## GoogleCloudPlatform/scion — nightly-20261003…nightly-20261004

_72 commits._

### Features
- **feat: per-runtime and per-profile shared_dir_storage backend override (#2393)** (6967374)
- **feat(hub): utc-timestamp-normalize maintenance migration (tz-refactor task 6) (#2403)** (be5f48a)
- **feat(cli): workspace mode on hub project create + empty-per-agent docs (#2409)** (e5f7fd4)
- **feat(web): Empty directory per agent workspace type (#2397)** (26846c9)
- **hub: add view=compact to the agent list endpoints (#2396)** (2963e4a)
- **feat(k8s): opt-in safe_to_evict setting for agent pods (#2380)** (c0a6914)
- **feat(cli): always show a zone in CLI times; add --tz and --utc (tz-refactor task 22) (#2377)** (a698659)
- **feat(web): configure-page Timezone row, pin and unpin (tz-refactor task 17) (#2387)** (80bbd63)
- **feat(sciontool): doctor transport diagnostics; reset-auth transport credential; surface refresh mint failures (#2382)** (e21da4f)
- **feat(broker): empty-per-agent workspace provisioning for non-git projects (#2390)** (4021538)
- **feat(hub): add applied-config-tz-cleanup maintenance migration (tz-refactor task 18) (#2388)** (1d54d97)
- **Add the Substrate runtime and in-cluster broker deployment (#2376)** (aed3994)
- **feat(web): template-aware Create Project dialog (#2371)** (0ce981e)
- **feat: add route authorization manifest and CI check (#1615)** (8643835)
- **feat: add setenv-guard lint check (#1612)** (0eb0a72)
- **feat(harness): declarative thinking block plumbing and resolve_thinking helper (#2342)** (bc13560)
- **feat(authz): grant agent.port_access to project owners and admins (#2379)** (e8eea66)
- **feat(hub): empty-per-agent workspace mode for non-git projects (store + hub) (#2365)** (6f12858)
- **feat(web): add Jump to agent to the agent graph views (#2361)** (efd758e)
- **feat(hub): wire the agent TZ resolver, ExplicitTimezone writers and PATCH timezone response (tz-refactor task 16b) (#2344)** (9849111)
- **feat(k8s): set shared-dir PVC storage class and size on a runtime or profile (#2324)** (29d0bea)

### Fixes
- **fix(web): reload chat preview image after reconnect (#2343)** (1604e2b)
- **fix(config): refresh provisioner scripts on non-force harness-config seeding (#2405)** (102cb9f)
- **fix(web): dispatch tier-aware maintenance operation from server config page (#2350)** (b6cdb87)
- **fix(cmd): guarantee one backfill project per boot; deflake budget test (#2383)** (1b1162d)
- **fix(hub): message pipeline correctness bundle (ptone/scion#2738) (#2370)** (98ad14c)
- **fix(hub): re-derive git source labels when clone overrides gitRemote (#2368)** (b6a6580)
- **fix(hub): store and read webchat times in UTC (tz-refactor task 3) (#2289)** (8ab2e62)
- **fix(web): format admin and access-boundary views through time.ts (tz-refactor task 20) (#2373)** (236996f)
- **fix(web): format log viewers, chat and file browser through time.ts (tz-refactor task 21 part a) (#2374)** (04d49ae)
- **fix(sciontool): share refreshed hub transport credential with in-agent clients (#2347)** (fb3c7d5)
- **fix(web): format lists and relative times through time.ts (tz-refactor task 19) (#2357)** (169a5e0)
- **fix(web): allow clearing string settings in file mode (#2332)** (fe95529)
- **fix(k8s): stage secret and auth files outside the agent home (#2352)** (b53b17b)
- **fix(hub): authorize project stop-all from role bindings (#2334)** (bbbb79f)
- **perf(hub): reuse authorization inputs across list requests (#2341)** (2220c46)
- **fix(sciontool): guard log init and debug state against races (#2317)** (10e5527)
- **fix(hub): sandbox agent port-forward proxy responses on the hub origin (#2340)** (a655d7e)

