## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - The release pipeline keeps a canonical stable note at
`releases/vX.md` on master for every published stable.
> - Stable `2026.831.1` was a hotfix cut from a branch off
`v2026.831.0`, with its notes committed into the source tree.
> - In that path the workflow resolves notes in `source_tree` mode and
skips `canonicalize_stable_notes`, which is the job that normally copies
the note to master.
> - As a result `releases/v2026.831.1.md` exists on the tag but never
landed on master, so the stable-notes history has a gap.
> - This pull request adds the canonical copy of that note to master.
> - The benefit is a complete, consistent stable-notes history for
readers and for the release tooling.
## Linked Issues or Issue Description
No separate issue. Describing the gap in-PR with the docs template
fields:
**Issue type**
Documentation gap in the release-notes history on master.
**Where is the issue?**
`releases/` on the master branch — the file `releases/v2026.831.1.md` is
missing, although the stable `2026.831.1` release has already published.
**What's wrong?**
The `2026.831.1` patch was published from a hotfix branch whose notes
lived in the source tree (`source_tree` notes mode). That mode skips
`canonicalize_stable_notes`, the job that copies a stable's note onto
master. So every other stable has a `releases/vX.md` on master, but
`2026.831.1` does not.
**Suggested fix**
Add the canonical `releases/v2026.831.1.md` to master, identical to the
copy published with the tag.
## What Changed
- Add `releases/v2026.831.1.md` to master, copied verbatim from the
published `v2026.831.1` tag.
## Verification
- `diff` of the added file against `git show
v2026.831.1:releases/v2026.831.1.md` is empty (identical to the shipped
note).
- Docs-only change: no code, tests, or build outputs are affected.
## Risks
- Low risk. The change adds one Markdown file and touches no code,
schema, or configuration.
## Model Used
- Claude (Anthropic), model id `claude-fable-5` (Claude Fable 5), used
with tool use, shell commands, and file editing.
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - The release process drafts stable notes under a beta-keyed path
during the soak and renames them to the versioned path after the stable
ships
> - Stable v2026.831.0 published, but its release run failed at the tag
push (workflows-permission error), so the automated canonicalize job
never ran
> - The canonical layout requires the notes at `releases/v2026.831.0.md`
> - This pull request performs the rename the skipped job would have
pushed
> - The benefit is that the repository returns to the canonical
release-notes layout
## Linked Issues or Issue Description
**Issue type**
Missing content
**Where is the issue?**
`releases/` — the stable notes for v2026.831.0 still live at the
beta-keyed path `releases/beta/v2026.828.0-beta.0.md`.
**What's wrong?**
The stable release run failed at the tag push, so the
`canonicalize_stable_notes` job was skipped and the rename branch was
never pushed. The published GitHub Release points at content that should
live at `releases/v2026.831.0.md`.
**Suggested fix**
`git mv releases/beta/v2026.828.0-beta.0.md releases/v2026.831.0.md`,
exactly as the workflow's canonicalize job does.
## What Changed
- Renamed `releases/beta/v2026.828.0-beta.0.md` to
`releases/v2026.831.0.md` (pure rename, no content changes)
## Verification
- `git show --stat` reports a 100% rename with no content delta
- The file matches the published GitHub Release body for v2026.831.0
## Risks
- Low risk: a pure file rename restoring the canonical layout.
## Model Used
- Claude (Anthropic), model ID `claude-fable-5` (Claude Fable 5),
extended thinking enabled, tool use via Claude Code
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - The release process promotes a soaked beta to stable; the stable's
GitHub Release body comes from `releases/beta/v<beta-version>.md` on
`master`
> - The `draft_stable_notes` job seeded this file as a raw commit-log
skeleton when `2026.828.0-beta.0` published
> - The stable preflight fails without the merged file, and the skeleton
is not fit to publish as release notes
> - This pull request rewrites the skeleton into finished stable notes
for the v2026.831.0 promotion
> - The benefit is that the stable release ships with accurate,
readable, user-facing notes on time
## Linked Issues or Issue Description
**Issue type**
Missing content
**Where is the issue?**
`releases/beta/v2026.828.0-beta.0.md` — the drafted stable-notes
skeleton for the `2026.828.0-beta.0` soak.
**What's wrong?**
The file holds the auto-generated skeleton (grouped commit subjects with
nested PR summaries). The stable promotion publishes this file verbatim
as the GitHub Release body, so it must be rewritten into release-notes
voice before the stable dispatch.
**Suggested fix**
Rewrite the skeleton at full stable depth per
`.agents/skills/release-changelog/SKILL.md`: verified breaking changes
with upgrade paths, delta-aware highlights, grouped improvements and
fixes with inline PR attribution, an upgrade guide covering migrations
and new environment variables, and a contributors section.
