# Changelog

## [3.9.2](https://github.com/dallay/corvus/compare/corvus-runtime-v3.9.1...corvus-runtime-v3.9.2) (2026-05-05)


### Bug Fixes

* **release:** add npm manifest sync post release-please ([a4ee895](https://github.com/dallay/corvus/commit/a4ee895140b0d511040d3282bc50bb1de1bd0666))

## [3.9.1](https://github.com/dallay/corvus/compare/corvus-runtime-v3.9.0...corvus-runtime-v3.9.1) (2026-05-05)


### Bug Fixes

* remediate sonar quality issues ([56da8f1](https://github.com/dallay/corvus/commit/56da8f1d15db7c45f3cb29e95952284289a8541d))

## [3.9.0](https://github.com/dallay/corvus/compare/corvus-runtime-v3.8.0...corvus-runtime-v3.9.0) (2026-05-05)


### Features

* **runtime:** implement core memory creation and snapshot hydration tests ([a316126](https://github.com/dallay/corvus/commit/a316126b644c50837fe218432b963de411c14862))

## [3.8.0](https://github.com/dallay/corvus/compare/corvus-runtime-v0.3.0...corvus-runtime-v3.8.0) (2026-05-05)


### Features

* **agent-runtime:** add dream system consolidation ([4820d2b](https://github.com/dallay/corvus/commit/4820d2b700d6f17c630ee38686af26fff18cde48))
* **agent-runtime:** add dream system consolidation ([d0170ab](https://github.com/dallay/corvus/commit/d0170ab61309a462a7c708844efce2572e217d09))
* **agent-runtime:** add session inspect and list commands ([bac9596](https://github.com/dallay/corvus/commit/bac95961d8e08fa9685b0931ac65a6c19f546a22))
* **agent-runtime:** add session inspect and list commands ([768a5df](https://github.com/dallay/corvus/commit/768a5dfda6aa155e0af33b87adcf3a1232bf424b))
* **agent-runtime:** add task tools and session discoverability ([8758858](https://github.com/dallay/corvus/commit/8758858e5c5a14d58c3eb46f0c13fa8088c8fcae))
* **agent-runtime:** expose track 4 orchestration lifecycle state ([7b2c679](https://github.com/dallay/corvus/commit/7b2c679c49e08b6f46a691d344fd4553253ffad8))
* **agent-runtime:** expose track 4 orchestration lifecycle state ([1928463](https://github.com/dallay/corvus/commit/192846366f347c84296e44775a6e78fafdabfc20))
* **agent-runtime:** publish tooling parity aliases ([c741afc](https://github.com/dallay/corvus/commit/c741afce6da0cc8b019e8674a23177207f6ddc50))
* **ci:** enhance URL validation in HttpGetTool and improve version parsing ([41b69f1](https://github.com/dallay/corvus/commit/41b69f1e4258d474f3d30a8599faa65d39b2e20b))
* **coordinator:** add foundational components for coordinator functionality and update timeout durations ([6961e8c](https://github.com/dallay/corvus/commit/6961e8c40b42611012f4d65474d192790ce0a563))
* **coordinator:** complete track 4 slice 1 foundations ([753cd53](https://github.com/dallay/corvus/commit/753cd53d2650d121c5a80cfeff4e8dbc88431faf))
* Enhance workflow permissions, fix detekt alerts, and add Rook dashboard ([e43fc1a](https://github.com/dallay/corvus/commit/e43fc1a9a5b1c0c6ce53ef102832df1ddad1c713))
* implement supervised child lifecycle for Track 4 Slice 2 ([92d591c](https://github.com/dallay/corvus/commit/92d591c1168ba0e1a0833d7a1d6cb52c6b21f250))
* **orchestration:** add mailbox-backed slice 3 delivery ([0f811dc](https://github.com/dallay/corvus/commit/0f811dcfc71bc8bbc871be13fba6ef6a2b88a51c))
* **orchestration:** add mailbox-backed slice 3 delivery ([1a566eb](https://github.com/dallay/corvus/commit/1a566ebeb9261eaaa59312bc251ffda8f939f1d1))
* **orchestration:** supervised child lifecycle tools and coordinator (Slice 2) ([5c8e23b](https://github.com/dallay/corvus/commit/5c8e23bf192e2bef6e0df3d2656ced9c059dd1ba))
* Persist Rook provider account health state ([930700f](https://github.com/dallay/corvus/commit/930700f7752b4a78f6fb52cd12198080d7b67216))
* **rook:** add embedded operator dashboard flows ([c51c8c1](https://github.com/dallay/corvus/commit/c51c8c1b2b09a79207271bb95d8568e4e17b3a86))
* **rook:** document operational health probes ([133d341](https://github.com/dallay/corvus/commit/133d341c6341b4270c33b3ccdf631bb29802e2f3))
* **rook:** implement routing engine with strategy dispatch and fallback chains ([d634ae1](https://github.com/dallay/corvus/commit/d634ae16e3a95cece392695c3804a4a1f28be45c))
* **runtime:** add dream hooks for generated sessions ([d200610](https://github.com/dallay/corvus/commit/d20061008cf2e38832b50488a32793bff0baa3eb))
* **runtime:** add slash command registry core ([d89056c](https://github.com/dallay/corvus/commit/d89056c761ae29b8c1b59eb55b93c04e8e8a70a6))
* **runtime:** add slash command registry core ([3310f7e](https://github.com/dallay/corvus/commit/3310f7e4fb595e807d4aebd284548e171934a51a))
* **runtime:** complete orchestration parity contract ([2e34682](https://github.com/dallay/corvus/commit/2e34682d34021e31220f7fc1a0412b6b2709f4a0))
* **tools:** implement alias resolution for search, fetch, and task tools ([c2cb49e](https://github.com/dallay/corvus/commit/c2cb49e27c93354deb406d583d31d34d964d6843))


