Changelog

When a session ends or is abandoned, the node records that durably. A later launch answers E_BROWSER_UNAVAILABLE with reason session_ended, and a delayed or retried start of it is refused, also after a node restart.

The node's GET /health now answers 503 with reason barrier_unreadable when its record of ended sessions cannot be read; the node then refuses every start and launch but keeps ending sessions.

The node's cap now counts browsers, from launch until their end is confirmed, crashes included. A session with no browser, such as a parked or abandoned one, takes no place, and a refusal says limit runningBrowsers.

When a warm-resume session's first browser launch was refused, for example because the node was at its browser cap, the saved sign-in was already used up, so the retry opened a cold session. The node now keeps it until a launch succeeds.

Ending a session now checks that every process of its browser is gone before the session counts as ended. Until then it stays draining and keeps its identity, so no other session can take it while the browser may still run.

The health endpoint's body now carries a node field: ok, or a short reason such as unreachable or timeout. Before, it checked only the database, so a down node still read as healthy.

identity_release_lease answered 400 (missing field declaredEvidence) on every call. The gateway sends an empty JSON object, and the route read any body as the declared override; an empty object now runs the ordinary release workflow.

When the node is at its live-session cap, a session start now answers 503 E_NODE_CAPACITY (retriable, NOT_STARTED) with a Retry-After header, instead of 502 E_UPSTREAM.

The typed wait's selector states now mean what they say: visible needs a rendered element, hidden and detached are satisfied by an absent one, and a selector that matches several elements is no longer stuck as not satisfied.

A session started with its network log off now stays off after a node restart. It used to come back at the metadata tier and start recording method, host, path and status. A higher tier is kept too, and so is the requested viewport.

The message on a session_abandoned refusal carried a run of 18 spaces in the middle of its sentence; it now reads as one line.

The console, docs and website deploys stay quiet while a build succeeds, but when it fails they now print the last 40 lines of the build and the path to its full log, so the deploy log names the cause.

The changelog now lists each change under the first release that actually contains it. It grouped by day, so a change merged after a day's last release read as shipped in that day's first one.

The What's new banner no longer says the changelog is older than the running build when the server runs a recent release. The banner matches the running version to the changelog's releases, and same-day releases were missing.

On 2026-10-08 seven cloak sessions with ChatGPT tabs outgrew the node's 8 GiB memory cap: the node thrashed, renderers were OOM-killed, and perceive timed out. The hosted node's cap is now 12 GiB.

On a phone-width screen, a dialog such as Create API key filled the screen edge to edge. It now keeps a margin on every side.

A scheduled probe checks the production health endpoint from outside every 15 minutes and opens a prod-down issue when it stays unreachable, closing it on recovery. A 28-hour outage in October went unnoticed because no alert path existed.

The small confirmations that appear after an action, such as Session ended with the session's id, now use the nightglass toast. Each has a close button and is drawn above any open dialog.

A session the node abandoned after its inactivity timeout (30 min by default) now answers later calls with E_BROWSER_UNAVAILABLE and reason session_abandoned, not proxy_not_registered, which pointed at the proxy instead of the timer.

On the create-organization page, each checkbox is now announced with exactly the text beside it. The business attestation used to be announced without its last sentence, about being authorized to bind the organization.

A quoted, exact role locator for a button named X now finds a native button, link or input with that accessible name. Before, it saw only elements with an explicit role attribute, so on most pages it timed out as not found.

When a session refuses to launch its browser, every page call on it now returns that same refusal with its reason. Before, only the first call did, and later calls returned E_TAB_NF, which reads as navigate first and can never work.

A background cleanup could mark an identity as in use again just after its session ended, so every new session on it was refused until someone force-released it. A lease that is ending now always finishes ending.

A session the node rebuilds after a restart, such as a deploy, now gets its exact egress policy back and relaunches its browser through its own proxy. Before, it was refused with envelope_not_restored and had to be replaced.

New node setting NIGHTJAR_REQUIRE_SESSION_EGRESS, on in the hosted deploy: every browser launch must go through a session proxy, or it is refused with proxy_not_registered. The node logs whether it is enabled or disabled at boot.

When a session can no longer launch its browser, for example after a node restart, the API error now carries a reason such as envelope_not_restored. Before, it looked the same as a node with no browser installed.

When the control plane does not report an identity's lease, the console now says Lease unknown and blocks deleting it, instead of showing it as Available.

The identity list and single-identity responses on /v1 now return leaseState, available or in_use, the same value the assumable list already returns for the same identity.

An org suspend, and the cleanup that finishes an end the node confirmed later, now record the identity lease they release, with no actor and a via field naming the path.

After a node restart, such as a deploy, a live session's browser relaunched without its egress proxy and limits, and cloak relaunched as Chrome. Such a session now refuses its next command with a typed error; start a new one.

launchedBrowserKind now describes the running browser: a relaunch updates it with a new launchConfirmedAt, and after a node restart it is absent until the relaunch is confirmed. Absent means not yet confirmed, never a match.

Two session starts on the same identity can no longer both succeed. The second is refused with 409 E_CONFLICT, and its reason says why the identity is held.

Identity responses gain leaseHold: live, in_flight, ending or unresolved, and null when the identity is free. A refused session start names the same value in reason. leaseState stays available or in_use.

Force-release now ends the session and frees the identity only once the node confirms the browser is gone. Otherwise the lease stays, and released: false says why.

Ending, deleting or suspending a session that holds an identity completes it only once the node confirms. Until then the session is draining: it cannot be driven, and the identity stays held.

A reconciliation worker, on by default, finishes interrupted starts and unconfirmed ends once the node confirms. Its boot line says whether it is running.

