Changelog

A new projection_search tool asks which subtree projects to a given sha256 — the inverse of the projection-hash check that wait and act already carry.

The workspace jail end-to-end suite now pins the shape of the act success and refusal envelopes against committed fixtures, so an unannounced field addition or removal fails CI instead of shipping silently.

A new v1 route resolves a command span id to its occurrences: the verb, the outcome, and the artifacts it touched.

The SDK gains commands.provenance, mirroring the existing artifacts.provenance.

Artifact provenance gains an optional processing field: raw, derived or unknown. Read it together with direction.

POST /v1/artifacts/provenance takes a list of content hashes and answers one entry per hash. A hash nothing produced comes back as an entry with an empty set, never a 404, so absence stays a usable answer.

The node now shuts down on SIGTERM, and drains live browser sessions before stopping — under a time budget, so it exits cleanly inside the container grace period.

An opt-in control worker logs what a profile-store reclaim would remove, reconciling the node's directory list against session records. It deletes nothing, and cannot: this build has no delete capability at all.

Every scan-backed provenance response reports how many sessions it read, the cap, and which bound ended the scan.

ScanExtent and ScanCompletion are exported so a client can branch on why a scan stopped.

AGENTS.md now records the collision class where a new test suite breaks a neighbour's global-count assertion, and why seeding-side fixes relocate the problem rather than removing it.

AGENTS.md told you to verify your own address with a bb send --dry-run. That proves a handle exists, never that it is yours, so the check returned a clean pass on a peer's identity.

AGENTS.md prescribed a count floor for merge watchers. A job whose dependencies have not resolved is never created, so it cannot be incomplete, and the floor passes straight over it.

Provenance and session-replay reads now tolerate a session whose profile column is null, instead of failing the whole request.

The reclaim report reads a nullable column into a non-Option String and is safe only because its query filters the NULLs out. That filter now has a regression test instead of a comment.

The API reference now says which Run fields are always null today, why, and what would change that.

The API reference said targets do not exist yet. They do - a run simply cannot be bound to one.

Three fields the API returns are never populated. The reference now says so, and says why.

The multi-organization sign-in page no longer tells you to run an approval from the CLI. That step does not exist on this flow, so the message now says plainly what happened and what will actually work.

The dedup guidance listed two ways an issue can pass every structural check and still not be takeable. Four screens in one day found four reasons, and two of them were new.

The node now gets 60 seconds to drain its browser sessions on redeploy, instead of the 10-second default that killed the drain part-way through.

The SW6 seat keeps a list of times it measured something correctly and published it wrongly. Two more were added, along with the condition under which it happens.

api-types is generated from the OpenAPI document and the WS event schemas but shipped no record of which revisions it came from. It now stamps both, so the release check can say a bump is due instead of reporting NOT APPLICABLE.

The marketing site carried no link to the documentation at all. It now closes with one, so the explanation layer is reachable from the front door.

The docs sidebar group Concepts is now How Nightjar works, at the same rank, so it reads as an argument rather than a cabinet of terms.

Reach grants and Identities now carry a contextual link into the docs, naming the question the screen raises rather than sending you to a docs front page to search.

The credentials guide said the MCP surface was a closed set of exactly 9 tools. It is 38. Both numbers now render from one validated selection, and CI refuses a tool table that has drifted from it.

Retention keyed on session status, so it reclaimed idempotency tickets that the API would still serve replays for. It now keys on the handler's own reachability condition, and sweeps the fill-credential store too.

Every MCP host recipe now leads with nightjar auth login. Carrying the key in an environment variable or header template is marked deprecated, with the incident that motivated it as the reason. No recipe is removed.

One mock-node helper served two opposite expectations through a single timeout, so the deadline expiring was the PASS for four denial tests and the FAILURE for the arm that proves them non-vacuous.

A revoked or expired reach grant stays in the owner-scoped list for 90 days after it became terminal, and its row is then reclaimed.

The retention sweep deletes oauth tokens past their expiry whose grant is already revoked. An expired token under a live grant is kept: revoke reads it with no expiry filter, so deleting it would make revocation a silent no-op.

The provenance route's docs presented two causes of an empty answer as the complete set and called the ambiguity a security property. A third cause, the 500-session scan bound, is a completeness limit and now says so.

artifacts.provenance(hash) resolves a content hash to the sessions that produced it, with the verb, page and time.