### Bug Fixes

* address PR [#602](https://github.com/dallay/corvus/issues/602) inline review comments ([687bb84](https://github.com/dallay/corvus/commit/687bb847225b5b2e9ba51feec828c14a616c3ed2))
* **agent-runtime:** address Dream review follow-ups ([f1e7c7d](https://github.com/dallay/corvus/commit/f1e7c7d32c30c402eedbf49342257fc203905509))
* **agent-runtime:** block on Dream completion lock ([a1354f5](https://github.com/dallay/corvus/commit/a1354f5d19b0c90346d105c8687fe53d5c5a8e50))
* **agent-runtime:** box handled session command success ([4665653](https://github.com/dallay/corvus/commit/46656535623426dfec71b6b62bf2379d21a486ae))
* **agent-runtime:** carry escalation state through child lifecycle ([06d4dce](https://github.com/dallay/corvus/commit/06d4dce10c159b6b4d60eb25e9bf821960e02ed1))
* **agent-runtime:** enforce slash command caller permissions ([d83d3ca](https://github.com/dallay/corvus/commit/d83d3caec28fdbf3c9c418f25a785ba4b6e51fcb))
* **agent-runtime:** enforce slash command caller permissions ([01107fa](https://github.com/dallay/corvus/commit/01107fa9bf8029d2dbd4f9dff68a91afab5c8477))
* **agent-runtime:** import hmac key init in webhook test ([89f5448](https://github.com/dallay/corvus/commit/89f544874127ba81c9f5824346523c7b51ab7285))
* **agent-runtime:** reduce session command clippy footprint ([ce64ee1](https://github.com/dallay/corvus/commit/ce64ee1d93a6fa380982ab36b639597e41601e6b))
* **agent-runtime:** restore rust hashing and hmac checks ([61d0049](https://github.com/dallay/corvus/commit/61d0049d4e810291edb77b3c021534baef558fca))
* **agent-runtime:** satisfy slash permission lint ([280ab35](https://github.com/dallay/corvus/commit/280ab350fa8dbdd38db88449c76af21d7d147b8c))
* **agent-runtime:** stabilize blocked coordinator inspection narrative ([83a43f5](https://github.com/dallay/corvus/commit/83a43f5e42e3948ecc084c0c86f60089b2018795))
* **agent-runtime:** stabilize blocked coordinator inspection narrative ([56ff071](https://github.com/dallay/corvus/commit/56ff07115fafd77c8c7a159f5b85f13b4dd45f84))
* **agent-runtime:** structure blocked child escalation state ([460803e](https://github.com/dallay/corvus/commit/460803e5b869bcacd37a96ca417908174e7d9824))
* **agent-runtime:** tighten Dream validation and recovery ([2dec988](https://github.com/dallay/corvus/commit/2dec98880ef8693b080ba4ec98ef79dc7a2b784d))
* **agent-runtime:** unblock pre-push clippy checks ([09d1936](https://github.com/dallay/corvus/commit/09d1936ad89cbe8da95a796133cf812a0048b356))
* apply CodeRabbit auto-fixes ([360176f](https://github.com/dallay/corvus/commit/360176f590093b30b792d7b5cd42e9437451222d))
* **build-logic:** avoid config-cache lock check failure ([ddc0cdf](https://github.com/dallay/corvus/commit/ddc0cdf2169b103dffa2b5a82dc9a180a34cac55))
* **cerebro:** align MCP contract with implemented surface ([c8f3f69](https://github.com/dallay/corvus/commit/c8f3f69776d022043dbc9f8c1744794d72ed4234))
* **cerebro:** align MCP contract with implemented surface ([5eba3c5](https://github.com/dallay/corvus/commit/5eba3c52e5510c828f3dcab046f527893d72b88e))
* **cerebro:** harden production readiness ([725b3ea](https://github.com/dallay/corvus/commit/725b3ea56852214212ef0f7ea89114b005a875a6))
* **cerebro:** update Makefile and Docker paths from modules/cerebro to clients/cerebro ([27c4a1b](https://github.com/dallay/corvus/commit/27c4a1b732cdd47d766cd7deb97b0a2085dfd31d)), closes [#699](https://github.com/dallay/corvus/issues/699)
* **code-scanning:** resolve naming and gradle style alerts ([2e206ce](https://github.com/dallay/corvus/commit/2e206ceb5ca51157ba176f3b0f0ad4b53179da21))
* correct Duration::from_mins usage, refactor announcement helpers, and fix Vue edge cases ([7efc729](https://github.com/dallay/corvus/commit/7efc729709cac677396c2da6fec5055cf33319ca))
* **deps:** restore compatibility for consolidated dependency updates ([7d406a2](https://github.com/dallay/corvus/commit/7d406a2540fa43a77201388f324500903b7ec174))
* **firmware:** remove vulnerable xmas-elf dependency ([9d90878](https://github.com/dallay/corvus/commit/9d90878ed5d51c7860ce8657201acfe23ee7ee50))
* fix TOCTOU in from_path and add security tests ([fcbae94](https://github.com/dallay/corvus/commit/fcbae94084aaa120e850d5b627419a399a71b102))
* reject absolute paths in Telegram attachment resolver to prevent path traversal ([fbc8026](https://github.com/dallay/corvus/commit/fbc802613440e58680a2cde30fbec53078907b1b))
* reject absolute paths in Telegram attachment resolver to prevent path traversal ([8907055](https://github.com/dallay/corvus/commit/89070554e28794d9f83260b9bee8502f94cf404e))
