## zeroclaw-labs/zeroclaw — v0.8.3…v0.8.4

_263+ commits._

### Features
- **feat(cron): add shell_output_format config for raw stdout output (#8438)** (449ce61)
- **feat(sop): centralize fan-in ingress adapters (#9205)** (bec32b3)
- **feat(providers): carry model context window from the models.dev catalog (#9347)** (cd74143)
- **feat(acp): accept resource.blob in prompts and add deliver_file with citation uri (#9195)** (72c2903)
- **feat(zerocode): add searchable keybinding help (#9356)** (807d032)
- **feat(gateway): add LAN peer discovery hints (#8325)** (344a158)
- **feat(runtime): surface model fallback notice on direct-turn surfaces (#8684)** (bf56271)
- **feat(obs): nest memory and RAG spans under the turn trace (#8752)** (43605e4)
- **feat(release): add broad-channel measurement builds (#9174)** (13b3df9)
- **feat(skills)!: replace built-in ClawHub source with git-catalog --skill selector (#8638)** (2efdf9d)
- **feat(zerocode): show active runtime context in dashboard (#9011)** (2206edd)
- **feat(channel/mattermost): add WebSocket listener mode (#9141)** (0de7f34)
- **feat(sop): channel gate prompts with checkpoint edit and revise for deterministic pipelines (#8979)** (bf5a97f)
- **feat(web-search): classify provider HTTP failures with precise search_status (#5316) (#8890)** (d7220e7)
- **feat(memory): gated rerank stage in engine memory-context injection (#8895)** (3520034)
- **feat(sop): add an approval broker with group membership and quorum over the gate chokepoint (#8880)** (c38c5cf)
- **feat(sop): release the exec slot on HITL approval and enforce a per-SOP admission policy (#8848)** (c937cdf)
- **feat(web): unify risk-profile tool permissions into one grid (#8879)** (e735beb)
- **feat(memory): scan memory content at write and recall boundaries (#8984)** (cf7dd9d)
- **feat(memory): config semantics validation and migration reindex hook (#8899)** (b98b1c5)