## What Changed
- Rewrote `releases/beta/v2026.828.0-beta.0.md` from the generated
skeleton into finished notes titled `# Paperclip v2026.831.0`
- Six breaking changes, led by the Node.js 24.11.0 minimum; each has an
upgrade path
- Five highlights: runtime skill delivery to agents, the Kimi Code
adapter, operator settings-visibility controls, the HTTP/2 sandbox
callback bridge, and the shortened onboarding arc
- Upgrade guide covers migrations `0223`–`0230` (each attributed from
its SQL) and the new `PAPERCLIP_HIDDEN_SETTINGS`,
`PAPERCLIP_SETTING_DEFAULTS`, `SENTRY_DSN`, and
`PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS` variables
- Entries already shipped to stable users in v2026.824.1 are noted as
such instead of re-announced
- Contributors section lists 7 verified community handles; core
maintainers and bots are excluded per the canonical list
## Verification
- Range verified as `664052f8e..dbf052577` (baseline v2026.824.1
merge-base to the `beta/v2026.828.0-beta.0` source commit); every entry
traces to a commit in that range
- Stable version confirmed with `./scripts/release.sh stable --date
2026-08-31 --print-version` → `2026.831.0`
- Migration list confirmed with `git diff --name-only
664052f8e..dbf052577 -- packages/db/src/migrations/` and each file's SQL
read at the source commit
- Environment variable names confirmed against
`docs/deploy/environment-variables.md` and source at `dbf052577`
- Contributor handles confirmed via `gh pr view <n> --json author` for
each attributed community PR
## Risks
- Low risk: a single markdown file; no source changes. The main risk is
a factual error in the notes — mitigated by verifying each claim against
the source commit rather than commit messages alone. If the promotion
date slips past 2026-08-31 UTC, the title needs a re-date (the
beta-keyed filename makes this harmless).
## Model Used
- Claude (Anthropic), model ID `claude-fable-5` (Claude Fable 5),
extended thinking enabled, tool use (git/GitHub CLI research against the
release range) via Claude Code
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Stable notes are drafted beta-keyed during the soak and published
verbatim as the GitHub Release
> - After the stable ships, the canonicalize job moves the file to its
durable home, releases/vYYYY.MDD.P.md
> - v2026.824.0 just shipped from the master-side beta notes, and the
job pushed this rename branch
> - This pull request lands that rename, keeping the stable-notes record
complete at the canonical path
> - The benefit is one canonical notes location per stable, with the
pinned shipped content
## Linked Issues or Issue Description
**What existing behavior does this improve?**
The `releases/` record on master after the v2026.824.0 promotion.
**Current behavior**
The shipped notes live at `releases/beta/v2026.818.0-beta.1.md`;
`releases/v2026.824.0.md` does not exist.
**Proposed behavior**
The file moves to `releases/v2026.824.0.md`, content pinned to the
revision the release read (machine-generated by the
`canonicalize_stable_notes` job).
**Reason and benefit**
The durable stable-notes invariant holds: every shipped stable has its
notes at `releases/vYYYY.MDD.P.md`.
## What Changed
- `git mv`-equivalent rename of the beta-keyed notes to
`releases/v2026.824.0.md`, exactly as the release published them.
## Verification
- Branch pushed by the release run's `canonicalize_stable_notes` job
(run 32806191945) from the preflight-pinned notes revision; the GitHub
Release v2026.824.0 body matches this content.
## Risks
- None; docs-only rename.
## Model Used
Claude Fable 5 (Claude Code) — PR opened for the machine-pushed branch;
a GITHUB_TOKEN-created PR would not run required checks.
## Pre-submission checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Stable versions date the promotion, and the promotion reads its
notes from master
> - The merged notes for beta 2026.818.0-beta.1 assumed an Aug 21
promotion; the beta soaked longer
> - This pull request re-dates the header to today's resolved version,
v2026.824.0
> - The benefit is a GitHub Release whose title, date, and body agree
## Linked Issues or Issue Description
**What existing behavior does this improve?**
The stable notes header for the promotion happening today.
**Current behavior**
`releases/beta/v2026.818.0-beta.1.md` is titled `# Paperclip
v2026.821.0`, `> Released: 2026-08-21`.
**Proposed behavior**
`# Paperclip v2026.824.0`, `> Released: 2026-08-24` — matching
`./scripts/release.sh stable --date 2026-08-24 --print-version`.
**Reason and benefit**
The file publishes verbatim as the GitHub Release body; the header
should match the version actually minted.
## What Changed
- Three header/intro lines re-dated. Nothing else.
## Verification
- `./scripts/release.sh stable --date 2026-08-24 --print-version` →
`2026.824.0`.
## Risks
- None; docs-only.
## Model Used
Claude Fable 5 (Claude Code)
## Pre-submission checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - The release channels promote a soaked beta to stable, and the
promotion reads the stable's release notes from
`releases/beta/v<beta-version>.md` on master
> - Beta `2026.818.0-beta.1` is soaking now, and the release workflow
auto-drafted its notes skeleton on this branch at publish time
> - This pull request rewrites that skeleton into the finished changelog
for the upcoming stable
> - The stable preflight fails without this file on master, so this PR
must merge before promotion day
> - The benefit is release notes reviewed during the soak instead of
written at the gate
## Linked Issues or Issue Description
**What existing behavior does this improve?**
The release-notes flow for the upcoming stable (planned `v2026.821.0`,
promoting beta `2026.818.0-beta.1`, source `664052f8e`).