The transport reaper tore down a crashed session's browser without first asking the node for its recording, so an opted-in capture was left unsealed and unindexed - and therefore unreadable.

The download-to-artifact endpoint promised that artifacts are garbage-collected with the session. Nothing collects them at session end.

The download_to_artifact tool carried the same false guarantee. An agent read it, ended its session, and nothing was collected.

A revoked or expired session capability row had no release path at all: only deleting the organisation removed it.

The SDK reach namespace lost its docs when artifacts was inserted between the comment and the member it described. Hover and the published types showed nothing, including the note that claim is excluded on purpose.

POST /v1/artifacts/collect runs the node's reachability-based artifact sweep for one profile and returns what it collected.

act with verb upload now returns the artifact refs it attached, on the receipt. Proving N files are attached no longer means finding N chips in a perception digest that is capped and gets denser as N grows.

The perceive output schema said its perception field was passed through verbatim. That is only true in full mode, and the default is compact.

The 12 keys the renderer adds to perception are now declared and documented, so clients can read the shape they receive.

A same-document navigation workaround is pinned to the chromiumoxide version it was reasoned against, so the next upgrade fails the build instead of quietly outliving its cause.

The controller idempotency table now has a reaper. It was the fourth ticket store and nothing had ever deleted from it.

An Idempotency-Key reused long after its retention horizon now re-executes instead of returning an expired error. Well before that, the error is unchanged.

Run status is computed on read, and its "this run never had activity" test asked whether the sessions and connections tables were empty. Once retention reclaimed those rows the test passed again, so a finished run looked new.

The provenance oracle now reports a direction for each artifact plus the command span that minted it. Direction is derived from a closed verb set and reports unknown rather than guessing when the verb cannot determine it.

The node can now answer which subtree projects to a given sha256, the inverse of the projection-hash check that wait and act already carry.

act and credential_fill declared their delta with no type at all. The wire carried 28 fields and 6 closed enums that no generated client could see.

The v1 API can now ask which subtree projects to a given sha256 — the inverse of the projection-hash check that wait and act already carry.

The artifact tool descriptions told every agent that no hosted surface exposed a collector. That stopped being true when POST /v1/artifacts/collect shipped, so the text now names the endpoint and the authority it needs.

Captured auth-state versions older than your organisation's retention preset are now reclaimed. The active version is never removed, nor is one a live session could still resume from.

Nine docs sites that said OAuth login now say remote-MCP OAuth login, so the shipped host flow stays distinguishable once nightjar auth login adds a second one.

A Today page that cites a symbol now fails CI if that symbol resolves to no source file.

Session artifacts now carry the page URL they were minted against, captured best-effort at mint time.

Credential store errors now say credential rather than profile, which had three other meanings a reader could land on.

The journal and session-activity reads take since and until, so you can ask for the window a session misbehaved in instead of paging from a cursor.

Journal events now carry the tab they belong to, and the journal read takes a coarse verb filter.

V1Error.code now documents that it carries the RENDER token, and which field the same token rides on the other paths that emit a Nightjar error.

A troubleshooting section stating which error field rides which path, and where to read it.

Corrected a module header that described the MCP error result as carrying only a code and a message.

Sixteen selector flags said CSS selector while accepting eight locator forms; four that really are CSS-only were left alone.

Each network_log entry can now carry _commandSpanId - the command span in flight when that request STARTED - so act-caused traffic is identifiable without matching timestamps.

ActReceipt now carries commandSpanId - the same key network_log entries publish as _commandSpanId - so a client can go from an act straight to the traffic it provoked.

The Drive panel's selector inputs said "CSS selector", but the value is resolved with the full eight-form locator grammar — so seven forms were advertised as unavailable.

journal() and journalWithMeta() take an optional args object, so a caller can narrow a recorded journal by sequence cursor, time window, or verb instead of fetching all of it.

consoleLog() and networkHar() take an optional args object, so a caller can narrow by cursor, tab, level, URL, method or status range instead of refetching everything to poll.

Taking, releasing, force-releasing and reaping an identity lease now each write an event.

