From d31ed545d591a264f61bc0e50f141647f68ea8e8 Mon Sep 17 00:00:00 2001
From: agentrelay-com <agentrelay-com@agentrelay.com>
Date: Thu, 30 Jul 2026 20:50:48 -0400
Subject: [PATCH 1/6] docs: mitigate agent-relay 11.3.0 credential output

---
 AGENTS.md                                     |  46 +++
 .../agent-relay-11.3.0-credential-exposure.md | 300 ++++++++++++++++++
 web/content/agent-relay/SKILL.md              |  18 +-
 web/content/docs/cli-agent-management.mdx     |   7 +
 web/content/docs/cli-broker-lifecycle.mdx     |   7 +
 web/content/docs/cli-overview.mdx             |   7 +
 web/content/docs/factory/where-it-runs.mdx    |   7 +
 web/content/docs/nodes-and-providers.mdx      |   7 +
 web/content/docs/nodes.mdx                    |   7 +
 web/content/docs/reference-cli.mdx            |   7 +
 10 files changed, 411 insertions(+), 2 deletions(-)
 create mode 100644 AGENTS.md
 create mode 100644 security/agent-relay-11.3.0-credential-exposure.md

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..2ffd6b6
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,46 @@
+# Agent operating rules
+
+Read `CLAUDE.md` for the resident lead role and content-pipeline process.
+These rules are repository law for every agent session in this checkout.
+
+## Safety and authority
+
+- Agents have no production access. Do not use Cloudflare, Wrangler,
+  Vercel, DNS, or other live-infrastructure credentials, and do not run
+  commands that can deploy or mutate production.
+- Production is reached only by a reviewed pull request through CI or by
+  a human running a prepared runbook. Deploys, previews, publishing, and
+  DNS remain gated on `cmo`.
+- Main requires at least two recorded reviews. The author's own pass does
+  not count; at least one review must come from a different agent.
+  Check/status contexts such as CodeRabbit are not submitted reviews.
+- Only humans cut releases. Any earlier agent release permission is void,
+  not paused.
+- Never execute a command that prints or may print a credential in an
+  agent transcript. In particular, do not run `gh auth status`. Use
+  `env -u GITHUB_TOKEN -u GH_TOKEN /opt/homebrew/bin/gh <command>` for the
+  concrete GitHub operation; escalate if credential scope itself must be
+  inspected.
+- Agent Relay 11.3.0 prints the active workspace key from
+  `agent-relay node up` and `agent-relay node status`. Do not run either
+  command in an agent or other transcribed session. A human may run them
+  from a trusted, non-transcribed terminal, or use a release confirmed to
+  include relay fix `3c5046a6`.
+
+## Session lifecycle
+
+- Sessions are disposable. Recycle at assignment boundaries and do not
+  let a session run beyond roughly four hours.
+- Check the Relay inbox at session start and once immediately before
+  going idle after completed work. Never poll on a timer.
+- Remain registered unless explicitly instructed to terminate. Do not
+  self-remove.
+
+## Working discipline
+
+- Inspect the tree before editing and preserve work that predates the
+  session.
+- Use a fresh branch or worktree from current `origin/main`.
+- Report `ACK`, progress, and `DONE` with evidence.
+- Do not merge, deploy, preview, publish, cut a release, or change DNS
+  without the applicable human and `cmo` gates.
diff --git a/security/agent-relay-11.3.0-credential-exposure.md b/security/agent-relay-11.3.0-credential-exposure.md
new file mode 100644
index 0000000..5885ebf
--- /dev/null
+++ b/security/agent-relay-11.3.0-credential-exposure.md
@@ -0,0 +1,300 @@
+# Agent Relay 11.3.0 workspace-key output exposure
+
+Status: mitigation prepared; not published
+
+Source snapshot: `origin/main` at `d02e9cd` on 2026-07-30. Line numbers
+below are the pre-mitigation positions in that snapshot.
+
+## Summary
+
+Agent Relay 11.3.0 prints the active workspace key when
+`agent-relay node up` or `agent-relay node status` runs. Relay commit
+`3c5046a6` masks the key and removes the credential-bearing observer URL,
+but that fix was not in npm `latest` when this exposure was recorded.
+
+The documented commands are legitimate product operations. The defect is
+the released CLI's output, so deleting the commands from user
+documentation would conceal normal product use rather than fix the root
+cause. The primary fix is a human-cut Agent Relay release containing
+`3c5046a6`.
+
+The hosted skill is sharper than the human docs: it can direct an agent to
+run the affected commands inside a transcribed session, placing a live key
+in context that may leave the machine. The prepared mitigation therefore:
+
+1. adds a version-aware warning to every affected user-facing docs page;
+2. gates the hosted skill so Agent Relay 11.3.0 startup/status is
+   human-only from a trusted, non-transcribed terminal; and
+3. retains the correct commands for a patched release.
+
+No affected command was executed while producing this report.
+
+## Enumeration
+
+Total: **31 instruction lines across 8 tracked files**.
+
+- Hosted agent-facing skill: **3**
+- User-facing documentation: **28**
+- Internal-only instructions: **0**
+
+### Hosted agent-facing skill
+
+File: `web/content/agent-relay/SKILL.md`
+
+Classification: hosted skill consumed by agents and human drivers
+
+Count: 3
+
+1. Pre-mitigation line 32:
+
+   ```text
+   - start the broker with `agent-relay node up`
+   ```
+
+2. Pre-mitigation line 74:
+
+   ```text
+      agent-relay node up --background --verbose
+   ```
+
+3. Pre-mitigation line 75:
+
+   ```text
+      agent-relay node status --wait-for 10
+   ```
+
+### User-facing documentation: agent management
+
+File: `web/content/docs/cli-agent-management.mdx`
+
+Classification: user-facing CLI documentation
+
+Count: 1
+
+1. Pre-mitigation line 45:
+
+   ```text
+   agent-relay node up --background
+   ```
+
+### User-facing documentation: broker lifecycle
+
+File: `web/content/docs/cli-broker-lifecycle.mdx`
+
+Classification: user-facing CLI documentation
+
+Count: 8
+
+1. Pre-mitigation line 13:
+
+   ```text
+   agent-relay node up
+   ```
+
+2. Pre-mitigation line 16:
+
+   ```text
+   `node up` starts the broker in the foreground, serves this machine as a fleet [node](/docs/nodes), and — when a `teams.json` with `autoSpawn` exists — spawns the configured agents into `#general`.
