrator/writer schema skew (#3426) (4997ebe)
  • dev: pin @catalyst-cloud/sdk 0.8.5, ending the pr_* frame loss (#3432) (88f24c3)
  • dev: pin @catalyst-cloud/sdk 0.8.6 — PRAGMA-accurate columns close the skew class at the root (#3433) (0be8892)
  • dev: pin @catalyst-cloud/sdk 0.8.7 — the replica tenant fence (#3434) (6dc1ab6)

12.58.0 (2026-08-19)

Features

  • dev: CTC-403 inc 1 — a host resolves Linear team and state ids from the replica, not from hand-written caches (#3501) (e42f861)
  • dev: CTC-633 — the disk sweeper reports free space, and stops keeping every worktree forever (#3504) (f757f74)
  • dev: CTL-1889 inc 1 — a host’s Linear writes go through the cloud write proxy, under ONE grant (#3489) (7d9e8cd)
  • dev: CTL-1889 inc 2 — every execution-core Linear comment goes through the cloud proxy under enforce (#3547) (3711854)
  • dev: CTL-1889 inc 3 — the cluster fence + heartbeat go through the cloud attachment proxy (CTC-692) (#3555) (e24bda2)
  • dev: CTL-1893 — the replica path derives from the ACCOUNT (increment 1: the resolver) (#3561) (61d6870)
  • dev: CTL-1908 — doctor reports when a login shell spends the FLEET’s Claude budget (#3506) (cd774d2)
  • dev: CTL-1908 — page at 80% of an armed account’s window, before the fleet stalls (#3526) (04e2ce5)
  • dev: CTL-1914/1917/1918 — the documented install ends with a working node, not a list of hand-steps (#3500) (0671d38)
  • dev: CTL-1916 — ship the cutover-verification tool instead of re-deriving it each session (#3496) (35035c5)
  • dev: CTL-1922 — ask skill: ask/decision-ticket SOP + threaded app-actor reply helper (#3480) (c9582a2)
  • dev: CTL-1922 — 👀 ack on the human’s latest comment; reply clears it; newest-first fix (#3484) (54203ef)
  • dev: CTL-1922 inc 2 — ask create / ask accept verbs that PROVE the ask is decidable (#3509) (92e32ca)
  • dev: CTL-1929 — run the GitHub producer in shadow, behind its OWN knob, with enforce refused by name (#3524) (773675a)
  • dev: CTL-1929 — the GitHub feed’s read + event layers, with both blockers named rather than papered over (#3513) (780d309)
  • dev: CTL-1929 — the GitHub leg’s enforce flip, suppressing smee PER NAME (#3535) (98ec1ed)
  • dev: CTL-1929 — the installer stops opening the GitHub smee tunnel once the feed is authoritative (#3540) (6a5f359)
  • dev: CTL-1929 — the sweep, the suppression set, and a parity ledger that can return INCONCLUSIVE (#3520) (aa599ed)
  • dev: CTL-1929 — wire check_suite.completed, and make BOTH remaining names’ coverage a property of the replica (#3560) (3fab3bb)
  • dev: CTL-1929 — wire pr.merged and per-push into the producer on schema 0.1.17 (#3544) (538214a)
  • dev: CTL-1931 — the dep-skew detector can see a writer running the WRONG checkout (#3493) (85f16a9)
  • dev: CTL-1935 — pin the catalyst-index serving root to a git SHA (COORD decision 2) (#3525) (d4084ca)
  • dev: CTL-1936 — a host bounds its own cloud write spend, and stops re-issuing a write that already converged (#3505) (4aec522)
  • dev: CTL-1943 — a dispatched phase narrates itself as a Linear agent session, without blocking the tick (#3529) (6a413b3)
  • dev: CTL-1944 — a fleet host proves it can materialize owner tokens, and installs direnv when it cannot (#3539) (b8adf84)
  • dev: CTL-1951 — the ROUTINE fleet reload advances the pinned indexer serving root, out of the broker’s event loop (#3542) (8cade58)
  • dev: CTL-1961 — register the reaction + issue-create proxy routes, measured at the dispatcher (#3647) (60c5c38)
  • dev: CTL-1975 — the uninstall could not remove two agents its own verify-clean fails on (#3606) (5d842e7)
  • dev: CTL-1993/CTL-2001 — the steward skill, and one canonical copy of the threading contract (#3612) (109da9c)
  • dev: CTL-1994 — a supervisor keeps a long-running role alive, so the SOP’s response times are a mechanism and not a promise (#3614) (f688265)
  • dev: CTL-1995 — the concierge skill: one door, one page, and no authority over stewards (#3615) (223aa30)
  • dev: CTL-1996 — AGENTS.md teaches the coordination roles, and CI catches the block drifting (#3618) (b48ec01)
  • dev: CTL-2042 — fleet host env-file materialization + doctor drift check (#3686) (da98683)

