September campaign: Slack removal and review remediation

CHANGELOG.md

@@ -6,6 +6,53 @@ Each GitHub release body is the matching section of this file.
 
 ## [Unreleased]
 
+### Changed
+
+- The Codex accounts table shows per-account quota windows and remaining usage;
+  an idle quota check refreshes accounts periodically, and limit-aware failover
+  prefers an account with remaining quota. When all accounts are limited, the
+  request still reaches Codex on the account whose limit resets first.
+- Outbound webhooks may target private and homelab addresses, while cloud-metadata
+  destinations remain blocked. Redirects and DNS are validated at delivery, and
+  webhook signatures are never forwarded to another origin.
+- MCP calls keep the first response for a request ID on all transports; later
+  responses are ignored with a payload-free warning. The handshake remains strict.
+- The completion judge no longer imposes a 128-token output cap. Native Codex
+  requests are unchanged; compatible and Ollama reasoning judges can use their
+  normal output budget. Empty or ambiguous judge answers are logged as warnings.
+- Knowledge ingestion splits unusually long words into bounded chunks. Existing
+  documents are unchanged until re-ingested.
+
+### Fixed
+
+- `/stop` removes its private deferred acknowledgement after Odin's public stop
+  message is delivered, avoiding a duplicate private notification.
+- Outbound webhook edits made in the API or WebUI persist across restarts and
+  report their durable state. Configured per-target TLS verification and secret
+  scrubbing settings now apply at startup.
+- Malformed permission overrides and API token records survive unrelated writes,
+  with operator-visible diagnostics; existing effective tiers and token access
+  are not changed by the migration.
+- Trusted-proxy forwarding validates IP addresses, supports CIDR trust ranges,
+  and walks the forwarded chain from the nearest proxy to prevent rate-limit
+  bucket spoofing and inaccurate audit IPs.
+- Concurrent knowledge ingests no longer bypass duplicate checks or add
+  spurious versions, and colliding chunk ID prefixes cannot overwrite chunks
+  belonging to another source, including on version restore.
+- Usage coverage recovers from transient scan failures and detects oversized
+  unfinished trajectory rows instead of stalling later records silently.
+- Computer-use audit and System Logs retain specific refusal reasons, including
+  `target_changed_observe_again`, instead of collapsing them to a generic
+  rejection; desktop input and receipts are unchanged.
+
+### Removed
+
+- Removed the unused standalone plan engine. The `python -m src.odin` plan
+  runner is gone; remove any scripts or automation that invoke it when upgrading.
+- Removed the Slack integration, its configuration fields, API routes and WebUI
+  controls. Existing `slack:` configuration sections are ignored for upgrade
+  compatibility; generic Slack-token redaction remains active.
+
 ## [4.6.0] - 2026-09-23
 
 ### Added

README.md

@@ -111,7 +111,7 @@ The package also grants the `odin` service account passwordless sudo; restrict `
 
 - Create, edit, enable, disable, import, export, and invoke Python skills at runtime.
 - Configure skills with JSON schemas, dependencies, and operator-managed settings.
-- Integrate external systems through webhooks, email, MCP servers, Slack, Grafana alerts, and custom skill code.
+- Integrate external systems through webhooks, email, MCP servers, Grafana alerts, and custom skill code.
 
 ### Management interface
 

config.yml

@@ -322,16 +322,6 @@ web:
 
 # --- Optional integrations (uncomment and configure to enable) ---
 
-# # Slack webhook forwarding
-# slack:
-#   enabled: false
-#   webhook_urls: {}            # { "channel-name": "https://hooks.slack.com/..." }
-#   default_webhook_url: ''
-#   scrub_secrets: true
-#   rate_limit_seconds: 1
-#   forward_alerts: true
-#   forward_webhooks: false
-
 # # Grafana alert auto-remediation
 # grafana_alerts:
 #   auto_remediate: false

coverage-baseline.json

@@ -1193,12 +1193,6 @@
   "percent": 100.0,
   "statements": 12
  },
- "src/notifications/slack.py": {
-  "covered": 129,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 129
- },
  "src/observability/__init__.py": {
   "covered": 3,
   "missing": 0,
@@ -1235,96 +1229,6 @@
   "percent": 87.5,
   "statements": 16
  },
- "src/odin/__init__.py": {
-  "covered": 7,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 7
- },
- "src/odin/cli.py": {
-  "covered": 46,
-  "missing": 13,
-  "percent": 77.97,
-  "statements": 59
- },
- "src/odin/context.py": {
-  "covered": 122,
-  "missing": 7,
-  "percent": 94.57,
-  "statements": 129
- },
- "src/odin/executor.py": {
-  "covered": 42,
-  "missing": 1,
-  "percent": 97.67,
-  "statements": 43
- },
- "src/odin/plan_loader.py": {
-  "covered": 29,
-  "missing": 8,
-  "percent": 78.38,
-  "statements": 37
- },
- "src/odin/planner.py": {
-  "covered": 95,
-  "missing": 3,
-  "percent": 96.94,
-  "statements": 98
- },
- "src/odin/registry.py": {
-  "covered": 26,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 26
- },
- "src/odin/reporter.py": {
-  "covered": 25,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 25
- },
- "src/odin/tools/__init__.py": {
-  "covered": 0,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 0
- },
- "src/odin/tools/base.py": {
-  "covered": 8,
-  "missing": 1,
-  "percent": 88.89,
-  "statements": 9
- },
- "src/odin/tools/file_ops.py": {
-  "covered": 19,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 19
- },
- "src/odin/tools/http.py": {
-  "covered": 8,
-  "missing": 13,
-  "percent": 38.1,
-  "statements": 21
- },
- "src/odin/tools/process.py": {
-  "covered": 29,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 29
- },
- "src/odin/tools/shell.py": {
-  "covered": 19,
-  "missing": 1,
-  "percent": 95.0,
-  "statements": 20
- },
- "src/odin/types.py": {
-  "covered": 37,
-  "missing": 0,
-  "percent": 100.0,
-  "statements": 37
- },
  "src/odin_log/__init__.py": {
   "covered": 2,
   "missing": 0,