+   ```
+
+3. Pre-mitigation line 39:
+
+   ```text
+   agent-relay node up --background --workspace-key "$RELAY_WORKSPACE_KEY"
+   ```
+
+4. Pre-mitigation line 42:
+
+   ```text
+   The broker listens on a local API port starting from `3888` (override with `AGENT_RELAY_BROKER_PORT`). If this machine was enrolled as a Cloud-managed node with `agent-relay cloud enroll`, `node up` picks up the persisted enrollment automatically and serves under the enrolled node name.
+   ```
+
+5. Pre-mitigation line 47:
+
+   ```text
+   agent-relay node status
+   ```
+
+6. Pre-mitigation line 48:
+
+   ```text
+   agent-relay node status --wait-for 10
+   ```
+
+7. Pre-mitigation line 52:
+
+   ```text
+   `node status` only checks the local broker daemon; `--wait-for <seconds>` polls until the broker is ready or the timeout expires. The top-level `status` command reports workspace, local broker state, and cloud login state.
+   ```
+
+8. Pre-mitigation line 80:
+
+   ```text
+   agent-relay node up --state-dir .agentworkforce/relay-staging
+   ```
+
+### User-facing documentation: CLI overview
+
+File: `web/content/docs/cli-overview.mdx`
+
+Classification: user-facing CLI documentation
+
+Count: 4
+
+1. Pre-mitigation line 106:
+
+   ```text
+   agent-relay node up --background
+   ```
+
+2. Pre-mitigation line 107:
+
+   ```text
+   agent-relay node status
+   ```
+
+3. Pre-mitigation line 122:
+
+   ```text
+   `node up` starts the local broker, registers this machine as a fleet [node](/docs/nodes), and can auto-spawn agents from `teams.json`. `node workflow run` executes Relayflows workflows (`.yaml`, `.yml`, `.ts`, `.tsx`, `.js`, `.py`, or `.sh`) in the current checkout and keeps metadata under `.agentworkforce/relay/local-runs`.
+   ```
+
+4. Pre-mitigation line 135:
+
+   ```text
+   `agent-relay status` reports the current workspace, local broker state, and cloud login state. `agent-relay node status` is narrower: it only checks the local broker daemon.
+   ```
+
+### User-facing documentation: Factory runtime
+
+File: `web/content/docs/factory/where-it-runs.mdx`
+
+Classification: user-facing Factory documentation
+
+Count: 2
+
+1. Pre-mitigation line 35:
+
+   ```text
+   agent-relay node up
+   ```
+
+2. Pre-mitigation line 38:
+
+   ```text
+   `agent-relay node up` auto-discovers an `agent-relay.ts` in the working directory, which just re-exports the node definition:
+   ```
+
+### User-facing documentation: nodes and providers
+
+File: `web/content/docs/nodes-and-providers.mdx`
+
+Classification: user-facing architecture and operator documentation
+
+Count: 3
+
+1. Pre-mitigation line 140:
+
+   ```text
+   agent-relay node up
+   ```
+
+2. Pre-mitigation line 143:
+
+   ```text
+   `node up` brings the current context's node online: it starts the node's agent runtime and serves
+   ```
+
+3. Pre-mitigation line 145:
+
+   ```text
+   with the enrolled node token. Long-running apps skip `node up` and serve their own node directly
+   ```
+
+### User-facing documentation: nodes
+
+File: `web/content/docs/nodes.mdx`
+
+Classification: user-facing node documentation
+
+Count: 6
+
+1. Pre-mitigation line 78:
+
+   ```text
+   agent-relay node up --config ./builder.node.ts   # serve this definition on the machine's node
+   ```
+
+2. Pre-mitigation line 83:
+
+   ```text
+   `node up` auto-discovers an `agent-relay.{ts,js,...}` definition in the project when `--config` is omitted, and serves this context's node and its providers. To run a Cloud-managed node, redeem the one-time enrollment token first with `agent-relay cloud enroll --token <token>`, then run `agent-relay node up` — it picks up the persisted enrollment and serves under the enrolled node name.
+   ```
+
+3. Pre-mitigation line 89:
+
+   ```text
+   By default a served node logs quietly — only warnings reach the console. Pass a log flag to `node up` to see its activity: every capability it registers and every action that hits it (invoked → completed or failed, with a duration).
+   ```
+
+4. Pre-mitigation line 92:
+
+   ```text
+   agent-relay node up --config ./builder.node.ts --log-file ./node.log                    # actions → a file
+   ```
+
+5. Pre-mitigation line 93:
+
+   ```text
+   agent-relay node up --config ./builder.node.ts --log-file ./node.log --log-level debug   # + capability registration
+   ```
+
+6. Pre-mitigation line 94:
+
+   ```text
+   agent-relay node up --config ./builder.node.ts --log-json                               # one JSON object per line
+   ```
+
+### User-facing documentation: CLI reference
+
+File: `web/content/docs/reference-cli.mdx`
+
+Classification: user-facing CLI reference
+
+Count: 4
+
+1. Pre-mitigation line 140:
+
+   ```text
+   | `agent-relay node up [flags]` | Start the local broker and serve this machine as a fleet node. See [Broker lifecycle](/docs/cli-broker-lifecycle) for flags. |
+   ```
+
+2. Pre-mitigation line 141:
+
+   ```text
+   | `agent-relay node status [--state-dir <path>] [--wait-for <seconds>]` | Check local broker daemon state. |
+   ```
+
+3. Pre-mitigation line 167:
+
+   ```text
+   Fleet commands inspect and configure workspace fleet nodes. To serve a node, run `agent-relay node up` (with `--config <file>` for an explicit node definition).
+   ```
+
+4. Pre-mitigation line 183:
+
+   ```text
+   | `agent-relay cloud enroll --token <token> [flags]` | Enroll this machine as a Cloud-managed fleet node, then run `node up`. |
+   ```
+
+## Release and mitigation boundary
+
+- Root cause: released CLI output in Agent Relay 11.3.0.
+- Root fix: relay commit `3c5046a6`.
+- Release authority: humans only.
+- Interim website mitigation: prepared warnings plus a stricter hosted-skill
+  gate; do not publish without `cmo` approval.
+- Verification constraint: never reproduce this defect with a live
+  workspace key in an agent transcript. If runtime confirmation becomes
+  necessary, escalate for synthetic credentials in an isolated,
+  non-transcribed environment.
diff --git a/web/content/agent-relay/SKILL.md b/web/content/agent-relay/SKILL.md
index cd25e5e..b34cf24 100644
--- a/web/content/agent-relay/SKILL.md
+++ b/web/content/agent-relay/SKILL.md
@@ -15,6 +15,20 @@ https://agentrelay.com/skill
 