Bug Fixes

  • dev: COORD-236 — the 60-second cool-down that would have stopped the label storm already existed; it could not see a budget refusal (#3667) (f29dbba)
  • dev: CTL-1832 — the PLUGIN_ROOT guard scans SKILL.md only, and progressive disclosure has moved the uses into references/ (#3660) (79874f2)
  • dev: CTL-1906 — the parity harness counts the feed’s own events as smee under enforce (#3452) (17cd352)
  • dev: CTL-1909 — readiness un-armed on the sweep’s most common HEALTHY outcome (#3469) (bedc8c3)
  • dev: CTL-1910 + CTL-1913 — the cloud installer pinned an NXDOMAIN host and never validated the token (#3470) (65bd1cf)
  • dev: CTL-1918 — catalyst-doctor is CRASHING on every host (an extracted default referencing doctor’s own scope) (#3515) (a9ffd66)
  • dev: CTL-1920 — a writer re-seed is a torn read, not 400 changed tickets (#3481) (1c59b7b)
  • dev: CTL-1921 — every new worktree inherited 1.3 GB of other agents’ scratch checkouts (#3472) (59385d9)
  • dev: CTL-1928 — the join bundle stops re-creating the retired Linear smee path (#3485) (9251f2b)
  • dev: CTL-1929 — an EMPTY check_suite association is a fact, not a gap; emit it, and put the recovered PR where nothing routes on it (#3563) (094eff3)
  • dev: CTL-1929 — set aside the suite conclusions the mirror cannot store (CTC-719), and collapse an observation node’s duplicated deliveries (#3565) (e4134eb)
  • dev: CTL-1929 — the P8 gate compared a young table against a long window and fabricated a FAIL; window both sides (#3573) (41a1a17)
  • dev: CTL-1929 — the parity ledger compares only repos smee can deliver, so CLEAN is reachable (#3551) (03b9399)
  • dev: CTL-1929 — the parity ledger says when its WINDOW, not the feed, produced the gap (#3562) (29cf9cb)
  • dev: CTL-1929 — the preflight checks EVERY repo on the tunnel, because the ledger structurally cannot (#3569) (67a7862)
  • dev: CTL-1931 — the dep-skew detector can reach a verdict on a bun isolated-linker host (#3499) (8c4dc40)
  • dev: CTL-1937 — a cli/*.mjs run by a SHELL refuses on its own, and CI keeps it that way (#3516) (5464175)
  • dev: CTL-1937 — a mis-invoked CLI module cannot become a 7,592-process fork chain (#3511) (7ea8206)
  • dev: CTL-1947 — an account the poller CANNOT sample now says so, instead of leaving an absent series (#3545) (faaddb1)
  • dev: CTL-1949 — the documented ask create path filed nothing and exited 0, and cross-team asks carried the wrong labels (#3531) (b77e8d6)
  • dev: CTL-1952 — a fully successful narration was recorded as a failure; the session route answers per part (#3538) (6bf7180)
  • dev: CTL-1956 — the direnv provisioning a host actually needs, on hosts that have no brew (#3552) (457f025)
  • dev: CTL-1963 — doctor asserts the cloud-sync launchd label resolves to ~/Library/LaunchAgents (#3572) (3b7eaae)
  • dev: CTL-1968 — a scratch HOME is not a launchd sandbox, so the install paths refuse it (#3576) (b70211b)
  • dev: CTL-1976 — the gate reads the readiness file the PRODUCER writes, not one under the caller’s dir (#3585) (39037d1)
  • dev: CTL-1997 — two out-of-date skill instructions, each verified at file:line, and one the audit got wrong (#3630) (c7b9f2d)
  • dev: CTL-1998 — main is red on a guard that could not fire for the change it guards (#3656) (6f4afb6)
  • dev: CTL-1998 — two real phase-pipeline defects: an unbound $EMIT crash and a plan glob the dispatcher and the phase disagree about (#3653) (91284f7)
  • dev: CTL-2008 — the broker folds github.pr.* into pr_status_cache, because retiring smee left the table with no writer (#3633) (a79ad89)
  • dev: CTL-2019 — setup wrote the cloud account to a file and then refused to read it, so the whole install aborted (#3637) (88a7216)
  • dev: CTL-2022 — the parity ledger reads the stream enforce actually emits, and a marker moves the verdict (#3644) (4337d64)
  • dev: CTL-2024 — a cleared stall could never re-enter its phase, because the janitor’s unstick left CTL-1805’s advance marker standing (#3649) (3740736)
  • dev: CTL-2026 — doctor could certify a host whose live Linear write path is a directory it never looks at (#3679) (34cda74)
  • dev: CTL-2028 — a pid file naming a LIVE peer was clobbered on start and deleted on exit, so two brokers ran for 85 minutes and every status read clean (#3675) (cba6bed)
  • dev: CTL-2030 — doctor graded whether smee was CONFIGURED, so after the cutover it reported a dead route as wired (#3672) (8146056)
  • dev: CTL-2033 — the cross-host claim could not say why it lost, so a refused write and a lost race were the same value (#3664) (07a4469)
  • dev: CTL-2047 — a triage budget held by a failed scan printed the same line as a busy one (#3682) (e7b41a5)
  • dev: CTL-2048 — a fence the worker could not READ was reported as a fence it read and found STALE (#3685) (c511edb)
  • dev: CTL-879 — the sixth blind gate, found by reading the first instrument: the cross-host claim declines at log.debug (#3661) (5e84413)
  • dev: CTL-879 — the triage admission path declined 20 tickets an hour and wrote down nothing (#3659) (8002c5d)