A new 503 E_BIND_BUSY, retriable and with Retry-After, is returned when every identity-start slot is in use.

identity_list_assumable shows leaseHold, and identity_release_lease runs the termination workflow and reports a reason when it keeps the lease.

An identity held by a start in progress, or by one that was interrupted, now reads In use instead of Available.

The allowSessionRecording and cloakEnabled descriptions in the governance contract said they were off by default, mirroring allowAgentSelfReach. New orgs now get allowAgentSelfReach on, so the two descriptions name each other instead.

In an org created from now on, an agent-bound key minted without scopes carries reach:self, so its agent can ask for local reach without an admin first enabling allow_agent_self_reach. Existing orgs keep their stored setting.

Since v2026.10.01.1 a session whose browser had crashed could keep its identity held: the reaper waited for a confirmation the node never gave. It now treats a session missing from the node's live list as ended, and frees the identity.

ActReceipt.commandSpanId is now described as absent when unset, never null, and as not yet delivered on act receipts, so no client builds a correlation chain on a key that is always missing today.

The act tool's receipt schema carries the same correction: commandSpanId is absent rather than null, and is not yet populated on act receipts.

The identity read now reports leaseHeldBy whenever a live session holds the lease, including after its renewal horizon has passed. It used to read null there while session_start still refused the identity.

Identity reads carry leaseExpiresAt, the held lease's renewal horizon, so a holder can renew before it passes. It is null exactly when leaseHeldBy is, and a past value does not mean the identity is free.

The identity page said a login snapshot is minted when a session ends; nothing does that. It now says snapshots come only from an explicit capture, and marks the version warm-resume actually uses.

GET /v1/access-requests takes a status filter, and every approved or denied request now names who decided it (actionedBy) and when (actionedAt).

accessRequests.history() pages through approved and denied access requests with their deciders; accessRequests.list() still returns the pending queue exactly as before.

The Identities screen shows Recent decisions under the access-request queue, so an approval no longer vanishes from the console once it is made.

clipboard_capture now resolves a perceive address for its copy control, the same way act does, generation suffix and all. It used to fail every time with not found in perception snapshot, whatever the page.

A not-found error for a uid or a tab no longer lists the tab ids and UID counts of other sessions on the same node. It names only the tab it was asked about.

The terminalReason description now says that every terminal session currently reads ended, crashed, evicted and challenge-walled ones included, since nothing records a reason yet. Read ended as “the session is over”, not “it ended cleanly”.

POST /v1/sessions/:sessionId/adopt now names sessions:takeover: replacing another principal’s live controller token, or a live input grab someone else holds, needs org-admin membership or that scope, and otherwise answers 403.

Opening the command palette with Control-K or Command-K focused its Close button instead of the search box, so typing went nowhere. The search box has focus again.

The crashed-session reaper now picks its candidate sessions before it asks the node which sessions are alive, so a session that starts during that check can no longer be ended as crashed.

The session reapers now end a session and free its identity lease only when the node confirms the browser is gone. An unreachable node leaves the session live and the lease held until a later tick can confirm.

The act selector description now says how a role locator's name matches: a case-insensitive substring, and the first match in accessibility-tree order wins with no ambiguity error. A name like Copy also hits an earlier Copy message button.

The act tool's selector description in the MCP schema carries the same matching rule, and points to the perceive address when two controls share a name.

A quoted name or text in a role, text, label or placeholder locator now matches exactly and case-sensitively. If an exact locator matches more than one element, nothing is done and E_LOCATOR_AMBIGUOUS names each candidate's uid.

The act, wait, extract and clipboard capture tools accept the quoted exact form in their selectors, with the same refusal when it matches more than one element.

A reach grant's issue, its owner's revoke and its expiry each write a value-free entity event: the target policy, the owner and the actor, never a claim code. Before, the only record was the grant row itself, deleted 90 days after it ended.

A reach grant's backing network is now torn down whichever path ends the grant, and stays guarded until it is cut. Before, after a re-ensure or before the reaper's next tick, another org member could bind it and reach the owner's target.

Settings no longer presents Data region as a residency choice: it says nothing in the platform acts on it yet. The Crypto-delete line says the flag is not read, and that purging a deleted org destroys its key either way.

The governance fields dataRegion, operatorAccess and cryptoDelete are documented as stored but not enforced, on both the settings and the patch shapes. Their behaviour is unchanged.

An act addressed by a role, text, label or placeholder locator now reports receipt.matchCount, how many elements that locator matched. Over 1, an A_LOCATOR_MATCHED_SEVERAL advisory on the delta names the element used and the others.

The act and credential fill tools publish receipt.matchCount in their output schemas, and the selector description says where the count and the advisory appear.

Filtering the session list by the completed status now returns every session the API reports as completed, including older ones stored under the legacy value ended, which the filter used to miss.

Both session list endpoints now declare their query filters. A status other than live, completed, failed, queued or draining is a 400 instead of an empty list, so a mistyped status no longer looks like no sessions.

CredentialKind no longer describes mailbox as a working email-code fetch. It says the kind was retired on 2026-07-14, is refused at create, and stays in the enum only so older credentials still read.

Filling a stored mailbox credential is still refused, but the error now says the kind was retired and will never fill, instead of suggesting a resolver ships later. Other kinds keep their not yet fillable error.

The sign-in approval page, the reach refusal receipt and the declared-hosts error no longer show 13 to 45 spaces in the middle of a sentence. The ruled words of the receipt are unchanged.

The daemon's could-not-determine-a-control-URL error reads as one sentence again.

The docs, READMEs and agent guides now write nightjar, nightfall and the other Bitspark projects exactly as their repositories are named, following the Bitspark naming rule. Quotations and verbatim records keep their original spelling.

A new advisory CI job runs the vendored Bitspark naming check on every pull request, after a control that proves it flags a planted misspelling by name.