### Backend
- **runtimebroker: assign via Workload Identity on Kubernetes (#2364)** (eb164b8)
- **conduit: session registry (relay_instances, conduit_sessions, principal epochs) (#2404)** (acd14fc)
- **auth: gate user access tokens on boundary and live authority; mint hub-bound tokens (#2407)** (f261ebe)
- **conduit: proto/conduit/v1 wire frames and pkg/conduit session library (Phase 1a) (#2401)** (893343d)
- **cli: wait for a 202 agent delete before local cleanup (ptone/scion#2483 phase 1a-3) (#2399)** (e323452)
- **hub: record agent authority provenance and apply frozen delegation ceilings (#2355)** (3b38ad4)
- **hub: agent delete engine with 202, failure markers and single-tx finalize (ptone/scion#2483 phase 1a-2) (#2391)** (bfd473a)
- **hub,runtime: reserve scion control-plane env/metadata targets and make the hub the authoritative metadata-mode source (#2372)** (48335b3)
- **hub: clear failed delete marker before the reincarnation completion write (fixes main flake) (#2394)** (c07d6a4)
- **hub: list every agent in chat space members, aligned with agent list authz (#2389)** (ea6dbf2)
- **hub(authz): stop copying Project.OwnerID into the project members group owner (#2369)** (0af2427)
- **hub: resolve @mentions and messaging targets beyond the first agent page (#2295)** (72c2dee)
- **changelog: daily entry 2026-10-01 (#2268)** (b8735e7)
- **agent: resolve GitHub skill refs with bounded parallelism (#2353)** (6502e87)
- **hub, store: agent delete guards and start gate (phase 1a-1) (#2351)** (bda404d)
- **broker: reconcile NFS mounts for the shared directory backend (#2356)** (f2321aa)
- **T1 async agent create: runtime hooks (P1b-2) (#2359)** (047f15d)
- **runtime(k8s): remove agent Secrets on delete when the pod is already gone (#2354)** (0a90154)

### Tests
- **test(hub): skip the headless browser test under an address-space cap (#2385)** (79e71aa)
- **test(runtimebroker): stop the env-flag downgrade test resolving a real cluster (#2386)** (18cd8a5)
- **test(hub): make rename-exchange GET and ConfigDelete leaf-reach proofs deterministic (#2363)** (7ea9acf)
- **test(hub): make rename-exchange PUT race test's leaf-reach proof deterministic (#2362)** (1dddb90)
- **test(hub): abort the test binary when its memory runs away (#2367)** (61c5b14)
- **test(sciontool): stop the reaper test racing later git helpers (#2311)** (db688ba)
- **test(provision): deflake heartbeat lock reclaim test (#2280)** (635bbd0)
- **test(harness): reject built-in aliases that resolve to another alias (#2270)** (87fe8c6)

### Docs
- **docs(skills): require structured markdown in agent messages (#2411)** (0fbfce3)
- **docs: nightly update for 2026-10-02 changelog (#2366)** (166b5fb)

### Chore
- **ci: Phase 0 CI offload — full suite off PRs, per-PR concurrency, single-node-vm path gate, fold Lint 405 (#2402)** (28dff04)
- **build: add make time-literals regression gate (tz-refactor task 5) (#2395)** (2aac24a)
- **ci: make check-annotation-prefix scan the repo, not CI's stdin (#2392)** (eac359c)
- **refactor(hub): typed governance denials for member removal, ownership transfer and project deletion (#2375)** (5d2470b)
- **chore: update LATEST.json for nightly-20261003 (#2346)** (c8074b0)
- **refactor(hub): members-multirole cleanup (shared refusals, shared per-role decision, single built-in role list) (#2338)** (dc21d86)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/GoogleCloudPlatform/scion?utm_source=github-action)._