Every release, newest first.

• ✓Changesets on every run. A run snapshots its workspace and records what it added, changed, deleted or renamed, with line counts. The room line, the Team board badge and the viewer all show it, and a git work tree is stat'ed rather than read, so a large repository still records a one-line edit.
• ✓Runs, with cost. Tokens, booked price and wall time travel with every result. The Runs page on the instance and the org lists orders, routines, reviews and Canvas edits with who asked, who approved, what changed and what it cost — with CSV export and an audit drawer.
• ✓Projects through the relay. The viewer's Files tab browses instance, bot and named workspaces and any repository the host can fetch, with tree, highlighting, worktree and commit diffs, and the commit list. Review a run's changeset, comment on a line, and send it back to the bot that made the change. Nothing is read by AnvilHub.
• ✓Canvas. publish_artifact renders and sanitises on the host; AnvilHub keeps every version. Draw a region and say what should change, compare two versions with a divider and opacity slider, and step back to any version from the host's own snapshot.
• ✓Live preview. Run the workspace app — Vite, Next, Expo web or static — in a phone, tablet or desktop frame through the relay. Loopback only, admits a granted identity only, idle-closed.
• ✓Credentials in your vault. Sealed in your browser to the instance's key; the hub keeps a name, a kind and a fingerprint, and forgets the blob the moment the host acknowledges it. Runs use {{vault:NAME}}, scopable to bots or routines, never written into files.
• ✓Routines join the team. A routine runs as a fleet task — on the board, able to hand off, answering its own prompts from the owner's schedule. The release itself is a chain: sbom → build → verify → approval → publish → surfaces, where the publish step is never automatic and only a person can grant it.
• ✓Team bundles. Publish a team as a bundle with bots, routines and credentials by name only — a value anywhere in a bundle is refused by the registry. Installing shows a dry-run plan with the credentials it still wants.

• ✓Orders within a ceiling. Say do … in the room and your Anvil runs the task on its host and posts the result back. Every task carries who asked, the workspace and a ceiling the host enforces; a refused tool parks the run for a one-time approval instead of guessing.
• ✓A team of bots with their own identities. The instance orchestrates. Each bot has a name, role, squad, model, ceiling and a Matrix identity minted by AnvilHub; it hears only its orchestrator and posts results as itself, threaded under the order.
• ✓Assignment and hand-offs. do as reviewer: … assigns by name, a plain order lets the orchestrator pick a squad, bots hand work to siblings, the orchestrator reports the end of a chain, and lendable bots serve other instances in your organisation.
• ✓Managed from three doors. bot: verbs in the room, /bot in the terminal and viewers, and the Team editor on the instance card all write the same team files on the host. The Team board shows what every bot is doing and for whom.
• ✓Approval policy. Order ceiling, who may decide, auto-approve for operators inside the workspace, per-path rules and one-time decisions from the room — every policy decision audited with the rule that made it.
• ✓A cleaner chat. The composer stays put, the room has a header, your settings and security sit behind your name, the room's people, pins, files and settings live in a drawer, and settings are five tabs.

• ✓Your team gets a room, and the server cannot read it. Every organization gets end-to-end encrypted chat. It is real Matrix: messages are encrypted in the browser and decrypted in the browser, and the server stores ciphertext and refuses plaintext into an encrypted room. Each browser is a named device you can see and revoke.
• ✓Your Anvil is in the room, by name. The bot is not a notification feed — address it and it answers, with a persona you control. When it stays quiet it records why: not addressed, no persona configured, or its own message echoing back. The reason never contains the text of your message.
• ✓One binary, still. The daemon that runs your sessions now lives inside the anvil binary you already download. This closed a real gap: on some installs the background service ran a binary that did not contain the chat subsystem at all, so the bot could never start — and every log line still looked healthy.
• ✓Setup in four screens. Permission mode is asked at the door with the tradeoff stated plainly instead of assumed, the language you pick drives the whole wizard, and the model catalogue is one curated list instead of four that disagreed with each other.
• ✓Plan mode is enforced. Eight tools could still write while plan mode was on. They now go through the gate — each one proven by deliberately breaking it. Secret screening also sees more shapes: JSON-shaped credentials were invisible to it, and a file dropped into the conversation was never screened at all.

• ✓Ask more than one model. /consult puts the same question to a panel of models at once — each through its own client and its own key — then reports where they agree, where they diverge, and asks the minority what it saw that the others missed. It never picks a winner for you.
• ✓Hand a problem down a chain. /relay passes one problem through models in order, each seeing the real transcript of the work before it, redacted at every vendor boundary. Neither command will fake it: a consult of one is not a consult, and a single model working alone is a normal turn, not a relay.
• ✓Spend you can actually see. Every turn is priced against a live pricing registry and booked per seat, and a budget cap now refuses before the provider call rather than reporting the overspend afterwards. When a turn cannot be priced, Anvil says the total is unknown instead of quietly calling it zero.
• ✓Use a secret without seeing it. Credentials pasted into a session are detected, moved into the vault, and replaced with a handle the host resolves only when a tool actually runs. Anvil can use a credential it never reads — and lend one to another seat for a bounded time without handing over the value.
• ✓143 commands. The command registry keeps growing, and every command is now discoverable and runnable from the web and mobile viewers, not just the terminal.

• ✓Manage Your Anvil. AnvilHub is now mission control — claim a deployment and manage it from the web: name it, give it a persona, pick its primary agent, and see its live status.
• ✓Install & remove capabilities. Add or remove skills, plugins, and agents on a claimed Anvil straight from the marketplace — applied live when it’s online, queued when it’s asleep.
• ✓Build → sync → publish. Build a capability locally, sync it up as a private draft, review it, then publish it to the marketplace in one click — nothing leaves until you say so.
• ✓Starter chain templates. The chain builder ships curated templates wired from real store skills, so you compose from a working chain instead of a blank canvas.
• ✓Latest models. Refreshed defaults to the current flagships — Claude Opus 5, GPT-5.6, Grok 4.5, Gemini 3.6 Flash. The /model picker live-fetches every provider.
• ✓Leaner first run. The setup wizard no longer installs external dependencies; native memory, voice, and media are the default. Prefer a guided setup? anvil setup --web.

• ✓The Vivid Viewer. The whole web viewer is worth looking at — the mind map, conversation, memory, and settings share one cohesive, glowing look, and everything is its own proper window.
• ✓Mind map, lit up. Nodes glow in their own color, curved/dashed/dotted links pop, and a sparse ambient starfield (with occasional shooting stars) drifts behind the graph.
• ✓A conversation worth reading. Real message cards, fenced code as glowing panels with a language chip, proper inline code and bold, and long context collapsed to an expandable chip.
• ✓Browse memory by layer. The seven-layer rail readout is interactive — click a layer to open the memory browser, every memory a card with a colored type badge.
• ✓Settings in a window & /atmosphere. Configuration is a floating window; a new /atmosphere on|off carries the starfield behind the terminal conversation, mind map, and memory.
• ✓Presentation-layer only. No engine, protocol, or crypto changes — identical in commercial and FIPS builds.