Console copy, page titles and the logo's accessible name now write the product as nightjar, following the Bitspark naming rule. HTTP header names such as X-Nightjar-Org are identifiers and are unchanged.

The docs site's pages, navigation and llms.txt write nightjar. One error line keeps the capital, because it quotes the tunnel's output verbatim and that output is unchanged.

The npm package descriptions and source comments of the SDK, the API types, the design system and the UI components write nightjar. No exported name or behaviour changes.

The nightjar CLI's command help, error messages and remediation hints now write the product as nightjar, for example: Cannot reach nightjar server. Error codes and exit behaviour are unchanged.

Five MCP tool descriptions now write nightjar: the egress argument of session_start and spawn_and_start_session, and console_log, network_log and local_reach_ensure. No tool name, argument or behaviour changes.

The ten numbered design-phase documents under docs/architecture now open with a banner saying they are a narrative frozen on 2026-06-13, and point to the current domain model and the ADR index instead.

receipt.commandSpanId is now present on act receipts and equals the _commandSpanId of the requests the act's verb started, so an act can be joined to its traffic in network_log. It was declared but absent on every act.

The act and credential fill tools return receipt.commandSpanId, and its description no longer says it is not yet delivered.

CLI output and errors that the CLI builds itself, such as the doctor report, surface probes and tunnel start-up errors, now write nightjar. Exit codes and error codes are unchanged.

The OpenAPI document is now titled nightjar API, and error messages the node and control plane return, such as tunnel refusals and session id validation, write nightjar. Error codes are unchanged.

The instructions the MCP server sends to a connecting client now open with nightjar hosted browser. No tool, argument or behaviour changes.

Migration 0076 respells the seeded nightjar-cli OAuth client's display name from Nightjar CLI to nightjar CLI, so the operator's list-oauth-clients output matches the Bitspark naming rule.

The consent, OOB copy and device approval pages used to say Claude Code for every OAuth client. They now name the client itself: a first-party client by its name, and a self-registered client as an UNVERIFIED application with its client id.

A dynamically registered OAuth client name is now refused if it contains any Unicode Default_Ignorable_Code_Point, such as variation selectors, tag characters or Hangul fillers, besides control, bidi and zero-width characters.

Descriptions in the published /v1 OpenAPI document now write the project name as nightjar, matching its repository. Only prose changed: no schema, field, header or operation id moved, and X-Nightjar headers keep their names.

GET /v1/sessions and GET /v1/sessions/page accept an identity filter, the identity's id. Combined with live, it lists the live sessions an identity's teardown must end, instead of listing every session in the org and filtering client-side.

SessionFilter gains identity, sent by sessions.list and sessions.listPage; the mock client filters on it the same way.

A script author asking what nightjar returns on failure had nowhere to look: CLI_REFERENCE.md is generated and has no exit-code section, so the contract lived only in main.rs. Now stated in command-architecture.md.

2,654 lines sat inside markers declaring them installer-managed, but 97 percent existed only here. An install would have destroyed about 1,900 lines of nightjar rules. That content moved out; AGENTS.md drops 169k to 126k tokens.

The Git workflow section was 6,976 lines with ZERO sub-headings, so the file's own advice, enumerate the headings, could not work on the file. 58 headings added at real topic boundaries. Provably zero content change.

A tool description over 2048 chars is cut by the client and the tail reaches no agent, with no error anywhere. Five of 39 exceed it. A guard now freezes those five as debt and blocks any new one.

Eleven register rows are now probed every six hours and written to a generated file. The register's subject changes without a commit, so no merge gate could ever have seen it drift.

Every probe carries a control whose expected answer is the opposite of the real probe's, and a failed control marks that row VOID rather than letting it read as a value.

Every Caddyfile apply has refused since 2026-06-29 because the remote Caddy lacks the rate-limit module, and no surface reported it. deploy.sh now runs a read-only edge check after a deploy, and verify-edge.sh runs alone.

About 2 MB of Rust doc-comment prose shipped without cargo doc ever running in CI, so no cross-reference in it had been checked. The first build found 97 unresolved intra-doc links. An advisory job now builds the docs and classifies them.

ADRs carry a generated Referenced by block, drift-gated in CI. ADR-018 said it supersedes ADR-002 and ADR-006; neither of them carried a single reference back, in the direction a reader travels.

Three networking relations are now declared rather than implied, so they render as labelled backlinks: ADR-018 supersedes, ADR-021 extends, ADR-035 reframes.

The CLI derived the daemon control-channel URL by adding one to the API port. That cannot work against a hosted deployment, so it asks the server instead, at a new public endpoint.

The CI filter already fired on ui, core and deploy markdown, so the gate ran and reported zero drift about files its graph did not read. It now scans the same roots as its sibling link checker.

A generated backlink stated its relation in the referrer's voice, so a superseded ADR was labelled as the one doing the superseding. The label now inverts for the target.

The guide described the cloak gate only at session start (the url must be a declared advisor origin). It now says the same gate narrows every request, so a login hop to an identity-provider host fails unless that host is declared too.

An identity lease keeps the session and the lease, not the tab: the node closes an idle session's browser 30 minutes after its last session verb; lease renewals do not count. A captured auth-state version is never promoted automatically.

Choose Chrome or Cloak in the New session dialog. Cloak shows organization availability and requires a valid start URL; Chrome remains usable if availability cannot be checked.

Human org admins can take over sessions and identity leases using their membership authority. API keys keep their own scopes, modes, and identity grants.

A successfully adopted controller is carried on subsequent calls for that session, including navigation and remote input. Tokens stay in client memory and are cleared on release.

Take control establishes one lease for navigation and remote input. Key creation shows execution mode and offers explicit workflow presets.