**Current behavior**
The branch holds the machine-generated skeleton: grouped commit subjects
for the 172-commit range from v2026.817.0's content baseline
(`8f7b8b3fd`).
**Proposed behavior**
The finished changelog in the established release voice: verified
Breaking Changes, Highlights, Improvements, Fixes, an Upgrade Guide
covering migrations 0212–0222 and the new environment variables, and a
verified community contributor list.
**Reason and benefit**
Notes get real review during the soak; the promotion just reads the
merged file.
## What Changed
- Rewrite `releases/beta/v2026.818.0-beta.1.md` from skeleton to
finished notes. Headline themes: chat-style tasks as the default
experience, Tailscale HTTPS managed runtime exposure, sandbox capability
contract with live output streaming, in-product Claude/Codex sign-in,
chunked resumable company imports, and the completed release-channel
automation.
- Five verified breaking/behavior changes, including the
`enableTaskChatRedesign` → `enableClassicTaskInterface` toggle inversion
and migration `0218`'s conservative resolver-policy remap.
- Contributors: 172 commits from 32 non-bot authors; 22 verified
community handles listed (founders/core excluded per the canonical list;
4 authors omitted as unverifiable rather than guessed).
## Verification
- Every cited PR number resolves to a commit subject in the range.
- No internal ticket identifiers.
- Handles verified via noreply emails, co-author trailers, or `gh api
users/<name>`.
- The version/date header says the planned promotion (`v2026.821.0`,
2026-08-21); if promotion slips, only that header needs a touch-up — the
beta-keyed filename is date-independent.
## Risks
- Docs-only. If a newer beta supersedes `2026.818.0-beta.1` before
promotion, this file stays as history and the new beta gets its own
draft.
## Model Used
Claude Fable 5 (Claude Code)
## Pre-submission checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Stable release notes live at `releases/vYYYY.MDD.P.md` on master as
the durable record
> - v2026.817.0 shipped from a candidate branch, so its notes file
exists on that branch and in the GitHub Release, but not yet on master
> - This pull request lands the exact shipped notes at the canonical
path
> - The benefit is a complete stable-notes record on master, and the
FULL RELEASE NOTES link in announcements resolves
## Linked Issues or Issue Description
**What existing behavior does this improve?**
The `releases/` record on master.
**Current behavior**
`releases/` on master ends at `v2026.722.0.md`. The v2026.817.0 notes
exist only on `candidate/release-2026.817.0` and in the published GitHub
Release.
**Proposed behavior**
`releases/v2026.817.0.md` exists on master, byte-identical to what the
release published.
**Reason and benefit**
Complete history at the canonical path; the standard notes link
(`releases/v2026.817.0.md` on master) resolves for the announcement.
## What Changed
- Add `releases/v2026.817.0.md`, taken verbatim from the candidate
branch the release was published from (tag `v2026.817.0`, commit
`213dabab4`).
## Verification
- `git diff v2026.817.0 -- releases/v2026.817.0.md` against this branch
is empty (byte-identical to the shipped file).
- Docs-only; no code surface.
## Risks
- None; docs-only. The candidate branch is deleted after this merges
(the `v2026.817.0` tag keeps its commits reachable).
## Model Used
Claude Fable 5 (Claude Code)
## Pre-submission checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
Release changelog for **v2026.720.0** (released 2026-07-20). Supersedes
#9612 (the 7/15 draft — that cut was never released, no `v2026.715.0`
tag exists).
Range is the full `v2026.707.0..master` — **195 commits from 16
contributors**.
## New since the 7/15 draft
- **Decision Training** — library + inspector, snapshot foundation,
decision image galleries
- **Built-in Summarizer & summary slots**
- **Skill organization** — nested folders, "My Skills",
import-from-project, open-by-default company skill policy (alongside
Skill Studio)
- **Issue monitor visibility** across task surfaces + issue properties
- **Reworked secrets dialog** with in-sheet per-agent access
- **Active PR-gardening workflow**
- Recovery / hot-restart / codex-auth reliability fixes and inbox/list
polish
No `BREAKING:` signals — DB migrations are additive and run
automatically (captured in the Upgrade Guide).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Release changelog — v2026.707.0
Generated with the `release-changelog` skill from the diff between
**v2026.626.0** (last stable tag) and **origin/master**.
- **Version:** `v2026.707.0` (release date 2026-07-07)
- **Range:** 89 commits from 8 contributors (bots + founders excluded
from the Contributors list per skill rules)
- **Breaking changes:** none (no `BREAKING` signals; migrations are
additive/idempotent)
- **File:** `releases/v2026.707.0.md`
Re-cut over the current `origin/master` — 4 new commits landed since the
prior draft (optional Ramp skill #9157, faster issue-detail payloads
#9125, Work Timeline actor-avatar fix#9152, iOS inbox archive-gesture
fix#9154). All four are founder-authored, so the contributor count is
unchanged; commit count is now 89.