### Fixes
- **fix(tests): make updater fixtures portable on Windows (#9482)** (19de521)
- **fix(cli): normalize wildcard browser hints (#9364)** (ca99c00)
- **fix(deps): update nostr-relay-pool for RUSTSEC-2026-0224 (#9622)** (cc92c86)
- **fix(log): preserve JSONL rows during schema migration (#9449)** (fb0ab6e)
- **fix(zerocode): measure picker modals by display width (#9279)** (b119cc0)
- **fix(zerocode): keep session picker scroll offset for mouse hit-testing (#9292)** (e5756d7)
- **fix(config): warn when WhatsApp Web chat policies cannot take effect (#9354)** (5a7451b)
- **fix(channels): skip enabled Signal/Voice Call channels missing required credentials (#9524)** (246f8e3)
- **fix(providers): propagate Responses usage (#9360)** (404c3e4)
- **fix(web): keep sidebar selection mutually exclusive (#9294)** (9c35ea7)
- **fix(runtime/security): allow various devices and files on landlock sandbox (#9114)** (0b8d9cb)
- **fix(robot-kit): bound TTS and audio playback subprocess waits (#9087)** (ea76e14)
- **fix(containers): serialize shared Cargo caches (#9369)** (c1eba0e)
- **fix(doctor): persist model catalog to cache on models refresh** (baa1f20)
- **fix(security): waive RUSTSEC-2026-0222 (wasmtime) in audit and deny ignores (#9586)** (3adee9a)
- **fix(tools): stop ask_user hangs on wrong/structured-only channels (#9452)** (f4789d9)
- **fix(tools): strip Windows verbatim prefix before handing paths to external grep (#9497)** (7d68ebc)
- **fix(channels): resolve aliases for one-off sends (#9495)** (05bc8c4)
- **fix(runtime): scope peer-agent turns to the recipient's cost context (#9469)** (54175bb)
- **fix(mcp): multiplex stdio calls without replaying unknown outcomes (#9418)** (1e99541)
- **fix(config): default context_compression.enabled to false and warn on the inert surface (#9299)** (f91b2e1)
- **fix(sop): recover fenced/prose-wrapped JSON in step outputs (#9375)** (ea2b152)
- **fix(config): emit json envelopes for patch missing-value and coercion errors (#9296)** (cdfb6ee)
- **fix(config): make test env guard portable on Windows (#9414)** (e362084)
- **fix(log): propagate explicit flush failures (#9500)** (f99a37d)
- **fix(channels): send Nextcloud Talk replies via the signed bot API (#9181)** (08a41d6)
- **fix(channels): satisfy clippy::question_mark for matrix media source (#9541)** (3d3e55e)
- **fix(docs): clear final rustdoc warning tail (#9502)** (10104f1)
- **fix(docker): copy nested plugin fixture manifest in pre-fetch stage (#9528)** (e5b99da)
- **fix(deps): bump nostr to 0.44.6 for RUSTSEC-2026-0219 (#9531)** (a16be78)
- **fix(tests): scope lifecycle observer test ordering to the target agent (#9522)** (d0f4485)
- **fix(runtime): close run() agent-lifecycle bracket on every exit path (#9490)** (04af7b8)
- **fix(tests): make CLI outside-workspace fixtures portable (#9467)** (14d6642)
- **fix(providers): send string tool-call content for Cloudflare Workers AI (#9493)** (3a9b1f7)
- **fix(web): render reasoning-only turns instead of hanging silently (#9234)** (295bbae)
- **fix(plugins): preserve detail and hint at wit/v0 drift on plugin instantiation failures (#9461)** (ec321cd)
- **fix(tests): use a bounded wait for the client count instead of fixed sleeps (#9475)** (d81d82b)
- **fix(macros): report invalid integration status fields (#9446)** (c7e8982)
- **fix(config): keep unknown-property sentinel matching typed (#9445)** (adc02de)
- **fix(runtime): reject non-file absolute shell paths (#9441)** (c3d5b16)
- **fix(memory): clear Windows Clippy blockers (#9437)** (97e09de)
- **fix(policy): retain actions when cutoff underflows (#9448)** (9695763)
- **fix(tests): make SOP checkpoint error assertion portable (#9455)** (62dd1ac)
- **fix(docs): preserve placeholders through mdBook rendering (#9407)** (cad5ca6)
- **fix(observability): pair display markers in order (#9412)** (7911cc8)
- **fix(tests): keep channel regression within Windows stack (#9439)** (e3092c5)
- **fix(tests): stop wall-clock guards in channels tests asserting scheduling (#9442)** (2764edc)
- **fix(tests): classify integration tests by path component in config-save gate (#9298)** (02d5e14)
- **fix(channels/matrix): resolve single transcription provider like other channels (#9153)** (7745bae)
- **fix(providers): preserve native tool pairs on context retry (#9372)** (53129fc)
- **fix(tests): isolate heartbeat MCP registry hooks (#9411)** (4340a54)
- **fix(cli): show feedback for secret prompts (#9164)** (52aa6c1)
- **fix(deps): update nostr to 0.44.5 (#9450)** (9204508)
- **fix(plugins): keep channel listener under supervision (#9125)** (e283e1a)
- **fix(plugins): host-stamp channel plugin routes (#9123)** (6d01904)
- **fix(web/deps): resolve npm audit advisories (#9270)** (14abce7)
- **fix(runtime): isolate model switches per turn (#9232)** (9dd4bca)
- **fix(config): propagate nested set_prop value errors instead of masking as unknown property (#9310)** (cf36b75)
- **fix(vi): fail closed when a constraint subject is absent from the fulfillment (#9327)** (86d9719)
- **fix(tests): make native dispatcher path assertions portable (#9257)** (4ae0d75)
- **fix(runtime): native tools shadow same-named plugin tools (#8851)** (05780f4)
- **fix(runtime/security): prevent Landlock from restricting ZeroClaw itself (#9233)** (f6d924d)
- **fix(delegate): skip global credential fallback for OAuth target providers (#8571)** (41432c4)
- **fix(config): create map aliases in config init and exclude resource keys from map-key writes (#9243)** (1610087)
- **fix(runtime): serialize RPC config writes so a flush can't erase concurrent updates (#9312)** (46e9d08)
- **fix(runtime/agent): authorize registered power-tool attempts at full risk level (#6619)** (a395f85)
- **fix(config): save_dirty resolves map keys containing dots (#9297)** (c19dd93)
- **fix(config): keep partial channel aliases through salvage instead of dropping them (#9309)** (441954c)
- **fix(channels): propagate the triggering msg_id on QQ group replies (#9180)** (69a9686)
- **fix(web): buffer ACP thought chunks (#9209)** (d88c768)
- **fix(release): repair package publishing workflows (#9295)** (92be9d3)
- **fix(plugins): restore WIT logging action parity (#9258)** (208091c)
- **fix(memory): allow Lucid ARM cold starts, make timeouts configurable (#9105)** (ba24fb4)
- **fix(zerocode): time out stalled daemon initialization (#9169)** (7ea253e)
- **fix(providers): add idle read_timeout to streaming HTTP clients (#9113)** (d444e62)
- **fix(config): LocalWhisperConfig::default reuses serde defaults (#8718) (#8751)** (108c18f)
- **fix(zerocode): theme the TodoWrite tracker panel (#9008)** (b7e0556)
- **fix(tests): make media marker assertions portable on Windows (#8756)** (f0b92f1)
- **fix(docs): make translation refresh reproducible (#9055)** (abb3c42)
- **fix(sop): bypass switch evaluation on a false top-level when guard (#9183)** (7b0ecea)
- **fix(channels): clear branch-isolated clippy warnings (#9140)** (33499a3)
- **fix(channels): bound ffmpeg transcode waits (#9145)** (cf4bb01)
- **fix(quickstart): map WhatsApp Web setup to WhatsApp config (#9159)** (2110eab)
- **fix(config): treat whitespace-only model_provider as non-dispatchable (#8324)** (bc66a1c)
- **fix(acp): log agent init failure on session/new (#9071)** (ac6274a)
- **fix(channels): route startup tool assembly through the scoped seam (#8830)** (e26e14e)
- **fix(sop): notify approval routes after durable checkpoint parking (#8903)** (fa57802)
- **fix(agent): preserve Gemini thought signatures in tool-call history (#8935)** (b6a09fe)
- **fix(providers/multimodal): degrade unplayable audio markers before dispatch (#9102)** (1247d10)
- **fix(providers): make model vision capability configurable (#9099)** (fc22104)
- **fix(sop): re-assemble the step agent's policy on the live nested-step path (#9030)** (c249473)

