Release 1.38.0

News · 2026-09-23

Captured events, field mappings and playbook bindings live in PocketBase collections instead of SQLite tables. They are ordinary records, which is what lets a binding be changed at runtime rather than by editing a database.
A read-only operator surface over the task database ships with the State Store (archie-state-store -admin-addr). It serves view collections over tasks, transitions, events, identities and resources, and refuses /api/backups and POST /api/sql, so it cannot rewrite state or hand out the database file.
A binding cannot go live without approval. It moves draft → pending approval → armed; one binding per source is enforced on insert, on edit and on approval; and an edit always returns it to pending approval. A secret left blank on an edit keeps the stored one rather than disarming a live binding.
The workspace code-search indexer is gone. No deployment configured it, and it was one more resident writer over the workspace.

A dashboard edit no longer needs a manual refresh. A successful binding or mapping write announces itself on the same activity path a captured event already uses. The announcement carries the record id and the action and the dashboard refetches the record, so the signal cannot go stale.

A cron job computes its next run and fires. Until this release a cron schedule was accepted at creation and then refused at run time with ErrScheduleUnsupported, so a cron job never ran.
The dialect is PocketBase’s, and it differs from Vixie cron on one point. Day-of-month and day-of-week are combined with AND rather than Vixie’s OR, so 0 0 1 * 1 means Monday the 1st, not “the 1st, or any Monday”. The @daily-style macros behave as usual. An expression that can never match, such as 0 0 30 2 *, is rejected instead of being left to run forever.

Every completed tool call is a row in the tool_calls collection, not only a line in the on-disk task log. The row carries the task, the attempt, the tool, its result or its error, and when it ran.
A failed projection never fails the task. The event is the record and the collection is a transcript of it, so a copy that could not be written is logged and counted rather than propagated.

A task naming an identity archie no longer knows — renamed, retired or removed in the control plane — no longer falls back to the root forge’s credential. It parks with the reason recorded. A task arriving over NATS with such an identity is refused before it is enqueued. A task with no identity is the single-identity root path and is unchanged.

A completed review is rendered to markdown and published to the collaborative editor, so a person reads it and comments on it instead of reading a wall of text in a pull-request comment.
Publishing never fails the review. With [artifacts] base_url unset the sender is not constructed and publishing is a log line; a publish that fails is logged with its status and the same review is republished the next time it completes. Set [artifacts] token (or WORKSPACE_INGEST_TOKEN) to enable it.

The feed’s resume cursor is opaque, and a malformed or pre-upgrade cursor degrades to “from the beginning” rather than failing the stream. One consequence on upgrade: a browser holding a cursor issued before this release replays the backlog once.

The runtime image is rebuilt by this release, and a host must pull it (docker compose pull agent). The shared State Store contract changed shape in the sections above — task and event-capture id fields are strings now — and the two halves are versioned together, so an agent image built before this release does not speak to the new State Store. There are no agent behaviour changes of its own in this release.