Issue: PAP-12779
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Summary
Adds the stable release changelog for **v2026.626.0** (released
2026-06-26), generated via the `release-changelog` skill from the diff
between `v2026.618.0` (last stable) and `origin/master` — 122 non-merge
commits.
### Headline
- **Pipelines** — multi-stage workflow primitives + operator UI (#7903)
- **Task watchdogs** — automated task-watching control plane (#8339)
- **Ask work mode** — Q&A tasks without a full execution workflow
(#8334)
- **Conference Room** graduated to default (#8628)
- **Sandbox runtime status in threads** + Daytona lease reuse (#8594,
#8513)
- **Workspace file downloads & external object references** (#8512)
- **Built-in Hermes adapters** (#8543)
No breaking changes detected (DB migrations 0108–0124 are additive; the
`skills:create` permission rename is auto-backfilled).
### Notes
- Contributor list excludes the named founders (`cryppadotta`,
`devinfoley`, `scotttong`) and bots, per the skill. Internal staff
`@nickyleach` (paperclip.ing) is also excluded from the Contributors
roll-up but retained in PR attribution, matching the existing
founder-attribution pattern.
- File: `releases/v2026.626.0.md`
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Summary
Adds the user-facing stable release changelog for **v2026.609.0**
(released 2026-06-09), generated per
`.agents/skills/release-changelog/SKILL.md` from the diff between
`v2026.529.0` (last stable) and `origin/master` — 119 non-merge commits.
## Highlights covered
- Company Artifacts (page, task-stack grouping, playback, video
thumbnails)
- Collapsible sidebar rail and takeover panes
- Rich issue attachments with video
- Checkbox confirmation interactions
- Information Architecture refresh (experimental) + instance settings
under company settings
- Automated PR quality/security gates + low-trust review containment
## Notes
- No breaking changes — all 5 new migrations (0094–0098) are additive
(backfills, tombstones, annotation links, source-trust tagging, project
icon).
- Contributor list excludes founders and bots per skill rules.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Release changelog: v2026.529.0
Stable changelog for the **v2026.529.0** release (released 2026-05-29),
generated with the `release-changelog` skill.
- Range: `v2026.525.0..origin/master` — 11 squash-merged PRs
- Adds `releases/v2026.529.0.md`
- **No breaking changes** — migrations are additive (`CREATE TABLE IF
NOT EXISTS`); the only `DROP CONSTRAINT` lines are FK adjustments, not
data loss
- **No external contributors** this cycle — all PR authors are Paperclip
founders, who are excluded from the Contributors section per the skill,
so that section is omitted
### Highlights
- Inline document annotations and comments (#6733)
- Company skills CLI and catalog management (#6782)
- Hide projects and agents from your sidebar (#6677)
- First-admin claim flow for fresh self-hosted deployments (#6755)
- Live Claude model discovery (#6953)
### Improvements
- Bundled plugins now appear in the plugin manager (#6734)
- Tighter workspace lifecycle guarantees (#6969)
### Fixes
- Accepted plans decompose exactly once (#6831)
Docs-only (README brand/license #6810, #6804) and CI-only (#6967)
changes were excluded as not materially user-facing.
Issue: PAP-10155
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Summary
- Adds `releases/v2026.525.0.md` for the upcoming stable release
covering 32 commits since `v2026.517.0` (2026-05-17 → 2026-05-25).
- Highlights: Modal sandbox provider plugin, first-party workspace diff
viewer, routine env secrets, local Cloud Upstream sync, and ACPX-Claude
adapter polish.
- Categorized into Highlights / Improvements / Fixes with inline PR +
contributor attribution per the release-changelog skill.
## Source range
`v2026.517.0..origin/master` (ECE8A51E22 at time of cut).
## Verification
- Manual scan of `git log v2026.517.0..HEAD --no-merges` and merged-PR
titles since 2026-05-17.
- Confirmed no `BREAKING CHANGE:` / `feat!:` markers in the range (no
Breaking Changes / Upgrade Guide sections needed).
- DB migrations in range (`0086_routine_env_runtime_contract`,
`0087_backfill_environment_manage_human_defaults`,
`0088_backfill_principal_access_compatibility`, `0089_cloud_upstreams`)
are additive/backfill-only — none flagged as breaking.
- Contributor list excludes Paperclip founders (cryppadotta, devinfoley)
and bot accounts per skill rules.
## Test plan
- [ ] Reviewer eyeballs the changelog against the recent PR list.
- [ ] Reviewer confirms the highlight set is the right shipped subset.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the control plane for autonomous AI companies.
> - Stable releases need a reviewer-readable changelog artifact that
summarizes what changed for operators and contributors.
> - The last stable release tag is `v2026.513.0`, and the requested
release date is 2026-05-17.
> - The release changelog skill maps that date to stable version
`2026.517.0` and requires the range `v2026.513.0..origin/master`.
> - I reviewed the commits, PR metadata, migration/API surfaces, and
contributor attribution in that range.
> - This pull request adds the `releases/v2026.517.0.md` changelog for
human release sign-off.
> - The benefit is a stable release note artifact that is ready to
review before publishing the release.
