Changelog

578releases across 9 months

Every PAPI release, cycle by cycle. Each one pushes back against project drift.

Get started free

October 202618 releases

v0.402.202

The queue is now called Actions, and your whole team can see it

  • "Needs you" is now "Actions" everywhere, and every member of a project can see and complete its actions, not only the owner.
  • Builds report which AI model and client did the work, warn when it is missing, and show how often it is recorded for your project.
  • Admin pages show a plain not-available page instead of raw text, and a UI change now needs a person's visual check before it is accepted.
Full detail
  • "Needs you" is now "Actions" across the hub tab, sidebar, page title, empty states, MCP copy and docs; the /needs-you route is unchanged.
  • The project action queue is readable by every member of the project (query project_actions), not only the owner; MCP copy and docs say project action.
  • A new project_action tool completes a project action over MCP, guarded by project membership.
  • Guard hits are logged locally, reported as guard_counts on build completion (new build_reports.guard_counts column), and trended in strategy_review.
  • Hosted builds get a numbered step to write the file-scope marker at start and to clear it at completion, and the build report lists files changed outside the handoff.
  • Build completion shows the project's model and agent coverage, and stores an explicit unknown model when the client does not report one.
  • Build completion warns when the agent is missing; the build template requires agent and model.
  • Review_task adds a design-canon checklist for UI tasks, and a UI accept needs visual_confirmed (per entry in a batch).
  • The usage reporter reads OpenCode token usage; Codex stays Not recorded until a real transcript is verified.
  • The install pages offer the one-command plugin install for Claude Code 2.1.292 and later, and keep the two-line form.
  • Caddy validate no longer leaves root-owned log files that break the next reload.
  • Dev project pages no longer 404 with OWNER_USER_ID set (dev-only, SKIP_AUTH).
  • Browser navigations to owner and admin pages get a not-available page instead of raw JSON.
  • A test pins the dev origin allowlist derived from NEXT_PUBLIC_APP_URL.
  • A test pins the marketing opt-out in the broadcast send path.
  • Refreshed papi-auto vs Hamster gap list.
  • Plugin-free attribution check recorded as not verified.

v0.402.200

Updates recover on their own and reach the server faster

  • An update that failed halfway can simply be run again, even after newer changes were merged.
  • Updates are sent to the server more directly and are about 15% smaller, so they arrive faster and more predictably.
  • The plan to replace the JavaScript frontend with simple server-rendered pages is written up and agreed.
Full detail
  • Release install hardening: a tagged-but-not-live release can be recovered after main moves (rerun from the tagged commit, every proof unchanged, recorded once); the live commit and a fresh activation receipt are checked before the release is recorded; remote activation has its own bound; the artifact download has a total deadline and reports HTTP status and body without retrying 4xx; cancelled or failed CI attempts refuse merged-PR evidence; the artifact workflow uses least-privilege job permissions (fixing the push-gate 403) and no longer rebuilds an already-dispatched commit.
  • The install machine downloads, verifies and uploads the release artifact to the VPS, with the VPS-side GitHub download as a bounded fallback; the transfer receipt records the path used; the artifact is compressed with gzip -6 (239 MB to 205 MB).
  • Research for replacing the Next.js frontend with server-rendered HTML plus HTMX (docs/research/ssr-htmx-migration-findings.md), with Alexander Brandt's decisions recorded.

v0.402.199

Releases go live sooner and recover cleanly from a slow download

  • The release package starts building as soon as a checked change is merged, instead of waiting for a second round of checks.
  • A slow download to the server no longer cuts off an update; it has its own time limit and one retry.
  • A version is only shown as released once it is actually live, and a failed update can simply be run again.
Full detail
  • The VPS downloads and checksum-verifies the release artifact in its own bounded step (per-attempt and total limits, at most two attempts, partial files removed) before activation, which keeps its unchanged 240 s limit; the timing receipt records download time, bytes and attempts.
  • A release is recorded in PAPI only after the VPS activation and live check pass: the version tag is pushed first in a tag-only step, and a failed activation leaves the cycle open for a retry that reconciles exactly once.
  • When a merged PR's tree is identical to main and its CI passed, the release artifact build starts right after the merge and the release's CI check accepts that PR CI instead of waiting for CI on main; CI on main still runs.

