All Sonny releases

Sonny 0.12.7

Published . Source commit 192e590345c6a4bf1ef8f72b043b318084ea84d6.

Download release JSON for this version's installer URLs, byte sizes and SHA-256 hashes.

Downloads and verification

This is an archived release. Its download links require GitLab project access. File hashes and sizes were checked against the release checksum manifest and package metadata; anonymous availability and signature verification are not claimed.

Choose the artifact for your operating system and architecture. Links marked “GitLab access required” need access to the Sonny release project. Public installers and archives use the same download host as the release notifications.

SHA-256 checksums (GitLab access required) · Checksum signature bundle (GitLab access required). A matching hash checks file integrity. Verify the signature before relying on publisher identity; this page's metadata importer does not perform that verification.

Release notes

Changelog

Features

  • 8ce2a3e38c578a115fab00cf30ad61baceffdf23 feat(app): show the startup re-host retry state in sessions.recover (SONNY-4905)
  • 2e4def5cceec69e046935078e6cd42245f19ed53 feat(desktop): add activity pane and durable queue controls (SONNY-134)
  • f2f5292084c9d5894c0035fb78ac92fa47a8e0ca feat(desktop): add newest-first turn history (SONNY-4746)
  • fb9c76531a9cc05816a9528202a55cb593fb3f2a feat(desktop): recover client connections after wake (SONNY-256)
  • 820afa97e0d51ff25fdac0a3716dd601df1845e1 feat(desktop): show live turn progress (SONNY-4745)
  • e3cdf3b9930cb6b0432f4cee0e9b27341ae184ea feat(desktop): show the truncated session id with a copy button (SONNY-4927)
  • a5eb1c374b98ee5dd58856b2ddda3848ac21dd73 feat(desktop): turn model providers on and off, and remove one with confirmation (SONNY-5126)
  • 3e5ff393a516a79c941e0291816a55471e76557c feat(isolation): name missing cgroup delegation and its root fix in init and the isolation doctor (SONNY-5244)
  • 342d95a075c80b22ed16a3a0ef02244e917365e6 feat(isolation): select and construct the native Linux realm at startup (SONNY-5018)
  • 1d4eee8ed4afe3a3ecc734a12d274136374e0a83 feat(mesh): add the managed provider input-admission owner (SONNY-4942)
  • 38615f092c9aa6240cade86c4a6514260fa9e00b feat(mesh): provision managed-worker authority with sonny mesh managed (SONNY-5545)
  • 25d71174cfc02af540e6d80bb4a88512ce46dca4 feat(meshengine): bind a session primary owner to the managed lease (SONNY-4942)
  • dc7aec23b66b13ca38538f96970e78be01137c52 feat(ops): report upstream reachability (SONNY-2703)
  • c0bc393ffcea775216a395935eb73a02f55be00e feat(packaging): delegate the io cgroup controller to user sessions from every Linux installer (SONNY-5244)
  • 804c37d1919928f610c4b727933778df3553d97c feat(packaging): rename the sonny-mesh daemon to sonnyd (SONNY-5471)
  • 5a67edc671ef59f5a799cc1476748430d66954f9 feat(promptcachekey): send the conversation cache key to vLLM-served routes
  • 3fd6fa430581f11c888adc75b091b06ac6cfeef4 feat(recipes): admit declared signed child invocation (SONNY-5031)
  • ace379e995bbdf6a8d0f1c8f76338763d9655812 feat(results): add immutable result browsing and export (SONNY-3927)
  • 0d33cd97986999bc689ed714dc4b3e19dc5a989e feat(runtime): keep only the live set and a bounded applied-key index (SONNY-4926)
  • 2e6acf62189ba160d6638e937c0e366cd01be93e feat(runtime): retire settled protocol history and bound re-host memory (SONNY-5014)
  • 0c2005f78a8e5f5258eb51fc265c6853ed43701e feat(sessions): bind a chat to a trusted workspace from inside the chat (SONNY-4927)
  • d7023f83a53a8e67ffbe33052c7386f4099331f2 feat(target): dispatch host-owned provider schemes (SONNY-2975)
  • 1e25d3165efb321f84dd2747214da511fcc0c4c1 feat(trace): record approval prompts and selected answers in session traces (SONNY-5109)
  • 0ac382ae6b95a099db3cb0fc171767f31d9a6f8c feat(trace): trace desktop workspace-trust prompts and audit trust grants (SONNY-5271)
  • a5d1ab5e3d10d5e9e76e759f178fb1638c71349b feat(tui): add bounded startup session selection
  • 4104f4ce7d1fccef6e0d41ed8dcadd1dfdde082c feat(tui): complete provider account setup (SONNY-3925)
  • bb5a9bc46598aacf8bf4d342603176fc7e344d57 feat(vscode): ship daemon-backed extension shell (SONNY-201)
  • 0009c21bd155b69b1cc3772f262817098189fef0 feat(workmanagement): add portable support layer (SONNY-4812)
  • 26773894cd6448cfca4dc0f9b4e3cbf86b5a449c feat(workmanagement): ship native portable PM runtime (SONNY-4812)
  • 6455db9a8a9b788f1fea3822f8081eb73440d4f3 feat(workmanagement): support multiple provider connections (SONNY-4812)
  • a68a9f3f2adb827413605ed8cd8282e704134a2b feat: integrate recipe selection with combined Sonny updates