The credentials guide (both twins) now says only exclusive is enforced at session-open: fork and readonly are stored and echoed read-side but not wired, and openModes echoes the stored default rather than reporting a capability.

identity_list_assumable and the server instructions now say provisioning (create identity, store credential, grant) is REST-only, name the routes and scope, point at the OpenAPI spec, and flag that openModes is an echo, not a capability.

The IdentityCreate defaultOpenMode description in the v1 OpenAPI spec now says only exclusive is enforced at session-open; fork and readonly are stored and echoed but not yet wired.

The credentials guide twins, ADR-011, ADR-009 and open-questions Q24 now record the 2026-09-12 decision: only exclusive is enforced, fork and readonly are not planned, and consumers multiplex their actors onto one session per identity.

The OpenMode, Identity.defaultOpenMode, IdentityCreate.defaultOpenMode and AssumableIdentity.openModes descriptions in the v1 spec now say only exclusive is enforced by decision, and that fork and readonly are stored, inert and not planned.

identity_list_assumable now says only exclusive is enforced by design (one live session per identity; multiplex your actors onto it) instead of today, so no reader plans around a mode that is not coming.

The New identity form's open-mode hint now says fork and read-only are not planned and exclusive is the only mode, by design, instead of not enforced yet: one live session per identity, actors multiplexed onto it by the consumer.

The MCP surface lets a caller consume an auth-state version and mint none: capture is v1-only by design and promote was deferred. The description now says so, rather than pointing an MCP caller at a tool absent from their surface.

Following a console link while signed out, such as one that opens the new key form, now brings you back to that page after you sign in, instead of to the start page.

The result contract and the getting-started guide told integrators every model-exit read is secret-shape-floored. That floor was removed 2026-08-07; floor_secret_shapes is now the identity function. Both now say so.

The ADR index listed 31 of 56 ADRs and was diverging. All 56 now have a row, and a new guard fails when an ADR has none or a row names a missing file. Five dangling wiki-links, six dead path claims and one broken anchor are also fixed.

The published glossary described both authority planes as credential mechanisms, and claimed captured network logs are filtered for secret values. Neither was true.

The external-state register was falsified 57 minutes after its own last edit and stayed wrong for 16 days across six rows. It said two npm packages were broken and burned when both were fixed and healthy.

check-doc-links reported zero broken links over 173 files while the repo's only broken link sat in the 34 files its roots could not reach. Widened to 204 files; it then caught the link, which is also fixed.

Two ratified ADRs carried self-expiry clauses that fired on the npm publication and were never pulled. ADR-024 still said the packages were not published while they sat at 0.1.5 and 0.1.3.

The root README now names the four doors a consumer can attach to, the ADR index lists all 56 ADRs instead of 31, and the architecture index reaches the ten sibling directories it never mentioned.

The published getting-started page told consumers ADR-035 was awaiting ratification, two months after it was ratified. The unpublished in-repo twin had it right.

The published intranetMode description said toggling it does not yet change session behavior. It has governed all private tunnel reach since v2026.06.28.1, so the contract told org admins the opposite of the truth for nine weeks.

Networking docs now carry forward pointers. ADR-002 and ADR-006 named none of the three later ADRs that changed them, and the architecture index mentioned ADR-018, ADR-021 and ADR-035 zero times.

The published guides said local reach has no CLI and was awaiting ratification. The tunnel command ships and the ADR was ratified on 2026-07-01; only the signed installer is unbuilt.

The GitHub sign-in entry points were classified as rate-limited and never actually were: they sat one layer outside the limiter. They are inside it now, so repeated sign-in attempts from one address get a 429 like every other public route.

core/docs/configuration.md calls itself the canonical reference for the environment variables the node, daemon and CLI read. It named 35; the runtime reads 72. The 37 missing ones are now documented with defaults read out of the code.

The daemon:files scope described itself as 'List and stat files' while also reading file content and writing files to the caller's local disk. Granters saw a read-only description for our broadest local-disk capability.

The published ActVerb description listed eleven verbs while the enum carried thirteen, so a client reading the spec could not discover fill or select. It now points at the enum instead of restating it.

The OpenAPI contract described inline clipboard capture as a usable return mode and its result field as sometimes populated. Both are refused with a 400, so the descriptions now say so.

A new request kind lets an agent compute a config change, render its diff and file it for ratification. Preparing grants nothing: the record is inert until someone with the authority acts on it.

Adopt mints the controller token onto a RESPONSE header; renew and release expect it back on a DIFFERENT REQUEST header. Renew never named it and neither declared it. All three endpoints now declare their required headers.

POST /v1/config-change-requests now accepts only declared change classes. Filing an unrecognised target returns 400 and names the classes that are allowed, instead of queueing a request that no one could ever apply.

A new guide tells app authors what App Surface protects today and what is only decided. The headline: there is no consent gate or scope check on import, so reachability to the node is the authorization.

Renewing the identity lease on a controller-owned session answered 'session is not identity-bearing' and stopped. True, and it reads as 'no renewal exists'. It now names the CONTROLLER lease and its renew verb.

Direct egress blocked by the SSRF guard said only 'private address'. True, and it left the caller nothing to act on. It now names intranet_mode and the declared-hosts allowlist for the classes where that is the sanctioned path.

One error variant covered two different gates with two different remedies, so a refusal could not name a correct next step for either. It now carries which gate refused and names that gate's remedy.

Console dialogs now use the adopted design system's three-step size scale and its dialog chrome: a header band with an explicit close button; widths converge on sm/md/lg.

A website merge used to trigger the console deploy, ship nothing of the site and report green. A dedicated workflow now runs the sanctioned script and asserts the live stamp, and the console filter no longer matches the website.

The MCP surface now exposes whoami, which returns the calling credential's own orgId, agentId, keyId and scopes.

The generated tool-surface reference now reports capability coverage across http, mcp, cli and sdk, with the tools it cannot represent counted beside it.