v0.402.198

See why a task was closed, and releases get faster

  • A finished or cancelled task now shows why it was closed, including the evidence when it was closed as already built.
  • Each release builds the dashboard once instead of twice, so releases reach you sooner.
  • Automated checks repair a broken set of installed packages on their own instead of failing for hours.
Full detail
  • The release artifact builds the Next.js dashboard once for both the public and admin roles (one build, copied without its cache); the public role now refuses every admin page and admin API path at runtime in proxy.ts instead of omitting them at build time.
  • The CI warm dependency check verifies every package-lock entry, nested workspace packages included, and detects an interrupted cold install, so a tree missing a nested package is reinstalled instead of breaking main CI.
  • The task detail panel shows "Why it closed" for Done and Cancelled tasks that have a closure reason.
  • The release announcement workflow checks out into its own directory, so it no longer wipes CI's warm dependency tree.

v0.402.197

Adding a task is faster, and planning skips work that is already built

  • Checking a new task for duplicates no longer reads your whole board, so adding a task on a large board is about four times faster, with the same results.
  • When you plan with chosen tasks, each one is checked against your code first, and a task that is already built is closed with its evidence instead of being scheduled again.
  • If the duplicate check cannot run, you are told so instead of it being skipped silently.
  • Lookups that only read data retry briefly on a server hiccup and say plainly that nothing was changed.
Full detail
  • The duplicate check for new tasks (idea, the dashboard New task form and plan dedupe) is one project-scoped database query instead of a full board read, with identical verdicts; idea p50 on a 5,000-task board went from 1227 ms to 305 ms. A failed check is now reported instead of silently ignored.
  • Every picked task, including plans made with task_ids, goes through the already-built check; a verified closure leaves the task off the cycle, an uncited one is refused, and the preview shows the result before you confirm.
  • The metering and client-name lookups are treated as reads on an empty 503: they retry briefly and say nothing was changed.
  • Release jobs check out into their own directory, so CI keeps its warm dependency tree and typecheck state.

v0.402.196

Invites count one seat per person, and UI work starts with the design system

  • On a Pro project, an owner with a second sign-in is counted as one seat, so invites are no longer blocked by the duplicate.
  • UI tasks get the full project design system when a build starts, so the builder reads it before writing code.
Full detail
  • Invites no longer count the owner's second account as an extra seat on Pro projects.
  • UI tasks get the full design system when a build starts, even when the handoff does not name DESIGN.md.

v0.402.195

Actions reach the teammate they belong to

  • A review or decision from a task goes to that task's creator, not to the project owner.
  • A decision not raised from a task goes to the member who proposed it.
Full detail
  • (partial) — Needs-you routes reviews and decisions to the member they wait on: a task's creator for task-raised items, the proposer for other decisions. Owner sees items with no resolver.

v0.402.194

Builders verify by tests and code, not a live deploy check

  • Planner handoffs stop asking for an MCP restart and a live curl before a change counts as verified.
  • A live check is only needed when a task names a deploy requirement.
Full detail
  • Handoffs no longer require a live MCP restart or a deploy check to verify a change. Tests and code reading are the check.

v0.402.193

Hosted plans check for already-built work on the caller's side

  • Tasks picked for a cycle whose notes say they are already built are checked by your own AI against your checkout, not skipped on the server.
  • A task is only closed as already built when the check cites the source file that shows it.
Full detail
  • (partial) — Hosted plans verify already-built claims client-side: picked tasks whose notes say they are built are listed for the caller's own AI to check, and a "Verified built:" closure must cite a source file.