## What Changed
- Added `releases/v2026.517.0.md` for the 2026-05-17 stable release.
- Summarized user-facing highlights, improvements, fixes, and
contributor attribution from `v2026.513.0..origin/master`.
- Omitted Breaking Changes and Upgrade Guide sections after checking for
destructive migrations, removed API surfaces, and breaking-change commit
signals.
## Verification
- `./scripts/release.sh stable --date 2026-05-17 --print-version` ->
`2026.517.0`.
- `git tag --list 'v*' --sort=-version:refname | head -10` confirmed
`v2026.513.0` is the latest stable tag.
- `git log v2026.513.0..origin/master --oneline --no-merges` reviewed
the 16 release-range commits.
- `git diff --name-only v2026.513.0..origin/master -- .changeset`
returned no changeset files.
- `git log v2026.513.0..origin/master --format='%s' | rg -n 'BREAKING
CHANGE|BREAKING:|^[a-z]+!:' || true` returned no breaking-change
signals.
- `git diff --name-only v2026.513.0..origin/master --
packages/db/src/migrations packages/db/src/schema server/src/routes
server/src/api server/src` reviewed the DB/API/server touchpoints; only
an additive document-lock migration appeared in the DB schema/migration
path.
- `test -f releases/v2026.517.0.md` passed.
- `rg -n -- '-canary|canary/' releases/v2026.517.0.md || true` returned
no canary filename/title language.
- `git diff --cached --check` passed before commit.
## Risks
- Low risk: docs-only release changelog addition.
- Changelog grouping is editorial; reviewers may want wording or
prioritization changes before release publication.
- Contributor attribution intentionally excludes bot accounts and
Paperclip founders from the Contributors section per the release
changelog skill.
> Checked [`ROADMAP.md`](ROADMAP.md); this is release documentation, not
new roadmap-level core feature work.
## Model Used
- OpenAI Codex, GPT-5 coding agent via Paperclip `codex_local`, with
shell, git, GitHub CLI, and repository file editing enabled. Exact
backend sub-version and context window were not surfaced by the
Paperclip runtime.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
## Summary
- Add `releases/v2026.513.0.md` covering the stable release range
`v2026.512.0..origin/master` (6 PRs).
- Includes one new DB migration (`0084_issue_recovery_actions`) under
the Upgrade Guide.
- No breaking changes detected; all PRs are core-maintainer commits so
the Contributors section is omitted.
## Highlights captured
- Source-scoped recovery actions
([#5599](https://github.com/paperclipai/paperclip/pull/5599))
- Blocked Inbox attention view
([#5603](https://github.com/paperclipai/paperclip/pull/5603))
- Local plugin development workflow
([#5821](https://github.com/paperclipai/paperclip/pull/5821))
## Test plan
- [ ] Reviewer confirms the highlight/improvement/fix categorization
matches release intent
- [ ] Reviewer confirms `0084_issue_recovery_actions` upgrade note is
accurate
- [ ] Reviewer signs off on `releases/v2026.513.0.md` for the stable
release cut
Generated under [PAP-9378](/PAP/issues/PAP-9378) via the
`release-changelog` skill.
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Summary
PR [#5366](https://github.com/paperclipai/paperclip/pull/5366) already
merged the v2026.511.0 changelog. This follow-up bumps the artifact to
the actual cut date and drops the pre-alpha sandbox work per maintainer
feedback.
- **Rename** `releases/v2026.511.0.md` → `releases/v2026.512.0.md`
- **Bump header / date** to `# v2026.512.0` / `> Released: 2026-05-12`
- **Drop new sandbox content** (pre-alpha, not yet ready):
- Daytona sandbox provider plugin highlight
([#5580](https://github.com/paperclipai/paperclip/pull/5580),
[#5586](https://github.com/paperclipai/paperclip/pull/5586))
- Cursor sandbox support improvement
([#4803](https://github.com/paperclipai/paperclip/pull/4803))
- Cursor sandbox runtime resolution fix
([#5446](https://github.com/paperclipai/paperclip/pull/5446))
- Sandbox provider messaging polish
([#4902](https://github.com/paperclipai/paperclip/pull/4902))
- **Add LLM Wiki plugin package highlight**
([#5716](https://github.com/paperclipai/paperclip/pull/5716)) — the
package itself landed on master after #5366 merged.
- **Update Upgrade Guide closer** to mention only the `cursor_cloud`
adapter as opt-in.
The `cursor_cloud` adapter is kept in (adapter, not sandbox). The
exe.dev and Cloudflare sandbox provider plugins that landed since the
merge are also excluded as pre-alpha.
No breaking changes; the nine new migrations (`0075`–`0083`) carry over
unchanged from the merged 511 file.
## Test plan
- [ ] Maintainer review of the dropped entries — confirm I caught
everything sandbox-related you wanted out
- [ ] Confirm Cursor Cloud adapter staying in is intentional (flag for
removal if not)
- [ ] Confirm LLM Wiki plugin package highlight phrasing
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Summary
- Adds the user-facing stable release changelog at
`releases/v2026.511.0.md`, generated per
[`.agents/skills/release-changelog/SKILL.md`](../blob/master/.agents/skills/release-changelog/SKILL.md)
from the 89 commits between `v2026.428.0` and `origin/master`.