Where a surface declares a scope ruling, the matrix now cites it beside the coverage figure, so a non-exposed state is not misread as debt.

The generated reference now records D9's per-capability sheets and effects/safety view as deliberately deferred, each with the condition that would revisit it.

The governance panel described crypto-delete as destroying per-session keys. It destroys per-org and per-credential keys.

The tool surface named profile-maintenance and runtime-admin as the authority for artifact collection. Those are node-side arms with no control-plane analogue, so an agent looking up the scope it needs found names that do not exist there.

A key minted by approving an access request took the database default and granted raw drive. It now binds the same delegation_required default as every other mint path.

An org that opted into agent self reach could mint a reach:self key but never rotate it, because rotation demanded a scope the template exists precisely not to require.

A key minted without an explicit mode now gets delegation_required instead of direct, so it cannot drive a session by its own raw presentation. Existing keys are untouched and keep the mode they were minted with.

Declaring a reachable host that cannot be parsed used to be accepted and then discarded. If it was the only entry the allowlist became empty, and an empty allowlist is permissive, so the one rule you declared quietly became no rule at all.

A new org-scoped endpoint reports which advisor origins your sessions were refused, so the person editing the declared set can see what is missing.

Declaring an advisor origin without a scheme now returns 400 instead of being stored as http://HOST — a form that could never match an https advisor session, because the comparison is exact on scheme and port.

Server-side traces for a refused request now carry the acting key id, so a 403 can be joined to the caller rather than only to the scope and the request.

Both app READMEs claimed a console deploy happens automatically. No deploy secret exists, so that workflow gates every real step behind an arming check and goes green having done nothing. Neither app has a live auto-deploy.

AGENTS.md said a session-UUID scratchpad path carries your own handle. On a resumed session it need not track the running session at all, so the first 8 characters can name a live registered peer instead of you.

The governance tab now lists advisor origins that were recently denied, directly under the field that declares them.

The download-to-artifact tool now explains why an agent cannot reclaim its own artifacts, instead of only stating that it cannot.

A wildcard advisor origin was honoured when the browser fetched a page but refused when the session started, so half the declaration worked and nothing said which half.

The planning draft said concepts had no public glossary. One is deployed and defines all five concepts the clause named, so the claim is struck in place.

A declared advisor origin can now use a leading wildcard label and will match any subdomain. Previously only an exact host matched, so a provider that generates hostnames could break a cloak session with no config change on your side.

The session-ended journal event now carries a typed cause beside its human reason, and a session drained by a redeploy closes the events socket with 1012 instead of 4410.

nightjar mcp install points a repo's .mcp.json at a saved login, and replaces an older entry that carried an Authorization header in the same write.

The docs app now carries a README saying a merge to main does not reach the live docs site, and how to verify a change actually shipped.

The public website app now carries a README saying a merge there triggers the console deploy, goes green, and ships none of the site.

Thirty-two OpenAPI descriptions shed their rationale paragraphs, which now live verbatim on two concept pages. Each field keeps a one-line pointer.

The changelog contract job now fails a PR that declares no position at all — neither an entry nor the changelog:none label.

act upload issues CDP SetFileInputFiles, so it cannot observe whether the page accepted the file - but the description never said so, and consumers read SUCCESS as attachment. It now states the limit and names the discriminating field.

The uploadedRefs receipt said the refs were ATTACHED. They are the refs the verb resolved and set on the file input, before the page is handed anything - so a page-side upload failure is invisible to the caller.

The concept page's closing section named three destinations in bold prose with no links. All three are now links, and each target route was verified to exist.

The rationale moved out of the spec is now grouped by what it protects you from, and sits before each page's closing section rather than after it.

An agent could file an access request for reach:self and no human could ever approve it. The approve gate checked the scope against the approver's own ceiling, and reach:self appears in no human role, so the click always failed.

On the OAuth sign-in leg, a present-but-empty X-Nightjar-Org header made a multi-org operator see an error telling them to set that same header, instead of the org picker.

The provenance scan's time budget now reads a runtime clock at its three enforcement sites, with a test pinning that production behaviour is unchanged. The bound itself remains untested, and the reason is recorded in the source.

The default-off test used remove_var, pinning the unset case. Deployment passes an empty string, which nothing pinned. Adds that arm, and fixes a lock that let the two tests race.

The declaredAdvisorOrigins description now states that the set bounds subresources, not just navigation, and that host matching is exact with no wildcards.

The spec's doc comments point at the concept pages, but no concept page pointed back. All four now link to the API reference, in prose that already named it.

A governance field that can be changed by API but has no control in the console now reds CI, unless it is exempted with a written reason.

Data governance gains an editor for declared advisor origins, the field that previously had no console control at all.

An SSRF denial on the direct egress route bumped its counters but emitted no EgressAuditEvent, so the same security event the tunnel-floor deny journals was invisible per-session on that route. It now emits one.

A session closed by a node redeploy recorded nothing at the time, and was later reported as abandoned - which says the client went stale when the host had actually restarted.

The docs site gains two explanation pages: the deliberate refusals and the reasoning behind them, and the category corrections where a name suggests one thing and the system means another.

Sessions using split or platform egress were launched without a proxy, so their direct traffic reached the cloud metadata address unscreened. They now run through the same chokepoint every other route uses.

Nineteen schema descriptions in the published spec began with an internal issue number. The number moved into a source-only comment; the description now opens with what it describes.

A test reached the process-global diagnostics context through a production dispatch without taking the test lock, racing the tests that did.

The How Nightjar works section now lists What Nightjar refuses and What these things are not, between How it works and the Glossary.

SDK-versus-spec coverage is now a machine-checked number instead of a snapshot someone remembered to re-run.

