Fast-fail with a shell steer before any prompt; docstring names the closed catalog
and stops citing semgrep (pip/brew, deliberately unmanaged) as an example.
More fold gains a Files section listing workspace/scratch/granted roots.
Roots open in the artifact viewer (Files breadcrumb); folder click-through was already there.
Gated sessions run workspace+scratch dual-root; artifact listing scans scratch only.
Artifact chips resolve across workspace, scratch, and granted roots; request_directory registers for all sessions.
List groups General/Security with quiet disclosures for unshipped coworkers and the installer (native pickers for folder/zip); gallery is internal-build only.
Detail: markdown About with bundle screenshot carousel, one Connectors table (Status/Enable), tool calls collapsed under Advanced, management controls moved here.
Account menu drops Automations (sidebar nav has it) and the OpenWorker Cloud suffix.
Token savings + compaction move from Models to a new Settings - Context optimization tab.
Coworkers page loses its duplicate intro line.
Team members move from sidebar to a drawer panel; RECENT keeps one entry per team.
All sections collapsed by default; Journal/Access fold behind More; leads drop Progress.
Lead mentions the board once via a [.](board:) chip that opens the drawer.
Worker delivery is now a read-time feed over its slice (assigned ∪ filed) — send-backs, comment answers, reassignments, cancels, and acceptance all arrive through one relation; per-event recipient addressing retired.
Reassignment delivers before interest ends; a new assignee replays the item's story. Detail pane gains Add a note (never changes state); external pending/consume become space-scoped feed calls.
Send-back/unblock/cancel by someone else now land in the worker's queue (only cancel did — send-backs woke nobody); done stays unaddressed.
The Request changes button drops the send-to-X phrasing — it's a board write, delivery is the queue's job.
Sections are the store's states (In progress / Awaiting review / Queued), no row buttons or badges; blocked rows carry the blocker fact.
Detail pane merges the item's events into one timeline (filed/assigned/moves/comments/attachments), links the assignee to its worker session, and hosts the verdicts: Mark done / Request changes… (returns to the worker with the comment).
Rail shows active work only (finished behind a count); wake digests clamp hand-offs and ride a collapsed BoardWakeCard.
Typing while a proposal gate is pending resolves it as decline-with-feedback; essay criteria clamp in the gate card.
Composer autogrow now counts padding in its cap (first line no longer clips); lead/worker prompts push tight criteria and hand-offs.
Blobs live in state-dir attachments/ (sha256-named); the log carries only attachment:// refs on a normal comment event.
Attach authority = comment authority; images-only allowlist with magic-byte check, 10MB cap; in-app tool + API + CLI + MCP.
Worker list_items was slice-only, so an unassigned external worker saw an empty board — a pull queue nobody can see.
Open+unassigned items are now visible to workers while claims are open; hidden again under lead-only.
ocw board/journal verbs with server auto-discovery (remote-first; direct SQLite only headless).
ocw board mcp serves the role-scoped toolset to external harnesses; 21 tests incl. both dialects over the real app.
Local (direct stores) and remote (one wire protocol) dialects; trackers become mirrors later, never dialects.
Tokens bind actor+role server-side (sha256-stored); board routes carry their own auth, external writes kick the wake tick.
Claim wins by first write under the store lock; lead supervises by exception via its digest.
Policy claims: open (default) | lead-only; per-item reservation = lead assigns itself.
The lead must end active turns with a sleep_for (3-5m, stretch when quiet); a 10-minute backstop wakes a lead that forgot while work is in flight.
Sleeping sessions show a strip with the next wake time and an Ask-for-a-status action — a scheduled agent never reads as a dead one.
ChatStore = groups + append-only messages + per-member cursors; agent posts wake mentions only, user posts wake everyone; post_chat(record_on_item) also lands the answer as an item comment.
Leads name workers (the callname is the handle everywhere); worker digests auto-carry the roster; gate checkbox is the user's call; canceling an assigned item now interrupts an in-flight worker.
Leads lose propose_plan (trait-derived exclusion — plan mode is meaningless without execution tools) and gain propose_work_items: mode-independent decomposition whose approval creates the items.
Team field moves off the turn-save upsert to a dedicated setter (workers detached from their lead after one turn); board deliveries carry a MessageSource sidecar; test-worker prefers project-local tool installs.
swe-lead (minimal tools, coordination verbs) + swe/design/test workers with the shared worker contract; workers never surface in the picker — they're staffed, not started.
Staffing card rides the approval slot; workers nest under the lead's ONE expandable RECENT entry in both sidebar layouts.
team: manifest trait gates lead/worker toolsets; propose_team pre-spawns worker sessions on approval (fail closed on solo personas).
Deliveries + lead subscriptions are cursor-consumed projections; turns end with a queue kick, ticks replay; timer wakes carry the code-computed staleness digest; hourly wake cap is the budget gate.
Plan proposals live in the conversation (plan-approval flow); items are created open/unassigned and work starts at assignment — the granted, revocable authority.
Also closes a verify gap: tail truncation is now caught against the stored head hash.
Board+journal endpoints act as the user; sessions get lead verbs behind OPENWORKER_TEAM_BOARD=1 until the team trait lands.
Rail hides all team chrome until the workspace has items; expand opens a full-width state-column board.
Cases outlive boards/teams, so entries+per-case chains move to journal.db with a grant table (creator-on-attach, assignment-fed, explicit shares).
Adds the raw capture kind: excerpt inline under a body cap, full payload as a sha256-referenced artifact; reads skip raw unless asked.
One hash-chained append-only log; board, journal, and per-agent deliveries are projections (rebuild == replay).
Six board verbs + journal verbs with role authority; worker slice and case access ride assignment.
max_tokens defaults to 32k (compat servers were capping at ~2k, truncating file
writes); a below-limit model 400 drops the param and retries on the server default.
effective_connectors intersects the declared allowlist, so the drawer no longer
renders undeclared connectors as live sources and inbound delivery is gated too.
Builder-based builtins (no manifest) stay unrestricted for channel bindings.
Drop allow-same-origin (srcDoc ran the page same-origin with the privileged
webview) and inject a no-network CSP so a poisoned report can't exfiltrate at
display time. Inline script/style keep working; system browser is the escape hatch.
Sessions expose declared-and-connected only; 'all' is builtin-only; legacy true
migrates to the recommended refs, else nothing. Consent lists real names and
per-connector caps force re-consent when an update widens the grant.
Unparseable (_raw) args now get a truthful error: cut-off-by-output-limit says
'smaller pieces', bad JSON says 're-send with declared parameters'. Raw junk is
shrunk before entering history so replays can't teach the model the _raw shape.
Anthropic default max_tokens 16k -> 32k so typical report files fit outright.
Fact strip: 'OpenWorker installs its own verified copy from <publisher>' replaces
supply-chain jargon. On decline the engine re-resolves — a copy the user installed
themselves is handed to the agent as theirs, not treated as a refusal.
Registry metadata (version, publisher, checksum) moves to a distinct fact strip.
Decline button renamed to say the run continues; reason capped to one sentence.
Rohit C Prasad