release: promote dev to master (v1.0.0-beta.48, sync branch)

.claude/skills/taos-development-skill/SKILL.md

@@ -148,7 +148,7 @@ uv run pytest tests/ --ignore=tests/e2e -n auto
 - Uses `uv sync --frozen` and `pytest -n auto`
 - Also required: `spa-build` (npm build + tsc + **vitest** - a desktop type error or failing
   component test fails CI), a "Verify app starts" `create_app` import smoke, `lint`
-  (`compileall`), and `cla`. The doc-gate is a separate workflow.
+  (`compileall`), and `cla`. The doc-gate and store-wiring gate are separate workflows.
 
 ## CLA - HUMAN signs
 
@@ -438,6 +438,43 @@ Docs-Reviewed: no user-facing change, internal refactor only
 Run `scripts/install-git-hooks.sh` to enable local hooks (`.githooks/pre-commit` and
 `.githooks/commit-msg`) so the gate runs before you push.
 
+## Store wiring gate
+
+A gate (`.github/workflows/store-wiring-gate.yml`, running `scripts/check_store_wiring.py`)
+blocks PRs that add a new `BaseStore` subclass without wiring it into `tinyagentos/app.py`.
+Routes reach stores ONLY via `request.app.state`, so an unwired store is unreachable dead
+code. The check is name-level (the class name must appear in `app.py`) and polices only
+classes added by the PR - pre-existing orphans are skipped.
+
+For a store genuinely constructed elsewhere (tests, CLI, workers), waive it with a PR-body
+trailer, which is logged by the gate:
+```
+Store-Unwired-Intentionally: <ClassName>, <why>
+```
+
+## Secret-ignores gate
+
+A gate (`.github/workflows/secret-ignores-gate.yml`, running `scripts/check_secret_ignores.py`)
+verifies that the committed `.gitignore` still protects known secret-shaped paths on every
+promotion target. A `.gitignore` rule is the kind of file a rebase conflict can quietly drop
+during a dev->master promotion while every test stays green and nothing builds red, so the
+protection is asserted here, not assumed. The gate runs on push to `master`, `dev` and
+`release/*` (a dropped rule fails the branch it lands on) and on PRs to those branches (a
+conflict-resolution loss fails before the merge, since the merge commit's `.gitignore` is what
+is checked).
+
+Two signals, defense in depth:
+
+- Every required protection rule must appear verbatim as an active line of `.gitignore`
+  (`*.key`, `identity.json`, `*.p8`, `*credentials.json`, `*creds*.json`, the `*_private.*`
+  key shapes, `secrets/`, `data/hub/`, and the rest listed in `REQUIRED_PATTERNS` in the
+  script). Comment prose and narrower sibling rules do not satisfy a rule.
+- A set of secret-shaped paths (`data/hub/identity.json`, `foo.key`, `creds.json`, `x.p8`,
+  `y_credentials.json`, ...) must all be reported ignored by `git check-ignore`.
+
+Removing any one protection pattern turns the gate red -- proven by a parametrized test that
+drops each pattern from a copy of the real `.gitignore` and asserts the guard fails.
+
 ## Upstream conventions (from CONTRIBUTING.md)
 
 - **Target branch is `dev`, not `master`.** `master` is the stable live-install track.

.github/workflows/ci.yml

@@ -184,7 +184,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v7
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "npm"
           cache-dependency-path: desktop/package-lock.json
 

.github/workflows/secret-ignores-gate.yml

@@ -0,0 +1,35 @@
+name: Secret-ignores gate
+
+# Verifies that the committed .gitignore still protects known secret-shaped
+# paths (data/hub/identity.json, foo.key, creds.json, x.p8, ...) on every
+# promotion target. A .gitignore is the kind of file a rebase conflict can
+# quietly drop during a dev->master promotion while every test still passes and
+# nothing builds red, so promotion is verified here, not assumed.
+#
+# Trigger scope is deliberate:
+#   - push to master/dev/release/* : a dropped pattern fails the branch it
+#     lands on (this is the post-promotion check from tsk-laezfg step 1).
+#   - pull_request to master/dev/release/* : a conflict-resolution loss fails
+#     BEFORE the merge, since the merge commit's .gitignore is what is checked.
+# The run is pure stdlib (~1s), so it carries no shard-timeout risk.
+#
+# See scripts/check_secret_ignores.py for REQUIRED_PATTERNS and SECRET_PATHS.
+
+on:
+  push:
+    branches: [master, dev, release/*]
+  pull_request:
+    branches: [master, dev, release/*]
+
+jobs:
+  secret-ignores-gate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Assert secret-shaped paths are ignored
+        run: python scripts/check_secret_ignores.py