Bug Fixes

  • ceab3a191cc146c69100cf4a425a545ea57810d3 fix(a2a): answer native back-pressure as retryable and wait for the session after a restart (SONNY-5020)
  • f12c7ba15e233063e8cd00aed4b20d896254082d fix(a2a): wait on relay backlog progress, not a fixed answer deadline (SONNY-5061)
  • a73c287f1ba7037715da5d66b1555adc1befc8d5 fix(a2a): wait out a full mailbox and leave expired inputs alone in the relay (SONNY-5048)
  • a2e70c6e7a1632f066040c01712ae50676a4aea0 fix(agentmail): bound live A2A protocol references and retire them with their task (SONNY-5049)
  • 76e4e60fa8a0b50f407ef8c67a44e111f31dee49 fix(agentmail): bound live incoming children and release a charge when the child is terminal (SONNY-5060)
  • 8f614c37678bd9df3758ca75ba2b575d68366a2a fix(agentmail): bound live remote children and release a charge when its child settles (SONNY-5059)
  • e2921abf98239ff6eeac0ac9aa0fb6db1e8e6d45 fix(agentmail): bound the open native tasks a session admits (SONNY-5061)
  • 09943b0b33db1d87ce99f794b9bab4ee7281613b fix(agentmail): purge settled mail early at the retained high-water mark (SONNY-5048)
  • 62bd6116dd82f8d98f4fd1fa08395ee54cd1f113 fix(agentmail): wake an idle receiver for verified peer mail (SONNY-4946)
  • ea7a2cf0b5348f2eee7a1d6129c4792ff264cd6e fix(agents): place write-capable children in the claimed repository of a multi-repo workspace (SONNY-5106)
  • 3150bd4253ed942d0ac6bbc603a5b1e8e4bb0325 fix(agents): stop a child whose dispatch intent cannot be leased (SONNY-5264)
  • 60621554309d3062428791efdaee56cdea41e8e7 fix(agents): tell agent_search callers whether a sub-pack can write files (SONNY-4829)
  • 2bb825d0b866d8ff5cb3d6e708d1210e575155ff fix(analysis): stop the captured preflight fixture expiring under load (ENG-4879)
  • a49f8c172bb4fd53cb7668a742604ea6ba380615 fix(app): answer an unhosted owner conversation session at once (SONNY-5020)
  • d68d9576489758e58416cb133b0c8d69124a6f53 fix(app): fold restart recovery reads in bounded journal pages (SONNY-5019)
  • cc77d24e24ba8d4f12496aff5f898c30c5aa4066 fix(app): read a hosted turn’s session facts without native protocol facts (SONNY-5044)
  • 2263ea6880c2a08786143e8b4095185cf4f71284 fix(app): retry a failed startup re-host with a bounded backoff (SONNY-4905)
  • 3938071f5bf1fadde09a138302cca68daac319e2 fix(app): retry a hosted re-host until it succeeds and audit journals in the background (SONNY-5045)
  • 768a969ffcbc7de1c8b208b9cebacbf532672a7f fix(benchconformance): point merge-order coverage at the renamed embedded override test (SONNY-4756)
  • 954764a444da71124fd01c101c08d9a34626799d fix(benchmarks): reseal the TCE fault report for the go1.27.2 toolchain (SONNY-4927)
  • 70b13e409538ee8e095dac8e28cac37a4d277f9a fix(build): install the macOS desktop app bundle (SONNY-4921)
  • 7e16436902cbe70b3aca9096d6e9c38c1b585641 fix(build): keep build-env.sh working on bash 3.2 with an empty GOFLAGS (SONNY-5279)
  • 87960700e6a96b3d7062b3f796f9cdb8d4d1c282 fix(build): stop the isolation engine and remove read-only state on uninstall
  • f954365d02e466ed3d094866248a880d2b7c5dd6 fix(catalog): admit tool_exec arguments against the target’s own schema (SONNY-4937)
  • 2ac91ddad74c562beed0ff73fc0111bc0d939a9e fix(catalog): certify tool_exec results against the target’s own output schema (SONNY-4940)
  • d29e43913880bb5eacc0c2f143d1fdc7e582bfbc fix(catalog): certify tool_search rows that carry MCP server metadata (SONNY-4945)
  • 86f9d30c66c98fd50af6c18251fbf01afd8fd42d fix(catalog): certify tool_search rows that carry an input schema (SONNY-4941)
  • e0dbd148e3e4e4dc35d457c8b89e29009d99c640 fix(catalog): read the host-wide file posture on every call (SONNY-5123)
  • f75394983e45ddaee4409b45d6698245103c6bf6 fix(category): never seed or route the template’s placeholder sources (SONNY-4640)
  • 615b38df55912cb45a3cc22c236bad40d31ac50d fix(category): rank sources this host cannot authenticate after credentialed ones (SONNY-1804)
  • b810d56aaf017d77667110604be47216b840e5be fix(category): retire an unedited starter catalog once a pack registry supplies models (SONNY-4640)
  • 00628beca287b2c9480440ad54dfffb0f7b53a5c fix(ci): bind CUE qualification to the pinned Lanning module
  • 6b1704adf3189041ac46334828c627325d316146 fix(ci): cancel remaining jobs after required failures
  • 633b614e3890687931ba06a49f038bc926af6e69 fix(ci): cancel required failures in the knowledge-base child pipeline
  • c832e2d1eedc71376ff819317c954c4fc10950fb fix(ci): canonical, admissible test TMPDIR on the build volume (SONNY-4927)
  • 778528819dbd0b22a79dc7fb7d43c907b843aef0 fix(ci): classify the nativequitqualification build tag in lint-variants (SONNY-4927)
  • 01d7ae8900e6e96f6a4f2c5f505ed460b4663547 fix(ci): complete cross-platform dependency checksums and preserve compiler API alias
  • 31ac61464bb259c2786ca4553ffcd95ae72444d5 fix(ci): consolidate Go linting under golangci-lint
  • 2660abce808c249cae65523554255b0d559af25e fix(ci): create no publication jobs for prerelease tags (SONNY-4578)
  • 860819db57eaa75f1e5f5af326838b6c6f260f67 fix(ci): eliminate duplicate schema checks and standalone Go linting
  • 4a6841b978311c1a3316af3f47a1db9782393c78 fix(ci): export the test TMPDIR in the script and budget full lint runs (SONNY-4927)
  • 2f5360f123adaf0e17e944ae8ae68e5ec36b654e fix(ci): give cue-handoff’s docs/user run 45m on slow kvm runners (SONNY-4578)
  • 1a45c696c5a4e1491ffa7e9efd61615e7774b91d fix(ci): give docs/user 45m on slow kvm runners (SONNY-4578)
  • bbcaf40cdc7835bbfd5711d3b3cc8f7c72f6d37b fix(ci): give drift-contract room to finish the shard check (SONNY-4927)
  • 16039e81a336df2efc6830be7e62959f1b119a52 fix(ci): give drift-guards room to upload its module cache (SONNY-4927)
  • e036c194cd68b463a82a90529d79391be4e5ea89 fix(ci): give every lint-variants run 85m on slow kvm runners (SONNY-4578)
  • 28ae01e8f39f3bfa17ca09e298fb8c1c7937648b fix(ci): give go-test shards a 150m package deadline for slower kvm runners (SONNY-4578)
  • c4c078da2a3abf621016a592c07c516758a3b2e0 fix(ci): give regression-evidence a 4h timeout (SONNY-5405)
  • 65ceecb9d707e136fe93479c37bb770f96bbd91f fix(ci): give regression-evidence a 4h timeout (SONNY-5405)
  • 0b12664068d1f76571e4329fc36e9eee6f3e2c1c fix(ci): give the PostgreSQL control-store shards 100m on slow kvm runners (SONNY-4578)
  • d4a4e53d02056439671c7150165becbb81b4e681 fix(ci): give the SQLite go-test shards 150m on slow kvm runners (SONNY-4578)
  • 1b563afc6a776cf381bbb7b8cc273cd19e9e9c5f fix(ci): grandfather the unconventional doctrine commits on main (SONNY-4756)
  • 5b75b1ede3461d724b68712e19badad46f51aa61 fix(ci): install the pinned pnpm with npm on node:26 images (SONNY-4927)
  • c503ce2c486dff0a90320b3a7db33c7a95f07c15 fix(ci): keep superseding when one prerelease pipeline refuses to cancel (SONNY-4578)
  • 8f850702e523b96adbc7f6e92314bd35b611afaf fix(ci): keep test caches out of foreign-owned build directories (SONNY-4578)
  • a9feae652ac991315234fad16ff566a37f90641a fix(ci): keep the test temp dir short enough for Unix sockets (SONNY-4927)
  • cba2563240f890117ed82ff8f8264a45b154f390 fix(ci): let a newer main push cancel go-build and the drift gates (SONNY-4927)
  • 025a51161ff7cb8282339b645ce4c6b2a42240fc fix(ci): lint linux-prod and linux-nocgo in separate verify cells (SONNY-4927)
  • 54b516c6e02ad58cd196a6bb90bf018be0f70c5b fix(ci): name the prerelease-cancel job’s HTTP client (SONNY-4578)
  • 6c96fbe8a67d0bd4db767ef671c497079ba63ce8 fix(ci): pass precommitci on the open-MR consolidation (SONNY-5131)
  • a5d300f7ab7e500ff86148107896561cf157620e fix(ci): qualify proc v0.2.1 and synapse v0.3.3 in the CUE isolation gate (SONNY-4927)
  • 9ef00aef31661be4d8febcc682fe3db3e3f47cac fix(ci): qualify proc v0.2.3 in the CUE isolation gate (SONNY-4927)
  • b2e75fafc527ac1dd5ec1134ad70ffb50408e02e fix(ci): reconcile frozen Lanning inputs and derived benchmark seals
  • 57b2af8ef61c573124363173b5da5d2db9565bfa fix(ci): reconcile release contracts and selected dependency inventory
  • d963e1529c8889811c1526927352d69b2cf9f55b fix(ci): repair shared Sonny validation and retry costs (SONNY-5472)
  • 6c7caff840b2fed2789dd9db78fd7ffa5f2da381 fix(ci): restore analyzer job schema (SONNY-2786)
  • 7b209e64e4f116165615e9d42c112f986656f92e fix(ci): run the production fixtures on a filesystem with O_TMPFILE (SONNY-4927)
  • 9170ac49c3915c35ad2abaaba3bad26c50ce1e8a fix(ci): set the Windows Artifact Signing certificate subject (SONNY-4575)
  • ede25bd9afba4754453cceac97b8423650e43d80 fix(ci): shallow corpus checkout and reconcile atomicfile import (SONNY-5131)
  • d31b7c56949a89ec0865c2227e01459c24b6c295 fix(ci): upload prerelease desktop packages under tilde-free names (SONNY-4578)
  • 099fceadd6815c5481132fc794cf687d0d9adb3e fix(ci): warn instead of failing when no build directory suits caches (SONNY-4578)
  • 7535e583b31d153e50de06d79afff773f48120a2 fix(cli): compare the product’s live heap in the federation soak growth check (SONNY-5091)
  • 4f891f73223e4364c558c924d22efd1ed4af1805 fix(cli): compare the product’s live heap in the federation soak growth check (SONNY-5091)
  • ff84a4803384ed398fc8de03d8834ed7557e0982 fix(cli): host again a local session whose host lease lapsed (SONNY-5097)
  • dc0cea36c3341020b7a793f44bd4c0054045d94f fix(cli): host again a local session whose host lease lapsed (SONNY-5097)
  • 05dc3f5d67aff1ed04c05181b0f79d787ec06cd3 fix(cli): onboard a gateway group through its -v1 twin when both are listed (SONNY-4829)
  • 96b42ca27983f4b9a43dae73dc237516407b2761 fix(cli): reconcile client fixtures, mesh test identity and pins (SONNY-5131)
  • 79c648bb1dd39ce3b0e3623963a1bb1f074464fc fix(cli): run SonnyMesh as NT SERVICE\SonnyMesh and make Windows service install idempotent (SONNY-5549)
  • d5c7ed4c8e2cb1c46c5d0b03ff435b92f434371f fix(cli): run the MCP doc_* round trips on an O_TMPFILE workspace (SONNY-4927)
  • 20aa8225408c8642e5291e1ffa2372ff393e6419 fix(cli): satisfy adoption lint gates (SONNY-4761)
  • ccea2d773cacf7a312272d63d221260fbcee7bb5 fix(cli): show what each child tool call touched, without blank lines (SONNY-5253)
  • e2bae826250ebde83f5d1ef5abf17bba8cf30eb6 fix(cli): write Windows service install output through the command (SONNY-5549)
  • d28c382bb591f9d9c6160a9de7e8ca7234b2ffd5 fix(compaction): carry findings and the files already read instead of call ids and prompt copies (SONNY-5047)
  • 833f4328884e9692df146f9b68148d4d9ae110c3 fix(compaction): compact TUI and tab sessions on undeclared windows (SONNY-5047)
  • 3b25f08f1defe9e872b351b9d9a1a4824c6c05b5 fix(compaction): compact sub-agents on models with no declared window (SONNY-5047)
  • c9e0268a6c5b1f10e406a038f8c29e0aeb51ed36 fix(compaction): compare the slow-model working budget with a provider-anchored size (SONNY-5470)
  • bc69033bf87ee95d5f03a3dd0514040b1d852236 fix(compaction): hold slow models to a working budget below window fit (SONNY-5275)
  • 41b80de1a3b17109bf6290f399a9078195b12fd6 fix(compaction): scale compaction timeouts to the model and trim when forced compaction fails (SONNY-5262)
  • 50757dafa3abdc1e8a4ea9e0c5a024f1582249ec fix(compaction): stop re-running a timed-out compaction every round on slow models (SONNY-5538)
  • 895e7be6adcfcfc55c70d74fe48d99e67ced04c7 fix(control): observe the newest migration in the one-behind read test (SONNY-4927)
  • b27564f2da3301607d12c93b3129f466dc39715d fix(control): restate the sensitive_read effect in control/domain (SONNY-4927)
  • 0425278e9ee4dbcf2d95bd50959227ede2e44701 fix(control/sqlite): keep host lease renewal and fence reads off the bulk write path (SONNY-1349)
  • 297f65de26ab7d52960d099d502b67f5ebaf0945 fix(controlauth): grant managed sensitive-read tools under an explicit tenant-policy allow (SONNY-4939)
  • 18756cbddfbdfbbf43d504ecec591f687045eef3 fix(credentials): refuse a keyless Anthropic request at the call, not at session open (SONNY-5119)
  • 56a159f45dd3d7bcd5e5689aca4a37d44a42835c fix(credentials): send the stored Anthropic key instead of a keyless request (SONNY-5119)
  • 2e07e1a233735a9d3f5fc8732755b99855ba3645 fix(daemonhost): reuse a busy live supervisor instead of starting a duplicate (SONNY-5404)
  • 2730b0fedd1a6822a5d5b2ad598c9326570d010f fix(delegation): tell parent and worker when the worktree lacks the checkout’s uncommitted files
  • 9150d409d919f1bebba106923659195349a4213d fix(deps): bump llm to v0.46.3 for max_completion_tokens (SONNY-5120)
  • 0a5bb9bf2af5ef781d8238abc5beeb4da25a70ec fix(deps): bump llm to v0.46.4 for line counts, background exec and MCP timeouts (SONNY-5276)
  • 4502d9d78154360d67fb3e6dd08a9702b2943f76 fix(deps): bump llmtools to v0.16.7 for host-wide file writes (SONNY-5123)
  • 3d61d3d06d55904848ef5f10231206490b6f83e9 fix(deps): pin the reachable consolidated Lanning revision
  • ce530333a03754fa5d2af3cfa819e07a8ab80f54 fix(deps): require devnw.dev/isolation v0.14.1 to reclaim realms from the signed image (SONNY-5603)
  • 541a2a1c597ef66eb9ec03bcc65e2acb4ed3a6c8 fix(deps): restore the pinned Geode digest and stop unpinned bumps (SONNY-4927)
  • d8be5892d617573036e1f4e8dcf59be8f35cbabd fix(deps): take job_output wait_seconds from llm v0.46.6 and llmtools v0.16.9 (SONNY-5398)
  • a1666835868a33374f9073f4bc9371a47f647996 fix(deps): take the find dotfile fix from llm v0.46.5 and llmtools v0.16.8