 Give that URL to a human driver, a lead agent, or a newly spawned agent when you want them to orient themselves without a long custom prompt.
 
+## Security Gate for Agent Relay 11.3.0
+
+Agent Relay 11.3.0 prints the active workspace key when
+`agent-relay node up` or `agent-relay node status` runs. An agent must not
+run either command inside a transcribed session on that release. Ask a
+human driver to run them from a trusted, non-transcribed terminal, or use
+a release whose notes confirm it includes relay fix `3c5046a6`.
+
+The commands remain the correct way to start and inspect a node. The gate
+is about the vulnerable release's output, not a replacement workflow. The
+human-only quick start below is retained so an operator has the exact
+commands; do not copy its first two command lines into an agent prompt
+while 11.3.0 is installed.
+
 ## Choose the Right Skill
 
 ### Human driver or lead orchestrator
@@ -29,7 +43,7 @@ https://github.com/AgentWorkforce/skills/blob/main/skills/orchestrating-agent-re
 
 Use this role when the agent should:
 
-- start the broker with `agent-relay node up`
+- coordinate broker startup with a human driver
 - create or reuse a workspace
 - spawn workers
 - send follow-up instructions through local attach or registered Relay messages
@@ -106,7 +120,7 @@ and `join_channel`.
 Use https://agentrelay.com/skill as your Agent Relay onboarding reference.
 
 You are the orchestrator. Use the orchestrating-agent-relay role:
-- start or verify the relay broker
+- have a human driver start or verify the relay broker when Agent Relay 11.3.0 is installed
 - spawn the workers needed for the task
 - tell each worker to use the using-agent-relay role
 - read worker output with agent-relay node tail --agent <name>
diff --git a/web/content/docs/cli-agent-management.mdx b/web/content/docs/cli-agent-management.mdx
index f335f6c..7ad5fa9 100644
--- a/web/content/docs/cli-agent-management.mdx
+++ b/web/content/docs/cli-agent-management.mdx
@@ -10,6 +10,13 @@ Agent identity and local process lifecycle are separate:
 
 Use the first group for any workspace. Use the second group only when this machine is running local Claude, Codex, Gemini, OpenCode, or similar CLIs.
 
+<Warning>
+  Agent Relay 11.3.0 prints the active workspace key from `node up` and
+  `node status`. On that release, run these commands only from a trusted,
+  non-transcribed human terminal; agents must not run them. Use a release
+  only after its notes confirm it includes relay fix `3c5046a6`.
+</Warning>
+
 ## Register Workspace Agents
 
 ```bash
diff --git a/web/content/docs/cli-broker-lifecycle.mdx b/web/content/docs/cli-broker-lifecycle.mdx
index 4961645..bf9bb70 100644
--- a/web/content/docs/cli-broker-lifecycle.mdx
+++ b/web/content/docs/cli-broker-lifecycle.mdx
@@ -7,6 +7,13 @@ The core product is workspace messaging. The local broker is optional: use it wh
 
 Broker commands live under `agent-relay node`. (`local` is a deprecated alias that prints a warning.)
 
+<Warning>
+  Agent Relay 11.3.0 prints the active workspace key from `node up` and
+  `node status`. On that release, run these commands only from a trusted,
+  non-transcribed human terminal; agents must not run them. Use a release
+  only after its notes confirm it includes relay fix `3c5046a6`.
+</Warning>
+
 ## Start The Broker
 
 ```bash
diff --git a/web/content/docs/cli-overview.mdx b/web/content/docs/cli-overview.mdx
index fb5fad9..d2b5e25 100644
--- a/web/content/docs/cli-overview.mdx
+++ b/web/content/docs/cli-overview.mdx
@@ -11,6 +11,13 @@ The CLI has two layers:
 
 Use the workspace commands to operate the shared messaging system. Use `node` only when this machine should run or attach to managed CLI agents.
 