.github/workflows/store-wiring-gate.yml

@@ -0,0 +1,46 @@
+name: Store wiring gate
+
+# Detects PRs that add a new BaseStore subclass without wiring it into
+# tinyagentos/app.py. Routes reach stores ONLY via request.app.state, so a
+# store that is never assigned to app.state is unreachable.
+#
+# Start with a NAME-LEVEL check (class name appears in the lifespan file).
+# Only newly added classes are policed; pre-existing orphans are skipped so
+# the check is mergeable on any branch.
+#
+# A "Store-Unwired-Intentionally: <ClassName>, <why>" trailer in the PR body
+# waives a named class and logs it, for stores genuinely constructed elsewhere
+# (tests, CLI, workers).
+#
+# See scripts/check_store_wiring.py for the implementation.
+
+on:
+  pull_request:
+    # "edited" so a waiver trailer added by editing the PR body retriggers the
+    # gate (a re-run replays the stale event payload with the old body).
+    types: [opened, synchronize, reopened, edited]
+    branches: [master, dev]
+
+jobs:
+  store-wiring-gate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      BASE_REF: ${{ github.base_ref }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Fetch base branch
+        run: git fetch origin "$BASE_REF"
+
+      - name: Check for unwired BaseStore subclasses
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: python scripts/check_store_wiring.py --base "origin/$BASE_REF"

.gitignore

@@ -152,6 +152,7 @@ data/.seeded-agent-tokens.json
 data/secrets.db*
 data/*.key
 data/*.token
+data/.litellm_master_key
 
 # Key material and secrets. Added 2026-07-27 after data/hub/identity.json was
 # committed to PR #2043 with signing_private and encryption_private in

CHANGELOG.md

@@ -7,6 +7,120 @@ Versions follow semver beta: `1.0.0-beta.N`, bumped on each dev->master promotio
 