  • 391c61409fe2393ef7092909287eec86131952be fix(deps): tidy go.sum and gate untidy module files at commit
  • 17eb504fc8875599ec2a24fe6b0055459df40b20 fix(desktop): Disconnect clears a provider’s stored API key (SONNY-5125)
  • b7a009a8088d372e6b4522bec8b9eba8d3bd5495 fix(desktop): admit packs installed after the daemon started (SONNY-4921)
  • 49693af39300cf073ce3dcf468f97579b47003f8 fix(desktop): clear the turn activity row when a hosted turn settles (SONNY-3622)
  • 54a74be6d0ea597aaa6c1e65a828abb119e09ce1 fix(desktop): complete queue ordering and execution inspection (SONNY-134)
  • dbf4086ecdfab5fd8db7e4cf80137d581c76c015 fix(desktop): cover file receipts and pre-dispatch cancellation (SONNY-134)
  • 873966b2a007804d6b121f270d0ef7c63ce6824f fix(desktop): describe automatic model selection (SONNY-4757)
  • 77dc8ba2c410151bf2f988dbb65f2d73a7f8530f fix(desktop): discover native subprocesses in the Agents tab (SONNY-2246)
  • f080ca6e28d97467f083fed07eb645da0f8297dc fix(desktop): expose archived sessions (SONNY-4747)
  • 2692685afb822c2c739c4c978175bb1a56efdf79 fix(desktop): harden release qualification shutdown
  • 1f1a905e06300135be4a6fd33ed6c325ef5b8c94 fix(desktop): hide unavailable provider sharing (SONNY-4762)
  • e5ad1fef3a0ef5ac79f06778950bbadbc45f1c63 fix(desktop): hide unsupported provider cards (SONNY-4758)
  • 26d195eaa58988ddd4dc30ce5438d15f4ba64df4 fix(desktop): log normal connect progress and clean child exits at info (SONNY-5121)
  • 5e151ef2cf265701b7d687e657a83608ef4d5a34 fix(desktop): make session Delete work after a turn (SONNY-5469)
  • 35adfbd93737d3245945eb499243ffeecf0e814c fix(desktop): persist project approval grants (SONNY-4766)
  • d97a37ffbda379f2f8ba0e8bf76f5355904fd393 fix(desktop): readable text on danger buttons in the quit dialog (SONNY-2510)
  • 510881394c788e67197db6806e72946a0076234f fix(desktop): resolve hosted providers against the current catalog (SONNY-5451)
  • 1d2db49bf30ffb4610bd9c640b0909335c214187 fix(desktop): retain config across legacy snapshots (SONNY-4748)
  • 172440637b9a5e17dc7042c9147d04ea6efb8888 fix(desktop): retain session approval mode (SONNY-4748)
  • bba38e3dfbe200f41c3c75bba1fce97215c246b7 fix(desktop): save server providers by receipt (SONNY-4759)
  • 195b1a9f0d046e4b585362187417345ac915adf4 fix(desktop): ship SSH host release trust defaults (SONNY-4763)
  • eec9f7002832e62b5d5dbdefb79700f6094b0a59 fix(desktop): ship the Sonny icon in the Windows build (SONNY-5100)
  • 1934f3a456913d8c82e21a8bc087b70ef1970ae6 fix(desktop): show bounded tool-call details in transcript (SONNY-4745)
  • 9380a355f8094a27dc3d0ad8eaf4ba26e737b5a1 fix(desktop): show live turn activity in the chat composer (SONNY-3622)
  • 2796ddb1fd2d90047fe12dbcc40f400e6db701a9 fix(desktop): show the model a turn is waiting on instead of a stall (SONNY-5273)
  • c1b3f118da38f5768a775e77b0f0746fadb1b35d fix(dispatch): name the remedy in the unexposed-tool refusal (SONNY-5260)
  • 1bed1fc9cb59b1f51986e6be443a21928cc1e534 fix(dispatch): refuse an unserved mesh.* name as not a mesh tool before the gate (SONNY-5267)
  • c2505d29b5fdddd24307ee7f17400dcdadd37b4e fix(dispatch): tell the model who denied a call, why, and what to do (SONNY-5265)
  • 2957a817393a75cc79c8d1e2dfeb04daecf39f28 fix(docs): use released recipe fence publisher
  • ba87e11d980f8a4daec37701c01950061469314d fix(exec): give the macOS daemon the user’s login-shell PATH (SONNY-5068)
  • 7378fe9d04be108368274c8cc7a68fa1db04bb5c fix(exec): read a mis-scaled exec timeout as milliseconds and tell the model (SONNY-5047)
  • 0080c821801afa2e77c20fd76dcf269fc99bf2d9 fix(exec): run every exec child with git’s optional locks off (SONNY-5047)
  • f0194a32fe0a727edf17e21eb811917c3ab0340d fix(executionroute): keep the todo reconciliation reminder from reading as a user stop request (SONNY-5544)
  • 98b58b1206c13a042b0e7dc3adcc839a3e4dc9cb fix(executionroute): stop refusing read-only work and refuse batches consistently
  • 183703391ac72089f1bfa0590d7a985aa3d604bd fix(executionroute): treat host-granted external reads as discovery (SONNY-5102)
  • bc21d80ddc685f3d2bdad79515681bec67825dab fix(find): treat a partial find result as a notice and never reuse it (SONNY-5105)
  • 885aff8b1ed4792edec59c0318ff389c56ec6ab0 fix(forge): send Sonny’s HTTP identity on GitLab merge requests (SONNY-5131)
  • a1dee079e487f38bb30db68e51578aaec1099d1a fix(gitfetch): name git authentication failures and retry with GITLAB_TOKEN (SONNY-5130)
  • f988ae1565c8bd655f07655cc009fc5fce6d485f fix(gitfetch): say who holds a repo lock and never prompt while holding it (SONNY-5128)
  • 53100d6407d876e0a61b40e862cf88cc50b134c7 fix(hosted): a tool error no longer fails the turn as a raw-payload system message (SONNY-4050)
  • 18badb62ed6de86e19ca1346befd9d625ba13f23 fix(hosted): commit the reply of a turn that fails after answering (SONNY-5058)
  • 9397fb16462eb5ab9f5a886a7cf6359bd7701ecb fix(hosted): give desktop and supervisor sessions the TUI’s MCP env, secrets and PATH on every OS
  • eb47efc9f47a2c6122576f8165fce54e22b6c524 fix(hostlease): continue a turn after every lease lapse and renew by CAS alone (SONNY-5597)
  • ad7b10386dfd011500d54e5ba974fe218c3d31f0 fix(hostlease): keep host leases through transient store stalls and continue fenced TUI turns (SONNY-5312)
  • 4f577166b830130fd967acc793b5be29ba78718a fix(http): send Sonny’s identity User-Agent on every outbound client
  • a5883955a57e873a0e894a2abb68e91a827e950f fix(isolation): bind managed cells through the session’s verified realm lineage (SONNY-4932)
  • 018b33099daa968d1edacb1e2f1224e776c42631 fix(isolation): bind managed execution authority to the verified managed identity (SONNY-4934)
  • 1c5458cb39850bb6fb2454e9e1a3024dda46c529 fix(isolation): bootstrap the local daemon’s realm under a UUID session (SONNY-5588)
  • f833aa19b7d1545c1572ac0260af5e6fa636dbdd fix(isolation): check the local daemon’s realm identity in the doctor (SONNY-5590)
  • b0389ce25c509dbb30ba459557790cecd05aff0e fix(isolation): discard the local daemon’s realm without an export (SONNY-5588)
  • c5b7ab6854012d46ec3160ada5fbc14bf64b9170 fix(isolation): enable delegated controllers on the user service before creating the native cgroup root (SONNY-5244)
  • 962a0cc8649ae4cc11885065d0db5ee6f68ff4ec fix(isolation): hold a busy day in Sonny’s default Docker journal (SONNY-4938)
  • 545b375499e9ba0d5e33e4479ae41dd226170a1e fix(isolation): name the doctor’s real daemon identity failure (SONNY-5590)
  • e767f7f5c36487efbf9bd16f0b99d4e1d2a3d780 fix(isolation): pin realm runtime facts in managed session dependencies (SONNY-4928)
  • 1c610951af2c253844d82494639a39ee984f3967 fix(isolation): re-verify live managed realms against recorded history (SONNY-4925)
  • 76fdda3844ebe9a49ed0f84cd4f9e907a0f5bce4 fix(isolation): renew managed realm freshness with signed realm renewals (SONNY-4930)
  • e8667f2f4be2fa8c66027247a37367321f0a4d34 fix(isolation): verify managed realm lineage incrementally and lift the 4096-record proof cap (SONNY-4936)
  • 516a627d2ab5e4b4d60a7d549235872abdfdc541 fix(isolationruntime): refuse a revoked structured capability before dispatch (SONNY-4927)
  • ee2fbd170581774b61844fd971bd1d9c56455512 fix(lint): name the project tier and capability result key (SONNY-4578)
  • cbd2a15a591c18c6fe59b5a0108f3edb7da66503 fix(localprofile): stop digesting the whole control database on every start (SONNY-5098)
  • 898224a8bb44592977c7bdca145ab7487f66fd9a fix(localprofile): stop digesting the whole control database on every start (SONNY-5098)
  • 431f0b601dc9cd041dfb55fe823b1199ae3943b2 fix(lsp): admit a language’s server when the session touches a file of that language
  • 6d47cc6ba60ae02f7e20563593a828a4e41ce0d0 fix(lsp): detect project languages from the canonical workspace root (SONNY-5310)
  • 59545c0544b362483c24058b9e8c5713c2c6f333 fix(mcp): always admit Sonny’s own sonny-internal server without an allowlist entry (ENG-5221)
  • 509b43e5a7d9222da965280016e83e398569cb32 fix(mcp): name failed MCP servers in tool_search and retry cut-off connects (SONNY-5250)
  • d343bc4ecbc612fc67103ec2e477236d7a732eb3 fix(mesh): answer a peer for a closed recipient as closed (SONNY-4943)
  • d5d35278025a1562157702122fb78cac518c9023 fix(mesh): authenticate exact server SPIFFE identity (SONNY-699)
  • 1dd7e88af284ff2a84a1085f5099ba656b88df4b fix(mesh): back off agent mail resends and stop them on a received receipt (SONNY-4944)
  • e01649bf7f94c0586b0c2d15a0cb519823a66653 fix(mesh): bind discovery and renewal to authenticated tenants (SONNY-699)
  • f83d0a2e4eddbc66b0bb69134083a399ea700246 fix(mesh): fail a hosted turn whose output copy falls behind (SONNY-5013)
  • 6722a449b1a93b0738bcdb2ef5f74af22aa208df fix(mesh): give each session stream its own copy of the output (SONNY-5012)
  • b6e3a9e3a18212b60f9a3749d106fa4d8bb422ca fix(mesh): give the managed peer-wake tests slow-runner headroom (SONNY-4578)
  • 3c67d47eb6ceeef629f0191fc7d0d74edcc1d22c fix(mesh): integrate tenant-bound discovery and authenticated renewal (SONNY-699)
  • e35d35b5bb3b7b6798fa550e1b24ecf69bda851f fix(mesh): interrupt a managed session whose host lease is lost (SONNY-4943)
  • 256adf660dcdcc133705b1fd024d9e94fd35e744 fix(mesh): issue a real control-plane grant for every managed catalog call (SONNY-4935)
  • f38cb60c9ac51da5093b091b99bfdc8aadf1fc63 fix(mesh): keep sealed turn prompts out of the turn run aggregate (SONNY-4947)
  • 2ff454f16792e06b5e3983efe4881b7f7ffdd3bf fix(mesh): package canonical Go module archives for upstream (SONNY-699)
  • f11eea5fb373213ff715802649a8c499e6e8e264 fix(mesh): preserve durable ownership in session replies (SONNY-699)
  • dc85df7c31f25c4192664453d55f940a05addb0d fix(mesh): qualify the docker cluster view through authenticated coordinator membership (SONNY-5472)
  • ba1d20929722a842c2cde1db3ff8fe11d7fe775f fix(mesh): re-host a Desktop session whose lease lapsed with no competing holder (SONNY-4943)
  • 7ef53db0decae8b5ba7533561dc63a2de06351b9 fix(mesh): re-observe a peer grant until its mirror is observed (SONNY-4929)
  • e57a9a0d2fb81211f1b124c660cffdf7d3ff9f01 fix(mesh): record managed operator turns and wake idle receivers (SONNY-4942)
  • c5d4a1225ee1cd7399adfe9f5b9c9bd383941730 fix(mesh): relay approvals across devices (SONNY-4760)
  • 279366b49e4a725c6d501e05e5b1d3d171d409bd fix(mesh): revoke a human-attach key id that begins with ‘-’ (SONNY-5113)
  • 5f227babc7bcfae3ad5b5346fe584ce445f4e9fa fix(mesh): seal the reply and tool results of sealed turns in their run aggregate (SONNY-5010)
  • 63d8c3b84574832268857e973edb113ac400d751 fix(mesh): settle a managed node’s sessions as INTERRUPTED at restart (SONNY-4931)
  • 851b704dbccdf1de3664655eb67e7aea54937206 fix(mesh): settle terminated managed sessions and cancel turns (SONNY-4948)
  • 98ea0a8427f994c8d61f70cfd799c34c3e3a82a6 fix(mesh): stop resends to a closed recipient and cancel the sender copy (SONNY-4944)
  • 1f627d66a27658860d0f0b1f067068ba89da67ca fix(mesh): wire local session adoption end to end (SONNY-4761)
  • c2ed7d972a9c104671050a19e33376c487b19d34 fix(meshengine): apply the refused-provider notice only after the route fallback
  • 81e3ecdf8029f4ce9ca8aae0c3e40c5f6fb5e584 fix(meshengine): record a canceled outcome for hosted turns on daemon shutdown (SONNY-5047)
  • 95b4f7129823cf979a38ce662a24098f9250f5e3 fix(meshengine): record a lost host lease before a hosted handle is done (SONNY-5239)
  • cb324cfc4a354240d8197db065f6f63dd3ebba35 fix(packaging): make fresh-install work and repeat on macOS
  • 45c980c6d608b73acc3db322abb2b424d7acfc22 fix(packaging): retire supervisors on every endpoint before an install (SONNY-1349)
  • d65cab91c5a81a39abb158736e6c11e0e4fd57e1 fix(packaging): say the reload delegates io to running sessions and name only stale ones (SONNY-5244)
  • 36a6e7a9d1f664ec0a1fae83255c07f69cbbc825 fix(packaging): terminate a supervisor the protocol cannot stop on install (SONNY-1349)
  • a453b709ae020f6fb47580ab488b178e402a8562 fix(packload): record llm v0.46.4 as validated for parent-merge inheritance (SONNY-5276)
  • 5672d5374cdb1f13268e4d636d0bdf1bb097c843 fix(packload): validate CheckInheritance against llm v0.45.0 (SONNY-4927)
  • 80aae863a0e10dd7cc3146d42f7b4a6421cf48d4 fix(packload): validate CheckInheritance against llm v0.46.0 (SONNY-4578)
  • 280ff41e887c75ef65a8029662d25b28519813f7 fix(packs): opt in to unsigned embedded overrides in the restored-parent test (SONNY-4756)
  • 51d17241e5b3a06632c463656a7fce2b9561c815 fix(packs): stop startup pack fetches blocking startup or dying silently (SONNY-4829)
  • c7a9395097a63287f15dd1698e6ff9c7bfb37935 fix(packsources): add a local directory as a pack source (SONNY-5127)
  • 6433a7f86057da0f3bde01c031db68433cbfd155 fix(packsources): register a pack source only after it clones (SONNY-5124)
  • 1902d5a3428575b675441e018e2494b2a87f62b3 fix(parity): assign the results command to artifacts.manage (SONNY-5131)
  • 521c3a74eab5a0ef147f2872ca9e156b8ff3324f fix(parity): disposition ClientTurnsSource and re-pin the daemon and client inventories (SONNY-4746)
  • c409b4d12166ca773c8e77cc8b81aba7253a9032 fix(permission): auto-approve read-only forge MCP calls such as read_tool_output (SONNY-5107)
  • 255b52e22aee9f7ed10b98b6e7f53abf63ccf2ce fix(permission): let read-only forge api GETs with command substitutions through the headless publish gate