v0.402.191

A failed save now tells you plainly whether it may have gone through

  • When the server cannot confirm a change, the error says the change may or may not have been saved, gives a request id, and asks you to check before trying again.
  • Changes are never repeated automatically, so nothing is saved twice. Reads still retry briefly on their own.
Full detail
  • An empty or non-JSON HTTP 503 from the data proxy is reported as "write outcome unknown" with the request id, status and body, and writes are never retried; reads keep their bounded retry, and an empty 2xx body gives a clear error.

v0.402.189

Releases no longer wait for a package build or a local test rerun

  • The release package is built automatically as soon as checks pass on main, so installing a release no longer waits for it.
  • A release reuses the recorded full test pass for its exact code instead of running the whole suite again on a laptop.
  • Only packages built by the project's own automated checks can be installed, and each one is verified by checksum first.
Full detail
  • The VPS release artifact is built automatically when CI passes on main, so a release no longer waits for it. Old artifacts are pruned; version-tagged ones are always kept.
  • A release looks up a per-tree full-suite record (written by the new Full qualification CI job, or published from a local run) instead of re-running the full suite, and installs only the CI-built artifact.
  • (partial) — The data-proxy quota load test now names the request, status and body when a response is unreadable. The underlying edge-runtime 503 race is tracked separately.

v0.402.187

See who wrote each note and who proposed each decision

  • Every new task note records who wrote it, and decisions record who proposed them. Board views, decision views and the task panel show the person's name.
  • Notes and decisions from before this release show "author not recorded" instead of a guess.
  • The install guide now says plainly that running PAPI locally over stdio is supported. The hosted connector stays the recommended place to start.
  • A project owner or release manager can now publish and install a teammate's finished cycle, and is recorded as the person who released it.
Full detail
  • Task notes and decisions now record who wrote or proposed them, and show the person's name instead of "the owner".
  • The install guide says local stdio is supported, with the hosted connector as the recommended start.
  • Deployment and identity docs now match how the hosted server reaches project data.
  • A project owner or release manager can publish and install another member's cycle by naming its owner (cycleOwnerUserId) in the release plan; the person releasing stays the recorded actor.

v0.402.185

Already-built tasks are checked only for the cycle being planned, and strategy reviews stay within the request size limit.

  • A plan checks only the tasks picked for its cycle for work that already exists, so unrelated backlog tasks are never scanned.
  • The strategy review caps its three grow-with-the-project sections, so a review fits within the tool-result limit.
Full detail
  • The already-built check looks only at tasks picked for the cycle being planned.
  • Strategy reviews cap their three grow-with-the-project sections so the payload stays under the tool-result limit.

v0.402.182

Board edits can now reopen a cycle and create a missing build handoff

  • Cycle status can be changed from the board: move a cycle to active or complete, or reopen a completed cycle when no other cycle is active.
  • Every cycle status change is recorded, so reopening a cycle leaves a clear trail.
  • A task in a cycle that has no build handoff can get one created from the sections you supply, without a separate generation step.
  • Releases finish sooner: independent release checks run at the same time, and a release that only changes documentation reuses the last full test pass.
Full detail
  • Board edits can now reopen a cycle, with the status change recorded.
  • A task with no build handoff gets one created from the sections board_edit is given.

v0.402.179

Your team's board, needs-you list and release page now load and show accurate state.

  • The needs-you list separates release problems, stuck builds and handoffs waiting on sign-off.
  • Exports now include decisions, conventions and cycles, and say which part failed if a read goes wrong.
  • Assignments on the team page are recorded the same way as assignments made from your AI client.
  • Errors name the real problem, such as a missing cycle or a project name that is not unique.
Full detail
  • Cycle 411: 16 tasks. See PR #1837 for the full list.

v0.402.178

A build start refuses a task that another live session is already building, instead of only warning.