• ✓The Mind Map Release. /mindmap (alias /mm) opens a daily-thoughts map — a collapsible outline in the terminal and a full interactive graph in the web viewer, one shared document that syncs live.
• ✓Force-directed web canvas. Nodes repel so they never overlap; drag a node and neighbors move aside; zoom has no lower limit (whole map always in view) with cursor-anchored wheel zoom; click a node for its full notes.
• ✓Style & time. Colorize nodes, choose link line-types, attach images, and view a day / week / month / year of interconnections.
• ✓Learns what Anvil learns (opt-in). Today's memories mirror into a collapsible “memories” branch (tagged by type, tasks open/closed); a separate read-only Memory Graph view projects the whole memory system with its [[links]]; suggestions reach into QMD + memories.
• ✓Live-session overlay (opt-in). When a web client drives the session, the terminal can show a calm “live session in browser” screen; the full conversation is intact when you wake it.
• ✓Remote & local viewers unified. The AnvilHub remote-control viewer serves the same mind map and features as local-control.
• ✓Seven platforms. macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64 (MSVC), FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.

• ✓The Convergence Release. Brings the security and supply-chain hardening from the regulated/FIPS edition into commercial Anvil, plus a new way for Anvil to learn from how you work.
• ✓Learns your recurring workflows. Repeat a multi-step workflow across sessions and Anvil offers to capture it as a reusable skill — /skills capture drafts one from your exemplar (or --never to dismiss).
• ✓Corporate TLS proxies out of the box. ANVIL_TLS_TRUST=system trusts your OS system trust store, so TLS-inspecting proxies (Zscaler, Palo Alto) with a locally-installed MITM CA just work.
• ✓Audit log (opt-in, on by default). A tamper-evident log of security-relevant actions, verifiable with anvil audit verify; disable with ANVIL_AUDIT=off.
• ✓Build & supply-chain hardening. Anti-exploitation build flags on every binary, a CycloneDX SBOM per release, and a cargo deny policy gating licenses, sources, and advisories.
• ✓Windows OAuth fixed. Browser sign-in on Windows completes reliably (PKCE via OsRng, single browser launch, dirs_next home resolution); the Windows asset is the MSVC wizard-fix build.

• ✓Security hardening release. Closes fifteen findings from a deep, adversarially-verified audit (no criticals). Recommended upgrade for all users; no feature changes, no config migration.
• ✓Relay pairing enforced locally. The daemon re-verifies pairing at the Rust layer before acting on any privileged message (CWE-306/862); the pairing-code attempt limit can no longer be reset by reconnecting (CWE-307).
• ✓Windows credential storage locked down. Secret files and the daemon capability token get an owner-only ACL at creation, and the daemon pipe verifies the connecting client's identity (CWE-732 / CWE-284).
• ✓Sandbox deny-by-default. An active sandbox denies read access to credential directories and scrubs secret env; strict mode denies outbound network; the macOS seatbelt profile is consolidated (CWE-522 / 668 / 1059).
• ✓Remote MCP bounded & SSRF-guarded. Response and line sizes are capped (CWE-400) and MCP URLs are checked against their resolved IP, refusing private/link-local/metadata ranges by default (CWE-918).
• ✓Additional hardening. Owner-only secret and run directories (CWE-732/367), a normalization-hardened command reviewer (CWE-697), and an allowlisted /perf argument (CWE-77).
• ✓Seven platforms. macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.

• ✓Sessions connect reliably. Fixed a daemon crash that dropped sessions on connect (early eof) — the provider runtime is shut down off the async worker. An older daemon can no longer shadow a newer build (build-timestamp recency guard).
• ✓Text selection copies from the right place. Drag-to-copy now starts exactly at your cursor even when lines above it wrap, with correct wide/emoji-character handling.
• ✓xAI / Grok refresh + Live Search. grok targets grok-4.3, retired ids removed, grok-build-0.1 added, and Grok Live Search via the x_search Responses-API tool (ANVIL_XAI_LIVE_SEARCH=1).
• ✓Sandbox policy gate. sandbox.require = strict | preferred | off with real macOS sandbox-exec seatbelt enforcement; the active backend shows in anvil daemon status.
• ✓AskUserQuestion over the daemon. Questions fan out over the relay so a daemon-attached or web viewer can answer, with an opt-in idle timeout.
• ✓Partial output preserved. A sub-agent that streams text then hits a rate limit keeps its partial work with an [incomplete response] marker; the failure is still reported.
• ✓Terminal hygiene & paste. The terminal is restored on every exit (quit, Ctrl+C, panic); large pastes land once, verified on local and daemon paths.
• ✓Daemon-leak fixed. Autostart is suppressed under test/headless, the singleton PID lock is atomic, an idle orphan self-exits, and anvil daemon reap clears runaway daemons.

• ✓Voice entry. /voice or Ctrl+E for live in-terminal dictation — words transcribe into the input box as you speak. Toggle on/off, Ctrl+C interrupts, type while recording. Cloud (your key) by default, or a local whisper.cpp backend.
• ✓Remote MCP servers. Streamable HTTP/SSE transport (not just local stdio) with anvil mcp login <server> browser OAuth + per-server tokens.
• ✓Whisper.cpp setup step. The wizard now offers an optional whisper.cpp install (next to QMD) for offline, no-key voice — installs the binary, downloads a model, wires your config. Cloud stays the default.
• ✓Shared action spinner. The model-turn animation now appears for every action with a label: Thinking, Recording, Transcribing, Running command, Loading, Searching, Authenticating.
• ✓Claude-Code parity. Inline !-bash, /config key=value, /permissions denial reasons, autoMode.classifyAllShell, org model allow/deny, skill-frontmatter casing, MEMORY.md compaction reminder, structured-output loop guard, mouse-click pass-through.
• ✓Security. sandbox.credentials blocks commands (inline shell included) from reading credential files or dumping secret env; destructive-command guards flag hard resets, force-cleans, and infra destroy.
• ✓Login lands in Anvil. anvil login runs the loopback OAuth flow then launches straight into Anvil; the callback listener ignores stray connections instead of aborting.
• ✓Fixes. Per-turn memory injection no longer floods context; voice capture fully silenced (no TUI corruption); Linux peer-credential checks; guaranteed release checksums.
• ✓Seven platforms — macOS ARM64/Intel, Linux x86_64/ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.

• ✓Memory browser (Phases 1–4). /memory browse in the TUI + a web memory console with an SVG graph of the [[link]] web; full management — create, edit, forget, and re-scope entries between global and per-workspace — from the browser.
• ✓/local-control. Serves the same web console locally over loopback (every remote-control feature + the memory browser), pairing-PIN gated, no cloud round-trip.
• ✓Relevance-filtered memory + stranded-import fix. Identity/process tiers always inject; project/reference memories are surfaced per-turn, filtered to the message, so the prompt stays lean. Memory now merges the global + per-workspace stores.
• ✓Web viewer ↔ TUI parity. Conversation-on-pair, input history, correct cost chip, and the full rail (model, version+build, permissions, semantic/procedural/reflective, self-improve, QMD); context bar = current window with a live block countdown.
• ✓Reliability. 10-minute streaming timeout (not 60s); OS proxy auto-detect off by default; mid-stream cuts re-run the turn; daemon version handshake respawns a stale anvild.
• ✓TUI. Esc cancels + recalls the message for edit/resend; navigable queued-message view; timestamps default to [YYYY.MM.DD.HH:MM], on by default; conversation replays on --continue/--resume.
• ✓Self-improvement + security. Workflow/process reviewer captures how a session went; dedup/upsert stops near-duplicate memories; hardened daemon/askpass sockets + the routine approval gate.
• ✓Seven platforms — macOS ARM64/Intel, Linux x86_64/ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.