12.59.0 (2026-08-20)

Features

  • dev: CTL-2000 — steward-first escalation (resolver-independent slice) (#3742) (87ca75d)
  • dev: CTL-2074 phase 1 — cloud-proxy identity config seam (bot.cloud.botUserId) (#3738) (bbb56cb)

Bug Fixes

  • dev: CTL-1754 — the escalation card read a key written on 0 of 44 live signals, so it always said “(no reason)” (#3699) (7f562b6)
  • dev: CTL-1851 — an SDK worker cannot outlive its daemon, so a restart is PROOF its ghost is dead (#3694) (61587c8)
  • dev: CTL-1889 inc 4 — a status write with no linearis stopped reporting itself applied (#3724) (741cbd5)
  • dev: CTL-2045 — the install proved the credential could READ, and the incident was a WRITE it never tested (#3706) (318268f)
  • dev: CTL-2050 — an artifact that proves a phase succeeded retracts the infra failure that buried it (#3690) (c90e30a)
  • dev: CTL-2068 — a claim the pipeline can overwrite is not a claim (#3712) (18d8eb9)
  • dev: CTL-2068 — the guard shipped INERT on mini; resolve the state map through a ladder (#3714) (f499dcb)
  • dev: CTL-2076 — setup_project_config preserves committed Linear identity on regen; surface the registry team-identity mismatch (CAT-52) (#3736) (ef5b0b1)
  • execution-core: OTL-67 — SDK-dispatched workers lose per-ticket OTEL_RESOURCE_ATTRIBUTES to settings.json pin (#3721) (4cc82ce)