Each MCP handshake now records its outcome per API key, so a connect-failure rate is one security-log query instead of a day of log forensics.

Every operation declares whether it needs the server; the CLI reads that instead of a denylist of one.

A new provenance read on the /v1 artifacts path answers which session minted an artifact, with which verb, against which page, and when.

'nightjar auth login NAME' signs you in by device flow and saves the credential to an owner-only local store under a name you choose. Nothing is typed at a prompt and no token is passed on a command line.

The OAuth token response now names the binding it minted: the org and agent ids, plus their display names when the deployment has them. All value-free ids, never secret material.

The retention sweep now deletes transport_connections rows that no live session can still be reaped through.

The reaper's candidate query joined identity leases, so a session that never assumed an identity could never be a candidate for reclamation.

The egress-audit drain kept one dedup set for the whole node process, keyed by session and never pruned, so entries outlived the sessions that produced them.

A repo can now declare its MCP entry as a command that names a saved login, rather than an HTTP entry carrying a credential in a header template.

The credential-security guide now states the store root, the NIGHTJAR_CREDENTIALS_DIR override, and why an unset home is an error rather than a fallback.

0.1.0 reached the registry uninstallable, because npm publish neither applies publishConfig nor rewrites a workspace range. The tree is fixed for 0.1.1, and a prepublishOnly guard now refuses the wrong publisher.

The published guide said a grant can never carry a write or admin scope. Since the owner-consent addendum an owner may consent to one, so the guarantee was false in the reassuring direction.

api-types 0.1.0 shipped with a correct manifest and an empty tarball, so the SDK installed and imported but failed every consumer tsc. The guard is now shared, and prepublishOnly builds first.

ADR-056 decides the agent credential binding: a local multi-profile credential store consumed by a stdio MCP proxy that attaches authorization at request time, replacing the env-var Bearer header pattern that cost a five-hour incident.

When the CLI cannot reach a server it now names the hosted platform URL as well as the local options, so a first run against the cloud does not fail with only localhost advice.

Three reach tests asserted on the reaper's batch report instead of on the grant they were testing, so a required postgres check could fail with a zero-scan signature.

The changelog contract gains a cli component, so a change to the command-line tool can be classified as what it is instead of borrowing a neighbouring slot.

Four assertions in the transport reap suite compared a globally-scoped batch counter, so a sibling test's candidate could red a healthy run while never asserting anything about the row under test.

CI now type-checks every crate that contains Windows-only code, instead of skipping it in silence.

A session credential now carries a stable id and a per-refresh instance id, instead of one id that conflated them.

POST /v1/reach/ensure accepts remintClaim. Declare it and the outstanding claim code is revoked and replaced atomically; omit it and repeated polls reuse the live code exactly as before.

The local reach ensure tool gains the same optional remintClaim argument, defaulting to false.

On Windows the credential store's files are now restricted to their owner, and the restriction is read back and proven rather than assumed.

The OAuth token response gains two value-free extension members: a credential id that is stable across refreshes, and a token instance id that is new on every refresh. Both are ids, never secret material.

A spec drift check could fetch its baseline from the wrong commit and report no drift forever, without ever failing.

Claiming a reach grant now revokes the join tokens it supersedes, so an older secret stops authorizing a daemon join the moment a newer one is issued.

Opening the credential store now locks and checks its directory first, and refuses rather than proceeding when it cannot.

The stdio MCP proxy re-reads its credential per request, sends it only to the profile's pinned origin, and reports which credential it attached without ever printing it.

The credential security model now covers where an agent's own platform credential lives on disk, and what the file backend guarantees about it.

The changelog gate read an elliptical arc's flags and radii as coordinates, so any motto drawn with a curve failed the safe-band check wherever its art actually sat. Path data is now parsed per command.

Adding a crate to the workspace without a matching COPY line in the node Dockerfile now fails a lane-tooling arm that names the crate, instead of failing the image build much later.

Pasting a Nightjar key where a saved login name belongs is now refused, instead of being repeated back inside the error message.

A bracketed IPv6 literal without a port was refused, because the authority was split on its last colon and an IPv6 address carries colons inside the host.

The underscore enters the summary allowlist, so an entry can write NIGHTJAR_REQUIRE_DB_TESTS instead of circumlocuting it. Headlines keep the narrow set and stay scannable at chip size.