  • ca415257814da56eecc9f958f49d736fb3a39923 fix(permission): lift every per-call approval class in dangerous mode (SONNY-5255)
  • bfa0f241f27f7ad5d56beb26367fbee314c49e98 fix(permission): place absolute effect paths against the checkout root (SONNY-5261)
  • 59a943545b9ab85646181be5b503ab1537cf0e83 fix(permission): require direct approval for go clean -modcache (SONNY-5307)
  • 9478720a2b4ee38cdf5054434252916a025d53e6 fix(permission): require direct approval to overwrite uncommitted work outside a worktree (SONNY-5118)
  • 1d67fa2507a84bac8141d6ee884232e302d2c031 fix(permission): require direct approval to read stored credentials (SONNY-5266)
  • 1b933b18546a8677f60487f6a307d43a4ba89f8d fix(permission): run workspace-free tools in a chat with no trusted folder (SONNY-4927)
  • ecabb4e9086f30eceeb2ee78a4b7a3ddd72010fa fix(permission): treat read-only noun-only forge tools as reads in the headless publish gate
  • cab700787f1dec86b3b6bc850e2d9fd1df951c79 fix(permission): treat repos nested in a child worktree as isolated (SONNY-5257)
  • a975de0900a58b5d841f15ddebbc2f3d9c5e6a35 fix(planbaseline): let the recovery report settle journal records (SONNY-4927)
  • d28c27e3638dcf64f3d9dfb0b4355e46b5e4cb66 fix(planmode): grant GitLab reads before planning and in Plan mode (SONNY-5102)
  • 539f3c2eb66f45e7b2de2d4e7e0785f6ce967061 fix(primary): never call a retried attempt’s timeout terminal (SONNY-5539)
  • 3c78b2558b67c35caa61d071555982e4174ed1c2 fix(projection): name the live turn progress kinds in the reducer switches (SONNY-4745)
  • 197c694cdf7552e4639cb9a2cc168c5c0b32ff8b fix(projection): settle session state from an external writer’s turn activity (SONNY-4113)
  • 5fdbc78657f6b59d9d00f6d194ee807e735a1aef fix(projinit): reuse an identical generation on disk and keep the title checkout-independent (SONNY-5047)
  • 405c6b376e4ccd3ecc046e2e3084f25a7728569c fix(promptcache): send a stable per-conversation prompt_cache_key on OpenAI-wire requests (SONNY-5047)
  • 512e5fe6984c63f5e454a8399ad09fbc26674b8f fix(protocol): align served session capability metadata (SONNY-5472)
  • b195cd335cbd4e8c7cb1ef34e75272ced1fd85c9 fix(provider): send a catalog row’s api_model and params from every session binding (SONNY-4829)
  • d1276c69782952c282db6e773eb5774509f163ab fix(provider): send the catalog row’s api_model and params from hosted sessions (SONNY-4829)
  • cdeef4c62f20575aa975fc78657613d60d9f74b3 fix(recipes): preserve declared scope refusals before fallback
  • 4a38e0428ccf7ad407ae56229fe031f20e7a392e fix(registry): record provider account command contracts (SONNY-3925)
  • 35b2d1dcc05bcd383eae4a5b8f881bd14200dbbf fix(release): give Linux and Windows desktop builds a two-hour job budget (SONNY-4578)
  • 3bb991a9050d56950d8012388f12336af5411335 fix(release): name and depend on prerelease desktop Linux packages by their deb/rpm version (SONNY-4578)
  • b2e59bd77ecc1bf390d221aa730aa1105f30f012 fix(release): publish prerelease desktop deb/rpm assets under the release version’s dash (SONNY-4578)
  • aac88ad4bf4e21b76fae573c490bfaf703989a16 fix(release): put the macOS signing keychain on the search list (SONNY-4578)
  • 47f437a3d10d52920631fce8aee611fe3ce4d785 fix(release): sign the NSIS plug-in DLLs the Windows installer loads (SONNY-5101)
  • a603b6eae6cc942aacf816748f31a93dd7ad9978 fix(release): unblock the desktop signing candidate on macOS and Windows (SONNY-4578)
  • cf57ec852b788ef666e8247bbe3699e80d2bff58 fix(release): verify the WebView2 bootstrapper against pinned Microsoft roots (SONNY-4575)
  • cfb086a77a7c66bf02a59faa6db71660742c0bf3 fix(replicated): bound undelivered replication intents on the local profile (SONNY-5062)
  • 7db9f8ba6f5081d82b58dd086fb51c88653f33b0 fix(replicated): forward acknowledged outbox pruning to the inner store (SONNY-5070)
  • 5552ca2bf9a6103947b6af8b38d69413bb3f1590 fix(replicated): forward acknowledged outbox pruning to the inner store (SONNY-5070)
  • 53f7f4765e8748dd17fe6dab0c15124a0b74a6b4 fix(replication): preflight imports and fence private scope lifetime (SONNY-763)
  • c7a20b46245a09eaecd0975f2c47bc4c06c4cff5 fix(replication): retain exact sealed session history (SONNY-763)
  • 7a749f3a8c506fd8743cc29822a8d6f6de0ba446 fix(resourcereuse): a read the result cap reduced never backs a full replacement (SONNY-5117)
  • 2afde15138272079dca922bd96c60d2acc4cdcc8 fix(resourcereuse): accept a chained edit naming the session’s own after_digest (SONNY-5093)
  • d606648f7898407fb8da274e16d35e3e519e71c8 fix(resourcereuse): build the line-anchor observation with the complete-only constructor (SONNY-5117)
  • 2b42243f07f6c44ad7a326dc0d1f93c9356a7eb7 fix(resourcereuse): canonicalize the model’s expected_digest before judging it (SONNY-5263)
  • 0cf861f4cd9bc7ae98e8a94481e088455d8ffcbb fix(resourcereuse): keep the observation when a failed edit left the file untouched (SONNY-5090)
  • 7547fdba28603ba1c8423a78944b89b548a93461 fix(resourcereuse): name the untrusted basis when a recorded digest is refused (SONNY-5246)
  • 360021cd313c7686ff42948cbaa6ca68793ed7e4 fix(resourcereuse): only a delivered read body may be a reuse source (SONNY-5089)
  • 3838b0d11195dc39768764280ca2175f8c06955c fix(resourcereuse): refuse line-range edits on lines the session has not seen numbered (SONNY-5112)
  • b90b95623cd00bd8c997ff9703f74942e33bf3c5 fix(routing): classify a local param refusal as policy and say what to change (SONNY-4640)
  • 484c1b6e2e0c9184156d40ec6b32463935bb0100 fix(routing): classify a provider that never answers as a retryable timeout (SONNY-5092)
  • d2e1e08190f58c0fa2a8582edbd762aed8f8377f fix(routing): fail over to the next candidate on a capability rejection
  • d6895598ea9276440f327b6479bde993a56eb745 fix(routing): fit routed primary requests to the dialed target’s window (SONNY-5047)
  • 286670d0ef00e1a9795088ee3f7570bb0c97e00c fix(routing): retry an undelivered provider hang on the same target and bound inactivity, not age (SONNY-2290)
  • bc280b17060be639e62a424d22f774dd8500e61d fix(routing): retry undelivered provider failures with outage-length backoff and window budgets
  • 84b747594c2b203db059a5abaf14ff02a8713734 fix(routing): settle an overrun hold and keep the paid response (SONNY-5047)
  • bbfaa9a1ea381129bf9388ab2d7aede51b64aece fix(routing): shape reasoning effort for tool-bearing calls per deployment
  • 6477b684d5b34b510540550ef52a7d940bd486ec fix(routing): stop fallback targets inheriting the primary route’s reasoning effort
  • fe200b192b929779d7e74439be6424bcd29cb8de fix(runtime): a parent cancel after workspace-lease expiry still stops the child (SONNY-5047)
  • 2d4323cdc659480643bea78e11407421b6c51afa fix(runtime): a split-admission refusal fails the call, not the turn (SONNY-5261)
  • fae6a5af2038859062c06ff76fd0ca1a9b14d0c4 fix(runtime): bound goal completion review loops (SONNY-4744)
  • 70f21a0f6f3f90215702a1372cb4d0de12e4dd96 fix(runtime): bound hosted session residency (SONNY-3425)
  • 6ffafcdad100650fa99d7ba1e744ef5fb679ee92 fix(runtime): bound how long child reconciliation yields and retries (SONNY-5047)
  • b215ea7f45785e213eeed27b38058ed38f63c50d fix(runtime): bound the goal completion review’s input (SONNY-5274)
  • b80eb25460b8ffd90439e478717e09d6f86114bb fix(runtime): calibrate the compaction estimate from the provider’s own prompt count (SONNY-5047)
  • c824acd9ec6a736860c1cf11ae5da9baf929f0f1 fix(runtime): check each fact detail once instead of on every append (SONNY-5061)
  • 61f7b028d33548531a8b36d45e86e158607d1bb0 fix(runtime): create delegated child worktrees in the per-user cache, not beside the checkout (SONNY-5047)
  • cac98af30a45411b5252e162937bc21f03af34df fix(runtime): end a blocked goal as a turn waiting for the user, not a failure (SONNY-4927)
  • 22edc37c29ac4b2e8e6c8484c27d313e77ef8167 fix(runtime): end a workspace-less policy denial with an actionable outcome (SONNY-4927)
  • 3a967a5236937ba67e2e261e950ef03f98154ae3 fix(runtime): find child worktrees in the per-user cache as well as beside the checkout (SONNY-5047)
  • b630047ae3dcef088058d9ca7f8dd4cd246eca7c fix(runtime): fit the retry after forced compaction instead of deferring it again (SONNY-5047)
  • 4095b04deb515c2f30cd7009af83e565f99f5715 fix(runtime): fit the retry after forced compaction instead of deferring it again (SONNY-5047)
  • 3c36fc32797972bc44cf6ff2ce989854f602a70f fix(runtime): give the goal completion review its own output budget (SONNY-4927)
  • e4a3e97be474aefc3cfe3991ef8f9883e2d5e8d3 fix(runtime): give turn finalization writes the store’s lock-wait budget (SONNY-5047)
  • ba1467e5b5be0222e5f953f82969c06d72efbee2 fix(runtime): ignore timing fields when the no-progress guard compares results (SONNY-5111)
  • 863326ad0127cc9471a1af513908652a1eb9a5ab fix(runtime): ignore tool_search timing in the no-progress guard (SONNY-5111)
  • 4dabb131b629509efcfc512db3d06183885577ec fix(runtime): integrate only a pulled child’s own change (SONNY-5306)
  • 92c9f6324437e83eb6e59b013289fd76637821ad fix(runtime): keep a discarded child’s work under refs/sonny/preserved before removing its worktree (SONNY-5047)
  • 5daed221e630e542143d6d03c781d84279d65e9d fix(runtime): keep a running child whose workspace-lease renewals the parent missed (SONNY-5047)
  • 2a3f97315d9a100e5d83a8ab6aeae6426942cbc2 fix(runtime): keep child reconciliation from starving the live turn’s writes (SONNY-1349)
  • 8a27b06658b87c9034b4b74b0037e43b42bfe59b fix(runtime): leave untracked nested repos out of child snapshots (SONNY-5258)
  • 794bb6ef841e24a1b4e228a83fc9e9f68d5e5b74 fix(runtime): let a canceled Sonny git delete its locks before it dies (SONNY-5047)
  • 68eb18563760f48d8459cfbcc9f708394477cfc4 fix(runtime): relay sonny run children’s journal appends through the parent (SONNY-5047)
  • 304f3130e91e403eb626be99c068121b8aca9550 fix(runtime): remove child worktrees that hold no work under the integration claim (SONNY-5047)
  • f02542bee68b105d258b856fc3957382570e69ee fix(runtime): retry a reasoning-only review once and keep an unreadable review unverified (SONNY-4927)
  • cfde30f6350e1bb2d033bace646ed6c1f0be6f57 fix(runtime): settle a relay’s conversation with the task it forwards (SONNY-4926)
  • 6703653786416c87f414bc058b7258780a2ec7fe fix(runtime): stop a foreground turn that repeats identical tool calls without progress (SONNY-5069)
  • 889206350285e6482aa02c8d27a3f3687a6ef2fe fix(runtime): stop a turn that keeps repeating the same file change (SONNY-5111)
  • a5ec975f6368938c9dbd3255472bad618d68bb8a fix(runtime): stop capping main-loop replies at a row’s 1024-token default and recover cut-off replies (SONNY-5064)
  • 0633af9451d0a4a416288e42b8643c65d039c18d fix(runtime): verify a resume from the verified head, not the whole journal (SONNY-5045)
  • 17af8c9bf4a377e2999e1e448cc8a308af9c7597 fix(runtime): verify a session journal from its verified head (SONNY-4905)
  • b505fe35b990a6e42627c1ce8281020266e92940 fix(runtime/hostlease): treat slow renewals as unconfirmed, not lost, until the lease expires (SONNY-1349)
  • 7afa6b7b730d212e8c5376f9ed8ff950a1acb411 fix(runtimeworker): wait briefly for a session’s previous fence (SONNY-4927)
  • fc1187ee6e5d8bd694cac6b92ec59113b26f2e5f fix(secretresolver): kill the token helper’s whole process tree (SONNY-5593)
  • 118daca94d2966110a78340c1836161891864733 fix(secrets): one secret-failure policy for TUI and hosted sessions
  • 20601b61b2e5c865817755023bd72e27fb3de036 fix(sidebar): cap the goal to three rows with an ellipsis (SONNY-5243)
  • b99b37c15ce91f38d9abc5e0c73ece3339e076a0 fix(sonny): let exec work_dir follow the host-wide posture and child worktrees (SONNY-5311)
  • 4eb7919c341da56870167ceae49ce1151ebfe357 fix(sonny): open a new session on a usable model, not an unreachable keyless local one (SONNY-5251)
  • 11908e95f9da0de475e857b6aa5bb3642d83eb29 fix(spawn): accept spawn_agent add_dirs while the session auto-approves (SONNY-5268)
  • 609edb181370d1bb33ad2aa5545ce32e129d7d51 fix(spawn): hand native sonny children the session’s MCP integrations (SONNY-5087)
  • 0ca89ca1fecfe8d3680dcf5a6617901b402f1ddd fix(spawn): keep the REPL gate construction the turn-registry test pins (SONNY-5256)
  • adc40242d2eb3e4a89e41c22c8680ef9de5e17cc fix(spawn): sub-agents inherit and follow the parent’s dangerous mode (SONNY-5256)
  • c969bab98f9742710b4806762c9a03dc3b82032b fix(spawn): worker resolves the parent’s pack copy; failed launch reported (SONNY-5543)
  • 99a39bf5dc27365e75ffc3d654bb2169de17c9b8 fix(store): back up every event of a long runtime journal (SONNY-4905)
  • 9dcdae9ff0623ac109189addca565bd296830bd8 fix(store): checkpoint and truncate control.db’s WAL in the background (SONNY-5047)
  • 0be59eeb4954a3804a9e8d4e650d66b124a090d4 fix(store): delete acknowledged replication intents from the runtime outbox (SONNY-5070)
  • 67170b38d77d5e93b6a169e0de7801b4bcdc16f6 fix(store): delete acknowledged replication intents from the runtime outbox (SONNY-5070)
  • e466ae883de557b8f8b932554baa9b66ec14afd6 fix(store): index runtime blob pins and prune blobs in batches
  • 67d64f481b4bc4856bc6c1cfe528868fef6629b0 fix(store): keep host lease renewals from starving under bursty write-lock contention (SONNY-5047)
  • 1f42dc66b203b5f09054e752253ae66e507ad8fd fix(store): keep the re-host heap test out of race builds (SONNY-4578)
