v2026.3.76

Added

• Agent Unification (T170): Unified cleo agent CLI with 10 subcommands (register, list, get, remove, rotate-key, claim-code, watch, poll, send, health)
• Agent Registry: agent_credentials table with AES-256-GCM encrypted API keys (machine-key bound, per-project derived)
• Conduit Architecture: ConduitClient + HttpTransport + factory (2-layer Transport/Conduit pattern)
• Transport interface: connect/disconnect/push/poll/ack/subscribe in @cleocode/contracts
• AgentCredential + AgentRegistryAPI contracts: typed CRUD for credential management
• @cleocode/runtime: AgentPoller with group @mention support (fixes peek blind spot)
• 5 Rust crates migrated: signaldock-protocol, signaldock-storage, signaldock-transport, signaldock-sdk, signaldock-payments (5→13 workspace crates)
• Diesel ORM foundation for signaldock-storage (schema.rs, models, consolidated migration)
• diesel-async 0.8 with SyncConnectionWrapper for unified SQLite + Postgres adapter
• Conduit dispatch domain (5 operations: status, peek, start, stop, send)
• cleo agent watch command for continuous message polling
• cleo agent claim-code command for ownership verification
• cleo agent health command (merged from deprecated cleo agents)
• TypedDb pattern with drizzle-orm/zod validation schemas
• CANT DSL epic complete (T202): 694 tests, 17K Rust + 3.8K TS, 3 new crates (cant-napi, cant-lsp, cant-runtime)
• Crypto hardening: version byte in ciphertext (F-006), HOME validation (F-002), key length check (F-004)

Fixed

• E-FIND-004: ACL denial now audited + projectPath redacted in nexus/workspace.ts
• AgentRegistryAccessor: pre-flight checks on update/remove (C1/C2), deterministic getActive ordering (H3)
• HttpTransport: since param now passed to peek endpoint (H5)
• ConduitClient: connect() transitions to error state on failure (H6)
• CLI agent key redaction safe on short keys (H1)
• CAAMP library-loader.ts TS2352 type cast fix
• workflow-executor.ts unused variable build errors
• Test assertions updated for conduit dispatch domain (10→11 canonical domains)
• Audit test mock updated for agentCredentials schema export
• Message dedup P0 fixed server-side by signaldock-core-agent
• Biome lint: 24 errors resolved (all types from @cleocode/contracts, zero any)
• Ferrous Forge: 4 violations resolved (cant-core file splits)
• CI pipeline: 5 layers of failures fixed (lint, lockfile, build order)
• AgentRegistryAccessor drizzle type mismatch (8 TS errors eliminated)

Changed

• Default API URL: api.clawmsgr.com → api.signaldock.io (legacy endpoint stays in parallel)
• packages/core/src/signaldock/ removed — replaced by conduit/ directory
• cleo agents deprecated — health monitoring moved to cleo agent health
• Conduit JSDoc updated: removed ClawMsgr references, documented Transport implementations
• DATABASE-ARCHITECTURE.md updated for Diesel as sole Rust ORM
• signaldock-storage traits split from monolithic mod.rs (432 lines) to 7 focused files
• Rust workspace version aligned to CalVer 2026.3.76

v2026.3.69

Fixed

• npm install: Use pnpm publish to resolve workspace:* protocol — npm publish leaked workspace references making npm install -g fail with EUNSUPPORTEDPROTOCOL

v2026.3.68

Added

• cleo check command group: cleo check schema|coherence|task — domain-prefix CLI access to check operations
• cleo admin command group: cleo admin version|health|stats|runtime|smoke — domain-prefix CLI access to admin operations
• cleo pipeline alias: Routes to existing phase command group

Fixed

• cleo add --dry-run session bypass: Dry-run no longer requires active session, orphan prevention, or acceptance criteria — no data is written
• Domain-prefix CLI routing: cleo check schema, cleo pipeline list, cleo admin version now route correctly instead of showing root help

v2026.3.67

Added

• cleo doctor --full (#79, T130): Operational smoke test — 13 probes exercise one read-only query per domain through the full dispatch pipeline, plus tasks.db integrity, brain.db connectivity, and migration state validation. ~100ms runtime, exit code 0/1
• cleo upgrade --diagnose (#80, T131): Deep read-only inspection of schema and migration state — validates required columns, migration journal entries, SQLite integrity, brain.db tables. Skipped steps now explain WHY with reason field

Changed

• Unified migration system (#82, T132): Shared migration-manager.ts consolidates duplicated reconciliation, bootstrap, retry, and column-safety logic from sqlite.ts and brain-sqlite.ts — ~170 lines dedup
• Upgrade output: UpgradeResult now includes summary (checked/applied/skipped/errors) and reason on skipped actions
• Admin domain: New admin.smoke query operation (tier 0)