* **release:** update artifact upload action version and improve release component resolution ([a7b3138](https://github.com/dallay/corvus/commit/a7b31389bde0bda696be3d0b7b3af6e66e0d8cda))
* replace non-existent Duration::from_mins, refactor Vue announcement helpers, and fix edge cases ([37d5a96](https://github.com/dallay/corvus/commit/37d5a969195f77d6c0af781db6f31ce3ef474643))
* rook 583 apply ([721302f](https://github.com/dallay/corvus/commit/721302f09b8967fb7926a86c3c485cbedc4e4a66))
* **rook:** clean up merge conflict files, re-apply fixes ([192cdb3](https://github.com/dallay/corvus/commit/192cdb3b7ade06ab2911042e870d7260eda6fdc4))
* **runtime:** address verified review regressions ([5d16d9f](https://github.com/dallay/corvus/commit/5d16d9f9b89d08785dd7b7dda97b6d1f4cadd482))
* **runtime:** allow staged dream re-exports ([7732cad](https://github.com/dallay/corvus/commit/7732cad7758f5d3482ff915716aa9f82d5f252e6))
* **runtime:** satisfy orchestration clippy gates ([a170a86](https://github.com/dallay/corvus/commit/a170a8604858daef5ca564796fc30aa74d788352))
* **runtime:** satisfy orchestration lint gates ([4ec0078](https://github.com/dallay/corvus/commit/4ec007806c17d2190ae701c2bac07a339ebf850a))
* **runtime:** satisfy slash registry clippy check ([50b471a](https://github.com/dallay/corvus/commit/50b471ab3f1dec43975ab8b42a3ed4099cd2d17e))
* **rust:** format observability security alert cleanup ([82fbb73](https://github.com/dallay/corvus/commit/82fbb7372aa22c24ab199c7449c08feca0dbd9b3))
* **security:** add CSP headers, harden Vite dev server, and fix weak RNG fallback ([a3da395](https://github.com/dallay/corvus/commit/a3da395762290a648bccf2dbd688a07fec10786b))
* **security:** block URL-encoded policy bypasses ([cdc34be](https://github.com/dallay/corvus/commit/cdc34bec398371d30931e3b54fb2a854ec946c90))
* **security:** block URL-encoded policy bypasses ([9efd810](https://github.com/dallay/corvus/commit/9efd81037697e4c9286f213005bbac67b8fa6e97))
* **security:** complete test constant extraction in webhook security tests ([28c219e](https://github.com/dallay/corvus/commit/28c219e7794c844d080042080c8b2cf768f8c8ba))
* **security:** format encoded bypass coverage ([31226ae](https://github.com/dallay/corvus/commit/31226aefb049ca4801077ed365aaf07821174451))
* **security:** harden package manager command and argument validation ([63bc62b](https://github.com/dallay/corvus/commit/63bc62b94e40aa07fdd8dc512ace2d8e93c76616))
* **security:** harden package manager command and argument validation ([9bf7c89](https://github.com/dallay/corvus/commit/9bf7c8987b226a03a77432b2e3736fb15b6a03f7))
* **security:** harden path handling for telegram and skills ([e075b2d](https://github.com/dallay/corvus/commit/e075b2d5076d1fe0f837ceaedfd248b7afd7884f))
* **security:** harden SecurityPolicy against quote-based bypasses ([46203fb](https://github.com/dallay/corvus/commit/46203fbef501ecf151e03b00a4fc997bd4193ff3))
* **security:** harden SecurityPolicy against quote-based bypasses (SONAR:SEC-001) ([a70ec1e](https://github.com/dallay/corvus/commit/a70ec1e1b8cc3ef88f9e07eda85dd6d1576df69f))
* **security:** neutralize critical code scanning alerts ([0d33552](https://github.com/dallay/corvus/commit/0d335522d0f46bcfb49a50423f10578e67dbb1ef))
* **security:** reject quoted direct paths ([f497653](https://github.com/dallay/corvus/commit/f4976535087bcc04af096b67c1207018e6fc3c45))
* **security:** remediate semgrep findings for secrets and shell IFS tampering ([020db43](https://github.com/dallay/corvus/commit/020db43a7270a293c0321b2e420103e8cff16636))
* **security:** resolve code scanning hard-coded cryptographic value alerts ([e6d31cf](https://github.com/dallay/corvus/commit/e6d31cf5fd1fc37829100b7fee6949e2a561a1c6))
* **security:** resolve code scanning hard-coded cryptographic value alerts ([82c7e0e](https://github.com/dallay/corvus/commit/82c7e0e308b5b5b854ce6702cdc584cc6e64ebea))
* **security:** validate raw paths before normalization ([f31a3b8](https://github.com/dallay/corvus/commit/f31a3b876e5ea74f1f9703533543b395bfb28d07))
* **tooling:** add local sonar review workflow ([70fee4e](https://github.com/dallay/corvus/commit/70fee4e2d27bcfd4a2a0d33d97ad993f1dd13c56))
* **tooling:** add local sonar review workflow ([929695b](https://github.com/dallay/corvus/commit/929695b58b13000809e0233a197243fd22e514cb))
* **tooling:** address review follow-ups ([cb6da04](https://github.com/dallay/corvus/commit/cb6da0404a471b88b93c0a9439ef4103236ac014))
* use unique temp filename in from_path test to avoid parallel collisions ([b820b7a](https://github.com/dallay/corvus/commit/b820b7a60b8095c05a621540bd4132e590bc4fac))
* verify findings from track-4-slice-1 verify-report ([0ef9b53](https://github.com/dallay/corvus/commit/0ef9b53bd2f9412f5eee55b623d6db7d5cc97b91))