• ✓Durable daemon sessions (D.1–D.4, #841–#844). Session execution moves out of the TUI into anvild — close the TUI and the session keeps running; reopen or attach from elsewhere and reattach to the same live session; crash and restart the daemon and it replays from the journal. Multi-client attach with peer-attach/detach events.
• ✓Named, multi-tab sessions + same-cwd auto-resume (#911). Session manifest gains name + last_active_at_ns; /session list|rename|kill|new|open|load|close mapped onto TUI tabs with per-tab daemon routing. Reopen Anvil in a directory with a live session and it reattaches.
• ✓Relay bridge — attach from the browser (#914, #917, #919–#921). A browser viewer pairs to a live daemon session over a passage WebSocket. #917 (P0) fixed a daemon tool-dispatch name-drift; #919 viewer UX; #920 /permissions over the relay; #921 ring recorder so resume carries the conversation.
• ✓Performance (#898–#900). One shared reqwest::Client ends per-call TLS handshakes; read-only tools in a batch fan out across worker threads (mutating tools still gated sequentially); grep_search walks-and-searches simultaneously, respects .gitignore, skips binaries.
• ✓The big modularization — 31 crates (#867, #873–#896). anvil-cli split into four crates; thirteen crates extracted from runtime (vault, journal, permissions, oauth, hooks, mcp, memory, curator, search, relay, reflection, skill-chain-exec, routines). runtime shrank ~70K→~57.7K lines.
• ✓Daemon hardening — P0 fixes (#902–#917, #827). Real provider runtime wired into the daemon; attach forwarder connected; correct PID file; /heal checks process liveness; auto-compaction actually compacts; anvild downgrade-prevention.
• ✓3,926 tests passing, zero failures. Latent shared-state test races serialized. IPC gained a dual-transport abstraction (Unix sockets + Windows named pipes) so the daemon runs natively on all seven platforms.
• ✓Seven platforms — every binary SHA256-verified.

• ✓F1 — Signed skill provenance. Every skill carries a signed provenance.jsonl ledger keyed by an ed25519 keypair; the verifier walks the chain on every load, a break surfaces as a P0 in /skill why. Trust-on-first-use pins an imported skill's pubkey. New anvil skill why|pubkey|verify.
• ✓F4 — Anti-skills (negative learning). The curator records failure modes as AntiPattern memory entries with their own retrieval-order block; anti-skills annotate rather than block, with a “you tried something similar and it scored N% worse” footnote.
• ✓F6 — Event-triggered routines. anvild routines accept FileWatch / Webhook / Process / Log triggers in addition to cron. Webhook listener is axum 0.8, localhost-only by default.
• ✓F3 — Curator A/B evaluation. New skills run an A/B pass against a held-out batch; winners promote, losers go to the anti-skill pool. Additive, escalate-only — a worse candidate can't replace a better incumbent.
• ✓F2 — Cross-machine memory federation. x25519 key agreement, HKDF-SHA256, AES-256-GCM (fresh nonce per call), ed25519 signatures, trust-on-first-use peer pinning. anvil memory sync|peer add|peer list.
• ✓Forge screensaver. Video-driven two-phase animation baked once into a 665 KB gzipped cell-grid bundle compiled into the binary — no ffmpeg at build or run time.
• ✓3,061 tests passing, 0 failing (+139 across the arc). Three parallel-test flakes pinned to a serial token.
• ✓Seven platforms — every binary SHA256-verified.

• ✓chore: regenerate Cargo.lock + man/anvil.1 for v2.2.19
• ✓release: v2.2.19 — bump version + finalize release notes
• ✓feat(wizard): #768 move anvild install prompt into wizard alt-screen
• ✓feat(wizard): #767b Ctrl+B Back keybind on Choice + Confirm modals
• ✓fix(tui/vs): #769 add ⌥/Alt+drag selection hint to vertical-split rail
• ✓fix(modal): #767a ConfirmModal adaptive height — long body no longer hides buttons
• ✓fix(daemon): #766 follow-up — spawn_detached execs anvild not anvil
• ✓feat(daemon): #766 anvild as separate process name across 7 platforms
• ✓feat(install): #751 locale-aware installers (sh + ps1)
• ✓task #764 (v2.2.20): extend OAuth keepalive to Gemini (refresh) + Copilot (monitor+alert)
• ✓feat(daemon): #763 OAuth keepalive observability + Heartbeat events
• ✓fix(tui): #757 wrap-aware scroll prevents text from disappearing under input
• ✓feat(daemon): #761 anvild as single source-of-truth for OAuth refresh
• ✓fix(startup): #762 share startup hooks across --resume, --continue, run_repl
• ✓fix(health): #745 self-heal false-positives on OAuth + completions
• ✓fix(resume): #760 enter REPL after --resume instead of exiting to shell
• ✓fix(session): #758 use $ANVIL_CONFIG_HOME/sessions/ instead of CWD-relative
• ✓v2.2.19 #750: detect system locale at startup
• ✓man(anvil.1): regenerate from clap_mangen + tail on every release (task #752)
• ✓i18n: wire 42 new locales into SUPPORTED_LANGUAGES
• ✓i18n: add 42 new locales (EU official + non-EU European + major world)
• ✓i18n(v2.2.19): wire top-10 slash command output through t!() (task #754)
• ✓refactor(tui/clipboard): factor osc52_encode out of write_clipboard (#748)
• ✓feat(tui/clipboard): copy/paste/select always work alongside mouse capture (#748)
• ✓i18n: translate 12 fallback locales for v2.2.19 TUI chrome (ru/ko/id/it/nb/nl/pl/pt-BR/sv/tr/uk/vi)
• ✓i18n: add TUI layout keys to 12 remaining locale YAMLs (English fallback)
• ✓i18n: wire TUI layouts (classic, vertical_split, three_pane, journal) through t!()
• ✓feat(memory/L6): /reflect emits pattern recap + appends to daily summary (#735 RED)
• ✓fix(runtime/routines): switch proposal tests to tempfile to kill flake (#741)
• ✓feat(release): wire step-gates into release.sh + Phase 6 SSH hardening (#730)
• ✓feat(memory/L4): /memory show procedural consolidates goals + skills + cron (#734)
• ✓docs(anvilhub): Apache flushpackets=on spec for SSE token stream (#740)
• ✓docs(anvilhub): publisher-standing pre-check + ANVILHUB_BACKEND_URL (#738)
• ✓fix(memory/L3): /memory promote gains --target + nominated_at/source provenance (#733)
• ✓test(memory/L2): regression tests for /memory prune episodic trash-bin (#732)
• ✓fix(memory/L2): wire /memory prune episodic dispatch arm (#732 follow-up)
• ✓fix(memory/L7): drop stray #732 episodic match arm referencing missing fn (#736 follow-up)
• ✓fix(memory/L7): file-cache path discovery + /memory show cache + dry-run prune (#736)
• ✓i18n(v2.2.19): wire Tier-2 NATIVE_NAMES rows in wizard + Configure picker (#710)
• ✓feat(memory/L1): /memory layer 1 renders live working snapshot (#731)
• ✓feat(prompt-section): iter_by_kind() extension method (#731 prep)
• ✓i18n(v2.2.19): Tier-2 finisher — nl/sv/nb/uk + SUPPORTED extend (#710)
• ✓docs(v2.2.19): AnvilHub /build page spec + BuildClient component (#674 #675)
• ✓docs(parity): file-path corrections appendix from implementing agents (#713)
• ✓docs(memory): I.1 audit — 7-layer architecture status (#712)
• ✓i18n(v2.2.19): Tier-2 part 2 — id + pl + vi locales (#710)
• ✓fix(worktree): preserve original-CWD MCP config across EnterWorktree (#728)
• ✓i18n(v2.2.19): Tier-2 partial — it + ko + tr locales (#710 partial)
• ✓fix(branch): preserve session origin across EnterWorktree boundary (#724)
• ✓feat(worktree): capture original_dir + original_sessions_dir at EnterWorktree (#728 prep)
• ✓fix(plugins/watcher): skip non-.md changes + exclude build dirs to prevent FD exhaustion (#726)
• ✓test(security/mcp): regression tests for permissions.allow gate (#717 part 4)
• ✓fix(mcp): disk-bind unsupported image MIME types instead of aborting (#725)
• ✓fix(security/mcp): consult permissions.allow before prompter (#717 part 3)
• ✓fix(theme): don't reset theme on first /rename invocation (#727)
• ✓fix(security/mcp): parse permissions.allow into PermissionsConfig (#717 part 2)
• ✓fix(tools/read): fall back to text/image alternate path on mime-mismatch (#723)
• ✓fix(security/mcp): add PermissionAllowList matcher for permissions.allow (#717 part 1)
• ✓fix(tui): self-heal glyph corruption in long sessions via periodic full-redraw (#718)
• ✓fix(api): 15s timeout on side-channel calls to prevent 75s startup hang (#722)
• ✓fix(tui): spinner/elapsed-time wake independently of input events (#716)
• ✓fix(session): preserve model field on --resume (#721)
• ✓fix(skills): recursion guard for context:fork invocations (#720)
• ✓fix(mcp): pagination for tools/list + resources/list + prompts/list (#715)
• ✓fix(security/bash): enforce permission rules on bare env-var assignments (#719)
• ✓docs(parity): CC v2.1.144-146 audit + 15 FILE-AS-TASK specs (#713)
• ✓feat(i18n/A6): wizard language picker + Configure menu picker (#645)
• ✓docs(v2.2.19): no-deferrals — fold all stretch items into hero arcs (#704)
• ✓feat(i18n/A5): --lang CLI flag + boot-time set_locale + pt-BR in SUPPORTED + drift gate test (#645)
• ✓docs(v2.2.19): master tracker + 6 supporting design docs (#704)
• ✓test(ssh-webui): end-to-end integration tests for /ssh relay round-trip (#706 phase 3)
• ✓i18n(v2.2.19): translate Tier-1 locales (es, zh-CN, fr, pt-BR, ru, ja, de) from en.yml seed (#645)
• ✓feat(/ssh webui phase 1): backend relay events + anvil-cli dispatch (#706)
• ✓i18n(v2.2.19): extract wizard + TUI core + cmd_static + cmd_ai strings → en.yml (#645)
• ✓release(scripts): add Phase 7 X announcement, renumber verify to Phase 9 (#659)

