v0.2.0

Release PR: merges pre-release into main for the v0.2.0 release. Full details in CHANGELOG.md; highlights below.

⚠️ Breaking changes & migration

Migrate v0.1.x projects with:

itervox init --update --workflow WORKFLOW.md

• itervox_schema_version: 2 is mandatory at the top of every WORKFLOW.md; the daemon hard-fails without it.
• Inline agent.profiles.<name>.prompt is rejected — profiles now live in file-backed .itervox/agents/<name>/SOUL.md + INSTRUCTIONS.md, referenced via soul_file / instructions_file. The migrator extracts existing inline prompts automatically (and writes a WORKFLOW.md.bak).
• agent.agent_mode is removed (typo-guarded hard-fail if present). Peer-roster injection now happens unconditionally when more than one profile exists; the POST /api/v1/settings/agent-mode endpoint, the "Agent Runtime" settings card, and the TUI ◈ SUB-AGENTS/◈ TEAMS badge are gone.
• workspace.auto_clear: true semantics changed: clears only when an issue reaches a terminal tracker state, no longer after every successful run — required so .itervox/handoff/ files accumulate across a pipeline. As a result, auto_clear + auto_review no longer conflict. The migrator prints a notice when it sees the flag.
• --demo flag removed — replaced by the embedded quickstart template (tracker.kind: memory).

Highlights

Agent pipeline & profiles

• File-backed profiles (SOUL.md identity + INSTRUCTIONS.md rules), committable under .itervox/agents/** with automatic .gitignore carve-outs.
• File-backed agent handoff (.itervox/handoff/): each worker leaves a Markdown deliverable; prior handoffs are budget-truncated and inlined into the next worker's prompt as ## Prior Agent Handoffs. Non-success exits mark the in-flight file .partial.md; missing handoffs on success are synthesized from the session summary and committed on the issue branch.
• Built-in merge-bot profile (embedded, scaffolded by itervox init) plus a guarded merge_pr agent action (gh pr checks --required + block-label + mergeable gates, unarmed_gate refusal on repos with zero required checks, dedup ledger).
• [SILENT] no-op convention — recurring automations can suppress tracker comments on the nothing-to-report path.

Automations v1

• New top-level automations: block with ten trigger types (cron, input_required, tracker_comment_added, issue_entered_state, issue_moved_to_backlog, run_failed, pr_opened, pr_merged, rate_limited, blockers_resolved), per-rule filters, and policy. Legacy schedules: still parses (deprecated, warns).
• Durable automation queue with backpressure (agent.max_automation_queue_length, default 100), persisted under .itervox/ with a checksummed v2 envelope + quarantine on mismatch.
• Dependency audit with fail-safe blocker tracking (unknown = blocked), restart-durable ledger, and the blockers_resolved trigger.
• pause_dispatch_when_any_in_state dispatch guard; paused automations are parked, not deleted.

Daemon operability

• Multi-daemon coexistence: default server.port: 0 (OS-assigned), .itervox/dashboard_url + Vite auto-discovery, fatal EADDRINUSE diagnostics, pidfile-based refuse-to-start, clean shutdown of liveness files.
• itervox doctor (port/heartbeat/dashboard-URL/binary-drift checks, STARTUP_ERROR.md reporting) and .itervox/HEARTBEAT.md liveness file.
• itervox models <list|refresh> CLI + POST /api/v1/settings/models/refresh + Settings → Models card, pulling live model catalogs from Anthropic/OpenAI.
• Evals suite foundation (internal/evals, make evals-fast in make verify) with merge-bot and reviewer scenario coverage.
• Atomic file writes everywhere (internal/atomicfs), single-write YAML cascades, persist-then-mutate settings convention with an AST-based guard test.

Security

• Bearer-token auth for the HTTP API and SSE on non-loopback binds (auto-generated ITERVOX_API_TOKEN, dashboard login screen, short-lived per-run action grants for /api/v1/agent-actions/*).
• SSH host-key checking defaults to accept-new (TOFU) instead of no.
• Token never written to the rotating log file; defense-in-depth RedactingHandler scrubs Anthropic/Linear/GitHub/Bearer patterns at the log sink.

Dashboard

• Live Ops strip (capacity, queue pressure, dependency counts, retry/input/SSH/automation activity), Automation Queue list + detail panel, read-only Deps graph tab (React Flow), per-issue status timeline, Resuming panel, stale-config banner, SSE Last-Event-ID resume + silence-watchdog poll fallback, mobile responsive hardening.

Reliability & correctness

• Input-required resume overhaul: continues the saved Claude/Codex session with the actual reply, reuses the workspace, survives restarts and early failures; deterministic fallback detector for plain-English blocking questions.
• Shutdown cancel-race fix that could drop a user's queued pending_input_resume reply (data-durability fix).
• Adversarial conformance audit against the Orchestrated Coding spec (L3 claim): event-loop crash fix, duplicate-worker/stall-kill race fix, fail-safe GitHub blocker lookups, blockers_resolved re-fire fix, Go↔TS automation-trigger schema parity test, and more.

Test plan

• make verify (fmt + vet + lint + Go -race tests + web coverage/build + size-budget + no-os-exit + evals-fast) green on pre-release.
• make release-check (verify + govulncheck + goreleaser check) for tag preparation.
• Manual release checklist: auth-gate first-run, server-down recovery, automation CRUD, profile-delete cascade, 30-minute releasability smoke.

🤖 Generated with Claude Code