## [0.3.0](https://github.com/dallay/corvus/compare/corvus-runtime-v0.2.2...corvus-runtime-v0.3.0) (2026-05-04)


### Features

* **ci:** enhance URL validation in HttpGetTool and improve version parsing ([41b69f1](https://github.com/dallay/corvus/commit/41b69f1e4258d474f3d30a8599faa65d39b2e20b))
* Persist Rook provider account health state ([930700f](https://github.com/dallay/corvus/commit/930700f7752b4a78f6fb52cd12198080d7b67216))
* **rook:** document operational health probes ([133d341](https://github.com/dallay/corvus/commit/133d341c6341b4270c33b3ccdf631bb29802e2f3))


### Bug Fixes

* **agent-runtime:** enforce slash command caller permissions ([d83d3ca](https://github.com/dallay/corvus/commit/d83d3caec28fdbf3c9c418f25a785ba4b6e51fcb))
* **agent-runtime:** enforce slash command caller permissions ([01107fa](https://github.com/dallay/corvus/commit/01107fa9bf8029d2dbd4f9dff68a91afab5c8477))
* **agent-runtime:** satisfy slash permission lint ([280ab35](https://github.com/dallay/corvus/commit/280ab350fa8dbdd38db88449c76af21d7d147b8c))
* apply CodeRabbit auto-fixes ([360176f](https://github.com/dallay/corvus/commit/360176f590093b30b792d7b5cd42e9437451222d))
* **firmware:** remove vulnerable xmas-elf dependency ([9d90878](https://github.com/dallay/corvus/commit/9d90878ed5d51c7860ce8657201acfe23ee7ee50))
* reject absolute paths in Telegram attachment resolver to prevent path traversal ([fbc8026](https://github.com/dallay/corvus/commit/fbc802613440e58680a2cde30fbec53078907b1b))
* reject absolute paths in Telegram attachment resolver to prevent path traversal ([8907055](https://github.com/dallay/corvus/commit/89070554e28794d9f83260b9bee8502f94cf404e))
* **security:** add CSP headers, harden Vite dev server, and fix weak RNG fallback ([a3da395](https://github.com/dallay/corvus/commit/a3da395762290a648bccf2dbd688a07fec10786b))
* **security:** harden package manager command and argument validation ([63bc62b](https://github.com/dallay/corvus/commit/63bc62b94e40aa07fdd8dc512ace2d8e93c76616))
* **security:** harden package manager command and argument validation ([9bf7c89](https://github.com/dallay/corvus/commit/9bf7c8987b226a03a77432b2e3736fb15b6a03f7))
* **security:** harden SecurityPolicy against quote-based bypasses ([46203fb](https://github.com/dallay/corvus/commit/46203fbef501ecf151e03b00a4fc997bd4193ff3))
* **security:** harden SecurityPolicy against quote-based bypasses (SONAR:SEC-001) ([a70ec1e](https://github.com/dallay/corvus/commit/a70ec1e1b8cc3ef88f9e07eda85dd6d1576df69f))
* **security:** reject quoted direct paths ([f497653](https://github.com/dallay/corvus/commit/f4976535087bcc04af096b67c1207018e6fc3c45))
* **security:** validate raw paths before normalization ([f31a3b8](https://github.com/dallay/corvus/commit/f31a3b876e5ea74f1f9703533543b395bfb28d07))

## [0.2.2](https://github.com/dallay/corvus/compare/corvus-runtime-v0.2.1...corvus-runtime-v0.2.2) (2026-05-01)


### Bug Fixes

* **security:** complete test constant extraction in webhook security tests ([28c219e](https://github.com/dallay/corvus/commit/28c219e7794c844d080042080c8b2cf768f8c8ba))
* **security:** resolve code scanning hard-coded cryptographic value alerts ([e6d31cf](https://github.com/dallay/corvus/commit/e6d31cf5fd1fc37829100b7fee6949e2a561a1c6))
* **security:** resolve code scanning hard-coded cryptographic value alerts ([82c7e0e](https://github.com/dallay/corvus/commit/82c7e0e308b5b5b854ce6702cdc584cc6e64ebea))

## [0.2.1](https://github.com/dallay/corvus/compare/corvus-runtime-v0.2.0...corvus-runtime-v0.2.1) (2026-04-30)


### Bug Fixes

* **security:** remediate semgrep findings for secrets and shell IFS tampering ([020db43](https://github.com/dallay/corvus/commit/020db43a7270a293c0321b2e420103e8cff16636))

## [0.2.0](https://github.com/dallay/corvus/compare/corvus-runtime-v0.1.0...corvus-runtime-v0.2.0) (2026-04-30)


### Features

* **tools:** implement alias resolution for search, fetch, and task tools ([c2cb49e](https://github.com/dallay/corvus/commit/c2cb49e27c93354deb406d583d31d34d964d6843))


### Bug Fixes

* fix TOCTOU in from_path and add security tests ([fcbae94](https://github.com/dallay/corvus/commit/fcbae94084aaa120e850d5b627419a399a71b102))
* **security:** harden path handling for telegram and skills ([e075b2d](https://github.com/dallay/corvus/commit/e075b2d5076d1fe0f837ceaedfd248b7afd7884f))
* use unique temp filename in from_path test to avoid parallel collisions ([b820b7a](https://github.com/dallay/corvus/commit/b820b7a60b8095c05a621540bd4132e590bc4fac))

