chore: release main

[github-actions]

🤖 I have created a release beep boop

1.10.0

1.10.0 (2026-10-02)

Features

• add Hermes Agent to private macOS (a1ee3bc)
• agent-audit: add Hermes Agent + unified breakdown table (677993c)
• bootstrap: export PRIVATE=1 on private machines (c86e539)
• brew-review: add hidden 0 option to target base overlay (4d2b402)
• brew: add blockblock to private macOS systems (5541548)
• brew: add hf and macOS app casks to chipwolf overlay (63666d5)
• brew: add Tailscale cask on macOS (a3928b0)
• brew: install Claude Desktop on private Macs (da18352)
• brew: install Discord on private Macs (3043544)
• git: enable rerere with autoupdate (acff272)
• hammerspoon: add ⌥0 to consolidate all windows onto focused space (d8874b9)
• mcp: drop context-mode from Claude Code target (659dcc6)
• skills: add --breakdown per-category view to agent-audit (b7f1503)
• skills: add agent-audit local skill (0b18089)
• skills: add consensus decision-meeting skill (4f9ec45)
• skills: consensus panel models real roles, not debate archetypes (7af9a90)
• skills: consensus records ADRs only on human approval, never via subagents (655de01)
• skills: vendor council for Claude Code (46bcb95)

Bug Fixes

• agent-audit: auto-run on load and output tables as markdown (f43f9e3)
• agent-audit: capture first-turn request overhead (6854be5)
• agent-audit: fix categoriser blanks for OpenCode MCP tools and pi project context (07f482f)
• agent-audit: fold pi tools-list and guidelines rows into base prompt (1b64503)
• agent-audit: report first-turn overhead (27f890c)
• brew: pass --no-ask to brew upgrade in apply script (227817e)
• brew: retrigger bootstrap onchange when chezmoi config data changes (ff271dd)
• brew: trust declared tap packages before update (dfde14d)
• chezmoi: gate Obsidian vault external on gh auth marker (a48f1fb)
• ci: pin Action digests to exact semver to satisfy zizmor (#112) (4df0d4c)
• ci: repair MegaLinter full-repo scan failures on main (#123) (c5a2112)
• ci: repair pre-existing main failures (source-tests + MegaLinter) (#110) (202d912)
• git: stop git-lfs littering repos with %(prefix)/dev/null hooks dir (e351952)
• hammerspoon: make ⌥0 consolidation work on macOS 26 (Tahoe) (870749a)
• install: give Homebrew installer a TTY and fail fast on errors (150c2df)
• nvim: wait for mason installs during headless preload (e3cf604)
• quote YAML description in update-skills skill to fix frontmatter parse error (3293672)
• skills: clean up agent-audit tmp dirs via EXIT trap (29221a0)
• skills: keep consensus facilitator off the long-context opus tier (c71729e)
• skills: parse consensus args, break empty-stance hang structurally (793ef79)
• skills: pin consensus frame to caller question, guard empty-stance loop (fd50734)
• skills: pin consensus opus tier to a non-1m build (claude-opus-4-7) (6f71e84)
• skills: quote YAML descriptions (04cfb9b)
• skills: re-run install script when skill files change (69d2696)
• skills: sharpen consensus convergence, groupthink guard, prep independence (2c80888)
• skills: stop duplicating skills into ~/.pi/agent/skills/ (02f6db6)

