Kernel v0.15.1 · TUI/Portal v0.10.1

New features and improvements

1. 01

   The source / user-local TUI updates itself (#404 complete)

   v0.10.0 shipped the Homebrew updater backend; v0.10.1 completes issue #404 for installs that are not Homebrew-managed, so the TUI can keep itself current however it was installed.

   • A manual TUI self-update command (#416) and a source-install self-update backend (#417) bring update-in-place to source / user-local installs.
   • A startup update prompt (#418) offers the update when the on-disk source drifts behind the published TUI, so an operator is told when they are behind.
   • These build on the v0.10.0 foundation — Homebrew updater backend, doctor install-method detection, and source-install metadata — now extended to non-Homebrew installs.

   Why it matters:A self-update path that only works for Homebrew leaves source and user-local users stranded on stale binaries; finishing #404 means the TUI stays current and honest about its own version regardless of how it was installed.

2. 02

   A `claude-code` provider for the kernel (#525)

   The kernel gains a new claude-code LLM provider that drives a Claude subscription through the claude CLI, widening how an operator can back the runtime without changing the cockpit they already use.

   • The claude-code provider drives the claude CLI on a Claude subscription as an LLM provider (#525).
   • It was originally proposed in closed PR #299 and merged this window — the originating contributor is credited.

   Why it matters:More provider choices behind the same runtime mean an operator can back a fleet the way their account and budget allow, without re-learning the cockpit.

3. 03

   MCP manual sidecars and bundled curated manuals

   The kernel documents a manual sidecar contract for MCP addons and ships bundled manuals for curated MCPs, so an MCP can carry usage guidance the runtime can surface.

   • The MCP manual sidecar anatomy and a minimal sidecar contract are documented (#529, #530).
   • Bundled manuals ship for curated MCPs (#528), and a Telegram media guidance manual is added (#526).

   Why it matters:An MCP that carries its own manual lets the runtime answer "how do I use this addon" from a documented source instead of guesswork, which matters most for media and messaging surfaces.

4. 04

   Safer kernel state writes and a recovery refactor

   Two kernel refactors reduce the number of hand-rolled, slightly-different state writes that a long-running fleet can corrupt: shared filesystem helpers, and a session-recovery / tool-execution consolidation.

   • Shared _fsutil filesystem / JSON / JSONL helpers consolidate how the kernel reads and writes state (#510, #522), with migration references documented.
   • Session-recovery and ToolExecutor helpers are consolidated in turn.py, renaming _post_send_housekeeping to _turn_boundary_housekeeping (#511, #523).

   Why it matters:Every slightly-different state-write path is a place a fleet can corrupt a file under load; routing them through shared, tested helpers makes the runtime steadier across long unattended sessions.

5. 05

   Spill and refresh told truthfully

   Failures that used to pass silently now surface: an expired spill artifact says so, a permanent refresh failure is visible, and headless runtime liveness can be proven.

   • Expired-spill artifacts now carry messaging instead of failing opaquely (#192, #291), and a permanent refresh failure is made visible (#292).
   • A headless runtime liveness proof confirms an unattended runtime is actually alive (#351).
   • Codex pre-molt summarize guidance is made clearer (#531).

   Why it matters:A spill or refresh that fails silently is exactly the kind of fault a long autonomy run discovers too late; surfacing them lets an operator act before the failure compounds.

6. 06

   Cockpit and doctor polish

   Around the headline work, the cockpit and doctor got a focused polish pass, and a headless agent-readiness reliability fix landed alongside.

   • Cockpit: a live agent-activity indicator on the mail view footer (#422), mail view copy mode (#402), and the live /viz ghost-avatar visibility fix (#354).
   • Doctor: a saved redacted report bundle with a privacy notice and export hint, install-method detection, and a diagnostic-section layout clarification (#406, #407, #409, #449, #450).
   • Reliability: wait for headless agent readiness before proceeding (#365), plus dev-guide release-workflow docs and README install-method output (#448).

   Why it matters:A patch window is the right place to clear small cockpit and doctor papercuts; an operator who can see agent activity, copy from the mail view, and read a clean diagnostic report trusts the surface more in a long session.

7. 07

   Release hygiene, validation, and contributors

   The paired patch versions — TUI/Portal v0.10.1 and kernel v0.15.1 — were validated from clean release worktrees before the publish step.

   • Kernel gates at the v0.15.1 bump commit 2d23801 (on base 834ce8b): compileall clean; full pytest 3034 passing, 4 skipped, 0 genuine failures (three subprocess-import failures proven to be local PYTHONPATH / non-installed-package artifacts, green on re-check with PYTHONPATH=src); python -m build produced sdist + wheel; twine check PASSED on both.
   • TUI/Portal gates at candidate head 418e470 (build version injected via make ... VERSION=v0.10.1, no source bump): git diff --check against v0.10.0 clean; full Portal Go tests passed; portal/web npm ci && npm run build passed; make build produced the TUI and Portal binaries.
   • Noted, non-blocking: two internal/config install-detection tests failed only on the maintainer machine because local /usr/local//opt/homebrew dev symlinks resolve out of the Homebrew prefix — classified as host / test-isolation sensitivity, with the underlying classifier verified to return homebrew on a clean path; the portal/web npm-audit advisories affect dev-only tooling, not the embedded static assets the Go binary ships; the locally built kernel wheel is macOS-arm64 platform-tagged, so the portable sdist is the artifact for PyPI.
   • Contributors in this window: @huangzesen (lead, scope and validation owner), @TZZheng (the source self-update epic and the kernel filesystem/recovery refactors), @wchwawa (the live mail-view agent activity indicator), @rawpaper123 (headless readiness and liveness reliability fixes), @LuuOW (review of the /viz ghost-avatar fix), @zechenzhangAGI (originated the claude-code provider in a closed kernel PR before the shipped implementation landed through #525), and @9s5bz2jvd2-lang (closed/unmerged /kanban main/daemon API-call split PR #367, reviewed and thanked inside the release window).

   Why it matters:A patch still deserves full gate evidence and an honest contributor list; recording that the publish artifacts and tags are cut from these exact validated commits is part of shipping responsibly.