## 0.1.0 (2026-04-29)


### Features

* Add and archive slash session commands with SQLite persistence ([#532](https://github.com/dallay/corvus/issues/532)) ([ba6bd0b](https://github.com/dallay/corvus/commit/ba6bd0b3dbb630b154cc33ede2c249062c6cd003))
* add audio input support for http gateway and cli phase 2 ([#437](https://github.com/dallay/corvus/issues/437)) ([faa496f](https://github.com/dallay/corvus/commit/faa496ff0e22d61fca9fdb05b7bef07a746feb8d))
* Add image ingestion and update staging tests for Slack ([#461](https://github.com/dallay/corvus/issues/461)) ([f752038](https://github.com/dallay/corvus/commit/f7520382a80bb6d0285fa71e355ac0089af3b42f))
* Add tests for public image staging in Discord CDN ([#460](https://github.com/dallay/corvus/issues/460)) ([7b07371](https://github.com/dallay/corvus/commit/7b07371bfd4a132b986bbfc526347af5a3cde294))
* **agent-runtime:** add agent templates and developer documentation for Phase 5B ([#514](https://github.com/dallay/corvus/issues/514)) ([9933713](https://github.com/dallay/corvus/commit/9933713e38da5302f5a5c0666aa80a0d481691aa))
* **agent-runtime:** add CLI composition flows for Phase 4 ([#513](https://github.com/dallay/corvus/issues/513)) ([ced2b06](https://github.com/dallay/corvus/commit/ced2b060655a3378e127984865c172eea08ea75f))
* **agent-runtime:** add code_search rollout benchmarks ([aff6dc8](https://github.com/dallay/corvus/commit/aff6dc83e6397c74447a1bca8f35ab8fd1bbccdc))
* **agent-runtime:** add dream system consolidation ([4820d2b](https://github.com/dallay/corvus/commit/4820d2b700d6f17c630ee38686af26fff18cde48))
* **agent-runtime:** add dream system consolidation ([d0170ab](https://github.com/dallay/corvus/commit/d0170ab61309a462a7c708844efce2572e217d09))
* **agent-runtime:** add indexed candidate verification for code search ([#443](https://github.com/dallay/corvus/issues/443)) ([79080e4](https://github.com/dallay/corvus/commit/79080e426b701417d1eb06b8d935b4f27ee0967a))
* **agent-runtime:** add session inspect and list commands ([bac9596](https://github.com/dallay/corvus/commit/bac95961d8e08fa9685b0931ac65a6c19f546a22))
* **agent-runtime:** add session inspect and list commands ([768a5df](https://github.com/dallay/corvus/commit/768a5dfda6aa155e0af33b87adcf3a1232bf424b))
* **agent-runtime:** add settings, mcp, and tool management slash commands ([#544](https://github.com/dallay/corvus/issues/544)) ([29ea635](https://github.com/dallay/corvus/commit/29ea6357da563c8978e0f358e4644094b810cef6))
* **agent-runtime:** add slash command registry core ([#545](https://github.com/dallay/corvus/issues/545)) ([72d1eff](https://github.com/dallay/corvus/commit/72d1eff9c238ae60da43cd7428eef8a348f55ddb))
* **agent-runtime:** add slash tools listing ([#544](https://github.com/dallay/corvus/issues/544)) ([cd3569d](https://github.com/dallay/corvus/commit/cd3569d4cb20970cacefdcfeac337b32b729faf7))
* **agent-runtime:** add slash tools listing ([#544](https://github.com/dallay/corvus/issues/544)) ([fb993c4](https://github.com/dallay/corvus/commit/fb993c499dec24d62a6a9e7af41135217bddfa38))
* **agent-runtime:** add task tools and session discoverability ([8758858](https://github.com/dallay/corvus/commit/8758858e5c5a14d58c3eb46f0c13fa8088c8fcae))
* **agent-runtime:** add task tools and session discoverability ([6f2f5b9](https://github.com/dallay/corvus/commit/6f2f5b9f9c257bf2e3b27f20b90162bdbe6e772c))
* **agent-runtime:** add tooling parity search and fetch tools ([#536](https://github.com/dallay/corvus/issues/536)) ([238fd09](https://github.com/dallay/corvus/commit/238fd09525d51c69a563223956d35eb73dabb7d1))
* **agent-runtime:** add typed slash command contract ([#546](https://github.com/dallay/corvus/issues/546)) ([63e1acd](https://github.com/dallay/corvus/commit/63e1acd6dce738758df4828bd7fa0e3e9a1a1fde))
* **agent-runtime:** expose track 4 orchestration lifecycle state ([7b2c679](https://github.com/dallay/corvus/commit/7b2c679c49e08b6f46a691d344fd4553253ffad8))
* **agent-runtime:** expose track 4 orchestration lifecycle state ([1928463](https://github.com/dallay/corvus/commit/192846366f347c84296e44775a6e78fafdabfc20))
* **agent-runtime:** keep search index fresh across file writes and workspace changes ([#444](https://github.com/dallay/corvus/issues/444)) ([82fa489](https://github.com/dallay/corvus/commit/82fa4896a60263f77e093f11e421ca8295626be0)), closes [#358](https://github.com/dallay/corvus/issues/358)
* **agent-runtime:** Phase 5A — trait compliance macros and differential tests ([#515](https://github.com/dallay/corvus/issues/515)) ([20c0527](https://github.com/dallay/corvus/commit/20c0527c0b0fe31aff58e74df59d5185fdfb7f43))
* **agent-runtime:** publish tooling parity aliases ([c741afc](https://github.com/dallay/corvus/commit/c741afce6da0cc8b019e8674a23177207f6ddc50))
* **agent-runtime:** support multiple images per turn ([#472](https://github.com/dallay/corvus/issues/472)) ([5afd58b](https://github.com/dallay/corvus/commit/5afd58b515f255e66371e1964730b1ba98b27109))
* **agent-runtime:** unify slash command transport handling ([#541](https://github.com/dallay/corvus/issues/541)) ([#549](https://github.com/dallay/corvus/issues/549)) ([dbee48b](https://github.com/dallay/corvus/commit/dbee48b1db30f6a6e53a844fe5e89394cd77be99))