12.60.0 (2026-08-20)

Features

  • dev: CTL-1785 phase 1 — entitlement seam (zero-import leaf, tri-state flag, local provider, off by default) (#3755) (cccf3b4)
  • dev: CTL-1786 phase 1 — lease-authority.mjs cloud client + auth-spike probe (#3756) (dcad0fe)
  • dev: CTL-1864 — publish slot-based active_count on node.heartbeat (#3768) (7051350)
  • dev: CTL-1974 — codify catalyst-dev:project-orchestrator as thin steward wrapper (#3759) (4de7a1a)
  • dev: CTL-1985 — catalyst enrol one-key host enrollment installer (#3758) (a903177)

Bug Fixes

  • execution-core: CTL-2090 — triage-capped ticket can no longer deadlock admission (#3787) (2a649dc)
  • execution-core: CTL-2103 — scrub PATH so the gh-unavailable test is deterministic (#3778) (be1840b)

12.61.0 (2026-08-21)

Features

  • dev: CTC-133 — CQRS fencing split + SDK replica cutover (#3762) (15450f1)
  • dev: CTL-1984 — re-arm claude-accounts.env without daemon restart (#3809) (b24dedc)
  • dev: CTL-2070 — a timely per-ticket actor source (fleet write-ledger) for the lane-claim guard (#3765) (cf9efd0)

Bug Fixes

  • dev: CTL-1783 — a deliberate reopen archives the stale worker dir, doesn’t get re-Done’d (#3723) (2d6ee09)
  • dev: CTL-2082 — refresh linear skill against linearis drift (#3750) (a93eca9)

12.62.0 (2026-08-21) Latest

Features

  • dev: CAT-170 correlated recovery-pass retry-cap alerts (lands #3209) (#3842) (d8fab3b)
  • dev: CAT-173 surface mutual fence standoffs (lands #3241) (#3839) (083e390)
  • dev: CAT-46 durable liveness anchor health checks (lands #3219) (#3841) (42efe53)
  • dev: CTL-1210 — split node config by lifecycle (cluster-secrets.json + node.json) (#3823) (8c0dc4b)
  • dev: CTL-1679 — recovery pass retries safe/retryable failures by default (#3835) (f594755)
  • dev: CTL-1958 — owner comms tools write through the cloud proxy, read from the replica; mint deleted (#3816) (cee3edf)
  • dev: CTL-2085 — auto-update claude CLI and Agent SDK on persistent hosts (#3817) (668c731)
  • dev: CTL-2151 — ask skill gains duplicate-search and blast-radius triage (#3866) (1bff497)

Bug Fixes

  • dev: CAT-116 — validate registry identity at dispatch revision (#3838) (5343dc1)
  • dev: CAT-124 close deferred recovery-pass review findings (#3836) (542d69e)
  • dev: CAT-139 — watchdog runner accepts an explicit —config path (#3833) (4f4c567)
  • dev: CAT-251 — prevent HOME-restoration leaks in tests (#3834) (bf5be52)
  • dev: CAT-47 commit the audit-comment dedup latch only on confirmed delivery (#3831) (5e6fee4)
  • dev: CTL-1550 — Bounded event-log coverage correctness (4 bugs: backfill probe, cap size, window clamp, first-line drop, per-event filter) (#3760) (d52d085)
  • dev: CTL-1596 — cluster secret sync hardening (5 latent bugs) (#3821) (80fd237)
  • dev: CTL-2052 — classify the refused proxy label-write, cool it down, and stop after N (#3815) (6069d8b)
  • dev: CTL-2056 — fix two fleet alarm blind spots (ratelimit-poller + escalation counter) (#3761) (fb66677)
  • dev: CTL-2108 — emit entitlement.restored.<host> when a shed host regains entitlement (#3840) (e6a0581)
  • dev: CTL-2137 — exclude listing-blocked bg sessions from the admission count (#3846) (7d8480d)
  • dev: trust the Tailscale MagicDNS name in the monitor’s reply-origin allowlist (#3830) (d8bde5d)