  • 5f9bdc3b56a4ded51809ef6d9f607512f8907d02 fix(store): lease a runtime outbox topic through a topic index (SONNY-5062)
  • 0a79de006223c42fbc26ae14e61667739e4ecee8 fix(store): read session projections without decoding native protocol facts (SONNY-5044)
  • 57e413cdc991d0b62b322f3557fced02dff531c3 fix(store): read session projections without decoding native protocol facts (SONNY-5044)
  • 2a0540e616bd3757a427444bff9a090ed0f7f7fa fix(store): register sonny_sha256_hex in the SQLite migrator itself (SONNY-5071)
  • 33a1ea91f6e9f81f20089526e13e66febabc65ba fix(store): register sonny_sha256_hex in the SQLite migrator itself (SONNY-5071)
  • 591ff71277c08a4e1515404bf0f3818f650c44e3 fix(store): retire settled agent mail and enqueue no unrelayed mail events (SONNY-5240)
  • 524868a79418cf55a6d8d3253f9a5165ac5faad1 fix(store): retire settled protocol history in the local supervisor’s control store (SONNY-5238)
  • c92e6752feb4111aa8c6b6ad72da3584a368b1fd fix(store): retry transient fixture database drops within a two-minute budget (SONNY-4578)
  • cd2db395fce44ae614490ea149677dca9b5b4863 fix(store): wait for foreground writes before retiring agent mail (SONNY-5240)
  • e623671da654f8dc1bf45b524c8475fafb3ab57e fix(stream): steer parent input into the running child turn (SONNY-5252)
  • 8bcc9102b698dda7ac6cc6214ad7643aba8f6308 fix(subagents): ask a read-only child for file contents only when it must create or change files (SONNY-5047)
  • a3bb185aa840a9d67ea9045569e958dde4beea70 fix(subagents): bound mis-scaled exec timeouts and surface why a child exited (SONNY-5047)
  • 2195e4587fb446983aa34676858bddcccba7e2c6 fix(subagents): retry timed-out child reconciliation and contended budget releases instead of logging them as failures (SONNY-5047)
  • 6e0ce79cd9d332184f38bda1120760f8cfa05663 fix(subagents): stop a delegated child’s no-progress loop and deliver parent input mid-turn (SONNY-5047)
  • cf5bf1c9d15d790ffc48285e9eba768ebaf20b63 fix(subagents): stop the child progress guard flagging paged reads and killing a child that reported or edits (SONNY-5047)
  • c66708382312e8ae45138b83f9b7669798ed1125 fix(supervisor): keep serving when a client hangs up before Accept
  • 5af04c78b82b7e4459937c23b5404aa8c2e74ba8 fix(supervisor): name the local daemon’s isolation startup failure (SONNY-5589)
  • cf1d4660bbaba96fde189213ebf2d15758707353 fix(supervisor): pin the Unavailable code of a refused daemon slot (SONNY-5589)
  • d7b8d3f8e7f38c52d3e90936e39f2604c90699e6 fix(target): learn which reasoning remedy a deployment accepts beside tools, and stop on none (SONNY-4829)
  • b2c68e83d9f82c844022de3e230bb8cec14c9026 fix(target): reset only after the request is read in transport-error tests (SONNY-2283)
  • fa771e7f5f0326b9e8bcf37387a6136711aa6a91 fix(target): retry a tool-bearing turn with reasoning_effort none when LiteLLM rejects the pair (SONNY-4829)
  • 836d8101a57c58617058dd4ad25442b2818ba987 fix(test): give expiring store fixtures 15s on slow kvm runners (SONNY-4578)
  • 032dd83f2255c61f91895c565fa2ee5b33fef5b1 fix(test): give the expiring relay tasks a lifetime a loaded host can answer in (SONNY-4578)
  • eacf433cf06e45d72d83a5b40fe79022a817c901 fix(test): give the wake expiry fixtures 15s on slow kvm runners (SONNY-4578)
  • 6f40d81c811c36dcf9194c5e99ce75251b8d588b fix(test): leave the peer fixtures time to confirm a stalled lease renewal (SONNY-4578)
  • 73231952b83b1e533f33b2b992471e0ade992d96 fix(test): reconcile drifted parity, CLI and mesh peer tests (SONNY-4927)
  • 1e8d4526b540e3fb9a371e8d95296ebd2aefca24 fix(test): run the resume measurement as a smoke check instead of skipping (SONNY-4578)
  • 0d23ceb952b43bdc2f62c4103fa1dfbbca394751 fix(test): stop git fixtures following an inherited GIT_DIR into the caller’s repository (SONNY-5242)
  • 59e1198385aacdf2b0ed27b1f5fc0f867dfaf5de fix(tool_search): match nothing for a capability the session lacks (SONNY-5088)
  • eba659485edba26cd7afd41a81ae9aab53c25c9c fix(toolexec): point an undiscovered tool name at the discovered tool it matches
  • 811fe4ac71bf20831ecbf8f0b8f6a493c39d5d5e fix(tools): delete_file, headless /cd and mesh file tools read the posture per call (SONNY-5254)
  • 0b0766d26385c838897181c31d027a004a2325de fix(tools): keep MCP out of the work-management model surface (SONNY-4578)
  • e238d5fd11485b1580e876d3d724c26339ded7bf fix(tools): keep job_output and job_kill callable once exec starts a background job
  • 32838bb4b1a074adcceba8cd71c2997d49167131 fix(tools): native file tools read the host-wide posture per call (SONNY-5254)
  • 514580021e63f224dc4b1daa0753f441d7d1675a fix(tools): provision private staging for in-process workspace scopes
  • 7292e67745ba2882b7c7445e248df70519596396 fix(tools): report partial results as successes flagged partial, not tool failures (SONNY-5066)
  • ba700e4951904aff510a8e77fb85ef6339f1ed4a fix(tools): tell the model to wait on background jobs, not poll (SONNY-5398)
  • 26689f1f7801dbe1c1e81986090896b6761daa81 fix(toolscope): allow cp/install of binary files into the workspace (SONNY-5542)
  • a553a740262acadc2d4ebe76f48c24c381f748ee fix(toolscope): declare the agent-process tools with spawn_agent so the tools array never grows mid-session (SONNY-5047)
  • 886d308f7854db975ef820b5faba2592258aba84 fix(toolscope): keep read_tool_output reachable for restricted packs (SONNY-2338)
  • dfe4e6b94cd151e4b8a49a0eaa92768e3db8140f fix(toolscope): let exec run sonny help and version without the agent-launch refusal (SONNY-5473)
  • bbcbc42ee9156861f76ca8b62a519fc748ad8d37 fix(toolscope): point exec git commands at the typed vcs_* tools (SONNY-5104)
  • 3c2509f3d13e0c224b421c1d9a7798f283f59058 fix(toolsearch): stop the reworded tool_search loop (SONNY-5110)
  • c36ccbd19a9b8e24979b89b47dd4912f8f99d64a fix(trace): count a reaped child’s events in its summary (SONNY-5245)
  • 76af4c6e99857be3f093700553b1ccffa0aa818c fix(trace): name ScanError files relative to the scanned root (SONNY-4927)
  • 8d432037abe32bc45b11619172bc3661bf9d1709 fix(trace): record a run’s own termination reason in its summary (SONNY-5259)
  • 4a1278ff9d2c7a27afdfcd77c8791b77d3fa09c2 fix(trace): record the child’s own identity on agent_session (SONNY-3592)
  • e598249f8a724390adfacdf8c065fca929acf5d2 fix(trace): redact a password-keyed JSON container, not the rest of the line (SONNY-5406)
  • 61b846061658a062c1bbfb9da6fc32e6e4cf70d8 fix(trust): judge desktop sessions by the desktop’s workspace-trust grants (SONNY-5270)
  • cdd49fa83b1e3e6c0c7ba569e9a804bdbfcb3dd9 fix(trust): re-read workspace trust for a live session’s project MCP servers and hooks (SONNY-5308)
  • 309facd3cd0d9c087f052832e5e23aba9b5d45f4 fix(tui): admit picked and pinned models through canonical routing
  • d66468d5f5bc5634e862f8a2d0d232eb24669058 fix(tui): authorize primary factory against served profile identity
  • 281a23e06212b33185c474d5edb9a9d2ffcb4c3d fix(tui): bind picked api_model rows through canonical routing (SONNY-4829)
  • afbbd4bfdbd6a39044ed28863501b2c946616916 fix(tui): fence turn activity with the host owner the turn ran under (SONNY-1349)
  • 4cdc5b63d4c68b2a0fce2ba94f73afc65ecde985 fix(tui): give each TUI session its own conversation tracer
  • 1c7823da1c568be481c07ff757a28dfc0b9e3ab2 fix(tui): keep boot pack picker modal (SONNY-2588)
  • 13413f10b72ebf71dccf565997e31b7c76225906 fix(tui): keep local turn activity over a stale daemon projection (SONNY-4113)
  • 62106f9382d1884c5ee437b64ce06c9e450e164f fix(tui): keep pack secret warnings off the TUI alt-screen (SONNY-5474)
  • 2980c27431ee05f30d9c24c58123d8e7b42104de fix(tui): leave the tool pill when the next model request starts (SONNY-5407)
  • 33ab44ae0bfbe546ffc79e4f6ffc14cbc0516037 fix(tui): open daemon-hosted sessions (SONNY-4765)
  • b344e0c848dad5309c70083d4923c2ee3b4490cf fix(tui): polish transcript navigation (SONNY-2584)
  • b01535894bcf59652127579af83a365dd39d67aa fix(tui): record external-writer turn activity in the session stream (SONNY-4113)
  • f6fb31d953f56055052f69b2b261205fc8339de7 fix(tui): recover a sealed external writer owner on a new lease generation at the next send (SONNY-1349)
  • a5c55617e945d1efa9b5c7c94e4c45afabe7adcb fix(tui): register a cleared session with the daemon; stop the repeating live-state Failure (SONNY-5475)
  • a7fb8a05b0b22b08a3ad0af160648accefd21e59 fix(tui): resume sessions the daemon runtime has never journaled (SONNY-5403)
  • 562c57a713b2a83f41cac82a09f075859bd6401f fix(tui): send the TUI’s route switches to its daemon session row (SONNY-4113)
  • c1d23fd01d7720e7f0e1d0a521368e2fa62dc2ee fix(ui): apply a same-id pack switch whose content changed (SONNY-4927)
  • baf5100b7925fe4ea11550e1e0b2e4d5040718df fix(ui): deliver a canceled turn’s terminal error (SONNY-5401)
  • 4a6fa9efebe02883b5639b809d9024d959202d65 fix(ui): fail a model-less turn with its real reason and trace it (SONNY-5452)
  • fab72c71aa83f5292d8a981da253ec5766196f5e fix(ui): filter the environment start picker by the latest running set (SONNY-4927)
  • e250dc697929d70a99adb7283775aa0ab1035430 fix(ui): keep a session busy while its sub-agents run (SONNY-4113)
  • 42da019f7c41773337349eda3b39af96785fc83b fix(ui): keep text streamed before a cancel in the interrupted reply (SONNY-4927)
  • f223b05dcb6dc1bc6550e2511252b3103d23fa7e fix(ui): keep the shown plan revision rendered while it is re-read (SONNY-4927)
  • 973eef43f49fc90163b3080caef4220253cc478d fix(ui): let an in-flight turn settle before quitting the TUI (SONNY-5047)
  • 3d9405b47e16d11702e68c945867fc5b90b297c8 fix(ui): offer approve-all with dangerous commands on a publication prompt (SONNY-5108)
  • 777a1de75cf78ca78b02949cc1e2614b34b89b2a fix(ui): re-list New chat models after Settings closes (SONNY-4921)
  • 179ef0aff66545127289f33e315f7a692013672d fix(ui): restore the frozen ui install and the /jump and /split gates (SONNY-4829)
  • 1fd052f4524b5b6713cfc44167cfdfdea65494c9 fix(ui): say “canceled by user” only for a cancel the user asked for (SONNY-1349)
  • d097d13d8851e0cde31f3614ba65330206dfc10f fix(ui): say which provider refused the connection and what to do (SONNY-5251)
  • 7d055ecd6d73e83dd6a76be967a337e35c5e7ab7 fix(ui): seal collapsed poll card with done glyph when polling ends
  • 179c974a5e47b0cf8fb31dff33f5d80f29223400 fix(ui): show notification reasons and parent-cancel stops in the sidebar
  • c8bd4bcc7c9da0dd3fbeec3f0e5d0b4114abbd64 fix(ui): stop calling a /models selection a pinned model in the routing log (SONNY-3150)
  • 701a333134fef1667e2716f2c9178b1fe0ac592a fix(vcs): bump llm to v0.46.2 and llmtools to v0.16.6 for vcs_fetch and vcs_pull (SONNY-5103)
  • 090c7c9548b9bc19fdeae4c2e767a12307e9f824 fix(vscode): allow extension signing setup (SONNY-201)
  • babe5ccfb49626962af6feb0d6bb1faaa33390fb fix(windows): stop directory fsync failing with Access is denied at supervisor bootstrap (SONNY-5099)
  • c8538c06d9858a9e4499a4d7d212e1dde078a475 fix(workcoord): resolve project work claims per repository in a multi-repo workspace (SONNY-5073)
  • 375bee33a766eeaa8824a9d896cf1bc4b9bb61d9 fix(workmanagement): satisfy repository gates (SONNY-4812)
  • 686685f7ed067bcb9fb30b866940132c4136a516 fix(workspace): untrust revokes every grant status counts, desktop’s included (SONNY-5309)
  • 0151981972e7a634cca54bdf74ad3b6dad00a307 fix(workspacetrust): hand a trusted multi-repository workspace’s trust to a delegated child’s worktree (SONNY-5047)
  • dfdcc227b347717c5b9257788dba6b2317d803af fix: accept the upstream manifest’s pre-move module path (SONNY-5074)
  • a3c3b76a88718a798496ee04a978e627f9fa469f fix: finish the module-path move in the shard script and bench conformance data (SONNY-5074)
  • e845952e5b943f055122bf94c8b54ddcac017009 fix: gofmt the files whose import order changed with the module path (SONNY-5074)
  • 30d37aa5a92af2178c6c4dc3306f6a9aef91c945 fix: integrate Sonny session fixes and preserve migration ordering
  • cbb8dd22148a5f4eeddbf02910d36d6b9a955827 fix: keep identity strings on their old values and finish the module-path move (SONNY-5074)
  • d947d96efe40edbf7577fda492261dfc0dad59ec fix: keep the evidence trees out of the lanning.dev/sonny module zip (SONNY-5074)
  • ff9d526c67a6c80cbe6b982e0fb905866e02c9da fix: let the bench gate compare across a module-path move (SONNY-5074)
  • b56c48acaab7b3e820f67d039e2c0a0e51e64aac fix: move extraction-consumer test module to lanning.dev (SONNY-5074)
  • f244585906ad731598d81e7c5ab255fe3b7166a3 fix: point the sonny-module archive tool at the lanning.dev module path (SONNY-5074)
  • 1da96daf918401ae232e0a9e54a0046a7965b5bf fix: qualify shared library consumers (SONNY-5177)
  • 149657a6a90fe14f3d300651b2704c879b820d9d fix: reconcile integrated host loss and migration definitions (SONNY-5131)
  • 15f9ff7081f04df122c4bd815302097e2b6bdc8f fix: reconcile module imports across integrated Sonny MRs (SONNY-5131)
  • 31756c53ca07f4c6324a880cde53cb6b70a821ac fix: release attachments on client disconnect (SONNY-4767)
  • bd0f41d04003bf1b46180692949ac3fbdfc4d7fd fix: reseal the TCE fault report against current main (SONNY-5074)
  • f6b834491f68bcd660c8291e1de74bb7d28671d4 fix: stamp ended_at on child sessions canceled by their parent
  • a605db7c50baaa7ca648f930bb4f4b11ece2ca9e fix: verify complete duplicate sync envelopes (SONNY-763)