Web Viewer Parity + Mouse Capture Default-OFF + Autocompact Hardening:

• ✓Autocompact threshold now uses the context window (64K–200K+), not the output cap — sessions on long-context models run far longer before compaction (#697)
• ✓Mouse capture default-OFF on all platforms — restores terminal copy-paste for users who hadn't opted in (#696 P4)
• ✓/tab new/rename/switch + Ctrl+T in TUI + relay; per-tab routing for concurrent sessions (#696)
• ✓Web viewer default layout = vertical_split + tabs, matching TUI default
• ✓Relay: default-allow forwarding, slash completion, cost_type chip, collapsible tool cards, MemorySnapshot broadcast
• ✓Bracketed paste in textarea modals — multi-line paste works in /mcp builder and wizard fields (#685)
• ✓Alt-screen raw-mode restore fix — keyboard no longer stops working after inline-op cancel (#688)
• ✓MemorySnapshot uses layouts::common helpers for rail parity (#695)
• ✓PermissionPrompt end-to-end round-trip regression test (#677)
• ✓Release pipeline Phase 6 hardened against set -e silent-exit (#654)

Setup Wizard Rewrite, Autonomous Reflection, Sandbox Detonation, Source Viewer:

• ✓Setup wizard rewritten as a single continuous in-TUI alt-screen session — 9 modal steps from Welcome through to first prompt, no stdin prompts, no screen flicker (#642)
• ✓Autonomous reflection loop: StuckDetector catches ToolLoop / Thrashing / InferenceStall / Oscillation patterns and injects strategy-switch reminders before the next inference call (#636)
• ✓anvil-sandbox-runner binary ships with every release — detonates hub package installCmd in an OS sandbox and shows you the diff before anything touches your machine (#570)
• ✓AnvilHub source viewer end-to-end: all 558 packages have synthesized source archives + GitHub-style file browser with Shiki syntax highlighting and IndexedDB cache (#528)
• ✓Skill-chain builder — /builder React Flow canvas + /my-chains + anvil:// deep-link install; SKILL.md extended with inputs:/outputs: slots (#529)
• ✓TUI region-targeted partial repaints — DirtyRegions extended with per-area bits; photosensitivity gate preserved (no full-screen Clear without DirtyRegions::ALL) (#622/#629)
• ✓Reactive compaction: providers detect context-overflow errors, compact to half remaining, and retry the same turn without losing user input (#564)
• ✓HookEvent::Stop fires at end-of-turn when no tool_use; block decisions inject reason as synthetic user-text message (#566)
• ✓/rewind slash command with TUI picker and “Summarize up to here” force-compaction action (#557)
• ✓Rail keybinds wired (g/d/s/a/Ctrl+R) + drift test that asserts every advertised key has a handler (#634)
• ✓Session auto-titling: derive_title_from_first_message now actually fires on first user message (#580)
• ✓Tests: runtime 1106, anvil-cli 717, commands 235, api 330 — all green. Slash-command spec count 119; rail-keybinds drift gate added.