+<Warning>
+  Agent Relay 11.3.0 prints the active workspace key from `node up` and
+  `node status`. On that release, run these commands only from a trusted,
+  non-transcribed human terminal; agents must not run them. Use a release
+  only after its notes confirm it includes relay fix `3c5046a6`.
+</Warning>
+
 ## Install
 
 ```bash
diff --git a/web/content/docs/factory/where-it-runs.mdx b/web/content/docs/factory/where-it-runs.mdx
index 161395f..5184482 100644
--- a/web/content/docs/factory/where-it-runs.mdx
+++ b/web/content/docs/factory/where-it-runs.mdx
@@ -5,6 +5,13 @@ description: 'You run the control plane. Agents run wherever you have checkouts
 
 Factory splits into two halves: the **control plane** that decides what to work on, and the **agents** that do the work in a real checkout. The control plane is yours. Where the agents run is a choice.
 
+<Warning>
+  Agent Relay 11.3.0 prints the active workspace key from `node up` and
+  `node status`. On that release, run these commands only from a trusted,
+  non-transcribed human terminal; agents must not run them. Use a release
+  only after its notes confirm it includes relay fix `3c5046a6`.
+</Warning>
+
 ## Local agents
 
 ```bash
diff --git a/web/content/docs/nodes-and-providers.mdx b/web/content/docs/nodes-and-providers.mdx
index 997c2e9..e293668 100644
--- a/web/content/docs/nodes-and-providers.mdx
+++ b/web/content/docs/nodes-and-providers.mdx
@@ -11,6 +11,13 @@ used for grouping and placement.
 Processes called **providers** attach to a node and give it abilities. Every provider connects
 directly to the engine with the node's token and registers what it offers.
 
+<Warning>
+  Agent Relay 11.3.0 prints the active workspace key from `node up` and
+  `node status`. On that release, run these commands only from a trusted,
+  non-transcribed human terminal; agents must not run them. Use a release
+  only after its notes confirm it includes relay fix `3c5046a6`.
+</Warning>
+
 ## The model
 
 | Term | What it is |
diff --git a/web/content/docs/nodes.mdx b/web/content/docs/nodes.mdx
index b898fc6..ef56093 100644
--- a/web/content/docs/nodes.mdx
+++ b/web/content/docs/nodes.mdx
@@ -7,6 +7,13 @@ A **node** is an enrolled context in a workspace — usually a project directory
 
 Every active agent still has a delivery route: a live SDK/MCP WebSocket, a node's agent runtime on another machine, or an HTTP endpoint.
 
+<Warning>
+  Agent Relay 11.3.0 prints the active workspace key from `node up` and
+  `node status`. On that release, run these commands only from a trusted,
+  non-transcribed human terminal; agents must not run them. Use a release
+  only after its notes confirm it includes relay fix `3c5046a6`.
+</Warning>
+
 ## Node Kinds
 
 | Kind | Use it for |
diff --git a/web/content/docs/reference-cli.mdx b/web/content/docs/reference-cli.mdx
index ad1a1de..15181bd 100644
--- a/web/content/docs/reference-cli.mdx
+++ b/web/content/docs/reference-cli.mdx
@@ -135,6 +135,13 @@ The SDK-backed groups are `agent`, `channel`, `message`, `integration`, `capabil
 
 `local` is a deprecated alias of `node` and prints a warning on use.
 
+<Warning>
+  Agent Relay 11.3.0 prints the active workspace key from `node up` and
+  `node status`. On that release, run these commands only from a trusted,
+  non-transcribed human terminal; agents must not run them. Use a release
+  only after its notes confirm it includes relay fix `3c5046a6`.
+</Warning>
+
 | Command | Description |
 | --- | --- |
 | `agent-relay node up [flags]` | Start the local broker and serve this machine as a fleet node. See [Broker lifecycle](/docs/cli-broker-lifecycle) for flags. |

From 008d3c6f3bd5ec915ad258b2dde348a3be4e57a9 Mon Sep 17 00:00:00 2001
From: agentrelay-com <agentrelay-com@agentrelay.com>
Date: Thu, 30 Jul 2026 22:28:10 -0400
Subject: [PATCH 2/6] docs: define credential-warning retirement condition

---
 security/agent-relay-11.3.0-credential-exposure.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/security/agent-relay-11.3.0-credential-exposure.md b/security/agent-relay-11.3.0-credential-exposure.md
index 5885ebf..b3adb97 100644
--- a/security/agent-relay-11.3.0-credential-exposure.md
+++ b/security/agent-relay-11.3.0-credential-exposure.md
@@ -298,3 +298,17 @@ Count: 4
   workspace key in an agent transcript. If runtime confirmation becomes
   necessary, escalate for synthetic credentials in an isolated,
   non-transcribed environment.
+
+## Retirement condition
+
+This website mitigation is temporary. Do not retire it merely because the
+fix is present in relay source or on relay's default branch. Retire it only
+after npm `latest` resolves to a published Agent Relay release that has
+been explicitly confirmed to contain `3c5046a6`.
+
+The person who confirms that published release owns the follow-up that
+removes the interim warnings from the seven docs pages, removes the
+11.3.0-specific gate from the hosted skill, and updates this report with
+the confirmed release and retirement date. Preserve the enumeration above
+as the historical record of the exposure; do not delete this file when
+the mitigation is retired.

From d7f55c7443cb9a1aa0d6340f3c23c730ea3b58d2 Mon Sep 17 00:00:00 2001
From: agentrelay-com <agentrelay-com@agentrelay.com>
Date: Sun, 2 Aug 2026 07:25:34 -0400
Subject: [PATCH 3/6] docs: make credential gate version-aware

---
 AGENTS.md                                     |  6 +--
 .../agent-relay-11.3.0-credential-exposure.md | 38 +++++++++++--------
 web/content/agent-relay/SKILL.md              | 16 ++++----
 3 files changed, 34 insertions(+), 26 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 2ffd6b6..757d653 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,11 +21,11 @@ These rules are repository law for every agent session in this checkout.
   `env -u GITHUB_TOKEN -u GH_TOKEN /opt/homebrew/bin/gh <command>` for the
   concrete GitHub operation; escalate if credential scope itself must be
   inspected.
-- Agent Relay 11.3.0 prints the active workspace key from
+- Agent Relay 11.3.0 and earlier print the active workspace key from
   `agent-relay node up` and `agent-relay node status`. Do not run either
   command in an agent or other transcribed session. A human may run them
-  from a trusted, non-transcribed terminal, or use a release confirmed to
-  include relay fix `3c5046a6`.
+  from a trusted, non-transcribed terminal; otherwise upgrade to Agent
+  Relay 11.3.1 or later, which masks the key.
 
