Changelog

0.16.0 (2026-09-20)

• session list: say which session is waiting on a human (#1138)
• session list: memoise each record's header against a stat (#1137)
• teach the post-#1007 turn contract on the surfaces a builder reads (#1063)
• declare the jaato-sdk floor instead of accepting any version (#1055)
• raise requires-python to >=3.12, the version CI actually tests (#1076)
• lower the complexity baseline build_session_envelope no longer earns
• A GC strategy resolved, carried, rendered — and installed on nobody (#1133)
• split the status-door scan under the complexity ceiling
• a spinner keyed on a word nobody says
• scaffold: the authoring surface knows the EU AI Act keys, all three verbs of it
• test: the runner-ledger guard must not leave the workspace-root ContextVar set
• runner: hold a ledger, so a runner-served session records what the audit contract promises
• The editor is the other writer of maturity (#1123 follow-up)
• Review of #1126: three inert mechanisms, and four that governed the wrong thing
• One marker, and the index descriptor is not it (#1130 follow-up)
• Arts. 11/13/15(3): the Annex IV dossier, and the accuracy section (#1121, #1124)
• A bundle is a directory a domain claims, not a vector index (#1130)
• a workspace with no GC, and a file that overrode what it did not say
• A guard that only binds when nothing needs bounding
• Arts. 72/73: an incident register over the audit log (#1122)
• Art. 73(6) + 15(4): tamper evidence, and provenance on the learning loop (#1120, #1123)
• Arts. 12/19: one audit-record contract, record_keeping:, explain audit (#1119)
• Art. 50(2): a marking hook that survives the wire, and the text posture (#1117, #1118)
• Art. 50(1): emit the first-interaction announcement (#1116)
• Document the uv equivalent of every install command
• Notify when PyPI or TestPyPI carries a newer jaato package
• test: the producer-key copy names regulatory
• fix three guards the EU AI Act mechanisms tripped
• events: ToolOutputEvent.generated_by -- model media carries provenance (Art. 50(2))
• ledger: append every record to disk as it is recorded; trace.ledger names the file
• explain/doctor: name the stop button as the Art. 14 oversight measure
• prompt: a disclosure instruction piece -- the model is told it is an AI (Art. 50(1))
• profile: a regulatory: block declaring what an application is under the EU AI Act
• scaffold: a .gitignore that keeps .jaato/ assets committable and its state out
• A session is not torn down because its audience blinked (#1106)
• "Never confined" is not "never served" (#1100)
• A subagent's plan LINES follow its plan PANEL
• workspace.ignore resolves the caller's workspace from three sources and names the one it lacked
• plan snapshot carries each step's sequence
• plans reach every client on a runner session; a null error is no error; rail handle
• workspaces: the root is not a workspace; the web client reads three events as the daemon sends them
• workspace registry: a row the verbs cannot act on is not listed
• event_sink: only a list of paths is a session boundary
• One target key, and a harness the manifest's author is sure about
• websocket: import List for the new visible_workspace_paths annotation
• web-coder-ui: seven gaps against the TUI — sessions, permissions, tools, and workspaces a user owns
• Files panel: hide and .gitignore toggles, served daemon-side as workspace.ignore (protocol 1.12)
• permission: send the prompt content on the runner path, and render it
• Both transports authenticate, and one path threw it away
• feat(session): session.reload_env re-resolves a live session's env and rebuilds its provider
• A failure while reporting a failure, discarded (#1077)
• A parent that looks at a freshly-forked child is reading a race (#996)
• fix(workspace_manager): derive the provider catalog from the provider contracts
• Only a failing test counts as a guard detecting its reversion (#1065)
• Give the reversion meta-guard its own job, and bind --ignore to its leg
• Name the ticket route where #1073 describes the WS transport
• refactor(web): rename jaato-web to jaato-web-coder-ui
• Identity at connect: bind a per-user ticket to a WS connection (#1074)
• One tolerance for a sink without get_client_peer
• Contain a workspace name to the workspace root
• Keep the new # env: descriptions to one line
• Describe the three other env vars explain env rendered bare
• Describe JAATO_IPC_TRUST_PEER_PATHS where explain env reads it
• IPC: read the peer credential, and refuse paths it cannot reach
• Remove max_turns: a bound declared everywhere and enforced nowhere (#1068)
• A rung a client could see and not read (#1069)
• fix(webmcp): read session-scoped env through get_session_env
• feat(webmcp): drive a page's declared tools, validated on real Chrome 153
• Unreported usage is not zero spend (#688 items 1 and 2)
• security: fence third-party MCP schema text; lift CDP client to shared

jaato-server

Jaato Server — LLM tool orchestration runtime and daemon.

See the project README for full documentation.