* **agent:** implement Plan Mode execution mode ([#530](https://github.com/dallay/corvus/issues/530)) ([43c8b45](https://github.com/dallay/corvus/commit/43c8b45a7d5cc823e5075e5a662fec61de43838b))
* capability-based agent composition and architecture ([#520](https://github.com/dallay/corvus/issues/520)) ([69353fc](https://github.com/dallay/corvus/commit/69353fc8ab0105cd5206096760193829a95d2515))
* **capability:** Phase 3 - corvus-composer crate with AgentManifest schema ([#511](https://github.com/dallay/corvus/issues/511)) ([61312a6](https://github.com/dallay/corvus/commit/61312a688a9ec129961b8567dab4d7d3c2af536e))
* cerebro memory enhancement layer ([#466](https://github.com/dallay/corvus/issues/466)) ([cd5838f](https://github.com/dallay/corvus/commit/cd5838f0d46a61b9042e7ff3c11adf4f4ed9031c))
* **cerebro:** add dashboard and gateway memory enhancement layer ([e96f68d](https://github.com/dallay/corvus/commit/e96f68d1fdf307447173423f69980d16da08f3d0))
* **chat:** show memory recall indicators on agent messages ([#470](https://github.com/dallay/corvus/issues/470)) ([d0b28ef](https://github.com/dallay/corvus/commit/d0b28ef93b8260ab60e365dcaa764053b7e4ef99))
* code search tool ([#440](https://github.com/dallay/corvus/issues/440)) ([d5dfcbb](https://github.com/dallay/corvus/commit/d5dfcbbc9c3e346f222b4f9d007f379cada24582))
* complete [#330](https://github.com/dallay/corvus/issues/330) startup staged-image reaper and [#365](https://github.com/dallay/corvus/issues/365) missing session/memory i18n ([#459](https://github.com/dallay/corvus/issues/459)) ([77d96e9](https://github.com/dallay/corvus/commit/77d96e9960d8a7ddb7e55284e7a2a5c45dfc63fe))
* **coordinator:** add foundational components for coordinator functionality and update timeout durations ([6961e8c](https://github.com/dallay/corvus/commit/6961e8c40b42611012f4d65474d192790ce0a563))
* **coordinator:** complete track 4 slice 1 foundations ([753cd53](https://github.com/dallay/corvus/commit/753cd53d2650d121c5a80cfeff4e8dbc88431faf))
* **cost:** productize budget governance across runtime surfaces ([#449](https://github.com/dallay/corvus/issues/449)) ([81c72ad](https://github.com/dallay/corvus/commit/81c72ad70272757d2bf7d2ae2c9269a1a43696c0))
* define cerebro distribution channels and dedicated docs presence ([#396](https://github.com/dallay/corvus/issues/396)) ([4f5ec99](https://github.com/dallay/corvus/commit/4f5ec997e53f6135e211f8b0c0199954329b48c5))
* Enhance model routing specs, documentation, and validation features ([#454](https://github.com/dallay/corvus/issues/454)) ([e72ff28](https://github.com/dallay/corvus/commit/e72ff28f589af4d3778640e734c607338eddbae7))
* Enhance workflow permissions, fix detekt alerts, and add Rook dashboard ([e43fc1a](https://github.com/dallay/corvus/commit/e43fc1a9a5b1c0c6ce53ef102832df1ddad1c713))
* Harden security policy and introduce code_search tool enhancements ([#442](https://github.com/dallay/corvus/issues/442)) ([024aa20](https://github.com/dallay/corvus/commit/024aa20d7c74e356afcf7eb60224986ed319210c))
* implement supervised child lifecycle for Track 4 Slice 2 ([92d591c](https://github.com/dallay/corvus/commit/92d591c1168ba0e1a0833d7a1d6cb52c6b21f250))
* **orchestration:** add mailbox-backed slice 3 delivery ([0f811dc](https://github.com/dallay/corvus/commit/0f811dcfc71bc8bbc871be13fba6ef6a2b88a51c))
* **orchestration:** add mailbox-backed slice 3 delivery ([1a566eb](https://github.com/dallay/corvus/commit/1a566ebeb9261eaaa59312bc251ffda8f939f1d1))
* **orchestration:** supervised child lifecycle tools and coordinator (Slice 2) ([5c8e23b](https://github.com/dallay/corvus/commit/5c8e23bf192e2bef6e0df3d2656ced9c059dd1ba))
* Phase 2 capability family crates with registries ([#510](https://github.com/dallay/corvus/issues/510)) ([c284503](https://github.com/dallay/corvus/commit/c28450312920d646627dbbe4178ca0e7a702e579))
* productize model routing with operator docs, config validation, and formal spec ([#452](https://github.com/dallay/corvus/issues/452)) ([8eb2b19](https://github.com/dallay/corvus/commit/8eb2b19eecb422c72470855b0791708f61f7c197))
* **rook:** add embedded operator dashboard flows ([c51c8c1](https://github.com/dallay/corvus/commit/c51c8c1b2b09a79207271bb95d8568e4e17b3a86))
* **rook:** implement routing engine with strategy dispatch and fallback chains ([d634ae1](https://github.com/dallay/corvus/commit/d634ae16e3a95cece392695c3804a4a1f28be45c))
* **router:** log affected route hints when provider warmup fails ([#463](https://github.com/dallay/corvus/issues/463)) ([fa05f57](https://github.com/dallay/corvus/commit/fa05f5791033e6ba87d3db9b62ae0e6b466b49f4))
* **runtime:** add audio input support with local transcription for Telegram ([#413](https://github.com/dallay/corvus/issues/413)) ([258d3c3](https://github.com/dallay/corvus/commit/258d3c399c1bd31c1201d39e60dae630c793e4cf))
* **runtime:** add dream hooks for generated sessions ([d200610](https://github.com/dallay/corvus/commit/d20061008cf2e38832b50488a32793bff0baa3eb))
* **runtime:** complete orchestration parity contract ([2e34682](https://github.com/dallay/corvus/commit/2e34682d34021e31220f7fc1a0412b6b2709f4a0))
* **runtime:** wire CostTracker to agent loop with budget enforcement ([3854403](https://github.com/dallay/corvus/commit/385440398585d1a23bbe10c5e769c04798043066))
* settings mcp tool commands ([53a50a8](https://github.com/dallay/corvus/commit/53a50a86a51ad6f760dc42ae9e5d5c53f3581b18))