### Tests
- **test(memory): harden Lucid process timing fixtures (#9540)** (653e3de)
- **test(updater): isolate web-dist resolver tests from host install state (#9608)** (234fc97)
- **test(runtime): isolate safety-net test workspaces (#9367)** (0a4077d)
- **test(auth): cover legacy auth-profile store load end to end (#9513)** (6419c02)
- **test(runtime): recover zeroclaw_root_crate-gated tests in service and integrations (#9489)** (b70d224)
- **test(cron): retire dormant zeroclaw_root_crate cron test module (#9491)** (3dbe081)
- **test(plugins): add channel component fixture (#9124)** (f302366)
- **test(api): cover authenticated outcome, none auth method, and principal builder (#8272)** (4b6e9ea)
- **test(channels): route mirror coverage through production paths (#9261)** (f4b297e)

### Docs
- **docs(observability): document deterministic log pagination (#9342)** (51c4e7a)
- **docs(maintainers): fix dead SLSA provenance link in release-verification** (ddbeed2)
- **docs(security): document untrusted review input (#9542)** (18c36c4)
- **docs(channels): add end-to-end Telegram setup guide (#9242)** (bc262d1)
- **docs(providers): document MiniMax Anthropic-compatible endpoint (#9485)** (ca58ec9)
- **docs(plugins): warn that prebuilt binaries lack the plugin subcommand (#9406)** (6c39657)
- **docs(governance): retire the CONTRIBUTORS.md record and ground maintainer roles in FND-003 (#9388)** (f422a20)
- **docs(sop): clarify boolean condition comparisons (#8679)** (de1f5fc)
- **docs(contributing): add user-boundary proof matrix (#9264)** (82fc7f7)
- **docs(rustdoc): clear remaining warning links (#9260)** (3473b0f)
- **docs(book): fix audit policy link in agent guidelines (#9271)** (f75b36a)
- **docs(bedrock): Explain Bedrock credentials and systemd env setup (#8991)** (d6043f6)
- **docs(review): document typed dispatch expectation (#8770)** (8d74816)
- **docs(release): troubleshoot startup_failure and the Actions allowlist (#9096)** (e919124)

### Chore
- **chore(release): bump version to v0.8.4 (#9648)** (a56c345)
- **chore(deps): bump postcss from 8.5.15 to 8.5.23 in /web (#9343)** (2f31d33)
- **ci(tests): scope parallel runtime checks by crate (#9483)** (6a942e0)
- **ci(release): add MUSL measurement builds (#9286)** (a23f06c)
- **chore(deps): bump anchore/sbom-action to v0.24.0 (#9344)** (a7bbdc4)
- **refactor(agent): split history for before-llm-call hook — PR-A (behavioral-equivalence) (#9525)** (c11adaa)
- **ci(release): consolidate release attestations (#9211)** (53280a6)
- **ci(scoop): derive Windows asset name from the canonical manifest (#9466)** (51f3cc9)
- **chore(clippy): clear Rust 1.97 warnings (#9501)** (3fbcda9)
- **ci(tests): parallelize runtime stress gate (#9371)** (b8b720a)
- **chore(codeowners): retire WareWolf-MoonWall, delegate singlerider's former areas to tidux, scope Nillth to the Git forge channel (#9358)** (3cb4ad1)
- **chore(deps): bump stagex/core-filesystem from `cd3a664` to `da28831` (#9301)** (707b005)
- **refactor(runtime): remove redundant delivery lookup (#9280)** (f5700e4)
- **ci(dependabot): monitor web npm updates (#9269)** (02c4f0b)
- **chore(firmware): share protocol parsing with ESP32 (#8447)** (a5763ce)
- **refactor(providers): adopt typed builders across the provider crate (#8854)** (7afecd8)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/zeroclaw-labs/zeroclaw?utm_source=github-action)._