The node's shutdown drain gave up after 8 seconds even though the container allows 60, so a redeploy killed sessions it had time to close cleanly.

Code citations in the credential guides now name a module and symbol instead of a file and line, so they stay true when the file changes.

The credential security guide no longer cites code by file and line. All 35 pointers are now module and symbol names, checked against the source tree on every CI run.

The 'How Nightjar works' section now contains an explanation, not just a glossary.

Signing in to an application while your account belongs to several organizations now shows a page asking which one to use, instead of an error naming a header a browser cannot set.

The API reference said targets do not exist yet. They do - a run simply cannot be bound to one.

Three fields the API returns are never populated. The reference now says so, and says why.

The multi-organization sign-in page no longer tells you to run an approval from the CLI. That step does not exist on this flow, so the message now says plainly what happened and what will actually work.

The dedup guidance listed two ways an issue can pass every structural check and still not be takeable. Four screens in one day found four reasons, and two of them were new.

The node now gets 60 seconds to drain its browser sessions on redeploy, instead of the 10-second default that killed the drain part-way through.

The SW6 seat keeps a list of times it measured something correctly and published it wrongly. Two more were added, along with the condition under which it happens.

api-types is generated from the OpenAPI document and the WS event schemas but shipped no record of which revisions it came from. It now stamps both, so the release check can say a bump is due instead of reporting NOT APPLICABLE.

The marketing site carried no link to the documentation at all. It now closes with one, so the explanation layer is reachable from the front door.

The docs sidebar group Concepts is now How Nightjar works, at the same rank, so it reads as an argument rather than a cabinet of terms.

Reach grants and Identities now carry a contextual link into the docs, naming the question the screen raises rather than sending you to a docs front page to search.

The credentials guide said the MCP surface was a closed set of exactly 9 tools. It is 38. Both numbers now render from one validated selection, and CI refuses a tool table that has drifted from it.

The API reference now says which Run fields are always null today, why, and what would change that.

The reclaim report reads a nullable column into a non-Option String and is safe only because its query filters the NULLs out. That filter now has a regression test instead of a comment.

AGENTS.md prescribed a count floor for merge watchers. A job whose dependencies have not resolved is never created, so it cannot be incomplete, and the floor passes straight over it.

Provenance and session-replay reads now tolerate a session whose profile column is null, instead of failing the whole request.

Every scan-backed provenance response reports how many sessions it read, the cap, and which bound ended the scan.

ScanExtent and ScanCompletion are exported so a client can branch on why a scan stopped.

AGENTS.md now records the collision class where a new test suite breaks a neighbour's global-count assertion, and why seeding-side fixes relocate the problem rather than removing it.

AGENTS.md told you to verify your own address with a bb send --dry-run. That proves a handle exists, never that it is yours, so the check returned a clean pass on a peer's identity.

An opt-in control worker logs what a profile-store reclaim would remove, reconciling the node's directory list against session records. It deletes nothing, and cannot: this build has no delete capability at all.

The node now shuts down on SIGTERM, and drains live browser sessions before stopping — under a time budget, so it exits cleanly inside the container grace period.

POST /v1/artifacts/provenance takes a list of content hashes and answers one entry per hash. A hash nothing produced comes back as an entry with an empty set, never a 404, so absence stays a usable answer.

The workspace jail end-to-end suite now pins the shape of the act success and refusal envelopes against committed fixtures, so an unannounced field addition or removal fails CI instead of shipping silently.

Artifact provenance gains an optional processing field: raw, derived or unknown. Read it together with direction.

A new v1 route resolves a command span id to its occurrences: the verb, the outcome, and the artifacts it touched.

The SDK gains commands.provenance, mirroring the existing artifacts.provenance.

A new projection_search tool asks which subtree projects to a given sha256 — the inverse of the projection-hash check that wait and act already carry.

Captured auth-state versions older than your organisation's retention preset are now reclaimed. The active version is never removed, nor is one a live session could still resume from.

The artifact tool descriptions told every agent that no hosted surface exposed a collector. That stopped being true when POST /v1/artifacts/collect shipped, so the text now names the endpoint and the authority it needs.

The v1 API can now ask which subtree projects to a given sha256 — the inverse of the projection-hash check that wait and act already carry.

act and credential_fill declared their delta with no type at all. The wire carried 28 fields and 6 closed enums that no generated client could see.

The controller idempotency table now has a reaper. It was the fourth ticket store and nothing had ever deleted from it.

An Idempotency-Key reused long after its retention horizon now re-executes instead of returning an expired error. Well before that, the error is unchanged.

Run status is computed on read, and its "this run never had activity" test asked whether the sessions and connections tables were empty. Once retention reclaimed those rows the test passed again, so a finished run looked new.

POST /v1/artifacts/collect runs the node's reachability-based artifact sweep for one profile and returns what it collected.

A same-document navigation workaround is pinned to the chromiumoxide version it was reasoned against, so the next upgrade fails the build instead of quietly outliving its cause.

The provenance oracle now reports a direction for each artifact plus the command span that minted it. Direction is derived from a closed verb set and reports unknown rather than guessing when the verb cannot determine it.

The node can now answer which subtree projects to a given sha256, the inverse of the projection-hash check that wait and act already carry.

act with verb upload now returns the artifact refs it attached, on the receipt. Proving N files are attached no longer means finding N chips in a perception digest that is capped and gets denser as N grows.

The SDK reach namespace lost its docs when artifacts was inserted between the comment and the member it described. Hover and the published types showed nothing, including the note that claim is excluded on purpose.

The perceive output schema said its perception field was passed through verbatim. That is only true in full mode, and the default is compact.

The 12 keys the renderer adds to perception are now declared and documented, so clients can read the shape they receive.