### Bug Fixes

* address PR [#602](https://github.com/dallay/corvus/issues/602) inline review comments ([687bb84](https://github.com/dallay/corvus/commit/687bb847225b5b2e9ba51feec828c14a616c3ed2))
* **agent-runtime:** address Dream review follow-ups ([f1e7c7d](https://github.com/dallay/corvus/commit/f1e7c7d32c30c402eedbf49342257fc203905509))
* **agent-runtime:** address slash-session code review findings ([a4157da](https://github.com/dallay/corvus/commit/a4157da814642583b8aefc8114d798af26353d89))
* **agent-runtime:** block localhost subdomains in http tools ([623b7ef](https://github.com/dallay/corvus/commit/623b7ef6335b46216452377e7e91a7009eb152bb))
* **agent-runtime:** block on Dream completion lock ([a1354f5](https://github.com/dallay/corvus/commit/a1354f5d19b0c90346d105c8687fe53d5c5a8e50))
* **agent-runtime:** box handled session command success ([4665653](https://github.com/dallay/corvus/commit/46656535623426dfec71b6b62bf2379d21a486ae))
* **agent-runtime:** carry escalation state through child lifecycle ([06d4dce](https://github.com/dallay/corvus/commit/06d4dce10c159b6b4d60eb25e9bf821960e02ed1))
* **agent-runtime:** complete rollout benchmark lint fix ([8780e52](https://github.com/dallay/corvus/commit/8780e523e195c8da926e5166ff377cb88b30efc4))
* **agent-runtime:** finish rollout benchmark enum rename ([8b786d9](https://github.com/dallay/corvus/commit/8b786d98a552f80d4eae147bcfcc232f7c1d65d5))
* **agent-runtime:** import hmac key init in webhook test ([89f5448](https://github.com/dallay/corvus/commit/89f544874127ba81c9f5824346523c7b51ab7285))
* **agent-runtime:** reduce session command clippy footprint ([ce64ee1](https://github.com/dallay/corvus/commit/ce64ee1d93a6fa380982ab36b639597e41601e6b))
* **agent-runtime:** restore rust hashing and hmac checks ([61d0049](https://github.com/dallay/corvus/commit/61d0049d4e810291edb77b3c021534baef558fca))
* **agent-runtime:** satisfy rollout benchmark lint ([b4afa50](https://github.com/dallay/corvus/commit/b4afa501acd495ee39273000755344d6789299e7))
* **agent-runtime:** stabilize blocked coordinator inspection narrative ([83a43f5](https://github.com/dallay/corvus/commit/83a43f5e42e3948ecc084c0c86f60089b2018795))
* **agent-runtime:** stabilize blocked coordinator inspection narrative ([56ff071](https://github.com/dallay/corvus/commit/56ff07115fafd77c8c7a159f5b85f13b4dd45f84))
* **agent-runtime:** structure blocked child escalation state ([460803e](https://github.com/dallay/corvus/commit/460803e5b869bcacd37a96ca417908174e7d9824))
* **agent-runtime:** tighten Dream validation and recovery ([2dec988](https://github.com/dallay/corvus/commit/2dec98880ef8693b080ba4ec98ef79dc7a2b784d))
* **agent-runtime:** unblock pre-push clippy checks ([09d1936](https://github.com/dallay/corvus/commit/09d1936ad89cbe8da95a796133cf812a0048b356))
* apply CodeRabbit auto-fixes ([9230e94](https://github.com/dallay/corvus/commit/9230e942164a06a66710519011663849e94e645e))
* apply CodeRabbit auto-fixes ([d8ccc59](https://github.com/dallay/corvus/commit/d8ccc5926277c7f8e955d3cbf42ecb07ba11128c))
* apply CodeRabbit auto-fixes ([b9ecd1f](https://github.com/dallay/corvus/commit/b9ecd1fe76da4038fe1a7da691b2fcdec109f252))
* bind gateway to 0.0.0.0, lift ChatWorkspace state, fix Spanish docs, harden mobile-smoke-test.sh ([948974a](https://github.com/dallay/corvus/commit/948974a2fed851e07e48f78cfd0133d724b36571))
* bind gateway to 0.0.0.0, lift ChatWorkspace state, fix Spanish docs, harden mobile-smoke-test.sh ([a04f4ee](https://github.com/dallay/corvus/commit/a04f4ee5717a096468f7535b458ba4d046229993))
* **build-logic:** avoid config-cache lock check failure ([ddc0cdf](https://github.com/dallay/corvus/commit/ddc0cdf2169b103dffa2b5a82dc9a180a34cac55))
* **cerebro:** align MCP contract with implemented surface ([c8f3f69](https://github.com/dallay/corvus/commit/c8f3f69776d022043dbc9f8c1744794d72ed4234))
* **cerebro:** align MCP contract with implemented surface ([5eba3c5](https://github.com/dallay/corvus/commit/5eba3c52e5510c828f3dcab046f527893d72b88e))
* **cerebro:** format runtime files for push checks ([7daf8e7](https://github.com/dallay/corvus/commit/7daf8e78a0092e10e827e1cb9a02e2152b9fff2a))
* **cerebro:** harden gateway contracts and dashboard guards ([eea1fc5](https://github.com/dallay/corvus/commit/eea1fc523ce232a03ddcc00715ebb24e0ba2e7ba))
* **cerebro:** harden production readiness ([725b3ea](https://github.com/dallay/corvus/commit/725b3ea56852214212ef0f7ea89114b005a875a6))
* **cerebro:** satisfy runtime push lint checks ([6bf3590](https://github.com/dallay/corvus/commit/6bf3590ec0633b08cf8336a04e938845a5088dc6))
* **ci:** use ARM64 runners instead of cross-compilation for linux-arm64 ([3ca2396](https://github.com/dallay/corvus/commit/3ca23967611f71e27b0bcbe30e8d47e89fe6af30))
* clarify Cerebro constants, fix Spanish heading, remove circular spec ref, explicit ceiling, improve shell docs ([#509](https://github.com/dallay/corvus/issues/509)) ([37b187d](https://github.com/dallay/corvus/commit/37b187d68a98d77f9e5bbc70880a4308887d0a5b))