Performance

  • 52baf6680dd01a8994b3ca9fe0a72c6bc969fa2f perf(ci): let precommitci-authoritative read the go-build caches (SONNY-4949)
  • bc61baf7b019b0138b8bf56183b6db7d948a203c perf(ci): publish docs beside validation, only when docs change (SONNY-4950)
  • 1f6d01bc616cb52e5e6d3b9885df23428ef2a6cc perf(routing): store shared route snapshot parts once, content-addressed (SONNY-5047)
  • c484bc52fd844659cb8dbf3a6bca9a475f7881a7 perf(runtime): store session state in append-only rows and checkpoint periodically (SONNY-5047)
  • 39a702476392dadaf8a4c54cb619e7a039392ffe perf(runtime): verify the journal once in InspectRecovery (SONNY-5019)
  • 221227107e94ca2bbeb2a6e3922458a25453b29e perf(store): verify a long runtime journal within the re-host bound (SONNY-4926)

Others

  • 814580c72ff19aab56b420ef5553df983f469328 Merge Sonny cache, coverage, and test CPU fixes
  • 9222cf675a3fb5306bf98b7d8ac4a6ff026a713a Merge commit ‘050a08f6d1015697f1588138bc353435761f839b’ into codex/direct-merge-197-606215
  • 74d096a66569ed88fe2306508bf54ff7f09d866b Merge current main into the Sonny integration repair
  • 5b2c9a40565e35ad5a8bca8c7e2f611c7b7001c5 Merge origin/main 286d26153 into sonny-gate-c-fixes-v2 (SONNY-3411)
  • 48c30b0fdeda44e02e00a717d254ec015c65f437 Merge origin/main a7f96a0fe into sonny-gate-c-fixes-v2 (SONNY-3411)
  • b246670c4c8f095d26d56ace299d171a20231292 Merge origin/main into chore/lanning-module-path (SONNY-5074)
  • c1d03e0d0b7288be1e14ac4f8bcd079f0e9d1a9f Merge origin/main into codex/sonny-1697-startup-qualification
  • 0f15da6acc909ec7d1830cdd80ad802badf978c0 Merge origin/main into fix/gui-tool-call-details
  • 1db0372b26305a8015e7a286c535304806391ea8 Merge remote-tracking branch ‘origin/feat/mesh-managed-provisioning’ into integ/fixes-20261023
  • f02d6b98ef6308240a9a7a42b3ece28c77049c30 Merge remote-tracking branch ‘origin/feat/rename-daemon-sonnyd’ into integ/fixes-20261023
  • 7860bc2e336f32fda1e01893fa2a8f054a97a690 Merge remote-tracking branch ‘origin/fix/agentguard-sonny-help’ into integ/fixes-20261023
  • a8a4a236c8dcab05144fd6a2e4bdf6faccdd6239 Merge remote-tracking branch ‘origin/fix/cmd-sonny-order-dependent-tests’ into integ/fixes-20261023
  • 21bb62270e77959bbb210d04d215b06cbf2c77f7 Merge remote-tracking branch ‘origin/fix/compaction-timeout-breaker’ into integ/fixes-20261023
  • e0e9465e61979db5008c2daa0eb5122d7b1d71df Merge remote-tracking branch ‘origin/fix/daemonhost-ensure-reuses-listener’ into integ/fixes-20261023
  • 3fe182bbff590f7d072a3ee6765bd393de73ada8 Merge remote-tracking branch ‘origin/fix/desktop-pack-source-test-flake’ into integ/fixes-20261023
  • 6c52d2536c2fc0c67495bbb609d3e5c865b4c966 Merge remote-tracking branch ‘origin/fix/exec-guard-binary-copy’ into integ/fixes-20261023
  • ea2d73ad2abacfe20177a273e538ffabb83da423 Merge remote-tracking branch ‘origin/fix/gui-auto-model-selection’ into integ/fixes-20261023
  • 97dd44c575a50ebab67aad08d7163c1c3cdaef57 Merge remote-tracking branch ‘origin/fix/gui-session-delete’ into integ/fixes-20261023
  • 687e37a58a1858e844609c70d2efc3379bf4aebe Merge remote-tracking branch ‘origin/fix/host-lease-confirm-failure’ into integ/fixes-20261023
  • 75bd7026f2a6d7243c21e83d58329d62e939b00a Merge remote-tracking branch ‘origin/fix/mesh-dockertest-cluster-view’ into integ/fixes-20261023
  • c02c9abeebed5adc06ca4d49c4650158132395ef Merge remote-tracking branch ‘origin/fix/primary-retry-diagnostic-terminal’ into integ/fixes-20261023
  • d3278730bc0b77adcb044ad2849578190ec7b7b3 Merge remote-tracking branch ‘origin/fix/reconcile-advice-stop’ into integ/fixes-20261023
  • 37f6aa2a65bf9aca248eb3ab9c24234a283af3e1 Merge remote-tracking branch ‘origin/fix/regression-evidence-timeout’ into integ/fixes-20261023
  • 1610c48bb8b39a2912dd5c87ca30a88a52516f8f Merge remote-tracking branch ‘origin/fix/spawn-agent-pack-source’ into integ/fixes-20261023
  • 7912f634f16a230eaff5074d114b659efef6bda4 Merge remote-tracking branch ‘origin/fix/tokenhelper-kill-process-group’ into integ/fixes-20261023
  • c0b4c25efc211fa84168ea93b5e97628a92f2042 Merge remote-tracking branch ‘origin/fix/trace-redact-json-password-schema’ into integ/fixes-20261023
  • f98f4940ad9c312d36adb962c39dfe0b3c0f6820 Merge remote-tracking branch ‘origin/fix/tui-phase-after-tool-batch’ into integ/fixes-20261023
  • 7bc565033c8eb9e3d9c1207dcfd82d74d192d98f Merge remote-tracking branch ‘origin/fix/tui-resume-session-not-found’ into integ/fixes-20261023
  • 02623afd560e765d26ab98c282dac585d9b598b7 Merge remote-tracking branch ‘origin/fix/tui-third-tab-clear-and-stderr’ into integ/fixes-20261023
  • 6857283252d7432ebba4d0d09c950698380543d9 Merge remote-tracking branch ‘origin/fix/windows-mesh-service-install’ into integ/fixes-20261023
  • 0eafbb1f152404a8df2b4a3ec1e1825dcb636cc1 Merge remote-tracking branch ‘origin/fix/working-budget-thrash’ into integ/fixes-20261023
  • 050a08f6d1015697f1588138bc353435761f839b Merge remote-tracking branch ‘origin/main’ into codex/sonny-4812-4815-support
  • b9bec7e1e052a4ec49cf56410836bfa896847ae6 Merge remote-tracking branch ‘origin/main’ into codex/sonny-4812-4815-support
  • 2adfe17f5c163155986ac78ace7d139aef3725e9 SONNY-4755 compose base doctrine for hosted sessions
  • 9de2b41edc10ddefbd88cdff8b588ad49b5b1c65 SONNY-4756 protect embedded recipes from unsigned shadows
  • 63e0c160dd78657d32048bb8661fea28bc4a9a41 chore(deps): bump devnw.dev/llm to v0.46.1 and llmtools to v0.16.5 (SONNY-5065)
  • da4a0dcec9864a518631f2a87ffe42c79e7f752f chore(deps): update all dependencies
  • 5bb6c45dc017b9994a540b65ee7da15b457f44dc chore(deps): update dependency certifi to v2026.10.19 [security]
  • 0b290a166ee30a84a1ad20a0c84fc53af9d24ec8 chore(init): refresh the tracked project init state for AGENTS.md (SONNY-5047)
  • 225dad29a6ecff024870c6e05c50d5bd06d692cf chore(recipes): integrate main for runtime review (SONNY-5031)
  • 192e590345c6a4bf1ef8f72b043b318084ea84d6 chore(release): bump to v0.12.7 (SONNY-4578)
  • b5bf6ffd259390bb3b72465a9ae5f2872f1eef47 ci(docs): publish the support-portal KB from a child pipeline (SONNY-4950)
  • a3e98449565c6c04f293cf28aa95cab4744cab99 ci(fuzz): run every Go fuzz target in extended mode on the weekly schedule (SONNY-5129)
  • 63323505044793078ee6af2e626ac1ea1a648ed8 ci(release): sign Windows desktop builds with Azure Artifact Signing
  • 1b404f59b18a79afbd3b485bbf974ade94e6adb4 ci(security): make local scanners the single execution (SONNY-5131)
  • 371e6385d90528f6d8272e0ea0258c92e198cf25 docs(architecture): record resume verification from the verified head and its security decision (SONNY-5045)
  • 5f8d4fc887f4c61997c491d59f851e9e65d966b8 docs(assurance): inventory the sonny worktrees prune command (SONNY-5047)
  • c3015a52f4d6dbda7f020abde06cc7a6c52b696c docs(assurance): re-pin the models list probe after credentialed-first ranking (SONNY-1804)
  • d1fedd4c8125773f9721bd951c7e8d11df1e42ec docs(assurance): reconcile drift-docs inventories with the consolidation (SONNY-5131)
  • ca7ef186a728e5cf3d09a913c52255ecccf4f57c docs(codeindex): recheck the codeintel contract against llm v0.42.0 (SONNY-4927)
  • 606bdad8e3b00068245aa1a9f72b0a30f60abe23 docs(config): document the spawn pack hand-down variables (SONNY-5543)
  • 1b2c42b71b3a46d64c458d9b37d93bab06ead522 docs(isolation): document the [email protected] cgroup delegation drop-in (SONNY-5244)
  • 5964001417589fc03ad44365e7733292675b7405 docs(isolation): move the architecture revalidation pin to the 03431f18 merge base (SONNY-3411)
  • fa7958df5db5a4bd43060535901f67079b72b5ae docs(isolation): move the architecture revalidation pin to the 03431f18 merge base (SONNY-3411)
  • 9882d4b282df8804ecaf8c7cbdb6fd0fb03eee64 docs(isolation): move the architecture revalidation pin to the 03431f18 merge base (SONNY-3411)
  • 3ec83e6d267ec8ffd45b9bfe139b75b06aaf352a docs(isolation): move the architecture revalidation pin to the 03431f18 merge base (SONNY-3411)
  • 0a6061b8383e73536b9c392e9665bac0c0daf2bb docs(isolation): move the architecture revalidation pin to the 139ced82 merge base (SONNY-3411)
  • d42107e12189e82c65015b626e86a188f4b9c2dd docs(isolation): move the architecture revalidation pin to the 139ced82 merge base (SONNY-3411)
  • 046ccc4d2cf5340eb1fd098132d3a2e2f580a1c7 docs(isolation): move the architecture revalidation pin to the 286d2615 merge base (SONNY-3411)
  • 8077025347b25643dac9662f6fdef42d2ad22eb8 docs(isolation): move the architecture revalidation pin to the 286d2615 merge base (SONNY-3411)
  • 20e57ece30a4b40c91ca25164e1fbbad35c0d01c docs(isolation): move the architecture revalidation pin to the 3715798b merge base (SONNY-3411)
  • 6cd1d0911730179ddd5be52df36f725cdce9faee docs(isolation): move the architecture revalidation pin to the 4e74cc8c merge base (SONNY-5594)
  • 93cd4d9cd45a74f4476e868973a3bf5cfe28f867 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 3e32221eef7a93a8be3c45c94367bc5183eb7344 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 1d417794527ba667914aef45d84b2fd89919d1ad docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • fe8e7cce0661100577ecc64cda738a81f3965a98 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 955495cb516cdff6d3b96148ebffc0ef933e23c9 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 80a2b864ad9e5faea9ba6f6531a2bee2c9b1d954 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 22dc7ac91c08c1eca54b83b35fde7a80f89d7521 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 9f4dc30cee52a667d7e487592454b4541e0bede7 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 951e3e15290d820fbaf211192eb622fa0ef7b856 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 383eb90d61400cf76833adec6ee4bd8a678fe247 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 008140537ff871476ddd27d4161d2295aa6b3757 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • bf3d439d8e4d04370b9f590ca312ebfc93e6b07c docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 79b4b6089c227203172ba0caf5fc8a0412c7b000 docs(isolation): move the architecture revalidation pin to the 5a53e37a merge base (SONNY-3411)
  • 2905adf7c68bd0715412cb75d7cfe4640b4d47b9 docs(isolation): move the architecture revalidation pin to the 9387bf46 merge base (SONNY-3411)
  • 51a0fa4eeb283d937aee56ae604c1fc9ba8b1b26 docs(isolation): move the architecture revalidation pin to the 9726c080 merge base (SONNY-5471)
  • eb377391393bcf57d5067be2d450e3181406d547 docs(isolation): move the architecture revalidation pin to the a7f96a0f merge base (SONNY-3411)
  • 3a4f682fb76af51a0b98795b6cc853af4fb6a010 docs(isolation): move the architecture revalidation pin to the a7f96a0f merge base (SONNY-3411)
  • 1b3d3b30a9efc19d11ef6e5832c926a5e3fe063a docs(isolation): move the architecture revalidation pin to the a7f96a0f merge base (SONNY-3411)
  • b64b9a86d6983cb624dd2afa325ec96a4142f9bb docs(isolation): move the architecture revalidation pin to the a7f96a0f merge base (SONNY-3411)
  • 46d6474296aaa8be565aa67c3a53095e8ba3a10c docs(isolation): move the architecture revalidation pin to the a7f96a0f merge base (SONNY-5129)
  • 4e015bfa921c55611312ab65f8659bca665bdb43 docs(isolation): move the architecture revalidation pin to the cfb086a7 merge base (SONNY-3411)
  • 5c106a721f04a477367c16f9fed809ce141655a9 docs(isolation): move the architecture revalidation pin to the efc30878 merge base (SONNY-3411)
  • d6a17601338407dd841a259c76ac7d67663495ac docs(isolation): record native backend selection and its revalidation (SONNY-5018)
  • f61f4c3516ae839e64ee530db17ad98fed108b97 docs(isolation): revalidate latest main (SONNY-3411)
  • 4637de962cb6e307a3e55c8b266f645b5db5f665 docs(isolation): revalidate the integration against current main (SONNY-5594)
  • 42c81b1fa9bd6269b8d3a2e2d5d8f4a8ee98c8db docs(isolation): say the doctor probes a fresh identity derived like the daemon’s (SONNY-5590)
  • 7dc5cddea7d1ef02f72f34dd3a5510a3e30dfd10 docs(isolation): source-review through 03431f18 and record the October 16 review (SONNY-5011)
  • d0af640c08090074cedeaa24849bacdbabd7d5dc docs(mcp): name sonny-upstream as the gateway’s home (SONNY-5131)
  • af14696dde53175e2b1718f2ff860bb1431b3155 docs(mcp): say Lanning, not sonny-upstream, in current guidance (SONNY-5074)
  • b13828a74513c7bd4ca3112988ec7b4c74243075 docs(messaging): record the blocked stage 2 canary fourth attempt on 63d8c3b84 (SONNY-4652)
  • 171fcc7a3241d6f0cae65ee7864923395adbb414 docs(messaging): record the blocked stage 2 canary rerun on e707f9e62 (SONNY-4652)
  • c1e4347c462eafcce9424f8255d2dd168ca9fad0 docs(messaging): record the blocked stage 2 canary third attempt on 1c610951a (SONNY-4652)
  • 23fd2abdbd27fdde43e4eb847f6dc6eb077be4a4 docs(messaging): record the stage 2 canary eighth attempt on 62bd6116d (SONNY-4652)
  • cb65030f5282accbd44d5b43708c1d079b8486ee docs(messaging): record the stage 2 canary fifth attempt on f954365d0 (SONNY-4652)
  • 5827d5e91de90bb6d0f6cc052a493399d32c8f57 docs(messaging): record the stage 2 canary seventh attempt on e57a9a0d2 (SONNY-4652)
  • ac0efafdda892852f8af1efced73592bd05335e0 docs(messaging): record the stage 2 canary sixth attempt on d66468d5f (SONNY-4652)