 ## [Unreleased]
 
+## [1.0.0-beta.48] - 2026-08-11
+
+### Added
+
+- Quarantined task cards surface their strike count and latest strike on the
+  task-detail response, and a lead can un-quarantine a card via
+  `POST /api/projects/{pid}/tasks/{tid}/unquarantine`, clearing its strikes (#2333).
+
+- **Hailo-10H HEF model catalog**: five NPU-accelerated model manifests
+  (DeepSeek-R1-Distill-Qwen 1.5B, Llama 3.2 3B, Qwen2 1.5B, Qwen2.5 1.5B,
+  Qwen2.5 Coder 1.5B) now resolve and install via `hailo-ollama` on
+  Raspberry Pi 5 + AI HAT+2, and downloaded `.hef` files show up in the
+  local-files and orphan scans (#2338).
+
+- The Agents app registry panel shows each agent's handle (alias) and lets the
+  owner or an admin edit it inline, saved via
+  `PATCH /api/agents/registry/{canonical_id}`. A leading `@` is display syntax
+  and is stripped before save (#2349).
+
+- Wallpaper fit options in Settings -> Desktop & Dock: fill, fit, stretch,
+  center, and tile. The choice is persisted per device (localStorage, keyed
+  by a locally minted device id that is never sent to the server), so each
+  screen keeps the fit that suits its aspect ratio (#2357).
+
+- **Agent loop infrastructure**: new `tinyagentos.agent_loop.AgentLoop` library
+  for subagent delegation and safe-point message queuing. Landed as
+  standalone infrastructure; wired into the chat router and taOS agent
+  routes in #tsk-icpt4i (#tsk-rl2lfb).
+
+- **CI**: store-wiring-gate workflow and `scripts/check_store_wiring.py` guard.
+  A PR that adds a new BaseStore subclass without wiring it into
+  `tinyagentos/app.py` now fails CI and names the unreachable class and file.
+  Routes reach stores ONLY via `request.app.state`, so an unwired store is
+  dead code. Only newly added classes are policed; a
+  `Store-Unwired-Intentionally: <ClassName>, <why>` trailer in the PR body
+  waives a named class for stores genuinely constructed elsewhere (tsk-n3w5mh).
+
+- **Docs**: mechanical-simple-auditable design law added to the agent manual
+  (`01-rules.md`), with a worked example anonymised as "an agent". Also trimmed
+  verbose prose in the image-prompting guide to stay within the compiled manual
+  character budget.
+
+### Changed
+
+- CI's `spa-build` job runs on Node 22 (was 20, now past end-of-life). Also
+  unblocks the jsdom 30 upgrade, which requires Node >= 22.13 (#2353).
+
+- **Agent loop wiring**: `AgentLoop` is now the single per-agent serialization
+  owner. `AgentChatRouter` drives OpenClaw ACP turns through a per-agent
+  `AgentLoop` (replacing the per-agent lock) and the turn-holder drives
+  messages queued mid-turn at its safe point. The desktop taOS agent chat
+  endpoint serializes on one `AgentLoop` too -- fixing a race where two
+  concurrent POSTs shared the opencode session with no serialization --
+  queueing concurrent messages and surfacing them in the turn-holder's stream
+  tail. New `GET /api/taos-agent/status` endpoint returns the desktop loop's
+  status scoped to state / current turn / queue depth / subagent descriptors
+  (subagent result/error payloads stay server-side) (#tsk-icpt4i).
+
+### Fixed
+
+- Project list entries: `get_entry` no longer reads cursor metadata after the
+  cursor closes, and a failed reorder now rolls back its partial updates so a
+  later unrelated write cannot commit a half-applied ordering (tsk-u23vjy,
+  fix-forward of #2183).
+
+- The Agent-as-a-Model surface (`GET /v1/models`, `POST /v1/chat/completions`)
+  is now reachable by external OpenAI-compatible clients: the auth middleware
+  passes exactly those two routes through to their own consent-key check
+  instead of rejecting every session-less caller before the handler ran. All
+  other `/v1` paths remain session-gated (tsk-hfs6zv).
+
+- **PWA refresh loop after a browser auto-update**: `/auth/status`, `/auth/me`
+  and the chat/canvas/terminal/web-chat WebSocket handlers now apply the same
+  session User-Agent binding check as the API middleware. Previously a session
+  created before a browser update kept reading as authenticated on
+  `/auth/status` while every `/api/*` call was rejected, so the desktop shell
+  remounted in a loop; the WebSocket endpoints conversely accepted a cookie
+  the APIs refused.
+
+- **Catalog manifests' `context_window` was silently dropped**: `AppManifest`
+  declared no `context_window` field and `from_dict` never read the YAML
+  value, so every manifest loaded as 0 and the chat context-window budget code
+  always fell back to the 4000-token "unknown window" default. The field now
+  loads onto `AppManifest` (0 reserved for unknown), so real windows -- e.g.
+  rkllm 4096, qwen 32768 -- drive the #1740 budget math. (#2338, #1740)
+
+### Security
+
+- Memory routes reject any `agent` value that is not a single plain path
+  component (separators, `.`/`..`, NUL all 400): the caller-controlled name
+  becomes a filesystem path component of the qmd `dbPath`, and a traversal
+  value could previously address SQLite files outside `agent-memory/` (#2352).
+
+- All owner-gated agent-registry routes are now existence-hiding: a caller who
+  does not own an agent gets the same 404 as a nonexistent id, on the
+  scope-request create/approve/deny routes and on registry PATCH, revoke,
+  rotate-tokens, and org update. Previously a 403-vs-404 difference disclosed
+  whether an agent id existed (issue #2106, reported by hognek) (#2356).
+
+- **CI**: `secret-ignores-gate` workflow and `scripts/check_secret_ignores.py` now
+  assert, on push to `master`/`dev`/`release/*` and on PRs to those branches, that the
+  committed `.gitignore` still contains every secret-protection rule (`*.key`,
+  `*.p8`, `identity.json`, `*credentials.json`, `*creds*.json`, the `*_private.*` key
+  shapes, `secrets/`, `data/hub/`, and more) and that known secret-shaped paths
+  are all reported ignored by `git check-ignore`. Closes the "promotion must be
+  verified, not assumed" gap from #2171/#2173. Removing any one pattern is
+  proven to fail the gate by a parametrized test (tsk-laezfg).
+
+- **Desktop deps**: bump `dompurify` 3.4.12 -> 3.4.13 (GHSA-55q2-fjhq-7xh7,
+  moderate) and `nanoid` 5.1.11 -> 5.1.16 (CVE-2026-67214, high) in
+  `desktop/package-lock.json`; lock-only, both already within the declared
+  ranges. Split out of Dependabot #2331, whose grouped jsdom 30 bump fails
+  spa-build (jsdom 30 requires Node >=22.13; CI pins Node 20).
+
 ## [1.0.0-beta.47] - 2026-08-09
 
 ### Added

README.md

@@ -26,7 +26,7 @@
 
 Self-hosted AI agent platform that runs on whatever hardware you have. An old laptop, a Raspberry Pi, a gaming PC, an SBC gathering dust, or all of them at once. taOS turns your spare hardware into a distributed AI compute cluster.
 
