v0.4.0 — hardening + from-zero onboarding

Follow-up hardening after an external static review, plus onboarding fixes.

Added

• Versioned exec envelope: leads with agent_river_contract: "exec-v1" and message_id.
• Codex/exec runner replies parse agent-dispatch blocks — dispatch proposal parity across all lanes, every proposal still owner-approved.
• telegram-codex-policy-set --direct-send-user-add / --direct-send-user-remove: restores owner-list management lost in the v1 retirement (fresh installs could not become owner from the CLI).

Changed

• Gate approval buttons bound to a task content hash, fail-closed for stale/legacy buttons; repeated approval is idempotent.
• README (en/zh-Hant) rewritten for from-zero onboarding; SECURITY.md documents the repository trust model and state retention.

Breaking

• Gate approval buttons sent before this release stop working after upgrade (by design). Re-trigger the pending approval for a fresh button.

384 tests green.

🤖 Generated with Claude Code

v0.3.0 — collab bus + dashboard

v0.3.0 — 2026-07-06

Added

• Collab sessions: budget rings counting only agent messages, kickoff plus
  automatic relay, agent-initiated help requests with read-only fixed small
  budgets, transcript harvesting, and two-step approval to convert a session
  into an edit task.
• Dashboard bot replaces v1 remotes: live feed, /session, /say, /sessions,
  /kill, /agents, /model, /task, hard-gate and registry approval buttons,
  and failure pushes that include the original error text.
• Handshake onboarding: agent-join with poll+token or one-line exec intake,
  per-agent tokens, and the participant prompt template in
  docs/AGENT_PROMPT_TEMPLATE.md.
• v2 @agent launcher is merged into the dashboard as the single poller.

Changed

• Packaging now exposes agent-river as a CLI bin and adds init for first-run
  state, registry, systemd unit, and Telegram env template setup.

Breaking

• v1 chat/classifier/old Telegram command surfaces are retired (-9.3k lines).
  The old codex-agent-telegram-bridge.service is replaced by
  codex-agent-dashboard.service; see
  docs/history/WORKORDER_U4_KILLLIST.md for cutover notes.

v0.1.0 — first public release

First public release of Agent River — a local, approval-gated control plane
that lets you drive Codex and Claude (Opus/Sonnet) coding agents from Telegram,
with a human approval gate on every risky move.

Highlights

• 🛡️ Approval-gated by design — edit tasks always require explicit owner
  approval (enforced server-side); agents only propose cross-agent work.
• 🧯 Brakes that hold — global kill switch, daily token budget, per-lane caps,
  and a fail-closed config.
• 👥 Two authority tiers — a bounded gateway allowlist vs. full owner authority.
• 🔒 Least-privilege agents — read-only review lane and a bounded edit lane
  (no commit/push/deploy/install/delete, no network, no cross-agent dispatch).
• 🧹 Secret scanning & redaction across every stored and outbound path.
• 📦 Zero runtime dependencies; every subprocess runs via execFile, never a shell.

Status

Early but usable for local, single-operator use. Core flows are covered by 360+
tests across Node 20 and 22. See the README (English ·
繁體中文) and SECURITY.md for the threat model.