  • 9dc56f620a5e5d92652c6f406cc028d1f2ec563b docs(packs): require the opt-in for unsigned sonny-base overrides (SONNY-4756)
  • 6db3eef2c7b67caa5b1539601660038e81729f9f docs(plan): seventh follow-up plan for the last plan-mode children (SONNY-3577)
  • 7ed63bda334f11c335a12112757de9ef59a26c18 docs(plan-mode): qualify plan mode on Windows 10 and 11 test VMs (SONNY-5592)
  • faae813232d0d932485371cb863f5af725479efa docs(plan-mode): record the hosted worker cells at v0.12.5 with the local realm fix (SONNY-4344)
  • 4e74cc8c2fcb14f595cad0e9e759e644be398aa0 docs(plan-mode): record the hosted worker cells on the v0.12.5 realm host (SONNY-4344)
  • c63e0682ad91db1735f4c997803ec59e161a535e docs(protocol): catalogue the live turn progress event kinds (SONNY-4745)
  • 6f8ec0d9f0172012678c28a10ab40f56fcf157ec docs(protocol): regenerate the schema for the setEnabled owner order (SONNY-5126)
  • 10ee252bca3141a176470b30b0a9ee25b6a20810 docs(recipes): document approved lifecycle design and delivery plan
  • 96a1cf398803dfd5f13598c43d9c8a5810a3b8df docs(recipes): record lifecycle implementation approval (SONNY-5022)
  • 5cccb95f12183655bf122426f3187662afee92f6 docs(recipes): refresh lifecycle plan prerequisites (SONNY-5022)
  • 8024bf9a640ea266029def02c6ba5fcc72373e4d docs(runtime): describe the live set and the applied-key index (SONNY-4926)
  • 8a709aacbf8481f9a7f0cbbacc1198ec7980c3ab docs(store): name the agent mail retention follow-up beside the soak’s store bound (SONNY-5238)
  • 509c1da45e2c16b89aec5b6a273f048a98f53ebc docs(ui): record the npm-installed pnpm 12.11.2 on node:26 CI images (SONNY-4927)
  • 8325849e0507c2f8d2c6f1398e0bbfbfbe687f23 docs(validation): record the live recheck of the session stream fan-out fix (SONNY-4652)
  • d120e6ba662fe012ecf19e7617fe85a345d92c56 merge: consolidate Renovate updates with compatible Go module majors
  • e92e6c7f1ec8431349018362f4be1b7aa64c073e merge: include Renovate certifi update in consolidated Sonny MR
  • 12cf8bc0373e5d74d0cbd8877b7403691f9329f3 merge: integrate Sonny !143 (SONNY-5131)
  • 44096b964d524619ec1e670eb0b3d8de633947bc merge: integrate Sonny !157 (SONNY-5131)
  • 0a98505cd8403c8e568d7b885ea42f4d18dd7c88 merge: integrate Sonny !179 (SONNY-5131)
  • fbbd8532b89deba9226cf8aa38a752c4c17e5c7d merge: integrate Sonny !226 (SONNY-5131)
  • 16a649e99bc692217d0fcfc6212491cf2012f009 merge: integrate Sonny !257 (SONNY-5131)
  • 8ce9acf429ea30eed48ea45ef8105f75dafaa277 merge: integrate Sonny !261 (SONNY-5131)
  • a3f89d5f6b67fe81725f826fa0122ca5c15107e1 merge: integrate Sonny !262 (SONNY-5131)
  • 1b6aff8ce2d7a65bae98607fbecc1de306cc8581 merge: integrate Sonny !263 (SONNY-5131)
  • 7bd04e27164c275ef62fc41d1ab059b288e0b635 merge: integrate Sonny !264 (SONNY-5131)
  • e967c4cc5f7f6c5f36be2f5c9a685d2946254f25 merge: integrate Sonny !265 (SONNY-5131)
  • af1328e27da48c0b2fe674122f4019403ccdc487 merge: integrate Sonny !266 (SONNY-5131)
  • 5ca50de1ba892a6c769736f3055005b1d47da924 merge: integrate Sonny !268 (SONNY-5131)
  • 997a8812fb890e4db07d92e1240e27e9e229ca05 merge: integrate Sonny !269 (SONNY-5131)
  • c6783ebd862233d28a87401ef72bfd1a83f2a890 merge: integrate Sonny !270 (SONNY-5131)
  • 19ed17542b788a0634cefea99f393e80fd1e7d2b merge: integrate Sonny !271 (SONNY-5131)
  • 1335d57b560343e84afb5f4ead9dffe4ea2ccce2 merge: integrate Sonny !272 (SONNY-5131)
  • 894da2caf5c12ad931a9d1767dad2d0479765e9b merge: integrate Sonny !274 (SONNY-5131)
  • f6e37a274c59b2933c3d2cbf9ee44c24a64e77e1 merge: integrate Sonny !275 (SONNY-5131)
  • bd37fdf89a93ce36306253868fa70a00eaaa5fb8 merge: integrate Sonny !276 (SONNY-5131)
  • ecaf804e336c942b40c019d0244791a9e3e3a9d2 merge: integrate Sonny !277 (SONNY-5131)
  • 198fe2edceeaf344696f9524a4ad938f453e88eb merge: integrate Sonny !278 (SONNY-5131)
  • c30834475bcea28c0088d058754fa516723594b4 merge: integrate Sonny !279 (SONNY-5131)
  • 9d0348f156c1f8849169738405cecf5ba8089ecc merge: integrate Sonny !280 (SONNY-5131)
  • 4cd5e98acb4ada821115d6fd1124803c2f878ddb merge: integrate Sonny !281 (SONNY-5131)
  • 3acee5bb367a6624df795f2d04daf05b44e203e1 merge: integrate Sonny !283 (SONNY-5131)
  • aa1f35f01171692d1c2235e3fd9aac9c58a892a1 merge: integrate Sonny !285 (SONNY-5131)
  • 97ad41b642719cd114bf204432f7c3eb6d65756b merge: integrate Sonny !286 (SONNY-5131)
  • 21b5faaf1f0a938cc769ed63aa67e2f9b3cda9ee merge: integrate Sonny !287 (SONNY-5131)
  • 53aa29fed7b3368c726b91fb044bfaad8cf6dda6 merge: integrate Sonny !289 (SONNY-5131)
  • 3f0836abda3445fdacdab715e6b6702c294fa8b7 merge: integrate Sonny !290 (SONNY-5131)
  • ce07cb546f65a90bd005e4546a73a26e8c84815a merge: integrate Sonny !291 (SONNY-5131)
  • 5060ecfa01da8cc1f5074b334ffdaa5b94d5f783 merge: integrate Sonny !292 (SONNY-5131)
  • 1083eb9719f1f524a6411094fb582629d6426595 merge: integrate Sonny !293 (SONNY-5131)
  • 399d09a806326f39deb85b66d13c9f2b41b2a4b5 merge: integrate Sonny !294 (SONNY-5131)
  • b09369c560a37967fc5d409d2c9c886ee21f75f9 merge: integrate Sonny !296 (SONNY-5131)
  • 0dd7245e97e6a1661d32dec2de78db90755a8c70 merge: integrate Sonny !297 (SONNY-5131)
  • 068ce55ace23fd5df517e5cee1f402f72aa55ef4 refactor(cli): keep mesh composition under lint limit (SONNY-4761)
  • 544878404e68027381ca71deea7731a96815984e refactor(lanning): migrate Sonny consumers and current guidance (SONNY-5079)
  • 55c3edb257ac8b100363db2557a03e878b90b0e9 refactor(tui): split provider account handlers for lint (SONNY-3925)
  • 7fc4cc58b4a3a5a3197161a9b4c1668fa4c42d8b refactor(workmanagement): reuse named MCP instances (SONNY-4812)
  • 07a65baf8d0af80d4b33bd21d3c22986743f59dc refactor: delegate Bao retry state to secrets (SONNY-5205)
  • bd686ca0a51b3c37d20705152c765a7162392b42 style(app): fix the lint findings of the turn history merge (SONNY-5063)
  • 8adbbd510ecba209de5263f01cc355ad5c74207e test(a2a): cover the native relay pump’s dispatch, retry and answer paths to restore the coverage floor (SONNY-4578)
  • da34adeb11df4e2aee9a021eeaa30949daa5c095 test(a2a): keep the federation soak’s TLS certificate valid for the whole run (SONNY-4647)
  • a5c6ba1916197c946caeb11384884e3836d78635 test(a2a): keep the relay’s held forward below its I/O bounds (SONNY-4927)
  • bb274870f02893d09e7a161eb7384b1e29b3761f test(a2a): release each restart’s runtime in the federation soak (SONNY-4647)
  • ea873941532e572ed6a9a216d792ba1af29b0295 test(a2a): report p99 and each task’s latency in the federation soak (SONNY-4926)
  • b5f11891285ff221e139bd58e4cce82a08e9af6a test(a2a): report task latency in the federation soak (SONNY-4926)
  • 2629c082fed08e06aea44f1196d4d94592fd8c5b test(a2a): size the restart journals for the race detector (SONNY-4927)
  • 5db26985dbd2dd6da0051773f9ac05b41de03671 test(agentmail): show a parent refused remote children after 1,024 settled ones (SONNY-5059)
  • 811ead35583d54d58b47a1ab573a4f8999cdecab test(agentmail): show a tenant refused incoming children after 1,024 settled ones (SONNY-5060)
  • b6dc9d41c9a70dc297a682f0ac00ac9e05dfe1a4 test(agents): reproduce agent_search hiding whether a sub-pack can write (SONNY-4829)
  • 0aded5bc482d8aa4a7e596802180227cb019d31a test(agents): reproduce kill_agent_process failing on an unleased child intent (SONNY-5264)
  • 1463994f85980abe944b0cb6f15a328c0c3e06b9 test(app): a hosted turn must not decode native protocol facts (SONNY-5044)
  • 757efa844eccacfc0d0e4a20b2f7598a3475549f test(app): allowlist the control-store compat reach in the facade guard (SONNY-4927)
  • 5af412e068fdc2596aedb46a4c3470af431b7cd7 test(app): restart recovery must not decode native protocol facts (SONNY-5044)
  • 1ff272ca4a3d357b05d42859643298452fadd884 test(app): restart recovery must not decode native protocol facts (SONNY-5044)
  • 3c0ad015f575c5cda071f8de10d4120a44ade7fa test(catalogruntime): cover dispatcher accessors and history recovery to restore the coverage floor (SONNY-4578)
  • f50c3bcb9f1300cb86fc5102fe6e15f6a4a98297 test(category): reproduce template placeholder sources being seeded and routed (SONNY-4640)
  • 09d33dd936e48c13320f462f8ee191375868e294 test(ci): align consumer and mesh command contracts (SONNY-5594)
  • 32deb711aecc527c2cf795d491ee6e56b562a784 test(ci): align consumer and mesh command contracts (SONNY-5594)
  • 6cae9e4a47c38c7d98b590cbaadfe7ef5107a430 test(ci): check both bounded VS Code build commands (SONNY-5594)
  • aeaa5faeac38b043eded0f3e260dc8da0b8f5613 test(ci): expect -vet=off on the canary producer qualification job (SONNY-5131)
  • 195d75ea98fa68b81fd5e4bd0f4a3b9c56557382 test(ci): isolate commit-check Git fixtures (SONNY-5594)
  • 7684e97765e715d675313fc9c1916bd82c91c2fa test(ci): make child commits identity-hermetic (SONNY-5242)
  • 9b56910dd900a6d3a896d08965eb4ec8ab036a51 test(ci): reproduce docs/user timing out on the slower Lab Servers runner (SONNY-4578)
  • c1378390481af3316744f4da7994abe01a473aa9 test(ci): reproduce publication jobs created for prerelease tags (SONNY-4578)
  • e63e1a376f5e870eb16a536a9ebcfcc18559364c test(ci): reproduce rc.7 go-test shards hitting the 90m package deadline on Lab Servers (SONNY-4578)
  • 4e264565dc678d36969e4ee8bc17807fb5b54781 test(ci): reproduce the rc.7 release upload refusing a tilde asset name (SONNY-4578)
  • f035d7cee3504338aa77ed34fa988e4a92caf3ed test(ci): restore merge-base and benchmark gates (SONNY-4949)
  • 83d2d43b3cb0a1a4a3729d5b63ab6f0d7fee6e99 test(cli): a relay backlog stays bounded and drains after a restart (SONNY-5061)
  • ac6ce7e7cbe8eae243e8b6ebd582f35f1c1270c3 test(cli): allow the next hop’s one-hour answers in the federation soak’s store bound (SONNY-5240)
  • 55abdb67e4df87815eca5b21f8dec5fa1e1590fc test(cli): bound the split-admission git init with WaitDelay
  • 6badca0da7e1eab225fe95211702da4ffcfad3e7 test(cli): ignore env-sourced accounts in the credentials delete test (SONNY-5126)
  • b529f1a9d86fe6e0c32747b06d231cdff13196e1 test(cli): keep the host’s secret service out of spawned mesh daemons (SONNY-5550)
  • eb1d67f31e46b43ca2f4c28b0edf6b998eb5b12f test(cli): record why federation soak sends fail and tasks stay unfinished (SONNY-5049)
  • 185661c09a05cb89b5248b4c2903159f2e8754cd test(cli): reproduce Desktop onboarding binding legacy gateway groups over their -v1 twins (SONNY-4829)
  • 3edbb5c6df425663f5422a2a488db05d4300080a test(cli): reproduce blank, argument-less tool rows in child output (SONNY-5253)
  • 4c46b4857cd2eda7a4b16156c8f4504a9e914f9d test(cli): retry backlog sends until stopped, not until a 5 minute deadline (SONNY-5072)
  • 42582345ea4d5e3ab373c5a8ff8a923d32650815 test(cli): retry backlog sends until stopped, not until a 5 minute deadline (SONNY-5072)
  • 32ecf094f1b6885842ef8cb1450bf9106d04472a test(cli): the federation soak’s heap check must not count the CPU profiler (SONNY-5091)
  • 7d68e25b29938268cb5e31516975ea310a4f295a test(cli): the federation soak’s heap check must not count the CPU profiler (SONNY-5091)
  • c6706bd6e08e31565036fd0250383a07d2685b7a test(cli): write heap profiles and goroutine dumps from the federation soak (SONNY-5091)
  • 7e0ffe4ef96c44da79134bc178907072833397c9 test(cli): write heap profiles and goroutine dumps from the federation soak (SONNY-5091)
  • 9256277a971a1321258a6d329cf90b061d701d1f test(cmd): reproduce integrate_agent_changes dead-ending on a child that pulled upstream (SONNY-5306)
  • b9e42ab07d81f4480e5bc270d9ff106562c3207a test(cmd/sonny): realign release-blocking tests with intended behavior (SONNY-4927)
  • 8cb794128aa7278f5f9301a2c69ea89fb41edc14 test(codeindex): review the gitenv dependency the worktree runner now uses (SONNY-5047)
  • 7925e86aced83bd71bd5ace7e98594082b54e5d5 test(codeindex): review the shared secure-file receiver’s dependencies (SONNY-5131)
  • cfa924e1845d423584bcd86a9ffa6985db479c67 test(codeindex): widen the store bound for the checkpoint kill driver (SONNY-4927)
  • cdc6b5eff50c97c143c7c9cb56f310b9e04bd048 test(control/sqlite): reproduce host lease renewal queuing behind bulk writes and child reconciles (SONNY-1349)
  • 6620a48bd4ebb5ad6d460643f5cd44d4c6cb43ce test(desktop): assemble synthetic bearer fixture at runtime (SONNY-4745)
  • 479881dfda4392855090da8e96d298c4a899fd70 test(desktop): verify hosted Agents discovery through the GUI (SONNY-2246)
  • 24fd2dfce9de668083841ce72880584d95f77188 test(dispatch): pin that an unserved mesh.* name is refused as not a mesh tool (SONNY-5267)
  • 7bf5f777353c0842cfc38fe56011f8dba5dc5c2b test(dispatch): reproduce the unexposed-tool refusal that names no remedy (SONNY-5260)
  • 948a4f755c9dc658af1c83b5134ba7827cbdfb77 test(envelope): track mesh push progress under runMeshPush (SONNY-4927)
  • 85cdddb4fdda6579c25934243b102873de30f9d5 test(executionroute): reproduce read-only work refused by the route
  • 41f4e43a86bc34e2c93fc4522c63ea292c9dae2a test(executionroute): reproduce the route refusing a read-only external tool_exec (SONNY-5102)
  • c010c79d1289c048b78b430650970813249c5508 test(git): stop stalled fsmonitor hooks from outliving their test (SONNY-5304)