* **code-scanning:** resolve naming and gradle style alerts ([2e206ce](https://github.com/dallay/corvus/commit/2e206ceb5ca51157ba176f3b0f0ad4b53179da21))
* correct Duration::from_mins usage, refactor announcement helpers, and fix Vue edge cases ([7efc729](https://github.com/dallay/corvus/commit/7efc729709cac677396c2da6fec5055cf33319ca))
* **deps:** restore compatibility for consolidated dependency updates ([7d406a2](https://github.com/dallay/corvus/commit/7d406a2540fa43a77201388f324500903b7ec174))
* **docs:** repair broken local links ([f560f8c](https://github.com/dallay/corvus/commit/f560f8c371cb1263549ecdf1c6bbf4a40d32ee09))
* **docs:** repair broken local links ([#399](https://github.com/dallay/corvus/issues/399)) ([ee07750](https://github.com/dallay/corvus/commit/ee07750674ec00166fa9047a30d6315de1570986))
* Harden sandbox isolation and update allowed status handling ([#398](https://github.com/dallay/corvus/issues/398)) ([b8d994e](https://github.com/dallay/corvus/commit/b8d994e5767fedc9f89d45a5dad2987740ff209a))
* **release:** publish stable artifacts from github releases ([#462](https://github.com/dallay/corvus/issues/462)) ([d3bfae0](https://github.com/dallay/corvus/commit/d3bfae07929a3177e7013a582affd2021fd0dce2))
* **release:** stabilize monorepo release automation ([6c9ea27](https://github.com/dallay/corvus/commit/6c9ea27e7ce7aa8d693edc17985929d56e5e3d5c))
* **release:** sync Cargo.lock files and add auto-sync workflow ([2bd57ac](https://github.com/dallay/corvus/commit/2bd57ac7e60a6db2be1c8e3ea6b17ba562607758))
* **release:** update artifact upload action version and improve release component resolution ([a7b3138](https://github.com/dallay/corvus/commit/a7b31389bde0bda696be3d0b7b3af6e66e0d8cda))
* replace non-existent Duration::from_mins, refactor Vue announcement helpers, and fix edge cases ([37d5a96](https://github.com/dallay/corvus/commit/37d5a969195f77d6c0af781db6f31ce3ef474643))
* rook 583 apply ([721302f](https://github.com/dallay/corvus/commit/721302f09b8967fb7926a86c3c485cbedc4e4a66))
* **rook:** clean up merge conflict files, re-apply fixes ([192cdb3](https://github.com/dallay/corvus/commit/192cdb3b7ade06ab2911042e870d7260eda6fdc4))
* **runtime:** address verified review regressions ([5d16d9f](https://github.com/dallay/corvus/commit/5d16d9f9b89d08785dd7b7dda97b6d1f4cadd482))
* **runtime:** allow staged dream re-exports ([7732cad](https://github.com/dallay/corvus/commit/7732cad7758f5d3482ff915716aa9f82d5f252e6))
* **runtime:** refine cost warning and estimation diagnostics ([6a19a63](https://github.com/dallay/corvus/commit/6a19a6367cf5edf4f157678459c0dd18aa169b5d))
* **runtime:** satisfy orchestration clippy gates ([a170a86](https://github.com/dallay/corvus/commit/a170a8604858daef5ca564796fc30aa74d788352))
* **runtime:** satisfy orchestration lint gates ([4ec0078](https://github.com/dallay/corvus/commit/4ec007806c17d2190ae701c2bac07a339ebf850a))
* **rust:** format observability security alert cleanup ([82fbb73](https://github.com/dallay/corvus/commit/82fbb7372aa22c24ab199c7449c08feca0dbd9b3))
* **security:** block URL-encoded policy bypasses ([cdc34be](https://github.com/dallay/corvus/commit/cdc34bec398371d30931e3b54fb2a854ec946c90))
* **security:** block URL-encoded policy bypasses ([9efd810](https://github.com/dallay/corvus/commit/9efd81037697e4c9286f213005bbac67b8fa6e97))
* **security:** format encoded bypass coverage ([31226ae](https://github.com/dallay/corvus/commit/31226aefb049ca4801077ed365aaf07821174451))
* **security:** neutralize critical code scanning alerts ([0d33552](https://github.com/dallay/corvus/commit/0d335522d0f46bcfb49a50423f10578e67dbb1ef))
* **security:** prevent path validation bypass via command flags ([#516](https://github.com/dallay/corvus/issues/516)) ([a2e511b](https://github.com/dallay/corvus/commit/a2e511bf9ce8e87bca7dc90b9c60e231f6615dec))
* **sonar:** resolve monthly code quality findings ([#475](https://github.com/dallay/corvus/issues/475)) ([1099e65](https://github.com/dallay/corvus/commit/1099e659814c2dfcbb78051b82f39f4b88469699))
* **test:** update slash-session tests to use SqliteMemory and fix service.rs issues ([fe13190](https://github.com/dallay/corvus/commit/fe1319070ace3110287615f2403b444894bf80fd))
* **tooling:** add local sonar review workflow ([70fee4e](https://github.com/dallay/corvus/commit/70fee4e2d27bcfd4a2a0d33d97ad993f1dd13c56))
* **tooling:** add local sonar review workflow ([929695b](https://github.com/dallay/corvus/commit/929695b58b13000809e0233a197243fd22e514cb))
* **tooling:** address review follow-ups ([cb6da04](https://github.com/dallay/corvus/commit/cb6da0404a471b88b93c0a9439ef4103236ac014))
* verify findings from track-4-slice-1 verify-report ([0ef9b53](https://github.com/dallay/corvus/commit/0ef9b53bd2f9412f5eee55b623d6db7d5cc97b91))