-A full web desktop environment with 40 bundled apps, 109 catalog apps, 47 MCP plugins, 17 agent frameworks, a curated local model catalog of 113 manifests covering LLMs, vision, embeddings, audio, and image generation (including RK3588 NPU variants via c01zaut/happyme531), plus 167k+ searchable models from HuggingFace, agent deployment, training, image/video/audio generation, and full system monitoring, all from a single web dashboard. Supports Apple Silicon (MLX), NVIDIA, AMD, Rockchip NPU, Raspberry Pi, Android phones, and more.
+A full web desktop environment with 40 bundled apps, 109 catalog apps, 47 MCP plugins, 17 agent frameworks, a curated local model catalog of 120 manifests covering LLMs, vision, embeddings, audio, and image generation (including RK3588 NPU variants via c01zaut/happyme531 and Hailo-10H HEF variants via hailo-ollama), plus 167k+ searchable models from HuggingFace, agent deployment, training, image/video/audio generation, and full system monitoring, all from a single web dashboard. Supports Apple Silicon (MLX), NVIDIA, AMD, Rockchip NPU, Raspberry Pi, Android phones, and more.
 
 **Framework-agnostic by design.** taOS owns everything that matters: your agent's memory, files, communication channels, model access, and configuration. The agent framework is just a replaceable execution engine. Switch from SmolAgents to LangChain to OpenClaw and your agent keeps its entire history, all its Telegram/Discord/Slack connections, its trained LoRA adapters, its files, and its API keys. No migration, no data loss, no reconfiguration. This is possible because taOS manages the full agent lifecycle outside the framework.
 
@@ -215,7 +215,7 @@ lets the scheduler route work only to backends that are genuinely ready.
 See [docs/design/resource-scheduler.md](docs/design/resource-scheduler.md).
 
 ### Local Model Catalog + Live Model Browser
-A curated catalog of 113 vetted model manifests ships in-tree, every download URL is verified against HuggingFace, covering LLMs (Qwen3, Qwen2.5, Llama 3.1/3.3, Gemma 2/3, Phi-4, Mistral, Mixtral, DeepSeek, Granite, Command-R), vision models (Qwen2.5-VL, MiniCPM-V 2.6, Moondream2, Florence-2, LLaVA), embeddings (nomic, bge, mxbai, snowflake-arctic), rerankers (bge-reranker-v2, qwen3-reranker), speech (Whisper tiny→large-v3-turbo, Kokoro TTS, Piper, Parakeet), image generation (SD 1.5 LCM, Dreamshaper 8 LCM, SDXL Turbo/Lightning, Flux schnell/dev, SD3.5, PixArt-Σ, Playground v2.5, Kolors, AuraFlow), and image tools (RMBG-1.4, BiRefNet, Real-ESRGAN, 4x-UltraSharp, GFPGAN, CodeFormer, ControlNet canny/depth/pose). **RK3588 NPU variants** are included via c01zaut (Qwen2.5 1.5B→14B RKLLM) and happyme531 (LCM Dreamshaper SD as multi-file RKNN). The live Model Browser also searches 167k+ GGUF models from HuggingFace and the Ollama library. Hardware-filtered compatibility indicators show what runs on your device (green/yellow/red).
+A curated catalog of 120 vetted model manifests ships in-tree, every download URL is verified against its upstream host, covering LLMs (Qwen3, Qwen2.5, Llama 3.1/3.3, Gemma 2/3, Phi-4, Mistral, Mixtral, DeepSeek, Granite, Command-R), vision models (Qwen2.5-VL, MiniCPM-V 2.6, Moondream2, Florence-2, LLaVA), embeddings (nomic, bge, mxbai, snowflake-arctic), rerankers (bge-reranker-v2, qwen3-reranker), speech (Whisper tiny→large-v3-turbo, Kokoro TTS, Piper, Parakeet), image generation (SD 1.5 LCM, Dreamshaper 8 LCM, SDXL Turbo/Lightning, Flux schnell/dev, SD3.5, PixArt-Σ, Playground v2.5, Kolors, AuraFlow), and image tools (RMBG-1.4, BiRefNet, Real-ESRGAN, 4x-UltraSharp, GFPGAN, CodeFormer, ControlNet canny/depth/pose). **RK3588 NPU variants** are included via c01zaut (Qwen2.5 1.5B→14B RKLLM) and happyme531 (LCM Dreamshaper SD as multi-file RKNN). **Hailo-10H NPU variants** (Raspberry Pi 5 + AI HAT+2, served by hailo-ollama) ship as `.hef` manifests: DeepSeek-R1-Distill-Qwen 1.5B, Llama 3.2 3B, Qwen2 1.5B, Qwen2.5 1.5B, and Qwen2.5 Coder 1.5B. The live Model Browser also searches 167k+ GGUF models from HuggingFace and the Ollama library. Hardware-filtered compatibility indicators show what runs on your device (green/yellow/red).
 