 ## Session lifecycle
 
diff --git a/security/agent-relay-11.3.0-credential-exposure.md b/security/agent-relay-11.3.0-credential-exposure.md
index b3adb97..4825b13 100644
--- a/security/agent-relay-11.3.0-credential-exposure.md
+++ b/security/agent-relay-11.3.0-credential-exposure.md
@@ -9,14 +9,15 @@ below are the pre-mitigation positions in that snapshot.
 
 Agent Relay 11.3.0 prints the active workspace key when
 `agent-relay node up` or `agent-relay node status` runs. Relay commit
-`3c5046a6` masks the key and removes the credential-bearing observer URL,
-but that fix was not in npm `latest` when this exposure was recorded.
+`2d911c1b5` masks the key and removes the credential-bearing observer URL.
+That fix shipped in Agent Relay 11.3.1; it was not in npm `latest` when
+this exposure was recorded.
 
 The documented commands are legitimate product operations. The defect is
 the released CLI's output, so deleting the commands from user
 documentation would conceal normal product use rather than fix the root
 cause. The primary fix is a human-cut Agent Relay release containing
-`3c5046a6`.
+`2d911c1b5`, first shipped as Agent Relay 11.3.1.
 
 The hosted skill is sharper than the human docs: it can direct an agent to
 run the affected commands inside a transcribed session, placing a live key
@@ -290,7 +291,7 @@ Count: 4
 ## Release and mitigation boundary
 
 - Root cause: released CLI output in Agent Relay 11.3.0.
-- Root fix: relay commit `3c5046a6`.
+- Root fix: relay commit `2d911c1b5`, shipped in Agent Relay 11.3.1.
 - Release authority: humans only.
 - Interim website mitigation: prepared warnings plus a stricter hosted-skill
   gate; do not publish without `cmo` approval.
@@ -301,14 +302,21 @@ Count: 4
 
 ## Retirement condition
 
-This website mitigation is temporary. Do not retire it merely because the
-fix is present in relay source or on relay's default branch. Retire it only
-after npm `latest` resolves to a published Agent Relay release that has
-been explicitly confirmed to contain `3c5046a6`.
-
-The person who confirms that published release owns the follow-up that
-removes the interim warnings from the seven docs pages, removes the
-11.3.0-specific gate from the hosted skill, and updates this report with
-the confirmed release and retirement date. Preserve the enumeration above
-as the historical record of the exposure; do not delete this file when
-the mitigation is retired.
+Publishing Agent Relay 11.3.1 ended the defect in that release; it did not
+upgrade consumers that remain on 11.3.0 or earlier. Do not retire this
+mitigation merely because the fix is present in relay source, on relay's
+default branch, or in npm `latest`.
+
+Remove the version-conditional warnings only when 11.3.0 installs are no
+longer plausible. Until then, the hosted skill must keep directing affected
+consumers to upgrade to 11.3.1 or later or to use a trusted,
+non-transcribed human terminal. The hosted gate earns a longer lifetime
+than prominent human-doc callouts because it directs an agent at the
+moment of acting, inside a session that may be transcribed, without the
+human judgment the warning assumes.
+
+The person who confirms that 11.3.0 installs are no longer plausible owns
+the follow-up that removes the version-conditional warnings and records
+the retirement date here. Preserve the enumeration above as the historical
+record of the exposure; do not delete this file when the mitigation is
+retired.
diff --git a/web/content/agent-relay/SKILL.md b/web/content/agent-relay/SKILL.md
index b34cf24..abe1259 100644
--- a/web/content/agent-relay/SKILL.md
+++ b/web/content/agent-relay/SKILL.md
@@ -15,19 +15,19 @@ https://agentrelay.com/skill
 
 Give that URL to a human driver, a lead agent, or a newly spawned agent when you want them to orient themselves without a long custom prompt.
 
-## Security Gate for Agent Relay 11.3.0
+## Version-Conditional Security Gate
 
-Agent Relay 11.3.0 prints the active workspace key when
-`agent-relay node up` or `agent-relay node status` runs. An agent must not
-run either command inside a transcribed session on that release. Ask a
-human driver to run them from a trusted, non-transcribed terminal, or use
-a release whose notes confirm it includes relay fix `3c5046a6`.
+On Agent Relay 11.3.0 and earlier, `agent-relay node up` and
+`agent-relay node status` print the active workspace key. Agent Relay
+11.3.1 masks it. If you are on 11.3.0 or earlier, upgrade to 11.3.1 or
+later, or ask a human driver to run those commands from a trusted,
+non-transcribed terminal.
 
 The commands remain the correct way to start and inspect a node. The gate
 is about the vulnerable release's output, not a replacement workflow. The
 human-only quick start below is retained so an operator has the exact
 commands; do not copy its first two command lines into an agent prompt
-while 11.3.0 is installed.
+while 11.3.0 or earlier is installed.
 
 ## Choose the Right Skill
 
@@ -120,7 +120,7 @@ and `join_channel`.
 Use https://agentrelay.com/skill as your Agent Relay onboarding reference.
 
 You are the orchestrator. Use the orchestrating-agent-relay role:
-- have a human driver start or verify the relay broker when Agent Relay 11.3.0 is installed
+- have a human driver start or verify the relay broker when Agent Relay 11.3.0 or earlier is installed
 - spawn the workers needed for the task
 - tell each worker to use the using-agent-relay role
 - read worker output with agent-relay node tail --agent <name>

From 433310553d7be48aeb2051a721148e62d63e9716 Mon Sep 17 00:00:00 2001
From: agentrelay-com <agentrelay-com@agentrelay.com>
Date: Sun, 2 Aug 2026 07:34:12 -0400
Subject: [PATCH 4/6] docs: align credential warnings with fixed release

---
 security/agent-relay-11.3.0-credential-exposure.md | 2 +-
 web/content/docs/cli-agent-management.mdx          | 8 ++++----
 web/content/docs/cli-broker-lifecycle.mdx          | 8 ++++----
 web/content/docs/cli-overview.mdx                  | 8 ++++----
 web/content/docs/factory/where-it-runs.mdx         | 8 ++++----
 web/content/docs/nodes-and-providers.mdx           | 8 ++++----
 web/content/docs/nodes.mdx                         | 8 ++++----
 web/content/docs/reference-cli.mdx                 | 8 ++++----
 8 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/security/agent-relay-11.3.0-credential-exposure.md b/security/agent-relay-11.3.0-credential-exposure.md
index 4825b13..31155d6 100644
--- a/security/agent-relay-11.3.0-credential-exposure.md
+++ b/security/agent-relay-11.3.0-credential-exposure.md
@@ -7,7 +7,7 @@ below are the pre-mitigation positions in that snapshot.
 
