Changelog

0.14.0 (2026-09-14)

• Name the pool slot's AppArmor profile after its boundary, not its session (#1037)
• A tier binds (provider, model), and half of it did not take (#1036)
• Refuse a session whose runner bootstrap failed, by name (#1034)
• Ask which MODE the kernel is applying, not only which profile (#1032)
• Sabotage a copy, never the checkout, in the reversion meta-guard (#1030)
• consumption: a pooled cache-hit rate nobody could defend, and the seam that made it unfixable (#1031)
• Evaluate the completion-tier exit on every path that ends a turn (#1027)
• Confine every runner thread, not just the one that transitioned (#1026)
• scaffold: the banner derives from the scope table, and a knob claim is earned (#1006, #1008) (#1022)
• docs: three documented surfaces that told a builder something false (#888, #771, #724) (#1020)
• notebook: state the execution boundary, and what the audit tier costs (#1011, #1012) (#1021)
• sdk: the source_type vocabulary named a member that does not exist (#1015)
• scaffold: four things explain knew and would not say (#904, #905, #908, #909) (#1010)
• fix(introspection): the tools stop misreporting their own environment (#966, #823) (#1009)
• validate: a finding may claim only what the validator knows (#910, #937) (#1005)
• scaffold: derive the explain topic list and the RenderContext attributes (#911, #994) (#1004)
• fix(session): the inbound gate reads the active tier's declared roles (#1001) (#1002)
• History pairing invariant: one definition, enforced at the producer and the boundary (#674) (#1000)
• fix(session): identify, surface and bound a session whose client is gone (#812) (#998)
• fix(runner-rpc): bound a dispatched RPC the runner never received (#856) (#997)

jaato-server

Jaato Server — LLM tool orchestration runtime and daemon.

See the project README for full documentation.