Contributions.

Kept unrelated background requests from changing a successful browser-verification verdict.

The problem. The action-verification path omitted declared network endpoints. An unrelated duplicate POST could therefore downgrade a successful action, and replay verification treated advisory findings as verdict-deciding contradictions.

The change. Threaded endpoint declarations into action checks and separated advisory replay findings from deciding failures, while keeping those findings visible in the response.

Added parity coverage for declared URLs and a replay regression for an unrelated duplicate POST.

Prevented duplicate JSON-RPC replies after an MCP event stream disconnected.

The problem. A queued request could receive a stream-loss error and then be forwarded again on reconnect. A local handshake timer could also answer initialization after the daemon had already handled it.

The change. Drained the pending stdin queue before emitting stream-loss replies and marked the handshake answered when the endpoint arrived and the queue flushed.

Made parallel verification persist usable run evidence instead of returning only a verdict.

The problem. Parallel flow verification skipped the persistence path used by sequential runs. It returned a suite verdict without producing the run artifacts needed by exports and downstream CI consumers.

The change. Captured replay timings, constructed the shared timed-run representation, persisted the parallel verification run, and passed project identity into leased browser sessions.

Added three focused tests covering persistence, injected-clock durations, and project-scoped session acquisition.

Redacted presigned cloud-storage credentials while preserving useful request metadata.

The problem. Credential and signature parameters in presigned S3 and Google Cloud Storage URLs were missing from the sensitive-key matcher. Network observation could expose them to downstream consumers.

The change. Extended credential-key matching with boundaries that redact signing secrets while preserving non-secret parameters and unrelated keys containing similar text.

Added key-matcher and URL-redaction tests covering cloud signatures, preserved metadata, and false-positive boundaries.

Fetched only the chunks needed for missing embeddings, with an explicit provider compatibility boundary.

The problem. Generating missing embeddings loaded the full chunk table, including source text and metadata. Synchronous database waits also occupied the async event loop.

The change. Added capability-gated SQL anti-joins and targeted chunk lookup, offloaded synchronous database calls, and preserved the non-SQL LanceDB fallback. Query errors propagate instead of silently triggering a full-table retry.

Added contract tests for targeted reads and query errors, plus integration coverage for the LanceDB fallback.

Moved vector-index maintenance off the event loop without changing database-operation ordering.

The problem. HNSW index drop and rebuild operations used synchronous provider dispatch during directory indexing. A long database operation could block unrelated coroutines and hit the synchronous dispatch timeout.

The change. Introduced async provider operations backed by the existing serialized database executor. Cancellation stops the caller waiting while in-flight DDL and a queued disconnect retain their executor order.

Added real-provider integration coverage for event-loop progress, cancellation ordering, restored indexes, and propagated database failures.

Enforced the same signed 64-bit integer contract in Python and TypeScript SDKs.

The problem. The client SDKs accepted integers beyond the server’s signed 64-bit range at APIs that serialize i64 values. These values could be constructed locally despite being unrepresentable by the server contract.

The change. Added range validation at explicit integer literals, property values, arrays, query values, and typed parameter boundaries while preserving the generic serializer’s separate contracts.

Added SDK regressions for both valid extrema, one-beyond-boundary values, and typed parameter serialization.

Made memory recall respect the scopes explicitly requested by the caller.

The problem. Global-only recall cleared the profile before calling the memory service, but default-profile fallback reintroduced profile-scoped evidence that the caller had excluded.

The change. Passed the scope filter into the service and applied it to the effective profile and session before retrieval, preserving the existing response and storage formats.

Added a deterministic SQLite regression through the public recall tool with global, profile, and session memories.

Closed a credential-redaction gap in audit records for failed tool calls.

The problem. Audit hooks redacted secret-shaped argument keys but persisted exception messages verbatim. Provider or transport errors could therefore place credentials inside an audit error record.

The change. Added narrow text redaction for common key-value and bearer-credential formats before recording the exception, retaining the surrounding diagnostic context.

Added an exception-path regression that inspects the audit record and checks that credential values are absent.

Removed stale searchable content when a knowledge-base source became empty.

The problem. Re-ingesting a non-empty replacement cleaned up old chunks, but an empty revision returned before that cleanup. The previous source content remained searchable after the file was emptied.

The change. Routed empty revisions through source-replacement cleanup so stale vectors and the ingestion manifest reflect the current source.

Added a deterministic empty-revision regression using a fake vector store.

Released retained SQLite handles so Windows profiles could close and clean up reliably.

The problem. Closing the database could leave native SQLite handles retained on Windows. Profile removal and restart workflows then failed with EBUSY even after the connection’s close method ran.

The change. Dropped the Drizzle reference before closing SQLite and collected retained handles at the explicit Windows close boundary when a connection had been open.

Added regressions for directory removal, repeated close, committed data after reopening, and the conditional Windows collection path.

Fixed Windows team-service startup by walking filesystem roots correctly.

The problem. The team directory walker started at the parsed root and then processed the Windows drive component again. A normal data path could turn into an invalid directory operation before startup completed.

The change. Removed the parsed root before walking remaining path components and kept directory validation explicit, including rejecting Windows junctions that cannot establish POSIX ownership trust.

Added path-traversal tests for nested and relative paths, invalid parents, linked final directories, and Windows junction trust.

Aligned browser workflow planning with the approved deterministic ordering contract.

The problem. The TypeScript planner stopped after an early depth-first result limit. A longer chain found first could displace a shorter valid chain discovered later, diverging from the native planner’s ordering.

The change. Completed the bounded search, ordered and deduplicated chains shortest-first with deterministic tie-breaking, and applied the five-proposal limit afterward. Existing work and depth limits remain in force.

Added a shared mixed-length ordering fixture consumed by the Rust and TypeScript planner tests.

Rejected malformed output-token limits consistently before cloud-provider translation.

The problem. Cloud adapters consumed raw JSON output caps differently: malformed values could be forwarded, omitted, or replaced with defaults. This disagreed with the runner’s unsigned-integer request contract.

The change. Validated the optional cap at each adapter boundary so malformed non-null values fail before provider calls, while null, zero, and valid unsigned values retain their behavior.

Added four-adapter regressions for fractional, negative, string, and boolean values, plus null/zero parity with request deserialization.

Made JSON Patch decisions agree across Python and TypeScript when booleans meet numbers.

The problem. Python treats True and 1 as equal, but JSON distinguishes booleans from numbers. The JSON Patch test operation could therefore accept an override in Python that the TypeScript coordinator rejected.

The change. Added a JSON-type-aware deep comparator to both Python references, checking booleans before ordinary equality and recursively handling nested objects and arrays.

Added seven shared conformance vectors covering accepted boolean values and rejected boolean-number mismatches, including nested values.

Handled the alternate terminal-marker terminator without trapping subsequent output.

The problem. The shell-ready scanner recognized only BEL-terminated OSC markers. An ST-terminated marker could leave the scanner holding later PTY output while waiting for a terminator it did not recognize.

The change. Recognized the two-byte ST sequence alongside BEL, tracked it across input chunks, and shared the match-completion path between both terminators.

Added single-chunk, split-chunk, and negative-match regressions while retaining the existing BEL cases.