- Surfaces nine headline themes: planning mode, full company search,
routine revision history, recovery system notices, expanded plugin host,
**secrets provider vaults + remote import**, **Cursor cloud adapter**,
**Daytona sandbox provider plugin**, and the ACPX local adapter — plus
categorized improvements/fixes.
- Documents nine new additive/idempotent migrations (`0075`–`0083`) in
the Upgrade Guide, including the `fuzzystrmatch` extension requirement
for company search and the `provider_config_id` text→uuid retype on
`company_secrets`.
Branch retains its `release/v2026.506.0` name to avoid PR churn; only
the artifact filename and content track the actual release date. Branch
was rebased onto current `origin/master` and force-pushed with a single
squashed commit.
No `BREAKING:` / `BREAKING CHANGE:` / `feat!:` signals across the full
range.
## Test plan
- [ ] Maintainer review of the draft changelog content for tone/scope
- [ ] Confirm the headline grouping reflects intended release messaging
- [ ] Confirm the migration list and upgrade guide match runtime
behavior
- [ ] Confirm the `0083` `provider_config_id` retype guidance is
acceptable for the release notes
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Summary
- Adds `releases/v2026.428.0.md` covering the diff between `v2026.427.0`
and `origin/master` (seven merged PRs).
- Generated via `.agents/skills/release-changelog/SKILL.md`.
- Flags the additive migrations `0071_default_hire_approval_off` and
`0072_large_sandman` plus the new-companies hire-approval default flip
in the upgrade guide.
## Notes
- Highlight: pause/resume actions in the sidebar agents panel
([#4616](https://github.com/paperclipai/paperclip/pull/4616)).
- Improvements: assigned-todo recovery dispatch, recovery issue
hardening, hire-approval opt-in default, inline selector keyboard
handling.
- Fixes: manual routine inbox visibility, stale company skill refresh
rejection, stale stored company-selection cleanup.
## Test plan
- [ ] Reviewer confirms section coverage and PR-to-bullet attribution.
- [ ] Confirm the file lands at \`releases/v2026.428.0.md\`.
- [ ] Confirm no canary suffix in title or filename.
Source issue: [PAP-2599](/PAP/issues/PAP-2599)
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip is the control plane for autonomous AI companies.
> - V1 needs to stay local-first while also supporting shared,
authenticated deployments.
> - Human operators need real identities, company membership, invite
flows, profile surfaces, and company-scoped access controls.
> - Agents and operators also need the existing issue, inbox, workspace,
approval, and plugin flows to keep working under those authenticated
boundaries.
> - This branch accumulated the multi-user implementation, follow-up QA
fixes, workspace/runtime refinements, invite UX improvements,
release-branch conflict resolution, and review hardening.
> - This pull request consolidates that branch onto the current `master`
branch as a single reviewable PR.
> - The benefit is a complete multi-user implementation path with tests
and docs carried forward without dropping existing branch work.
## What Changed
- Added authenticated human-user access surfaces: auth/session routes,
company user directory, profile settings, company access/member
management, join requests, and invite management.
- Added invite creation, invite landing, onboarding, logo/branding,
invite grants, deduped join requests, and authenticated multi-user E2E
coverage.
- Tightened company-scoped and instance-admin authorization across
board, plugin, adapter, access, issue, and workspace routes.
- Added profile-image URL validation hardening, avatar preservation on
name-only profile updates, and join-request uniqueness migration cleanup
for pending human requests.
- Added an atomic member role/status/grants update path so Company
Access saves no longer leave partially updated permissions.
- Improved issue chat, inbox, assignee identity rendering,
sidebar/account/company navigation, workspace routing, and execution
workspace reuse behavior for multi-user operation.
- Added and updated server/UI tests covering auth, invites, membership,
issue workspace inheritance, plugin authz, inbox/chat behavior, and
multi-user flows.
- Merged current `public-gh/master` into this branch, resolved all
conflicts, and verified no `pnpm-lock.yaml` change is included in this
PR diff.
## Verification
- `pnpm exec vitest run server/src/__tests__/issues-service.test.ts
ui/src/components/IssueChatThread.test.tsx ui/src/pages/Inbox.test.tsx`
- `pnpm run preflight:workspace-links && pnpm exec vitest run
server/src/__tests__/plugin-routes-authz.test.ts`
- `pnpm exec vitest run server/src/__tests__/plugin-routes-authz.test.ts
server/src/__tests__/workspace-runtime-service-authz.test.ts
server/src/__tests__/access-validators.test.ts`
- `pnpm exec vitest run
server/src/__tests__/authz-company-access.test.ts
server/src/__tests__/routines-routes.test.ts
server/src/__tests__/sidebar-preferences-routes.test.ts
server/src/__tests__/approval-routes-idempotency.test.ts
server/src/__tests__/openclaw-invite-prompt-route.test.ts
server/src/__tests__/agent-cross-tenant-authz-routes.test.ts
server/src/__tests__/routines-e2e.test.ts`
- `pnpm exec vitest run server/src/__tests__/auth-routes.test.ts
ui/src/pages/CompanyAccess.test.tsx`
- `pnpm --filter @paperclipai/shared typecheck && pnpm --filter
@paperclipai/db typecheck && pnpm --filter @paperclipai/server
typecheck`
- `pnpm --filter @paperclipai/shared typecheck && pnpm --filter
@paperclipai/server typecheck`
- `pnpm --filter @paperclipai/ui typecheck`
- `pnpm db:generate`
- `npx playwright test --config tests/e2e/playwright.config.ts --list`
- Confirmed branch has no uncommitted changes and is `0` commits behind
`public-gh/master` before PR creation.