 ## Summary
 
-Agent Relay 11.3.0 prints the active workspace key when
+Agent Relay 11.3.0 and earlier print the active workspace key when
 `agent-relay node up` or `agent-relay node status` runs. Relay commit
 `2d911c1b5` masks the key and removes the credential-bearing observer URL.
 That fix shipped in Agent Relay 11.3.1; it was not in npm `latest` when
diff --git a/web/content/docs/cli-agent-management.mdx b/web/content/docs/cli-agent-management.mdx
index 7ad5fa9..a8698ca 100644
--- a/web/content/docs/cli-agent-management.mdx
+++ b/web/content/docs/cli-agent-management.mdx
@@ -11,10 +11,10 @@ Agent identity and local process lifecycle are separate:
 Use the first group for any workspace. Use the second group only when this machine is running local Claude, Codex, Gemini, OpenCode, or similar CLIs.
 
 <Warning>
-  Agent Relay 11.3.0 prints the active workspace key from `node up` and
-  `node status`. On that release, run these commands only from a trusted,
-  non-transcribed human terminal; agents must not run them. Use a release
-  only after its notes confirm it includes relay fix `3c5046a6`.
+  Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  run these commands only from a trusted, non-transcribed human terminal;
+  agents must not run them.
 </Warning>
 
 ## Register Workspace Agents
diff --git a/web/content/docs/cli-broker-lifecycle.mdx b/web/content/docs/cli-broker-lifecycle.mdx
index bf9bb70..cddd6e5 100644
--- a/web/content/docs/cli-broker-lifecycle.mdx
+++ b/web/content/docs/cli-broker-lifecycle.mdx
@@ -8,10 +8,10 @@ The core product is workspace messaging. The local broker is optional: use it wh
 Broker commands live under `agent-relay node`. (`local` is a deprecated alias that prints a warning.)
 
 <Warning>
-  Agent Relay 11.3.0 prints the active workspace key from `node up` and
-  `node status`. On that release, run these commands only from a trusted,
-  non-transcribed human terminal; agents must not run them. Use a release
-  only after its notes confirm it includes relay fix `3c5046a6`.
+  Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  run these commands only from a trusted, non-transcribed human terminal;
+  agents must not run them.
 </Warning>
 
 ## Start The Broker
diff --git a/web/content/docs/cli-overview.mdx b/web/content/docs/cli-overview.mdx
index d2b5e25..4ce8489 100644
--- a/web/content/docs/cli-overview.mdx
+++ b/web/content/docs/cli-overview.mdx
@@ -12,10 +12,10 @@ The CLI has two layers:
 Use the workspace commands to operate the shared messaging system. Use `node` only when this machine should run or attach to managed CLI agents.
 
 <Warning>
-  Agent Relay 11.3.0 prints the active workspace key from `node up` and
-  `node status`. On that release, run these commands only from a trusted,
-  non-transcribed human terminal; agents must not run them. Use a release
-  only after its notes confirm it includes relay fix `3c5046a6`.
+  Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  run these commands only from a trusted, non-transcribed human terminal;
+  agents must not run them.
 </Warning>
 
 ## Install
diff --git a/web/content/docs/factory/where-it-runs.mdx b/web/content/docs/factory/where-it-runs.mdx
index 5184482..dd9e479 100644
--- a/web/content/docs/factory/where-it-runs.mdx
+++ b/web/content/docs/factory/where-it-runs.mdx
@@ -6,10 +6,10 @@ description: 'You run the control plane. Agents run wherever you have checkouts
 Factory splits into two halves: the **control plane** that decides what to work on, and the **agents** that do the work in a real checkout. The control plane is yours. Where the agents run is a choice.
 
 <Warning>
-  Agent Relay 11.3.0 prints the active workspace key from `node up` and
-  `node status`. On that release, run these commands only from a trusted,
-  non-transcribed human terminal; agents must not run them. Use a release
-  only after its notes confirm it includes relay fix `3c5046a6`.
+  Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  run these commands only from a trusted, non-transcribed human terminal;
+  agents must not run them.
 </Warning>
 
 ## Local agents
diff --git a/web/content/docs/nodes-and-providers.mdx b/web/content/docs/nodes-and-providers.mdx
index e293668..14b7ac7 100644
--- a/web/content/docs/nodes-and-providers.mdx
+++ b/web/content/docs/nodes-and-providers.mdx
@@ -12,10 +12,10 @@ Processes called **providers** attach to a node and give it abilities. Every pro
 directly to the engine with the node's token and registers what it offers.
 
 <Warning>
-  Agent Relay 11.3.0 prints the active workspace key from `node up` and
-  `node status`. On that release, run these commands only from a trusted,
-  non-transcribed human terminal; agents must not run them. Use a release
-  only after its notes confirm it includes relay fix `3c5046a6`.
+  Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  run these commands only from a trusted, non-transcribed human terminal;
+  agents must not run them.
 </Warning>
 
 ## The model
diff --git a/web/content/docs/nodes.mdx b/web/content/docs/nodes.mdx
index ef56093..e5685e3 100644
--- a/web/content/docs/nodes.mdx
+++ b/web/content/docs/nodes.mdx
@@ -8,10 +8,10 @@ A **node** is an enrolled context in a workspace — usually a project directory
 Every active agent still has a delivery route: a live SDK/MCP WebSocket, a node's agent runtime on another machine, or an HTTP endpoint.
 