 ### Agent Templates (1,467 Templates)
 Pick from 1,467 agent templates, 12 built-in plus 196 from awesome-openclaw-agents and 1,259 from the System Prompt Library, and deploy in one click. Browse by category (28 categories), filter by source, or search. Each template includes a system prompt, recommended framework, model, and resource limits. All templates vendored locally so nothing depends on external services.
@@ -384,7 +384,7 @@ Search across agents, apps, messages, and shared folders from a single endpoint.
 |----------|------|
 | **Agent Frameworks (17)** | SmolAgents, PocketFlow, OpenClaw, nanoclaw, PicoClaw, ZeroClaw, MicroClaw, IronClaw, NullClaw, Moltis, Hermes, Agent Zero, OpenAI Agents SDK, Langroid, ShibaClaw, DeerFlow, OpenCrabs (beta) |
 | **Streaming Apps (13)** | Blender, LibreOffice, Code Server, GIMP, Krita, FreeCAD, Obsidian, Excalidraw, JupyterLab, Grafana, n8n, Terminal, Neko Browser |
-| **LLM Models** | 113-manifest local catalog: Qwen3 0.6B-32B, Qwen2.5 0.5B-72B (+ RKLLM 1.5B-14B for RK3588), Llama 3.1/3.2/3.3, Gemma 2/3, Phi-3.5/4/4-mini, Mistral/Nemo/Mixtral, DeepSeek, Granite, Command-R, SmolLM2, TinyLlama, plus 167k+ searchable from HuggingFace |
+| **LLM Models** | 120-manifest local catalog: Qwen3 0.6B-32B, Qwen2.5 0.5B-72B (+ RKLLM 1.5B-14B for RK3588), Llama 3.1/3.2/3.3, Gemma 2/3, Phi-3.5/4/4-mini, Mistral/Nemo/Mixtral, DeepSeek, Granite, Command-R, SmolLM2, TinyLlama, plus 167k+ searchable from HuggingFace |
 | **Vision Models** | Qwen2-VL, Qwen2.5-VL, MiniCPM-V 2.6, Moondream2, Florence-2, LLaVA 1.6 / LLaVA-Phi-3 |
 | **Embeddings / Rerankers** | nomic-embed-text-v1.5, bge-large/small/m3, mxbai-embed-large, snowflake-arctic-embed, qwen3-embedding/reranker, bge-reranker-v2-m3 |
 | **Audio Models** | Whisper tiny→large-v3-turbo, Kokoro TTS, Piper voices, Parakeet TDT |
@@ -741,7 +741,7 @@ CI runs automatically on every push (Python 3.12 and 3.13 on every PR; Python 3.
 - [x] 47 MCP server plugins in app catalog
 - [x] Desktop notifications (toast stack + notification centre)
 - [x] Widget system (Clock, Agent Status, Notes, System Stats, Weather)
-- [x] Curated local model catalog, 113 manifests, all download URLs verified against HuggingFace
+- [x] Curated local model catalog, 120 manifests, all download URLs verified against their upstream host
 - [x] Activity monitor app, rktop-inspired per-core CPU/NPU/thermal/GPU/process stats
 - [x] Loaded Models panel in Model Browser, shows running models, purpose, and VRAM/RAM usage
 - [x] iOS PWA pill bar, safe-area-aware bottom nav with back / home / card-switcher / notifications