• ✓release: Anvil v2.2.16
• ✓chore: drop stale .claude/worktrees agent dirs from index
• ✓release(v2.2.16): hand-written release notes
• ✓test(v2.2.16): update layout_live_switch baselines for new default
• ✓prep(v2.2.16): bump version + flip default layout + wizard highlight
• ✓tui(classic): inline 7-layer MEMORY block above input (#607)
• ✓tui(paste): keystroke-burst detection for drag-and-drop (#604 Part C)
• ✓cli(cancel): wiremock integration test for Ctrl+C stream abort (#606)
• ✓cli(cancel): tokio::select! aborts blocking HTTP read on Ctrl+C (#605)
• ✓tui(paste): submit-time path detection + long-paste placeholder (#604)
• ✓runtime+cli(cancel): DefaultRuntimeClient honors set_cancel_token across all 7 providers
• ✓tui(vertical-split): close tool-call boxes, gate banner, style markdown, 2-decimal cost (#602)
• ✓runtime+tui(paste): first-class ContentBlock::Document for PDF + Office docs (#601)
• ✓tui(paste): consolidated handler + file-path detection, mouse capture OFF (#599)
• ✓feat(runtime): prefer anvilhub /api/version, fall back to GitHub
• ✓docs: clarify commit attribution for d219e18 / ccde10b
• ✓tui(vertical-split): commit #596 deliverables that the linter stripped from prior commit
• ✓tui(vertical-split): split-anchor rail, fold QMD into MEMORY, update banner (#596)
• ✓oauth: strict RFC 6749 token-exchange parser + startup validator (#595, BUG-14)
• ✓tui(vertical-split): rail owns all chrome, deck has input only (#594, BUG-13)
• ✓tui(vertical-split): rail sections — uppercase headers, cross-tab status aggregates, agent tab-binding (#588 polish)
• ✓tui(layouts): wizard + slugs + /layout --global + live preview page bumped to 8 variants (#588)
• ✓tui(three-pane): delete vim modal — always-on input, standard handler (#588, BUG-8)
• ✓tui(layouts): build real rail+deck vertical_split renderer matching mockup (#588)
• ✓tui(layouts): rename vertical_split renderer to classic + add TuiLayoutKind::Classic (#588)
• ✓tui(layouts): move layout from AnvilTui to Tab (per-tab layout state) (#588)
• ✓fix(model): async fetch_all_configured_models with timeout + Ctrl+C cancel (#BUG-7)
• ✓fix(tui): wire slash command completion popup into all 6 layouts (#BUG-6)
• ✓fix(tui): request redraw on every keystroke so input renders live across all layouts (#BUG-5)
• ✓feat(tui): make three-pane Insert mode discoverable with framed hint + ghost input (#BUG-4)
• ✓fix(tui): three-pane uses Constraint::Fill for CONTEXT band (#BUG-4)
• ✓fix(oauth): poll background callback channel each frame so login completes without requiring a keypress
• ✓fix(journal): clear header/input rows before draw to prevent stale-cell ghosting and add bg_primary to header
• ✓fix(api): 5xx errors name configured provider/gateway, not hardcoded Anthropic URL (#568, CC-143-B)
• ✓fix(session): title heuristic skips bare URL as first message (#563, CC-142-B)
• ✓fix(tui): welcome banner names active provider, not hardcoded Anthropic (#562, CC-141-B)
• ✓feat(mcp): ANVIL_MCP_TOOL_TIMEOUT env to override per-request fetch timeout (#559, CC-141-B)
• ✓feat(tui): spinner color warm green→amber→red on elapsed time (#558, CC-141-F)
• ✓fix(tools): Read offset accepts string forms with whitespace/+ prefix (#555, CC-140-B)
• ✓chore(docs): file task #579 — migrate wizard.rs prompts to in-TUI modal
• ✓feat(tui): intercept /login and /provider login to open TUI modal (#578)
• ✓feat(tui): wire ProviderLoginModal key handler and OAuth listener (#578)
• ✓feat(tui): add ProviderLoginModal for in-TUI OAuth/API-key flows (#578)
• ✓fix(tui): clear terminal on /layout switch to drop stale cells (#bug-3)
• ✓fix(tui): force full repaint after inline OAuth/setup flows (#bug-2)
• ✓fix(vault): retry up to 3 times + pre-fill /vault unlock on failure (#bug-1)
• ✓tui(layouts): wire /layout command, set_layout(), intro toast + live-switch tests (v2.2.16 Step 3E)
• ✓tui(layouts): land Step 3 — layout renderers, dispatch, DirtyRegions widening (v2.2.16)
• ✓tui(layouts): land LayoutSnapshot extraction + golden baseline (v2.2.16 step 1)
• ✓tui(layouts): config schema + /layout slash command (8 axes) + wizard step (v2.2.16 step 2)
• ✓security(oauth): lenient scopes deserializer prevents auth lockout (#565, CC-143-B)
• ✓v2.2.16: verification gate, /hub status (all 8 axes), /plugin update REVOKED guard
• ✓v2.2.16: HubPackage verified-badge structs + require_verified config (AnvilHub F3)
• ✓release: prepend ~/.cargo/bin to PATH (brew-Rust shadowing fix, #534)
• ✓docs(v2.2.15): clear public README narrative — 35 providers, /cursor, /model