 <Warning>
-  Agent Relay 11.3.0 prints the active workspace key from `node up` and
-  `node status`. On that release, run these commands only from a trusted,
-  non-transcribed human terminal; agents must not run them. Use a release
-  only after its notes confirm it includes relay fix `3c5046a6`.
+  Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  run these commands only from a trusted, non-transcribed human terminal;
+  agents must not run them.
 </Warning>
 
 ## Node Kinds
diff --git a/web/content/docs/reference-cli.mdx b/web/content/docs/reference-cli.mdx
index 15181bd..63ba0be 100644
--- a/web/content/docs/reference-cli.mdx
+++ b/web/content/docs/reference-cli.mdx
@@ -136,10 +136,10 @@ The SDK-backed groups are `agent`, `channel`, `message`, `integration`, `capabil
 `local` is a deprecated alias of `node` and prints a warning on use.
 
 <Warning>
-  Agent Relay 11.3.0 prints the active workspace key from `node up` and
-  `node status`. On that release, run these commands only from a trusted,
-  non-transcribed human terminal; agents must not run them. Use a release
-  only after its notes confirm it includes relay fix `3c5046a6`.
+  Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  run these commands only from a trusted, non-transcribed human terminal;
+  agents must not run them.
 </Warning>
 
 | Command | Description |

From bba230fb9eaf8c848d6fa92e4ad7f4616874f815 Mon Sep 17 00:00:00 2001
From: agentrelay-com <agentrelay-com@agentrelay.com>
Date: Sun, 2 Aug 2026 07:45:18 -0400
Subject: [PATCH 5/6] docs: scope credential guidance to affected commands

---
 AGENTS.md                                          | 13 ++++++++-----
 security/agent-relay-11.3.0-credential-exposure.md |  4 +++-
 web/content/agent-relay/SKILL.md                   |  9 +++++----
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 757d653..7c5951c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,6 +1,5 @@
 # Agent operating rules
 
-Read `CLAUDE.md` for the resident lead role and content-pipeline process.
 These rules are repository law for every agent session in this checkout.
 
 ## Safety and authority
@@ -17,15 +16,19 @@ These rules are repository law for every agent session in this checkout.
 - Only humans cut releases. Any earlier agent release permission is void,
   not paused.
 - Never execute a command that prints or may print a credential in an
-  agent transcript. In particular, do not run `gh auth status`. Use
+  agent transcript. Never pass `--show-token` to `gh auth status`; that flag
+  deliberately exposes the credential. The bare command is not the
+  credential-printing hazard the old rule treated it as. Use
   `env -u GITHUB_TOKEN -u GH_TOKEN /opt/homebrew/bin/gh <command>` for the
-  concrete GitHub operation; escalate if credential scope itself must be
-  inspected.
+  concrete GitHub operation; escalate if unmasked credential scope itself
+  must be inspected.
 - Agent Relay 11.3.0 and earlier print the active workspace key from
   `agent-relay node up` and `agent-relay node status`. Do not run either
   command in an agent or other transcribed session. A human may run them
   from a trusted, non-transcribed terminal; otherwise upgrade to Agent
-  Relay 11.3.1 or later, which masks the key.
+  Relay 11.3.1 or later, which masks the key in these two commands. That
+  version is not a guarantee about credential output from every command in
+  the installed dependency tree.
 
 ## Session lifecycle
 
diff --git a/security/agent-relay-11.3.0-credential-exposure.md b/security/agent-relay-11.3.0-credential-exposure.md
index 31155d6..ccd21e0 100644
--- a/security/agent-relay-11.3.0-credential-exposure.md
+++ b/security/agent-relay-11.3.0-credential-exposure.md
@@ -11,7 +11,9 @@ Agent Relay 11.3.0 and earlier print the active workspace key when
 `agent-relay node up` or `agent-relay node status` runs. Relay commit
 `2d911c1b5` masks the key and removes the credential-bearing observer URL.
 That fix shipped in Agent Relay 11.3.1; it was not in npm `latest` when
-this exposure was recorded.
+this exposure was recorded. Agent Relay 11.3.1 closes the two-command defect
+documented here; it is not a guarantee about credential output from every
+command in the installed dependency tree.
 
 The documented commands are legitimate product operations. The defect is
 the released CLI's output, so deleting the commands from user
diff --git a/web/content/agent-relay/SKILL.md b/web/content/agent-relay/SKILL.md
index abe1259..a9bc019 100644
--- a/web/content/agent-relay/SKILL.md
+++ b/web/content/agent-relay/SKILL.md
@@ -19,9 +19,10 @@ Give that URL to a human driver, a lead agent, or a newly spawned agent when you
 
 On Agent Relay 11.3.0 and earlier, `agent-relay node up` and
 `agent-relay node status` print the active workspace key. Agent Relay
-11.3.1 masks it. If you are on 11.3.0 or earlier, upgrade to 11.3.1 or
-later, or ask a human driver to run those commands from a trusted,
-non-transcribed terminal.
+11.3.1 masks it in these two commands; it is not a guarantee about
+credential output from every command in the installed dependency tree. If
+you are on 11.3.0 or earlier, upgrade to 11.3.1 or later, or ask a human
+driver to run those commands from a trusted, non-transcribed terminal.
 