  • 8f080d02ed77c79556f1372092ca3c4c24f4e2f7 test(hooks): cover ValidateYAML, BlockResult canonicalization, and UnwrapTool to restore the coverage floor (SONNY-4578)
  • d8fb3dc12937ffd3eb367710ba1b9a0e45478be8 test(hosted): a denied spawn adds no system failure after the reply (SONNY-4050)
  • ac6424d493d7eea673228be1d64cfa657df55673 test(hosted): an unreadable review delivers the reply instead of failing the turn (SONNY-5058)
  • eaa8089547627a552b14bec995e9127b76c26d6d test(hosted): expect a denied spawn’s notice after the kept reply (SONNY-5058)
  • 434720ccd0b15d7a372cf52935f01293fc461d19 test(hostlease): reproduce host lease lapses under transient store stalls (SONNY-5312)
  • b7b13aa1f99881355e03db922065dda166337151 test(hostlease): wait for the owner’s renewal log lines instead of racing them (SONNY-5312)
  • b3024060381ca9b731bb779014493fa1b66aa3ea test(isolation): pin cgroup delegation detection and the installer drop-in (SONNY-5244)
  • 4137cae198c9fb0ec8210b19bfb147ca7e922ae4 test(isolation): pin enabling delegated controllers on the user service and the native delegation fix (SONNY-5244)
  • f9312dc469d1450772862fc7ab2bf0db2907eca4 test(isolation): pin native backend selection and the native managed session lifecycle (SONNY-5018)
  • 6653ae8472809e17af41c0467d85e017d6f25e68 test(isolation): pin the delegation fix in init readiness and the isolation doctor (SONNY-5244)
  • 467f5e4d5eeeb37e723a969be0b0e9e2542cc2c4 test(isolation): pin the lineage contract for native and VM realm renewals (SONNY-4933)
  • 8c095ae64d99afec3117ff11ea9a13ac23febc63 test(lsp): count the detection-only manager in the construction guard (SONNY-5310)
  • edf2f7c0b215ed60d42cfdceba305282738edaaa test(lsp): reproduce project detection missing a symlinked workspace root (SONNY-5310)
  • afdef9885033d14cf53732e62406aef769efeb05 test(mcp): reproduce Sonny’s own sonny-internal server refused by the MCP allowlist (ENG-5221)
  • 0c5a0b39b07aaa77f79a934b928410154b339288 test(mcp): reproduce invisible, never-retried failed MCP connects (SONNY-5250)
  • 6afe2c6e9eecc9ff615917c699f023f693b7c115 test(mesh): expire the signed policy after managed provisioning (SONNY-5594)
  • 5adcc670c9f7332b14532b4b29fd17c7ca763c93 test(mesh): read portable child mailbox results from the tool_exec envelope (SONNY-4940)
  • eac54fb6d4f0ea83b4201843dc251753aa54c46e test(mesh): reproduce Desktop sessions interrupted for good when their lease merely expired (SONNY-4943)
  • 44c96ff973827ee593d2f22ccebc675081a1e24a test(mesh): settle wake binding charges before checking holds (SONNY-4927)
  • 52f0ce117a2f49a6b1a1220bc8e640d721ef6c39 test(meshengine): a hosted handle reports its host loss by the time it is done (SONNY-5239)
  • 727ac31086b8943f14af424b468800c1042dffdc test(meshengine): call the mesh posture tools with the session context (SONNY-5254)
  • 184f4bb6129c237907450ce98fb1989706874e17 test(meshengine): keep message recovery inside the receive hang guard (SONNY-4927)
  • 597ab160ea4e5d3c4bdaa9acdb81d6fcfe0f1a09 test(meshengine): take a hosted lease over atomically in TestHostedOwnerReportsTakeover (SONNY-5239)
  • d29f1037c44d9349808b0ffd75f63351e82a7d05 test(packcompile): route policy decision_policy packs like governance (SONNY-4927)
  • 89c0fb79040314adb071d301555bd42e0ba938f0 test(packload): validate llm v0.46.4 inheritance (SONNY-5276)
  • 1e484a4fc5dabe8c0778161eb8769107d8bd7f4f test(packs): reproduce a startup pack fetch killed with no reason (SONNY-4829)
  • 01b323a0f7827a1bed3b23ec4a20bd6403eae23c test(permission): pin that a gate denial tells the model why (SONNY-5265)
  • a35ed67607b8d0364d8b8073ac27246cde1746a6 test(permission): pin that credential-store reads need direct approval (SONNY-5266)
  • 16e26ed5671d88457f6b4dab614a6cb3e1a06958 test(permission): pin that dangerous mode lifts every per-call class (SONNY-5255)
  • 453be44b280ef875f09009fe80eaedb50ea387da test(permission): pin that go clean -modcache needs direct approval (SONNY-5307)
  • 4fa8e6d9aa2a99c2ff85eb0cc1ebaed38f259388 test(permission): reproduce the overwrite floor denying a child’s nested clone (SONNY-5257)
  • d66b99c04b7a7dbf953ba6219a265641379475da test(projection): reproduce an external writer’s turns never settling session state (SONNY-4113)
  • 8798ab9c3aa83c44501a9c1509e697a669c28afb test(protocol): pin the workspaces.trust source member in the schema types golden (SONNY-5271)
  • fcff5a9c49c17dc00684af194123cc6807818ec1 test(provider): reproduce hosted session sending the catalog id instead of api_model (SONNY-4829)
  • acd183b1d138a036037fbd50707eaa46d5851eaf test(provider): reproduce hosted sessions sending the catalog id and dropping row params (SONNY-4829)
  • a9ff6a0d8dfd41b2922f65d797e9f3b771bac294 test(release): reproduce prerelease desktop Linux packages failing their contract (SONNY-4578)
  • 8063325eb23dbec87d5e2e11228b6105727f36bb test(release): reproduce rc.5 desktop builds exceeding the 60m job timeout (SONNY-4578)
  • 2aa05131deca238d7222222bf341b14aef42b8b4 test(release): reproduce rc.7 build-release failing to attach the tilde-named desktop packages (SONNY-4578)
  • 621fff543f9a6ec386401b23af5bb931aa40c721 test(release): reproduce the v0.12.1-rc.1 desktop signing failures (SONNY-4578)
  • 4319b8b99fe212056b4b1be5ac194b842ec03a5f test(release): reproduce the v0.12.1-rc.2 missing Developer ID identity (SONNY-4578)
  • e288f8a687dc4fd9a7e7dd04d6c677b66a643c6d test(relverify): mirror the homebrew-publish v1.55.8 include (SONNY-4927)
  • 5f06cacc0cd9305fd0bd571649ac182b1e800718 test(resourcereuse): bare-hex expected_digest after a full read must be admitted (SONNY-5263)
  • 6f2488c9842f49d38af4af3e524ae5a8e4137dfc test(resourcereuse): refusal on an invalidated own-write digest names the cause (SONNY-5246)
  • 0dee8caa026c4eb7f203f2793847b54cd6bb8174 test(routing): reproduce a local param refusal reported as malformed_response (SONNY-4640)
  • fd688d431acea03deb5137f7c2e67ce9d6fb6bd6 test(routing): reproduce primary reasoning effort leaking to fallback targets
  • 6b18eb0bf85c81c56675bb16f6743d2f5e359bf0 test(runtime): reproduce snapshot and discard failing on an untracked nested repo (SONNY-5258)
  • e56dc307c12f0aca961248d3ec2dc4191d978afb test(runtime): reproduce the 01a1549f exec loop the no-progress guard missed (SONNY-5111)
  • 248941cdbe4b1e9e7909ffc5b7e9a8c65bc1c275 test(runtime): reproduce the 01a15514 oscillating identical edit_file loop (SONNY-5111)
  • b53e865af0aa1bd94c7b56732f5eda4f3dbfb25a test(runtime): reproduce the completion review re-sending the whole transcript (SONNY-5274)
  • 2b577e73689dff4d95b0d6d427ab1690fa68a393 test(runtime/hostlease): reproduce one slow renewal permanently sealing a host owner (SONNY-1349)
  • 9220cd0a84cc70efcf940a4c5699b995c670fe04 test(security): skip the proc-environ probe when the runner holds CAP_SYS_PTRACE (SONNY-4068)
  • 41486ae9824347ccd867d2c286f62d0b1aea23c3 test(sessions): reproduce Desktop chats that cannot choose a workspace (SONNY-4927)
  • b2bdd250bba5bd7711a51a4be60de52c2fdc07b3 test(sonny): check the bounded goal-review request on its own terms
  • 9cda6837579a4e288c9ec1a20544fd68504f2916 test(sonny): give the cmd/sonny test binary a git identity for CI (SONNY-5313)
  • 86623728f54a97d3aed98f6803035042242d96c3 test(sonny): isolate plan pack source bindings between tests (SONNY-5546)
  • a34212a307770119a5918e535b220ce3aa79f72f test(sonny): repair consolidation test regressions (SONNY-5131)
  • 8b252f965c41e34470eb9696e231628b85de104a test(sonny): reproduce exec work_dir refused outside the workspace root (SONNY-5311)
  • 641c3e833a0f7f99fd95bf65549e0bcefb3c444b test(sonny): stop provider and policy-host state leaking between tests (SONNY-5550)
  • a660a64c569ef56963b2575c2d6a179f5f7e09fa test(sqlite): run the verify measurement as a smoke check instead of skipping (SONNY-4927)
  • b4cef4cbd4d5c84885ede27cd300e8753ccaed17 test(store): retire agent mail while foreground writes are in flight (SONNY-5240)
  • 2bc6db212442c9baf9589cf550566e6c379e8079 test(store): retire settled agent mail in the local supervisor’s control store (SONNY-5240)
  • c18f8bcb31efadccd2dbf43515acdb5d157e7030 test(store): retire settled protocol history in the local supervisor’s control store (SONNY-5238)
  • 7306662f07665f213c1a6f988108d6ef864d5b96 test(store): run the fresh-process migrator check without a skipping helper test (SONNY-5071)
  • 3a2e4b17b7ccf9def73a71ea7f2767d3f486eb2d test(store): verify a retired journal whose checkpoint is the base (SONNY-5238)
  • 0956eb6849198cb481e5a3e4986b013da9a7ae46 test(stream): reproduce parent input never reaching a running child (SONNY-5252)
  • 2b744200fad4891a29d8f4f2d3a11184304cf3cf test(supervisor): reproduce desktop startup exit status 4 on macOS
  • abe9d84a6ba5580501215f94c6d695e114b0095d test(target): end the identity stream fixture with a finish_reason (SONNY-5131)
  • ca4402ba6f0fb945dd92dfd3600ccdd3ab0e8c00 test(target): reproduce Desktop turns failing on LiteLLM tools+reasoning_effort 400 (SONNY-4829)
  • 98479345c5df35cf18b6d71b86fb6c0e2a40e0a5 test(target): reproduce the tools/reasoning retry poisoning astra with a rejected none (SONNY-4829)
  • 12d935a84eaf30cd3870c180548d59baae91820e test(tce): align coverage seal (SONNY-4763)
  • 641c73cb71a6b7f963468d138e77a00041367852 test(tce): pin refreshed coverage digest (SONNY-256)
  • 55df18834ffb05a0c0b6f513335a4b883f9f0785 test(tce): refresh fault coverage (SONNY-2588)
  • 4e9a17b86d78a4b3e844597b6cbee63593505cc8 test(tce): refresh fault coverage for Go 1.27.3 (SONNY-256)
  • f32b469ec8416885d7cfe48987c0a61939b37c34 test(tce): refresh lifecycle fault evidence (SONNY-4763)
  • 6741106e19bd4ec87c8711705523664beaab275f test(tce): refresh lifecycle fault evidence (SONNY-4766)
  • 8067dc8a82141fea36f6097f33d36a3b90f5def0 test(tce): refresh permission relay artifact seal (SONNY-4760)
  • 60023c5ac6794178fe29adceb521186ba998a995 test(toolefficiency): check the CI Geode service against the pin (SONNY-4927)
  • 580212d59ac9e803f14c6c6ff644efbb7de8455b test(toolefficiency): require the Lanning gateway name in the qualification doc (SONNY-5594)
  • 6e4cca85f2b361ae61a03397fc9e642e8bd9905c test(toolefficiency): reseal surface parity for the wired history stage (SONNY-4927)
  • 81955fd05edec855fc07410b35412e12132e3c4d test(tools): reproduce delete_file and mesh tools ignoring live posture (SONNY-5254)
  • 38269ef476d2bb0cb1586d21a1da867e6ee993c4 test(tools): reproduce native file tools ignoring host-wide posture (SONNY-5254)
  • 7d59a7498d0615098ba48351a323ae92f820c1a9 test(toolscope): exempt the activation presentation schema check (SONNY-4927)
  • d78cd6af439425a673d4c0865f7b7f780f51b192 test(trace): reaped child summary must count the child’s events (SONNY-5245)
  • 4e3bd743575fdc2307ca89de01a2281b80472894 test(trace): reproduce agent_session carrying only the parent’s identity (SONNY-3592)
  • 26b5ec9d89c3dcd616e35420aec7ac480f84f402 test(trace): reproduce the child summary that drops its own exit reason (SONNY-5259)
  • e7ccb5c3b35296b79e04713dad78fe28198ecb9c test(trust): reproduce desktop workspace-trust grants being ignored (SONNY-5270)
  • 893b35d3705e86c4f6543c51dd023278bb4cdcc6 test(trust): reproduce live sessions ignoring mid-session workspace trust changes (SONNY-5308)
  • bcb71b109b6090593f6ff7381e8810f4ec563201 test(tui): include results in palette registry lock (SONNY-3927)
  • 3cd94dd1faae4ae471355749ad0ee3318fb2d749 test(tui): qualify startup session selection (SONNY-1697)
  • e9e73a9dac3fadf92ec71ed60216b6251746c3e8 test(tui): reproduce a sealed external writer owner refusing every later send (SONNY-1349)
  • 4485fdbfc37b202bd96024db953e482b21a366d4 test(tui): reproduce picked api_model rows bypassing canonical routing (SONNY-4829)
  • 82453e8b87960eea3a1bc20de1de3e09bcc31ea2 test(tui): reproduce picked-model bypass of tools_with_reasoning gate
  • 7931994c61ea14b32ea51276e05658f0177f5213 test(tui): reproduce primary authority refusal under profile tenant
  • 61c51d21b5aad4265489a6bb6c11458d694901ac test(tui): reproduce turn activity refused after host owner recovery (SONNY-1349)
  • c8948db66f92090b9ac0f60feb5488a850a702cb test(tui): update provider account characterization (SONNY-3925)
  • 7578492f9cfb3ea828c9f085ff26089fc96cdf74 test(ui): bound the interrupted-stream cleanup test’s transport retries
  • 010c7e6aeb9bd9593df80928f392553a661abaab test(ui): have the fake testlang server publish diagnostics and answer shutdown
  • 2220ac3ccdd0c728c030dcfbf5adb6fcb6516f89 test(ui): host write tests on an O_TMPFILE-capable workspace (SONNY-5594)
  • 950dd4fbe345f1f3f2c0583a35529f18322fc455 test(ui): wait for T2’s turn request after an interrupted turn is reconciled
  • 5d49f080da9462636b2b8b1b2ef6955f9733a6d7 test(verdict): cover claim validation and signer key checks to restore the coverage floor (SONNY-4578)
  • ee3c64f9363af2412bf6d1b01a54fb60040d5bb8 test(workspace): untrust must revoke the desktop’s workspace-trust grant (SONNY-5309)
  • 7b18317eb25c7156248e24abff269694b243f7d9 test(workspacetrust): pin child-worktree trust inheritance across every gate (SONNY-2288)