- Confirmed no `pnpm-lock.yaml` change is staged or present in the PR
diff.
## Risks
- High review surface area: this PR contains the accumulated multi-user
branch plus follow-up fixes, so reviewers should focus especially on
company-boundary enforcement and authenticated-vs-local deployment
behavior.
- UI behavior changed across invites, inbox, issue chat, access
settings, and sidebar navigation; no browser screenshots are included in
this branch-consolidation PR.
- Plugin install, upgrade, and lifecycle/config mutations now require
instance-admin access, which is intentional but may change expectations
for non-admin board users.
- A join-request dedupe migration rejects duplicate pending human
requests before creating unique indexes; deployments with unusual
historical duplicates should review the migration behavior.
- Company member role/status/grant saves now use a new combined
endpoint; older separate endpoints remain for compatibility.
- Full production build was not run locally in this heartbeat; CI should
cover the full matrix.
## Model Used
- OpenAI Codex coding agent, GPT-5-based model, CLI/tool-use
environment. Exact deployed model identifier and context window were not
exposed by the runtime.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
Note on screenshots: this is a branch-consolidation PR for an
already-developed multi-user branch, and no browser screenshots were
captured during this heartbeat.
---------
Co-authored-by: dotta <dotta@example.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## Thinking Path
> - Paperclip is the control plane for autonomous AI companies, and
stable releases need a clear changelog artifact for operators upgrading
between versions.
> - The release-note workflow in this repo stores one stable changelog
file per release under `releases/`.
> - `v2026.410.0` and `v2026.413.0` were intermediate drafts for the
same release window, while the next stable release is `v2026.416.0`.
> - Keeping superseded draft release notes around would make the stable
release history noisy and misleading.
> - This pull request consolidates the intended content into
`releases/v2026.416.0.md` and removes the older
`releases/v2026.410.0.md` and `releases/v2026.413.0.md` files.
> - The benefit is a single canonical stable release note for
`v2026.416.0` with no duplicate release artifacts.
## What Changed
- Added `releases/v2026.416.0.md` as the canonical stable changelog for
the April 16, 2026 release.
- Removed the superseded `releases/v2026.410.0.md` and
`releases/v2026.413.0.md` draft release-note files.
- Kept the final release-note ordering and content as edited in the
working tree before commit.
## Verification
- Reviewed the git diff to confirm the PR only changes release-note
artifacts in `releases/`.
- Confirmed the branch is based on `public-gh/master` and contains a
single release-note commit.
- Did not run tests because this is a docs-only changelog update.
## Risks
- Low risk. The change is limited to release-note markdown files.
- The main risk is editorial: if any release item was meant to stay in a
separate changelog file, it now exists only in `v2026.416.0.md`.
## Model Used
- OpenAI GPT-5 Codex, model `gpt-5.4`, medium reasoning, tool use and
code execution in the Codex CLI environment.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - The board depends on issue, inbox, cost, and company-skill surfaces
to stay accurate and fast while agents are actively working
> - The PAP-1497 follow-up branch exposed a few rough edges in those
surfaces: stale active-run state on completed issues, missing creator
filters, oversized issue payload scans, and placeholder issue-route
parsing
> - Those gaps make the control plane harder to trust because operators
can see misleading run state, miss the right subset of work, or pay
extra query/render cost on large issue records
> - This pull request tightens those follow-ups across server and UI
code, and adds regression coverage for the affected paths
> - The benefit is a more reliable issue workflow, safer high-volume
cost aggregation, and clearer board/operator navigation
## What Changed
- Added the `v2026.415.0` release changelog entry.
- Fixed stale issue-run presentation after completion and reused the
shared issue-path parser so literal route placeholders no longer become
issue links.
- Added creator filters to the Issues page and Inbox, including
persisted filter-state normalization and regression coverage.
- Bounded issue detail/list project-mention scans and trimmed large
issue-list payload fields to keep issue reads lighter.
- Hardened company-skill list projection and cost/finance aggregation so
large markdown blobs and large summed values do not leak into list
responses or overflow 32-bit casts.
- Added targeted server/UI regression tests for company skills,
costs/finance, issue mention scanning, creator filters, inbox
normalization, and issue reference parsing.