  • build_execute refuses to start a task another live session holds; pass your session_id from session_announce.
  • A start that cannot confirm its claim backs off rather than building the task twice.
  • Product update emails now arrive in a light design with headed sections, screenshots and numbers.
Full detail
  • Build_execute refuses a start when another live session holds the task; the claim is written before the start and re-checked after it, and a claim write keeps the session's announced branch and files.
  • Product update emails use a light-first lavender design: a landing hero, a numbers grid, headed sections with screenshots between the bullets, an offer card and a sign-off. The send route validates the content with one shared function and refuses non-https links and images.

v0.402.170

PAPI now records how each tool call went, so cycle timing and failures can be measured.

  • Every tool call records its size, outcome and cycle, so per-cycle numbers can be read directly.
  • A failed release or cycle closure now records why it failed.
Full detail
  • Every tool call records its response size, outcome and cycle; cycle_performance reads the per-cycle numbers.
  • Failed tool calls and release steps record a redacted reason; orient shows the last release failure when the edge serves it.

v0.402.177

Planning and building are faster and lighter, with fewer steps before each task.

  • Orient, planning and build starts send less text, so each step returns sooner.
  • Reviewing several tasks takes one call, and a finished build shows how long the review queue has waited.
  • Plans stay within their size limit and leave out tasks that belong to other people.
  • Releases are safer: a broken main is refused, and test runs no longer collide on shared state.
Full detail
  • Reconcile upstream report e127ef65 — board_view cycle filter returned 0 tasks
  • Reconcile upstream report 441eb5fe — review_submit MISSING_BUILD_HANDOFF dead end
  • Reconcile upstream report fd6b2b26 — review_submit NO_DIFF_TO_REVIEW with a real diff
  • Reconcile upstream report 3ecc7028 — orient via MCP returned opaque -32603
  • Reconcile upstream report 1aef86c8 — plan apply reported Cycle 5 but wrote into Cycle 4
  • Reconcile upstream report 2f158b70 — orient reported contradictory cycle state
  • P1: Linux full qualification prepares Chromium after the browser integration suites already need it
  • P1: Integrated release regression leaks its disposable workspace binding into subsequent checks
  • P1 bug: Migration CI publishes its disposable PostgreSQL service without an explicit loopback binding
  • P1 bug: Cycle98 integration fixtures bypass the canonical proxy factory type and fail clean CI qualification
  • CI dependency concurrency cancels an unrelated PR's pending build before checks start
  • Ship opt-in, warn-only token-waste guard hooks to external users (ranged-read, bash-dump, duplicate-overwrite) via the client-side install path
  • Orient times out on the hosted connection (30s budget): repeated "Pending work at timeout: unblock-candidates" (5s to 26s) on PapiUI during the C404 release, so orient, review_list and planning calls fail intermittently. Find why the unblock-candidates read is slow on a 3,700-task board (unbounded scan or missing index), bound it or make it best-effort so it cannot take orient past its budget. Note convention AD-96: mandatory orient readers keep their own uncapped scan and are not folded into the shared best-effort unblock list; only the unblock-candidates piece should degrade.
  • Planner must not select tasks assigned to another member: exclude them at plan prepare and run the ownership check in the apply preview
  • Plan prepare ignores its stated 88 KB context budget: payload was ~256 KB and overflowed the client tool-result limit
  • Repair the stale database-backed browser tests so ci:local converges. The full local gate (npm run ci:local) runs tests/integration/** in real browsers on a disposable database; these never run in remote CI, so they went stale. Found in the Cycle 406 release run: (1) tests/integration/cycle102-public — asserted the plan chip on /hub after Cycle 405 removed it (repaired to the Plans page, commit 94e5039e1); (2) tests/integration/cycle102-admin needs PAPI_BUILD_TEMP, which ci:local does not set on macOS; (3) tests/integration/dashboard-integrity — focus-return assertion raced Radix close animation (repaired with polling, baae1bac2) and 'shows the last real change after an earlier real read in one controlled throttle window' is flaky (realtime replication timing, passes alone); (4) tests/integration/cycle97-database-pages — calls selectOption on the Library Types filter, which is now a shadcn Select combobox, so it must click the trigger and choose the option; (5) dashboard dev server runs out of memory when one file drives many pages (use the compiled dashboard, PAPI_TEST_COMPILED_DASHBOARD=1). Goal: run npm run ci:local -- --status to green on a clean main, fix or quarantine each with a reason, and consider running these tests in remote CI so they cannot go stale again. Reference: scripts/ci-local.sh, scripts/test-with-supabase.mjs, commits 94e5039e1 and baae1bac2.