• ✓docs(v2.2.15): clear public README narrative — 35 providers, /cursor, /model
• ✓release(v2.2.15): bump workspace + release notes
• ✓v2.2.15: /model handler — atomic cross-provider switch + ambiguous-name guard
• ✓v2.2.15: /model TAB completion — provider-prefixed unified list
• ✓v2.2.15: cross-provider unified model list (fetch_all_configured_models)
• ✓v2.2.15: /cursor handler — all 6 subcommands end-to-end
• ✓v2.2.15: /cursor spec registration with full subcommand tree
• ✓v2.2.15: SlashCommand::Cursor variant + 6 subcommand enum
• ✓Release notes for v2.2.14
• ✓fix(bedrock): add crate_env_lock to three env-touching tests to prevent parallel flake
• ✓test(bedrock): SigV4 compliance tests against Python-verified vectors
• ✓feat(gemini-oauth): Google Code Assist OAuth provider replacing Antigravity OpenAI-compat stub
• ✓feat(cursor): Cursor Cloud Agents provider — real API replacing broken OpenAI-compat stub
• ✓Expand provider catalog from 5 to 35 providers across the open-source ecosystem
• ✓Phase 6.5g: OTel events verified, ProviderRewriter Debug derive, cleanup
• ✓Phase 6.5b-f: /memory clean slash command + dispatch + integration tests
• ✓Phase 6.5a: MemoryRewriter trait + MockRewriter + RewriteResult schema
• ✓Phase 6.3 follow-up: --include-sessions fails loud on missing provider
• ✓Phase 6.3e: --include-sessions flag + integration tests
• ✓Phase 6.3b-d: sessions composer wiring + nominations subdir + OTel
• ✓Phase 6.3a: SessionSummarizer trait + MockSummarizer + SummarizedSession schema
• ✓Phase 6 follow-up: return real conflict_count from run_settings_import
• ✓Phase 6 integration: orchestrate all 5 pipelines in run_import_pipeline_headless
• ✓Phase 6.4c: full report generator + OTel event wiring
• ✓Phase 6.4a: wizard migration step + skip flag
• ✓Phase 6.1c: dispatch handler wiring + serial test isolation fixes
• ✓Phase 6.1b: instructions discovery + ANVIL.md merge semantics
• ✓Phase 6.1a: memory entry discovery + translation
• ✓Phase 6.2c: plugin manifest translation (with Phase 5.1 skills/agents fields)
• ✓Phase 6.2b: skills import (disabled by default, collision handling)
• ✓Phase 6.2a: settings.json schema translation + conflict staging
• ✓Phase 6.0: Migration foundation (ImportArtifact, manifest, staging machinery)
• ✓Phase 5.4g: Rewrite parallel-tab dispatch test to use Barrier
• ✓Phase 5.4f: Inherit SandboxConfig through subagent spawn
• ✓Phase 5.4e: serialize auto_tune cache-mutation tests to fix workspace race
• ✓Phase 5.4d: pin defect #11 resolution in fetch_ollama_models_for_cache doc
• ✓Phase 5.4a/b: HOOKS.md + SANDBOX-MODES.md research documentation
• ✓feat(#8): wire CommandCacheManager into glob_search and grep_search
• ✓feat(#9): wire CommandCacheManager into WebFetch/WebSearch (5-min/1-hr TTL)
• ✓fix(#514): serialize TRACEPARENT env tests to eliminate workspace-parallel race
• ✓fix(#4,#5): plugin manifest skills/agents fields + skill root discovery
• ✓Phase 5.2a/b/c: ResultBlock schema, 45-tool formatter, subcommand vocab consts
• ✓Phase 5.1a CC-BUG-3/4: Thread parent permission_mode into spawned subagents
• ✓Phase 5.3 #19: wire mcp_tool hook entries from settings.json (Stream B)
• ✓Phase 5.3 #21: propagate TRACEPARENT to plugin tool subprocesses
• ✓Phase 5.3 #16: document permission decision chain and pin order invariant
• ✓Phase 5.3 #15: extend Gate 3 sync-LLM lint with 4 new blocked patterns
• ✓Phase 5.1a #20 #22: TeamDelegate delegations in agents-live + parent_agent_id
• ✓Phase 5.1a #1: Wire EgressPolicy::is_allowed into web_ops + automation_ops
• ✓Phase 5.0.5: Unify slash command dispatch (4 sites → 1)
• ✓Phase 5.0: Bidirectional drift, menu-handler smoke, sync-LLM lint
• ✓Fix Anvil OAuth Max-plan 429: missing claude-code beta header + identity preamble
• ✓Wire DailyStore L2 episodic summaries into SystemPromptBuilder
• ✓Wire egress allowlist into settings.json + /memory show policy view
• ✓Serialize all ANVIL_CONFIG_HOME-mutating tests via #[serial(anvil_config_home)]
• ✓docs: overnight session summary for 2026-05-13
• ✓Phase 4.4 follow-up: update memory_show_nominations test for new banner phrasing
• ✓Phase 4.5: L1 — SYSTEM_PROMPT_DYNAMIC_BOUNDARY consumer for prompt-cache split
• ✓Phase 4.4: alias deprecations (file-cache, cmd-cache, history-archive, nominations)
• ✓Phase 4.3: L4 — /goal web_available audit (decision documented)
• ✓Phase 4.2: L7 — file-cache + cmd-cache size caps + LRU eviction
• ✓Phase 4.1: L2 — 90-day history retention with trash-bin + dry-run
• ✓Phase 3.7: L2 — fix /memory why daily-reconciliation help text
• ✓Phase 3.6: L5 — zero-injection integration test [SECURITY]
• ✓Phase 3.5: L7 — is_l5_path sentinel gates cache store/lookup [SECURITY]
• ✓Phase 3.4: L6 — PermissionEffect {Allow,Deny,Prompt} enum
• ✓Phase 3.3: L5 — wire classify_learning into nomination-emit (ANVIL_L5_AUTOROUTE) [SECURITY]
• ✓Phase 3.2: L3 — anvil-semantic QMD collection + nominated_from frontmatter
• ✓Phase 3.1: L3 — /memory promote writes ANVIL.md + atomic rename
• ✓Phase 2.8: spec + subcommand updates for /memory tier vocabulary
• ✓Phase 2.7: L7 — unified cache tier (file/cmd/qmd sub-views)
• ✓Phase 2.6: L6 — policy tier (grants + auto-deny + reviewer + egress)
• ✓Phase 2.5: L5 — identity tier (labels/keys + locked-state counts)
• ✓Phase 2.4: L4 — procedural tier (goals + skills + cron + routines stub)
• ✓Phase 2.3: L3 — semantic --pending recast (nominations alias)
• ✓Phase 2.2: L2 — episodic tier + daily sub-view
• ✓Phase 2.1: L1 — /memory why + show working introspects WorkingMemorySnapshot
• ✓/model picker reads live provider /models APIs, not static registry
• ✓Fix /model switch to atomically swap routing + prompt identity + chrome
• ✓Populate missing /cmd subcommand pickers + add drift-prevention test
• ✓Fix /model autocomplete regression — live provider-aware completions
• ✓Add missing /ollama spec + strengthen variant<->spec drift test
• ✓Wire /file-cache and /cmd-cache slash commands to real handlers (#490, L7)
• ✓Wire env::current_dir() into PermissionMemory load (#489 follow-up)
• ✓Wire PermissionMemory into the permission gate (#489, L6)
• ✓Update remaining test fixtures for Vec<PromptSection> migration
• ✓Flip system_prompt storage to Vec<PromptSection> end-to-end (Phase C+D of #486)
• ✓SystemPromptBuilder::build() returns Vec<PromptSection> (Phase B of #486)
• ✓Add PromptSection and WorkingMemorySnapshot types (Phase A of #486)
• ✓Fix /changelog freezing the TUI
• ✓Embed release notes into the binary
• ✓v2.2.14 Phase 1: retrieval-order block + 3 synthesis defect fixes + TUI placeholder
• ✓docs(research): seven-layer memory architecture + v2.2.14 arc plan
• ✓release(v2.2.14): bump workspace + release notes + README catchup
• ✓v2.2.14 BUG-fix: tab-2 missing Thinking + lost prompt + Apple Terminal Enter
• ✓v2.2.14 BUG-fix-real: render arbitration + instrumentation
• ✓v2.2.14 BUG-fix: tab-2 input echo missing while tab-1 streams
• ✓v2.2.14 TUI-2 (deep): true per-tab non-blocking turn waits
• ✓chore: fix anvil-cli test-target build + cross-module env-var test race
• ✓v2.2.14 TUI-3: queue user messages typed while a turn is streaming
• ✓v2.2.14 CC-DRIFT bundle: B4 agent panic, B6 compact usage, B8 mcp test
• ✓v2.2.14 TUI-2: cut in-flight wait latency from 80ms to 20ms
• ✓v2.2.14 CC-DRIFT-B5: OTEL TRACEPARENT propagation
• ✓v2.2.14 TUI-1: Ctrl+C cancels mid-flight streaming
• ✓v2.2.14 #474: rewire /ollama slash commands (W4-merge regression)
• ✓docs: record v2.2.14 audit verdicts for 4 VERIFY items
• ✓docs: mark CC-136-F2 SHIPPED in parity table
• ✓v2.2.14 CC-136-F2: autoMode.hard_deny short-circuit (#465)
• ✓v2.2.14 CC-139-F1: cross-session agent view via anvil agents subcommand (#462)
• ✓v2.2.14 CC-139-F5: transcript view nav keys (?, {, }, v) (#460)
• ✓v2.2.14 CC-136-B6 SECURITY: ReadOnly cannot be bypassed by env or Edit (#467)
• ✓v2.2.14 CC-139-B5 SECURITY: safe wildcard match primitive for tool allow-rules (#469)
• ✓v2.2.14 CC-136-B5 VERIFY: --resume/--continue on underscore paths (#466)
• ✓v2.2.14 CC-139-F16: subagent OTel headers (#461)
• ✓v2.2.14 CC-139-F4: /plugin details <name> with inventory + token cost (#459)
• ✓v2.2.14 CC-139-F3: /scroll-speed slash command + live mouse-wheel tuning (#458)
• ✓v2.2.14 CC-139-F2: unify /goal — auto-link active session on /goal new (#457)
• ✓v2.2.14 CC-133-F1: worktree.baseRef setting + apply at worktree-create (#463)
• ✓v2.2.14 W15b: wire auto-promote engine into read/bash + main.rs install (#394)
• ✓v2.2.14 W11: wire file-fingerprint cache into read/write/edit + system prompt (#390)
• ✓v2.2.14: hook args[] exec form + continueOnBlock for PostToolUse (#453, #454)
• ✓v2.2.14 CC-132-F1/CC-133-F4/CC-139-F8: per-session env propagation
• ✓v2.2.14 CC-132-F2: ANVIL_DISABLE_ALTERNATE_SCREEN env opt-out
• ✓.anvil-release.toml: fix WP path + pm2 process name drift

• ✓FreeBSD x86_64 + NetBSD x86_64 binaries — first-ever BSD support. Every binary SHA256-verified and signed by the release pipeline; paired .sha256 manifests served at anvilhub.culpur.net/sha256/.
• ✓Windows x86_64 is back. The v2.2.12 hold is fixed: ssh-agent auth is now #[cfg(unix)]-gated with a clean Windows stub. The rest of the SSH driver (key-file, password, kbd-interactive) works on Windows exactly as on Unix.
• ✓Seven platforms total — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64.
• ✓Release pipeline hardening. Removed the | tail -1 mask that hid the v2.2.12 Windows build failure. Build errors now hard-fail instead of silently producing partial releases.
• ✓Routines foundation on disk. New crates/runtime/src/routines/ module with schedule grammar (duration, interval, cron, ISO timestamp), output archive with [SILENT] early-stop, and SHA-256 input-hash packet schema. 63 new tests. v2.2.14 daemon ships on top.
• ✓FreeBSD ARM64 and OpenBSD x86_64 are not in this release — the Rust toolchain does not publish a precompiled standard library for either target. Both are queued for v2.2.14.