The provenance route's docs presented two causes of an empty answer as the complete set and called the ambiguity a security property. A third cause, the 500-session scan bound, is a completeness limit and now says so.

artifacts.provenance(hash) resolves a content hash to the sessions that produced it, with the verb, page and time.

The transport reaper tore down a crashed session's browser without first asking the node for its recording, so an opted-in capture was left unsealed and unindexed - and therefore unreadable.

The download-to-artifact endpoint promised that artifacts are garbage-collected with the session. Nothing collects them at session end.

The download_to_artifact tool carried the same false guarantee. An agent read it, ended its session, and nothing was collected.

A revoked or expired session capability row had no release path at all: only deleting the organisation removed it.

Every MCP host recipe now leads with nightjar auth login. Carrying the key in an environment variable or header template is marked deprecated, with the incident that motivated it as the reason. No recipe is removed.

The retention sweep deletes oauth tokens past their expiry whose grant is already revoked. An expired token under a live grant is kept: revoke reads it with no expiry filter, so deleting it would make revocation a silent no-op.

One mock-node helper served two opposite expectations through a single timeout, so the deadline expiring was the PASS for four denial tests and the FAILURE for the arm that proves them non-vacuous.

A revoked or expired reach grant stays in the owner-scoped list for 90 days after it became terminal, and its row is then reclaimed.

Retention keyed on session status, so it reclaimed idempotency tickets that the API would still serve replays for. It now keys on the handler's own reachability condition, and sweeps the fill-credential store too.

The egress-audit drain kept one dedup set for the whole node process, keyed by session and never pruned, so entries outlived the sessions that produced them.

'nightjar auth login NAME' signs you in by device flow and saves the credential to an owner-only local store under a name you choose. Nothing is typed at a prompt and no token is passed on a command line.

The OAuth token response now names the binding it minted: the org and agent ids, plus their display names when the deployment has them. All value-free ids, never secret material.

The reaper's candidate query joined identity leases, so a session that never assumed an identity could never be a candidate for reclamation.

A new provenance read on the /v1 artifacts path answers which session minted an artifact, with which verb, against which page, and when.

The retention sweep now deletes transport_connections rows that no live session can still be reaped through.

Every operation declares whether it needs the server; the CLI reads that instead of a denylist of one.

Each MCP handshake now records its outcome per API key, so a connect-failure rate is one security-log query instead of a day of log forensics.

The Drive panel's selector inputs said "CSS selector", but the value is resolved with the full eight-form locator grammar — so seven forms were advertised as unavailable.

journal() and journalWithMeta() take an optional args object, so a caller can narrow a recorded journal by sequence cursor, time window, or verb instead of fetching all of it.

consoleLog() and networkHar() take an optional args object, so a caller can narrow by cursor, tab, level, URL, method or status range instead of refetching everything to poll.

Taking, releasing, force-releasing and reaping an identity lease now each write an event.

Credential store errors now say credential rather than profile, which had three other meanings a reader could land on.

ActReceipt now carries commandSpanId - the same key network_log entries publish as _commandSpanId - so a client can go from an act straight to the traffic it provoked.

A troubleshooting section stating which error field rides which path, and where to read it.

Corrected a module header that described the MCP error result as carrying only a code and a message.

Each network_log entry can now carry _commandSpanId - the command span in flight when that request STARTED - so act-caused traffic is identifiable without matching timestamps.

The journal and session-activity reads take since and until, so you can ask for the window a session misbehaved in instead of paging from a cursor.

Journal events now carry the tab they belong to, and the journal read takes a coarse verb filter.

V1Error.code now documents that it carries the RENDER token, and which field the same token rides on the other paths that emit a Nightjar error.

Sixteen selector flags said CSS selector while accepting eight locator forms; four that really are CSS-only were left alone.

Nine docs sites that said OAuth login now say remote-MCP OAuth login, so the shipped host flow stays distinguishable once nightjar auth login adds a second one.

A Today page that cites a symbol now fails CI if that symbol resolves to no source file.

Session artifacts now carry the page URL they were minted against, captured best-effort at mint time.

A repo can now declare its MCP entry as a command that names a saved login, rather than an HTTP entry carrying a credential in a header template.

0.1.0 reached the registry uninstallable, because npm publish neither applies publishConfig nor rewrites a workspace range. The tree is fixed for 0.1.1, and a prepublishOnly guard now refuses the wrong publisher.

The published guide said a grant can never carry a write or admin scope. Since the owner-consent addendum an owner may consent to one, so the guarantee was false in the reassuring direction.

api-types 0.1.0 shipped with a correct manifest and an empty tarball, so the SDK installed and imported but failed every consumer tsc. The guard is now shared, and prepublishOnly builds first.

The credential-security guide now states the store root, the NIGHTJAR_CREDENTIALS_DIR override, and why an unset home is an error rather than a fallback.

The OAuth token response gains two value-free extension members: a credential id that is stable across refreshes, and a token instance id that is new on every refresh. Both are ids, never secret material.

Claiming a reach grant now revokes the join tokens it supersedes, so an older secret stops authorizing a daemon join the moment a newer one is issued.

Opening the credential store now locks and checks its directory first, and refuses rather than proceeding when it cannot.

The stdio MCP proxy re-reads its credential per request, sends it only to the profile's pinned origin, and reports which credential it attached without ever printing it.

The credential security model now covers where an agent's own platform credential lives on disk, and what the file backend guarantees about it.

The changelog gate read an elliptical arc's flags and radii as coordinates, so any motto drawn with a curve failed the safe-band check wherever its art actually sat. Path data is now parsed per command.

Adding a crate to the workspace without a matching COPY line in the node Dockerfile now fails a lane-tooling arm that names the crate, instead of failing the image build much later.

Pasting a Nightjar key where a saved login name belongs is now refused, instead of being repeated back inside the error message.