  • Board_edit cannot change a task's acceptance criteria or its BUILD HANDOFF fields. Found in Cycle 407: had an acceptance criterion that could not be met before release ("callable on the hosted transport"), the owner ruled to reword it, and the only route was handoff_generate force: prepare (a 72 KB prompt) then apply with the whole handoff re-sent inline, just to change one line. Add the ability for board_edit to edit acceptance criteria (replace, add, remove or tick a single criterion) and the other handoff sections (scope, scope boundary, security, files likely touched, effort) without regenerating the handoff, plus any remaining board fields it does not cover today. Keep the edit logged in the task history so a changed bar is visible, and say who changed it. Reference: packages/server/src/tools/board.ts board_edit; handoff_generate force.
  • Keep build and test caches warm across worktrees and runners so a fresh checkout does not pay a cold build before every qualification
  • Flaky test: "delivers planning presence through authenticated project-scoped Realtime" (session-message-context) fails under host load
  • Cut board paging cost: query_board_page takes ~500 ms per call, so paging 3,773 Done tasks spends ~19 s of orient/board_reconcile's 30 s budget
  • Add a join key between the application boundary and pg_stat_statements so slow requests can be tied to the SQL that caused them
  • Ops: make a red typecheck impossible to miss on main and refused by the merge and release tooling (branch protection unavailable)
  • Test tiering part 2: shrink test:full below its 1200 s ceiling and gate PRs on typecheck plus changed-file tests (split from )
  • Bound board_reconcile prepare's Done cross-check to a few proxy round trips (live 30s timeout persists)
  • Artifact workflow fails on a clean runner: promote.sh stages edge from a checkout with no node_modules (esbuild unresolved)
  • ArtifactRunToWatch double-dispatches on run-list lag; identity check can fail transiently ("artifact workflow identity changed while waiting")
  • Measurement spine: instrument every tool call (bytes, outcome, cycle) and add a rerunnable per-cycle performance view, so cycle 410 can be compared with its baseline
  • Record the failure reason on every failed tool call and release step, then diagnose the cycle 409 close_cycle failures and the top failure causes
  • Cut orient and build_execute response size: move cycle-specific gate, branch and release prose out of per-call responses
  • Make board_view compact by default: fewer columns and a smaller default page, with detail on request
  • Measure the fixed per-session cost an agent pays before its first call (MCP tool list, skills listing, rules files) and trim it
  • Speed up idea: it takes about 20 seconds per call and echoes the full conventions block (about 7 KB) back on every task it creates
  • Record the ceremony ruling: every cycle step is optional capability for all users, and defaults tier by maturity (decision and wording, no new system)
  • Ship capability presets (first run, established, full) on the existing toggles so a new user starts with the light path
  • Shrink the review wait and review_submit cost: nudge when a build is ready for review, review several tasks in one call, and cut the per-task steps
  • P2 bug: handoff_generate apply and plan parse BUILD HANDOFF / structured output only when the JSON after <!-- PAPI_STRUCTURED_OUTPUT --> sits inside a ```json code fence. Bare JSON is rejected with a generic "Could not parse structured output" error regardless of content, and the handoff prompt never tells the caller to fence it. Fix: make parseStructuredOutput (packages/server/src/prompts.ts) accept bare JSON after the marker as well as fenced JSON, and state the expected format in the handoff and plan prompts. Add a test for both forms and for the error text. Cycle 410.