Release 1.26.0

News · 2026-09-17

archied

fix(webui): publish per-identity forges so multi-identity task rows keep their links
feat(config): add [scheduling] config block
feat(configuration): translate [scheduling] into scheduling.EngineConfig
feat(cronevents): adapt the events bus to scheduling.Sink
fix(webui): count every chat front-end in the published projection
fix(scheduling): respect configuration ownership
feat(ratelimit): wire per-identity inbound rate limiting into the gateway
fix(tools): judge the rm guard by base name so absolute paths cannot bypass it
fix(store): keep an empty binding secret empty so a partial edit cannot erase it
fix(archied): stop advertising review_pr when no reviewer can run
fix(daemon): carry kind/label routing bindings to the process that routes
feat(configuration): add archied setup, the caller the first-run flow was built for
fix(configuration): stop letting a secret value be set from the command line
feat(configuration): let setup reference a secret without carrying its value
fix(archied): disable a provider whose credential is missing instead of refusing to boot
refactor(install): install.sh delegates config generation, and tests stop reading hand-written configs
fix(daemon): guard binding dispatch loop against nil dispatcher/creator
fix(webui): enforce CSRF/origin gate on binding and mapping mutations
fix(secret): recover a panicking secret engine instead of crashing
fix(config): deep-copy Image.Hosted/Image.Local in Config.Clone
fix(email): stop dropping the first paragraph of plain-text bodies
fix(logging): keep the live descriptor open across a failed rotation
feat(configuration): report config keys no decode target consumed
feat(archied): warn at boot when the config file has unrecognised keys
feat(archied): wire the scheduling ticker engine at boot
fix(agentworker): wire configured tool-result policy into worker’s LoopRunner
refactor(staterpc): delete the superseded single-token auth interceptor
refactor(memory): delete the unreachable fence scrubber
fix(channels): delete unreachable Telegram webhook delivery mode
fix(gateway): delete unwired Router.Dangerous approval path
refactor(gateway): delete orphaned SessionState goal/steer/queue machinery
refactor(archied): delete the daemon’s unused webui.Server and UI adapters
refactor(tools): delete unreachable dispatch/gating engine
feat(channels): wire chat.webhook route config through to the gateway
refactor(tools): delete unreachable AST-based tool discovery
refactor(tools): delete unused plugin-tool registration API from builtin.Registry
feat(channels): wire ConfigSchema/ValidateConfig into a startup validation loop
refactor(state): delete the dead IncrementRetryCount RPC (breaking change, accepted)
fix(curator): populate PassInput.Since with the prior pass time
fix(memory): install the threat scanner the composition root never wired
fix(staterpc): preserve marshal_error marker in eventDataJSON
fix(gate): validate finding level and share the blocking threshold
fix(scheduling): record a completed run so a recurring job stops re-firing every tick
fix(releaseupdate): don’t treat empty available as deferred
fix(tools/provider/mcp): preserve MCP binary tool results for delivery
refactor(gateway): share sensitive-key markers with webhookguard
refactor(daemon): remove unreachable SQLite poll/drain path
refactor(tools/mcp): delete unreachable MCP adaptation path
fix(taskactions): resolve max_retries from the task’s owning identity
fix(daemon): forward configured MCP servers to task agents
refactor(skill): delete dead Discover/DiscoverPlugins/Skill path
refactor(skillbuild): delete dead AugmentRegistry path
fix(builtin): bound read/edit filesystem work by DefaultToolTimeout
refactor(binding): delete dead Matcher.Overlaps method
refactor(forge): delete dead CreateIssue surface
fix(mcp): cancel in-flight SSE reconnect on Stop
fix(container): enforce MaxUptime lifetime cap with a timer
refactor(store): use taskstate status constants in SQL
fix(ui): unbreak binding approve and the two deletes, and centralise the client
fix(tools): stop testing on the text of other files, and ungate contractaudit
refactor(forge): delete the unwired RepliesAfter surface
refactor(config): delete the two decoded-but-unread policy fields

This release is dominated by dead-code removal and the completion of the scheduling capability. Roughly half the commits delete surfaces that no longer had a caller: the unreachable SQLite poll/drain path, the unwired MCP adaptation path, the AST-based tool discovery, the superseded single-token auth interceptor, and several dead forge and binding methods. The IncrementRetryCount State Store RPC is gone with them – a breaking change to the wire contract, accepted because nothing called it.

The cron/scheduling epic lands its remaining slices: the [scheduling] config block, its translation into the engine’s own settings, the events-bus sink adapter, and the boot wiring that starts the ticker. A recurring job now records a completed run, so it stops re-firing on every tick.

Operator-facing work: archied setup gives the first-run flow the caller it was built for, configuration no longer accepts a secret value from the command line, and a provider whose credential is missing is disabled rather than refusing to boot. A secret engine that panics is now recovered instead of crashing the daemon.

archie-agent

feat(config): add [scheduling] config block
fix(webui): count every chat front-end in the published projection
fix(scheduling): respect configuration ownership
feat(ratelimit): wire per-identity inbound rate limiting into the gateway
fix(tools): judge the rm guard by base name so absolute paths cannot bypass it
fix(daemon): carry kind/label routing bindings to the process that routes
fix(config): deep-copy Image.Hosted/Image.Local in Config.Clone
fix(logging): keep the live descriptor open across a failed rotation
fix(agentworker): wire configured tool-result policy into worker’s LoopRunner
refactor(staterpc): delete the superseded single-token auth interceptor
refactor(tools): delete unreachable dispatch/gating engine
feat(channels): wire chat.webhook route config through to the gateway
refactor(tools): delete unreachable AST-based tool discovery
refactor(tools): delete unused plugin-tool registration API from builtin.Registry
refactor(state): delete the dead IncrementRetryCount RPC (breaking change, accepted)
fix(staterpc): preserve marshal_error marker in eventDataJSON
fix(gate): validate finding level and share the blocking threshold
fix(tools/provider/mcp): preserve MCP binary tool results for delivery
refactor(tools/mcp): delete unreachable MCP adaptation path
refactor(skill): delete dead Discover/DiscoverPlugins/Skill path
refactor(skillbuild): delete dead AugmentRegistry path
fix(builtin): bound read/edit filesystem work by DefaultToolTimeout
refactor(binding): delete dead Matcher.Overlaps method
refactor(forge): delete dead CreateIssue surface
fix(mcp): cancel in-flight SSE reconnect on Stop
fix(container): enforce MaxUptime lifetime cap with a timer
refactor(forge): delete the unwired RepliesAfter surface
refactor(config): delete the two decoded-but-unread policy fields

The runtime carries a smaller, more focused set of changes than the same version’s archied entry: agent-side tool-result policy is now wired into the worker’s loop, MCP binary tool results survive to delivery, the container MaxUptime lifetime cap is enforced with a timer, and a scheduled run records completion so it does not re-fire each tick.

Note that several bullets above name config, webui and ratelimit packages. Those are attributed here by the release tool’s package-closure rule (go list -deps over the agent binary), not because the agent owns them; the substantive runtime changes are the worker, MCP, container and scheduling fixes.

This entry also confirms the removal of the dead IncrementRetryCount State Store RPC, which the agent reaches through staterpc rather than by calling it directly.