Pasting a credential where a profile name goes no longer puts it into an error message, and so into every log or screenshot that captures one.

The live contract now carries the rule for declaring changelog:none when no component fits, so an author meets it where they already look.

Approving an access request now reads the receipt before deciding what to show, instead of always revealing a secret.

A finalize script promotes your draft into its PR directory and stamps the number.

A changelog-entry skill covers the fields, the prose rules, and how to draw a motto.

The three browser-facing legs of the device-approval flow now render a titled HTML error page instead of the API's JSON error body.

The docs site gained a changelog page that renders every shipped entry, newest first, with its drawing.

A screenshot withheld because a secret field could not be safely redacted now reports its outcome certainty as a confirmed failure, not as an operation that never started.

The same corrected certainty is visible to MCP clients reading the error envelope of a suppressed screenshot.

Following a device sign-in link while signed out used to drop the code and leave you on the console with nothing to approve. The approval page now renders after you log in.

If you belong to more than one organisation, the approval page now asks which one to approve as, instead of returning an error that named an HTTP header.

A banner appears when the console you are running is not current with the shipped changelog, and links to what you are missing.

The device-grant approval leg is now exercised end to end against a real control and a real postgres, covering the six states a fixture can hold honestly.

Approving a pickup grant now shows when the collection window closes, instead of only saying the agent will fetch its own key.

A new repo-root reference, WORK CONCEPTS, explains how work is modeled: the units of design, work, planning, tracking, specification and memory, their relations, and which concepts are materialized versus convention versus implicit.

The changelog page now carries the two releases that predate the per-PR system, under a Before the per-PR system section, and the root file is a dated pointer rather than a second source of truth.

changelog-capture takes the console screenshots this changelog has required since day one, and refuses rather than write one it cannot vouch for.

It refuses an over-size capture before the browser starts, with the arithmetic and a remedy.

A guard now keeps an annotated review list of every path built from chained join() literals, and fails only on one whose segments could compose a path the CI filter drops.

Inline links in docs prose are underlined, so they are distinguishable without relying on colour. Nine of twelve pages carried this, and it was the only serious accessibility violation on the whole site.

The docs site is now covered by the accessibility job, which previously ran two other apps and had no test files at all for this one.

The agent-key template's opt-in condition now has a negative arm on the mint path: an org that has not enabled agent self-reach must never be handed reach:self.

The entry-contract check now writes its advisories to the run summary, where they are visible without opening a log.

Running the check on your own machine now says that it did not look at whether this branch owes an entry.

The 201 from POST /v1/keys now carries templateApplied, plus a closed-enum reason when the agent-key template was eligible but something blocked it.

A deploy can now be checked against the build it shipped, rather than against a 200. Both sites answer 200 on every path, so the old check could not tell a current site from one serving an old build.

An inline link in a block of text no longer relies on colour alone to be recognisable as a link.

Every reference on the public changelog page that pointed into the private source repository is now plain text, so a visitor no longer clicks through to a login wall.

Opening a request deep link while a different org is active told you the request was already resolved. It now says only that the request is not in this org's queue.

When a capture refuses because it cannot find your text, it now says whether the page rendered or not.

The expected build can now be given as any ref, resolved internally, instead of a copied commit id. A ref has nothing to transcribe, and a bad one is reported as a caller error rather than as a failed deploy.

Rotating an agent credential no longer moves a secret by hand. The operator initiates the rotation, and the replacement is minted only when the key itself collects it.

Every PR now ships a small illustrated changelog entry: what changed, who it affects, and a drawing.

A CI gate validates every entry: schema, filing, prose, illustration and screenshots.

An access request actioned by a signed-in human now records that person, not only the key they acted through. A row names a key approver or a human approver, never both.

Filing an access request with a misspelled field now fails with a 400 that names the offending field. Previously the unknown field was ignored and the request was accepted, so a typo produced a scopeless request that looked like success.

The create and status responses now echo back the scopes and delivery mode as recorded, including the defaulted delivery mode, so a caller can confirm what was actually stored.

Sending a malformed body to the key-mint route now returns the normal error envelope, which names what was wrong. Previously the rejection arrived as a bare 422 with no envelope, so the explanation was discarded before the caller saw it.