• ✓v2.2.12: parallel inference, tool-call cards, SSH tabs, scrollback fix
• ✓v2.2.12 Bug3-C3: per-tab parallel inference via JoinHandle spawn
• ✓T5-Ssh-F: wire /ssh end-to-end + add integration test with in-process russh server
• ✓v2.2.12 T5-Ssh-E: modal SSH connection form overlay
• ✓v2.2.12 T5-Ssh-D: render vt100 SSH tab + forward keys + Ctrl+B escape
• ✓v2.2.12 T5-Ssh-D-checkpoint: SshTabState + async/sync bridge + key encoder
• ✓v2.2.12 T5-Ssh-C: vault HostCredential schema for SSH aliases
• ✓v2.2.12 T5-Ssh-B: russh driver + 4-method auth chain
• ✓v2.2.12 T5-Ssh-A: SlashCommand::Ssh — parser for embedded SSH client
• ✓v2.2.12 T4-O: hot-reload ANVIL.md / MEMORY.md when they change on disk
• ✓v2.2.12 T4-M: /doctor release — pre-flight self-check for the release pipeline
• ✓v2.2.12 T4-L: mark interrupted turns visibly when partial response preserved
• ✓fix(release): require RELEASE-NOTES-<TAG>.md or hard-fail; never ship empty body
• ✓v2.2.12 T4-K: auto-show diff summary after file-modifying turns
• ✓v2.2.12 T4-N: /clear wipes the TUI's visible state, adds --all for workspace
• ✓v2.2.12 T3-I: /fork uses Arc-shared snapshots when log unchanged
• ✓v2.2.12 T3-H/T3-Exit-UX/T3-J: session friendly names + resume-by-name + exit banner
• ✓v2.2.12 T1-#400: TUI accepts live typing while a turn is in flight
• ✓v2.2.12 T1-A/B/C/D: harden release pipeline against the v2.2.11 incidents
• ✓v2.2.12 T2-G: introduce RedrawScheduler for the TUI
• ✓fix(release): stop globally rewriting every version mention in public README

The release where the agent learned to know itself, the operator learned to shape it, and ten core surfaces landed in one cut.

• ✓release(v2.2.11): self-awareness — agent knows its own version, model, and provider in every turn
• ✓feat(prompt): system prompt now references current Anvil version + loaded model + provider
• ✓W1 hook events: full catch-up with CC parity — PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, PreCompact, Notification
• ✓W2 effort slider: /effort low|medium|high — tune reasoning depth per turn, persisted per session
• ✓W3 goal persistence: per-session goals survive /clear and reconnect, surfaced in status line
• ✓W4 named profiles: save and switch (provider, model, effort, output style) tuples by name
• ✓W5 published JSON schema: settings.json fully typed, IDE-completable, anvilhub.culpur.net/schema/settings.json
• ✓W6 OpenTelemetry events: OTEL_EXPORTER_OTLP_ENDPOINT support, permission_decision + tool_call + token_usage spans
• ✓W7 custom output styles: define your own /output-style names in settings, ship them as plugins
• ✓W8 reviewer-agent approval gate: optional second-agent review before file writes — configurable threshold
• ✓W9 anvil mcp-server mode: run Anvil itself as an MCP server — expose agents and tools to any MCP client
• ✓W10 requirements.toml admin policy floor: enforce minimum versions, required plugins, denied domains org-wide
• ✓feat(skills): rename CLAUDE.md → ANVIL.md across user-facing strings + anvil-md-curator skill
• ✓fix(build): rerun build.rs when current branch ref changes (GIT_SHA stayed stale on rebuild)
• ✓fix(w3): goals slash command implementation, not stub — persistence, completion tracking, status line
• ✓fix(w1): hook events were declared but unwired; tests added covering all 7 event types end-to-end
• ✓fix(w6): OTel permission_decision span unwired; W5 schema tightening for required fields

• ✓release(v2.2.10): TUI usability patch — wrap, native-select, tool-result summaries
• ✓fix(tui): wrap long lines, restore native selection, give tool results meaning
• ✓fix(release): regenerate sha256 manifests every build + verify-before-release
• ✓fix(release): correct repo target on gh release calls

• ✓release(v2.2.9): wave 2 — OAuth paste-code, alwaysLoad MCP, plugin zip/URL + version bump
• ✓feat(v2.2.9): CC parity catch-up v2.1.118 → v2.1.131

• ✓See commit history for details

• ✓docs(v2.2.8): release notes + rollback runbook
• ✓fix(cli): remove unused format_suggestions import; bump workspace to v2.2.8
• ✓feat(v2.2.8): integrate F1 /agent compose + F3 skill-eval CLI + F5 loader forward-compat + F6 embed bundled plugins
• ✓feat(config): add output_style axis — /output-style precise|condensed (v2.2.8)
• ✓feat(skills): bundle terse skill — token-economy mode with Auto-Clarity
• ✓feat(commands): trait-based agent composition engine (Anvil v2.2.8)
• ✓Add three-arm skill evaluation harness (skill_evals module)
• ✓feat(commands): add YAML front-matter trigger keywords to skill system
• ✓feat(cli): /model warning + Ctrl+U/Ctrl+Y readline kill-yank + PAI survey
• ✓fix(agents): correct module path in Bug #83 Part B subagent inheritance test
• ✓fix(api): make HTTP request timeout configurable via ANVIL_API_TIMEOUT_MS (Bug #84)
• ✓test(permissions,file_ops,agents): document DangerFullAccess stability invariants (Bug #83)
• ✓fix(api): add 5-minute dead-air timeout to OpenAI-compat stream (Bug #82)
• ✓fix(api): use max(Retry-After, backoff) on 429 retries (Bug #81)
• ✓feat(sandbox): Claude-Code-style permission modes with on-the-fly switching
• ✓feat(ollama): honor ANVIL_OLLAMA_NUM_CTX / ANVIL_CONTEXT_SIZE for context window
• ✓fix(runtime): don't fail turn when Ollama returns empty stream after tool result
• ✓docs(readme): update for v2.2.8 — badges, Windows binary name, new commands
• ✓docs: Anvil v2.2.8 release-complete report

• ✓release: Anvil v2.2.7
• ✓test(runtime): fix parallel-test races for v2.2.7 release gate
• ✓fix(installer): close e2e test blockers B-1/B-2 + shell completion T9
• ✓fix(hub): use CARGO_PKG_VERSION for install-telemetry client string
• ✓security: fix 3 pre-release blockers in v2.2.7 installers
• ✓docs: add v2.2.7 release notes
• ✓feat(setup): curated Ollama model menu with explicit per-model confirmation
• ✓feat(installer): add cross-OS installers + anvil check/upgrade/uninstall for v2.2.7
• ✓feat(tui): add in-TUI scrollback ring buffer + compile fix for share command
• ✓fix(cross-platform): replace Unix-only env lookups with portable alternatives
• ✓fix(ollama): add multi-format tool-call parser and fail-loud warnings

Web Config, AnvilHub Installer, Deep Autocomplete — full browser parity with TUI:

• ✓17 web config panels: providers, vault, notifications, SSH, Docker/K8s, memory, and more
• ✓Full Status Line editor in browser: 36 widgets, 16 presets, drag-and-drop, live preview
• ✓AnvilHub installer: search, install, restart prompt — vault-gated, telemetry-tracked
• ✓Deep hierarchical autocomplete: /vault store <Tab> → 21 credential types
• ✓8 previously-broken TUI handlers now working: /mcp, /plugins, /session, /daily, and more
• ✓New commands: /tab, /fork, /share, /audit, /restart
• ✓Self-respawn on macOS/Linux after plugin installs

Intelligent Memory System — 6-tier architecture, self-improving knowledge base:

• ✓Sensitivity classifier: auto-routes credentials to vault, infra to encrypted memory
• ✓Knowledge nominations: AI discovers patterns, users review and promote to CLAUDE.md
• ✓Private project memory: AES-256-GCM encrypted infrastructure details
• ✓Daily summaries: auto-generated task reconciliation, flags forgotten items
• ✓558 AnvilHub packages: 512 skills across 30 categories

Security Hardening + Optimization — 17 audit findings fixed, zero warnings:

• ✓Constant-time HMAC verification, plugin command injection prevention
• ✓Path traversal protection, cryptographic session IDs
• ✓110 functions made const fn, redundant clones eliminated
• ✓main.rs modularized into 3 focused modules
• ✓RC widget: live client count with connect/disconnect signals
• ✓Zero compiler warnings, 428 tests, 0 failures

Six Major Features — interactive editor, productivity, MCP, history, plugins, agents:

• ✓Interactive Status Line Editor — full TUI editor with 6 sub-screens + WebUI drag-and-drop visual editor
• ✓37 widgets, 16 presets (8 emoji-rich themes), per-widget category colors
• ✓Code Productivity Dashboard — live git diff tracking, /productivity command
• ✓MCP Server Manager — /mcp command, live McpStatus widget
• ✓Session History Browser — /history-archive stats with model breakdown
• ✓Plugin System UI — web viewer management panel with config toggles
• ✓Agent Panel Expansion — web viewer agent management buttons

Customizable Widget-Based Status Line — 8 presets for different workflows:

• ✓Widget-based status line system — 28 widget types, dynamic rendering
• ✓8 presets: default, minimal, developer, token-heavy, git-heavy, compact, cost-focused, streamer
• ✓/configure statusline command with full tab completion
• ✓Web viewer config panel gains Status Line preset selector
• ✓Dynamic footer height — 2-line presets maximize content area

URL rendering fix, context-aware vault, CI/CD automation:

• ✓URL rendering fix — terminal hyperlinks render correctly across all providers
• ✓Context-aware vault — vault auto-selects credentials based on active project context
• ✓CI/CD automation — /cicd command scaffolds pipelines for GitHub Actions and GitLab CI

Typed Credential Vault — the vault is now the single source of truth for ALL sensitive data:

• ✓Typed credential entries — name, type, value, tags, created_at, rotated_at
• ✓Vault covers API keys, SSH keys, TLS certs, tokens, and environment secrets in one place
• ✓/vault add — interactive typed credential entry with category selection
• ✓/vault rotate — rotate any credential in-place, preserving audit history
• ✓/vault export — encrypted vault export for backup and migration
• ✓/vault inject — load vault secrets into shell env for any subprocess
• ✓Audit trail v2 — every vault access logged with timestamp, operation, and credential type

Browser configuration panel, Gemini provider, slash command execution in web viewer:

• ✓Browser-based visual configuration panel
• ✓Google Gemini as 5th provider
• ✓Slash commands execute from web viewer
• ✓30+ commands with subcommand completions

Focus view, context warnings, stalled stream recovery — 6 improvements:

• ✓Edition 2024 mode — optimized session defaults and provider routing for 2024-era models
• ✓Focus view — /focus hides sidebars and agent panels for distraction-free single-pane mode
• ✓Context-low warning — proactive alert before auto-compaction fires when context nears capacity
• ✓Stalled stream handling — detects and recovers from stuck token streams without losing the response
• ✓WebFetch cleanup — improved HTML-to-text extraction, strips nav, footer, and cookie banners automatically
• ✓/loop and /proactive — new slash commands for recurring prompt loops and proactive agent nudges

Credential scanner, egress control, conversation branching — 16 new features:

• ✓Credential auto-detection — scans env vars, dotfiles, SSH keys, TLS certs, auto-vaults provider keys
• ✓Network egress control — configurable domain allowlist, default: AI provider APIs only
• ✓Signed session transcripts — HMAC-SHA256 audit trail in ~/.anvil/audit/
• ✓Conversation branching — /fork to snapshot and branch conversations
• ✓Markdown session export — /export md with code blocks and token summary
• ✓Clickable URLs — OSC 8 hyperlinks in system messages
• ✓Remote control browser auto-open — /remote-control launches browser automatically
• ✓Expanded cost tracking — OpenAI, xAI, Ollama pricing alongside Anthropic
• ✓Inline image rendering — iTerm2/Kitty graphics protocol support
• ✓Smart context compaction — preserves 6 recent messages, code blocks, file paths
• ✓Tool output redaction logging — secrets redacted and logged to audit trail
• ✓SSH key and TLS certificate vault storage — /vault ssh and /vault certs

8 commits: 827d941..fb33055

Live streaming, remote control, and thinking mode:

• ✓Live streaming responses — real-time token-by-token rendering in the TUI
• ✓Remote control — type /remote-control to share your session via browser WebSocket
• ✓Web viewer at passage.culpur.net/viewer for real-time session observation
• ✓Thinking mode — visible reasoning indicator with /think toggle
• ✓Background turn execution — TUI stays responsive during API calls via scoped threads
• ✓WebSocket relay infrastructure — secure pairing with 6-digit codes, multi-client support
• ✓Cross-platform release pipeline — automated builds for macOS, Linux, and Windows

5 commits: 30bf569..2108c93

Security-first release — encrypted vault, file sandbox, modular architecture:

• ✓AES-256-GCM encrypted credential vault with Argon2id KDF — all API keys encrypted at rest
• ✓Setup wizard vault password step — credentials encrypted before touching disk
• ✓Session-based vault unlock — one password prompt per session, KEK zeroed on exit
• ✓Automatic migration from plaintext credentials.json to encrypted vault
• ✓File write sandbox — writes blocked outside project root (PermissionDenied)
• ✓Project root detection via .git, Cargo.toml, package.json markers
• ✓Native Ollama /api/chat with NDJSON streaming and think: true/false
• ✓Multi-line input — footer expands 1-5 lines dynamically with word-wrap
• ✓Ctrl+C clear input / double-tap exit (CC parity)
• ✓Codebase modularized — main.rs 15,756 → 4,770 lines, 134 module files
• ✓Content filter: modern OpenAI key formats (sk-proj-*, sk-svcacct-*)
• ✓Clippy warnings: 470 → 0, strict compilation mode
• ✓394 tests passing, zero unsafe code

11 commits: aeeeff2..4bb283f

Full CC 2.1.94 parity — 3 commits:

• ✓Permission memory — persistent tool approval decisions per project
• ✓Content filtering / prompt injection defense
• ✓Configurable keybindings via ~/.anvil/keybindings.json
• ✓Agent SendMessage / Continue for multi-turn agent conversations
• ✓Worktree isolation for agents — git worktree per agent
• ✓/fast mode toggle — lower token budget for quick responses
• ✓Rich slash command help with examples
• ✓Clipboard image paste support
• ✓Background agent desktop notifications
• ✓/review-pr — AI-powered pull request review
• ✓First-run setup wizard with 5-step provider configuration

3 commits: dc1d81a..6ce5d4d