Fixed

• Doctor/upgrade opts merging: citty-parsed command-specific flags (--full, --diagnose, --detailed, etc.) were silently ignored because action handlers called parseGlobalFlagsFromArgv() which only extracts global flags. Now merges both sources

v2026.3.66

Changed

• Config type safety (T128): EnforcementConfig + VerificationConfig interfaces wired into CleoConfig — eliminates untyped getRawConfigValue dot-path access in enforcement.ts, complete.ts, add.ts
• Retry dedup (T129): agents/retry.ts withRetry delegates to lib/retry.ts — single backoff implementation, dead sleep() removed

Fixed

• Facade domain count: Updated from "10 domains" to "12 domain getter properties" (agents + intelligence added in v2026.3.60)
• Missing barrel exports: Added AgentsAPI, IntelligenceAPI, getCleoTemplatesTildePath, updateProjectName to public barrel

v2026.3.65

Fixed

• Phases crash (#77): Full null guard in queryPhase() — listData.phases and listData.summary now use ?? fallbacks
• detect-drift user projects (#78): Detects CLEO source repo vs user projects. User projects get applicable checks only (injection template) instead of CLEO-internal source structure checks

v2026.3.64

Fixed

• Phases crash (#77): paginate() now guards against undefined/null/empty input arrays
• detect-drift false errors (#78): Uses process.cwd() as project root instead of walking up from the CLI bundle file location

v2026.3.63

Fixed

• brain.db migration (#65, #71): Journal reconciliation now correctly applied — was lost in v2026.3.62 due to git stash conflict
• --dryRun on cleo add (#66): dryRun flag now passed through dispatch domain → engine → addTask() core — previously silently dropped
• backup list side effect (#74): Query gateway handler now properly included in build — read-only listSystemBackups() prevents snapshot creation
• Help text leak regression (#76): Parent command run() now detects subcommand in rawArgs before showing help — prevents showUsage() from firing after valid subcommand output

Added

• session find CLI (#75): Re-added after loss in v2026.3.62 — dispatches to existing query:session.find MCP operation

v2026.3.62

Fixed

• Migration journal reconciliation (#63, #65): runMigrations() in tasks.db and brain.db now detects stale __drizzle_migrations entries from older CLEO versions (hash mismatch), clears them, and marks local migrations as applied
• Defensive column safety net (#63): ensureRequiredColumns() runs after every migration — uses PRAGMA table_info to detect and add missing columns via ALTER TABLE
• Issue command routing (#64): cleo issue bug/feature/help calls addIssue() from core directly instead of dispatching to removed MCP operations
• brain.db migration (#65, #71): Same journal reconciliation pattern applied to brain.db — unblocks memory find, observe, sticky, refresh-memory, and reason similar
• --dryRun flag (#66): cleo add --dryRun now returns preview with id: T??? before sequence allocation — no DB writes or counter advancement
• Labels empty output (#67): labels list marked as isDefault subcommand — bare cleo labels now invokes list
• Exists routing (#68): cleo exists calls getTask() from core directly instead of unregistered query:tasks.exists
• Critical-path routing (#69): cleo deps critical-path calls depsCriticalPath() from core directly instead of unregistered query:orchestrate.critical.path
• Silent empty commands (#70): Parent commands without subcommand now show help text via citty showUsage() — fixes 21 commands that returned zero output
• Sequence padding (#72): nextId in showSequence() uses padStart(3, '0') — returns T012 not T12
• Stats contradiction (#73): totalCompleted now uses audit log as SSoT (same source as completedInPeriod) for consistent metrics
• Backup list side effect (#74): Changed backup list from mutate to query gateway with new read-only listSystemBackups() function

Added

• session find CLI subcommand (#75): MCP operation already existed — added CLI registration with --status, --scope, --query, --limit options
• repairMissingColumns(): New repair function in cleo upgrade that reports missing column detection/fix

Changed

• Injection template: session find reference clarified to cleo session find

v2026.3.59

Added

• Agent health monitoring: cleo agents health — heartbeat, stale/crash detection (T039, 25 tests)
• Retry utility: withRetry() exponential backoff in lib/retry.ts (T040, 16 tests)
• Agent registry: Capacity tracking, specializations, performance recording (T041, 21 tests)
• Impact prediction: cleo reason impact --change <text> — dependency analysis (T043)
• Reasoning CLI: cleo reason why|similar|impact|timeline — CLI parity (T044)
• SharingStatus: Git sync fields for Nexus visibility (T110)

Changed

• Config vaporware audit (T101): Removed ~170 dead config fields across schema/templates/presets
• Strictness presets: Fixed phantom hierarchy.requireAcceptanceCriteria key (T107)

Assessed

• Nexus: Zero production usage — deferred to Phase 3 (T045)