## Verification
- `pnpm exec vitest run
server/src/__tests__/company-skills-service.test.ts
server/src/__tests__/costs-service.test.ts
server/src/__tests__/issues-goal-context-routes.test.ts
server/src/__tests__/issues-service.test.ts ui/src/lib/inbox.test.ts
ui/src/lib/issue-filters.test.ts ui/src/lib/issue-reference.test.ts`
- `gh pr checks 3779`
Current pass set on the PR head: `policy`, `verify`, `e2e`,
`security/snyk (cryppadotta)`, `Greptile Review`
## Risks
- Creator filter options are derived from the currently loaded
issue/agent data, so very sparse result sets may not surface every
historical creator until they appear in the active dataset.
- Cost/finance aggregate casts now use `double precision`; that removes
the current overflow risk, but future schema changes should keep
large-value aggregation behavior under review.
- Issue detail mention scanning now skips comment-body scans on the
detail route, so any consumer that relied on comment-only project
mentions there would need to fetch them separately.
## Model Used
- OpenAI Codex, GPT-5-based coding agent with terminal tool use and
local code execution in the Paperclip workspace. Exact internal model
ID/context-window exposure is not surfaced in this session.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Thinking Path
> - Paperclip orchestrates AI agents for zero-human companies
> - Reliable execution depends on heartbeat routing, issue lifecycle
semantics, telemetry, and a fast enough local verification loop to keep
regressions visible
> - The remaining commits on this branch were mostly server/runtime
correctness fixes plus test and documentation follow-ups in that area
> - Those changes are logically separate from the UI-focused
issue-detail and workspace/navigation branches even when they touch
overlapping issue APIs
> - This pull request groups the execution reliability, heartbeat,
telemetry, and tooling changes into one standalone branch
> - The benefit is a focused review of the control-plane correctness
work, including the follow-up fix that restored the implicit
comment-reopen helpers after branch splitting
## What Changed
- Hardened issue/heartbeat execution behavior, including self-review
stage skipping, deferred mention wakes during active execution, stranded
execution recovery, active-run scoping, assignee resolution, and
blocked-to-todo wake resumption
- Reduced noisy polling/logging overhead by trimming issue run payloads,
compacting persisted run logs, silencing high-volume request logs, and
capping heartbeat-run queries in dashboard/inbox surfaces
- Expanded telemetry and status semantics with adapter/model fields on
task completion plus clearer status guidance in docs/onboarding material
- Updated test infrastructure and verification defaults with faster
route-test module isolation, cheaper default `pnpm test`, e2e isolation
from local state, and repo verification follow-ups
- Included docs/release housekeeping from the branch and added a small
follow-up commit restoring the implicit comment-reopen helpers that were
dropped during branch reconstruction
## Verification
- `pnpm vitest run
server/src/__tests__/issue-comment-reopen-routes.test.ts
server/src/__tests__/issue-telemetry-routes.test.ts`
- `pnpm vitest run server/src/__tests__/http-log-policy.test.ts
server/src/__tests__/heartbeat-run-log.test.ts
server/src/__tests__/health.test.ts`
- `server/src/__tests__/activity-service.test.ts`,
`server/src/__tests__/heartbeat-comment-wake-batching.test.ts`, and
`server/src/__tests__/heartbeat-process-recovery.test.ts` were attempted
on this host but the embedded Postgres harness reported
init-script/data-dir problems and skipped or failed to start, so they
are noted as environment-limited
## Risks
- Medium: this branch changes core issue/heartbeat routing and
reopen/wakeup behavior, so regressions would affect agent execution flow
rather than isolated UI polish
- Because it also updates verification infrastructure, reviewers should
pay attention to whether the new tests are asserting the right failure
modes and not just reshaping harness behavior
## Model Used
- OpenAI Codex coding agent (GPT-5-class runtime in Codex CLI; exact
deployed model ID is not exposed in this environment), reasoning
enabled, tool use and local code execution enabled
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [ ] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [ ] If this change affects the UI, I have included before/after
screenshots
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] I will address all Greptile and reviewer comments before
requesting merge
---------
Co-authored-by: Paperclip <noreply@paperclip.ing>
## Summary
- Adds comprehensive release notes for `v2026.410.0`, the security
release that patches GHSA-68qg-g8mg-6pr7 (unauthenticated RCE via import
authorization bypass)
- Required before triggering the stable release workflow to publish
`2026.410.0` to npm and create the GitHub Release
## Context
The security fix (PR #3315) is already merged to master. The GHSA
advisory references `2026.410.0` as the patched version, but only canary
builds exist on npm. This PR unblocks the stable release.
## Test plan
- [x] Release notes file is valid markdown
- [ ] Merge and trigger `release.yml` workflow with `source_ref=master`,
`stable_date=2026-04-10`
- [ ] Verify `npm view paperclipai version` returns `2026.410.0`
- [ ] Verify GitHub Release `v2026.410.0` exists
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Introduces the release-changelog skill (skills/release-changelog/SKILL.md)
that teaches agents to generate user-facing changelogs from git history,
changesets, and merged PRs. Includes breaking change detection, categorization
heuristics, and structured markdown output template.
Also creates the releases/ directory convention for storing versioned
release notes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Devin Foley
Dotta
dotta
Dotta