A bracketed IPv6 literal without a port was refused, because the authority was split on its last colon and an IPv6 address carries colons inside the host.

The underscore enters the summary allowlist, so an entry can write NIGHTJAR_REQUIRE_DB_TESTS instead of circumlocuting it. Headlines keep the narrow set and stay scannable at chip size.

Pasting a credential where a profile name goes no longer puts it into an error message, and so into every log or screenshot that captures one.

The live contract now carries the rule for declaring changelog:none when no component fits, so an author meets it where they already look.

ADR-056 decides the agent credential binding: a local multi-profile credential store consumed by a stdio MCP proxy that attaches authorization at request time, replacing the env-var Bearer header pattern that cost a five-hour incident.

Opening a request deep link while a different org is active told you the request was already resolved. It now says only that the request is not in this org's queue.

When a capture refuses because it cannot find your text, it now says whether the page rendered or not.

The expected build can now be given as any ref, resolved internally, instead of a copied commit id. A ref has nothing to transcribe, and a bad one is reported as a caller error rather than as a failed deploy.

When the CLI cannot reach a server it now names the hosted platform URL as well as the local options, so a first run against the cloud does not fail with only localhost advice.

Three reach tests asserted on the reaper's batch report instead of on the grant they were testing, so a required postgres check could fail with a zero-scan signature.

The changelog contract gains a cli component, so a change to the command-line tool can be classified as what it is instead of borrowing a neighbouring slot.

Four assertions in the transport reap suite compared a globally-scoped batch counter, so a sibling test's candidate could red a healthy run while never asserting anything about the row under test.

CI now type-checks every crate that contains Windows-only code, instead of skipping it in silence.

A session credential now carries a stable id and a per-refresh instance id, instead of one id that conflated them.

POST /v1/reach/ensure accepts remintClaim. Declare it and the outstanding claim code is revoked and replaced atomically; omit it and repeated polls reuse the live code exactly as before.

The local reach ensure tool gains the same optional remintClaim argument, defaulting to false.

On Windows the credential store's files are now restricted to their owner, and the restriction is read back and proven rather than assumed.

A spec drift check could fetch its baseline from the wrong commit and report no drift forever, without ever failing.

Approving a pickup grant now shows when the collection window closes, instead of only saying the agent will fetch its own key.

A new repo-root reference, WORK CONCEPTS, explains how work is modeled: the units of design, work, planning, tracking, specification and memory, their relations, and which concepts are materialized versus convention versus implicit.

The changelog page now carries the two releases that predate the per-PR system, under a Before the per-PR system section, and the root file is a dated pointer rather than a second source of truth.

changelog-capture takes the console screenshots this changelog has required since day one, and refuses rather than write one it cannot vouch for.

It refuses an over-size capture before the browser starts, with the arithmetic and a remedy.

A guard now keeps an annotated review list of every path built from chained join() literals, and fails only on one whose segments could compose a path the CI filter drops.

Inline links in docs prose are underlined, so they are distinguishable without relying on colour. Nine of twelve pages carried this, and it was the only serious accessibility violation on the whole site.

The docs site is now covered by the accessibility job, which previously ran two other apps and had no test files at all for this one.

The agent-key template's opt-in condition now has a negative arm on the mint path: an org that has not enabled agent self-reach must never be handed reach:self.

The entry-contract check now writes its advisories to the run summary, where they are visible without opening a log.

Running the check on your own machine now says that it did not look at whether this branch owes an entry.

The 201 from POST /v1/keys now carries templateApplied, plus a closed-enum reason when the agent-key template was eligible but something blocked it.

A deploy can now be checked against the build it shipped, rather than against a 200. Both sites answer 200 on every path, so the old check could not tell a current site from one serving an old build.

An inline link in a block of text no longer relies on colour alone to be recognisable as a link.

Every reference on the public changelog page that pointed into the private source repository is now plain text, so a visitor no longer clicks through to a login wall.

Approving an access request now reads the receipt before deciding what to show, instead of always revealing a secret.

Sending a malformed body to the key-mint route now returns the normal error envelope, which names what was wrong. Previously the rejection arrived as a bare 422 with no envelope, so the explanation was discarded before the caller saw it.

A finalize script promotes your draft into its PR directory and stamps the number.

A changelog-entry skill covers the fields, the prose rules, and how to draw a motto.

The three browser-facing legs of the device-approval flow now render a titled HTML error page instead of the API's JSON error body.

The docs site gained a changelog page that renders every shipped entry, newest first, with its drawing.

A screenshot withheld because a secret field could not be safely redacted now reports its outcome certainty as a confirmed failure, not as an operation that never started.

The same corrected certainty is visible to MCP clients reading the error envelope of a suppressed screenshot.

Following a device sign-in link while signed out used to drop the code and leave you on the console with nothing to approve. The approval page now renders after you log in.

If you belong to more than one organisation, the approval page now asks which one to approve as, instead of returning an error that named an HTTP header.

A banner appears when the console you are running is not current with the shipped changelog, and links to what you are missing.

The device-grant approval leg is now exercised end to end against a real control and a real postgres, covering the six states a fixture can hold honestly.

Every PR now ships a small illustrated changelog entry: what changed, who it affects, and a drawing.

A CI gate validates every entry: schema, filing, prose, illustration and screenshots.

An access request actioned by a signed-in human now records that person, not only the key they acted through. A row names a key approver or a human approver, never both.

Filing an access request with a misspelled field now fails with a 400 that names the offending field. Previously the unknown field was ignored and the request was accepted, so a typo produced a scopeless request that looked like success.

The create and status responses now echo back the scopes and delivery mode as recorded, including the defaulted delivery mode, so a caller can confirm what was actually stored.

Rotating an agent credential no longer moves a secret by hand. The operator initiates the rotation, and the replacement is minted only when the key itself collects it.