 The commands remain the correct way to start and inspect a node. The gate
 is about the vulnerable release's output, not a replacement workflow. The
@@ -43,7 +44,7 @@ https://github.com/AgentWorkforce/skills/blob/main/skills/orchestrating-agent-re
 
 Use this role when the agent should:
 
-- coordinate broker startup with a human driver
+- coordinate broker startup with a human driver when Agent Relay 11.3.0 or earlier is installed
 - create or reuse a workspace
 - spawn workers
 - send follow-up instructions through local attach or registered Relay messages

From ba34492e37ac042996a10034c07e554e1988b3c8 Mon Sep 17 00:00:00 2001
From: agentrelay-com <agentrelay-com@agentrelay.com>
Date: Sun, 2 Aug 2026 08:16:38 -0400
Subject: [PATCH 6/6] docs: bound 11.3.1 credential guidance

---
 web/content/docs/cli-agent-management.mdx  | 5 ++++-
 web/content/docs/cli-broker-lifecycle.mdx  | 5 ++++-
 web/content/docs/cli-overview.mdx          | 5 ++++-
 web/content/docs/factory/where-it-runs.mdx | 5 ++++-
 web/content/docs/nodes-and-providers.mdx   | 5 ++++-
 web/content/docs/nodes.mdx                 | 5 ++++-
 web/content/docs/reference-cli.mdx         | 5 ++++-
 7 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/web/content/docs/cli-agent-management.mdx b/web/content/docs/cli-agent-management.mdx
index a8698ca..c554460 100644
--- a/web/content/docs/cli-agent-management.mdx
+++ b/web/content/docs/cli-agent-management.mdx
@@ -12,7 +12,10 @@ Use the first group for any workspace. Use the second group only when this machi
 
 <Warning>
   Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
-  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Upgrading closes
+  the key print in `agent-relay node up` and `agent-relay node status`. It is
+  not a guarantee about credential output from every command in an Agent Relay
+  install. Until upgraded,
   run these commands only from a trusted, non-transcribed human terminal;
   agents must not run them.
 </Warning>
diff --git a/web/content/docs/cli-broker-lifecycle.mdx b/web/content/docs/cli-broker-lifecycle.mdx
index cddd6e5..0cc1c3d 100644
--- a/web/content/docs/cli-broker-lifecycle.mdx
+++ b/web/content/docs/cli-broker-lifecycle.mdx
@@ -9,7 +9,10 @@ Broker commands live under `agent-relay node`. (`local` is a deprecated alias th
 
 <Warning>
   Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
-  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Upgrading closes
+  the key print in `agent-relay node up` and `agent-relay node status`. It is
+  not a guarantee about credential output from every command in an Agent Relay
+  install. Until upgraded,
   run these commands only from a trusted, non-transcribed human terminal;
   agents must not run them.
 </Warning>
diff --git a/web/content/docs/cli-overview.mdx b/web/content/docs/cli-overview.mdx
index 4ce8489..6d685f1 100644
--- a/web/content/docs/cli-overview.mdx
+++ b/web/content/docs/cli-overview.mdx
@@ -13,7 +13,10 @@ Use the workspace commands to operate the shared messaging system. Use `node` on
 
 <Warning>
   Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
-  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Upgrading closes
+  the key print in `agent-relay node up` and `agent-relay node status`. It is
+  not a guarantee about credential output from every command in an Agent Relay
+  install. Until upgraded,
   run these commands only from a trusted, non-transcribed human terminal;
   agents must not run them.
 </Warning>
diff --git a/web/content/docs/factory/where-it-runs.mdx b/web/content/docs/factory/where-it-runs.mdx
index dd9e479..750288d 100644
--- a/web/content/docs/factory/where-it-runs.mdx
+++ b/web/content/docs/factory/where-it-runs.mdx
@@ -7,7 +7,10 @@ Factory splits into two halves: the **control plane** that decides what to work
 
 <Warning>
   Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
-  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Upgrading closes
+  the key print in `agent-relay node up` and `agent-relay node status`. It is
+  not a guarantee about credential output from every command in an Agent Relay
+  install. Until upgraded,
   run these commands only from a trusted, non-transcribed human terminal;
   agents must not run them.
 </Warning>
diff --git a/web/content/docs/nodes-and-providers.mdx b/web/content/docs/nodes-and-providers.mdx
index 14b7ac7..01e7139 100644
--- a/web/content/docs/nodes-and-providers.mdx
+++ b/web/content/docs/nodes-and-providers.mdx
@@ -13,7 +13,10 @@ directly to the engine with the node's token and registers what it offers.
 
 <Warning>
   Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
-  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Upgrading closes
+  the key print in `agent-relay node up` and `agent-relay node status`. It is
+  not a guarantee about credential output from every command in an Agent Relay
+  install. Until upgraded,
   run these commands only from a trusted, non-transcribed human terminal;
   agents must not run them.
 </Warning>
diff --git a/web/content/docs/nodes.mdx b/web/content/docs/nodes.mdx
index e5685e3..d3aa6bb 100644
--- a/web/content/docs/nodes.mdx
+++ b/web/content/docs/nodes.mdx
@@ -9,7 +9,10 @@ Every active agent still has a delivery route: a live SDK/MCP WebSocket, a node'
 
 <Warning>
   Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
-  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Upgrading closes
+  the key print in `agent-relay node up` and `agent-relay node status`. It is
+  not a guarantee about credential output from every command in an Agent Relay
+  install. Until upgraded,
   run these commands only from a trusted, non-transcribed human terminal;
   agents must not run them.
 </Warning>
diff --git a/web/content/docs/reference-cli.mdx b/web/content/docs/reference-cli.mdx
index 63ba0be..2297b5e 100644
--- a/web/content/docs/reference-cli.mdx
+++ b/web/content/docs/reference-cli.mdx
@@ -137,7 +137,10 @@ The SDK-backed groups are `agent`, `channel`, `message`, `integration`, `capabil
 
 <Warning>
   Agent Relay 11.3.0 and earlier print the active workspace key from `node up`
-  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Until upgraded,
+  and `node status`. Upgrade to Agent Relay 11.3.1 or later. Upgrading closes
+  the key print in `agent-relay node up` and `agent-relay node status`. It is
+  not a guarantee about credential output from every command in an Agent Relay
+  install. Until upgraded,
   run these commands only from a trusted, non-transcribed human terminal;
   agents must not run them.
 </Warning>