Miscellaneous

• agents: a confirming rejection may come from a gate before the one under test (ceef1af)
• agents: a new file with a shebang needs the exec bit before commit; pins that hash the tree move with it (dae917d)
• agents: a POC must exercise the actual mechanism in its real environment (ba29133)
• agents: a read CLI can cap output at a default limit (bef10fb)
• agents: a shutdown budget's enclosing waiters, a harness's input projection, and two shell traps (6a2da79)
• agents: a sibling-modelled addition owes feature parity; mine the component's history before dropping a piece (07f3b69)
• agents: add actions/cache exclude and target-shell testing rules (22c1bcb)
• agents: add CI-log-reading and doc-vs-enforcement rules (a1edf5a)
• agents: add CI-SHA diagnosis and shallow-fetch rules (1b9f8a5)
• agents: add composite-action ${{ }} load-time and merge-before-green rules (f858763)
• agents: add instrument-contradictions and autonomous-repro rules (37ba33b)
• agents: add LFS raw-blob-blocks-pull rule and chezmoi apply-drift warning (7ed7554)
• agents: add load generator and recovery rules, strengthen restart and setup-fact rules (109fb62)
• agents: add missing-CI-run failure signature rule (0ca5b9d)
• agents: add repo-sanitization sweep rule (981da83)
• agents: add rule to act on the operator's diagnosis, not re-litigate it (4a27773)
• agents: add rules for lockfile diff churn and base-ref workflow validation (563c5a9)
• agents: add rules for verifying desktop-app UI without the native shell (b106684)
• agents: add rules on ANSI-safe CI log greps and in-place linter checks (2a5f0a5)
• agents: add rules on overlapping CI cache layers and docs sitemap lookup (0fd02a1)
• agents: add semantic commit footer and empty-commit rules (6aa75db)
• agents: add the lock convoy rule, try new CI gates locally, settle time before comparing builds (be83bdb)
• agents: anchored-edit deletion guard, Paper plugin manifest namespace and op permission default (e750b07)
• agents: bash owns GROUPS and friends, and echo the parsed config back (70b7a76)
• agents: calibrate probes in the measured dimension, never write an unborn id (4b61f00)
• agents: capture the full property chain in a dead-key sweep (015ebbd)
• agents: capture web-displayed secrets via clipboard pipe, never transcript (fb21842)
• agents: check the base branch and the tool version before debugging a red check (a4fcbfc)
• agents: claim-specific diff normalisations, fleet-restart preconditions, calibrate appearance waiters (438ba86)
• agents: credential-in-argv leaks, git-lfs vs partial clone, colima bind-mount scope (ec86b1e)
• agents: derive the runtime tag from a package pin before reading source (8e1131c)
• agents: desktop-app checks need both a headless harness and a real run under Xvfb (284ff44)
• agents: detached-worktree fallback for subagents; diff-line filtering by header form (92b09aa)
• agents: differential checker calibration and deep-require ordering (5d84875)
• agents: don't reserialise configs for small edits; git-toplevel anchoring orphans subtree scripts (b8036fb)
• agents: establish provenance before undoing a commit on a shared branch (c7688ec)
• agents: eval'd escaped programs, perl \Q interpolation, and rebase-dropped exec bits (35f6157)
• agents: extend subagent-verification rule to causal hypotheses (55101c1)
• agents: filter config diffs for key material; taint not cordon during two-node drains (09d1ba5)
• agents: footprint ownership checks, set -e and && lists, .gradle copies, ignored generated files (3288f39)
• agents: gate every equivalent code path and prove the live one with a counter (314f43a)
• agents: GitHub Packages 422 on uppercase Maven artifactId; per-mod JDK/distributionManagement (a1936e9)
• agents: headless harness for desktop-app checks, EOL normalisation before byte hashes (b6635eb)
• agents: key crash watches on a monotonic counter (3758e09)
• agents: kustomize quoting, empty substitutions, private release assets, comment authorship (4c7e779)
• agents: lessons from Shadow HDR remediation session (4eeab1c)
• agents: merged GitOps change is not deployed until the controller is Ready (c3e5af1)
• agents: merged-tree gate check when reviewing sibling PRs for overlap (5b1a12f)
• agents: mise env scoping, zsh word-splitting, gh --delete-branch in worktrees (78e6dee)
• agents: never git add -A in a checkout another agent may be editing (7f0f0a4)
• agents: never hand-type git object ids, derive with rev-parse (3486058)
• agents: never signal a pattern-matched pid or PID 1 in a container (58a7bfb)
• agents: never truncate the output of a mutating command (271ca2a)
• agents: no AI attribution in headlesshq repos (a7bfaa7)
• agents: note modify_ toPrettyJson diffs re-sort keys (649a94e)
• agents: note stale-local-branch-from-squash-merge git gotcha (b837e8b)
• agents: note zsh =word expansion gotcha in shell-discipline rule (4b9a904)
• agents: own migration decisions; flag path-rewrite orphaning (c779278)
• agents: per-category generators must prune their output and guard on empty input (bf750c7)
• agents: perl delimiter, pipefail gates, squash base, rebase push rules (8da2530)
• agents: pin a discovered deploy target instead of rescanning on every run (274f3c6)
• agents: pin validator versions and measure declarative matchers (45c693b)
• agents: pinned-runtime capability check, hooksPath pin, informational grep under set -e (0251497)
• agents: pipe exit masking, no bare cd in agent shell, doc summaries are not source (c18d1b5)
• agents: plan-reading, one-member probes, saved-form checks, zsh export -f (2c62cfd)
• agents: positive checks need an unreachable-by-default target; cold JIT samples (41c1fea)
• agents: private release assets and comment authorship (4840d75)
• agents: probe a library's runtime behaviour in a REPL, a signature listing is not it (b4f2b3a)
• agents: prove a build reproducible before gating a deploy on byte equality (ce6490f)
• agents: re-decide auth per host when an API hands you follow-up URLs (e10f17a)
• agents: read a CI step's log for hidden side effects before removing it (9bd9b5f)
• agents: record CI step-unmasking and green-sibling-PR lessons (5a27e09)
• agents: record devcontainer feature extension injection and && || true masking (84d7a7d)
• agents: record Gradle Kotlin DSL configuration-cache closure rule (d2fef22)
• agents: record itzg interpolation lessons (secret redaction, shared config knobs, tolerant tests) (da44212)
• agents: record partial-delivery, Actions env precedence, and bucket-discovery lessons (40fb4b0)
• agents: record PR-base, pinned-version docs, kill-by-listener and automation-keypress lessons (8a6aaf2)
• agents: record Release-As scope trap and bot-PR batch merge hazard (2d8d9a1)
• agents: record release-please migration and release-verification lessons (e2300ad)
• agents: record the reusable-workflow event_name trap (60521ca)
• agents: record ugrep context-pattern limit and client-rendered doc page fallback (6121d6a)
• agents: release-please aggregate PR + untagged-merge global abort (867d5bf)
• agents: release-please stale open PRs and simple-type pom extra-file (2dfa797)
• agents: released version can be the corrupt baseline; verify lineage vs pre-migration source (e0ad5cb)
• agents: reproduce docker:// action steps with the runner's container contract (51c98ae)
• agents: require ASD-STE100 for all responses (4765d00)
• agents: require committing completed work (eef8153)
• agents: require executable bit on committed entrypoint scripts (86dc49b)
• agents: require permissive stubs in API capture loopbacks (54642a2)
• agents: scratch files in PR-opening CI jobs, and attributing automated diffs (e629482)
• agents: seed a simulated pipeline stage with its real inputs before reading failures (e535212)
• agents: sparse-clone false negatives, and keep stderr out of parsed files (9964e31)
• agents: strengthen prior-work check for upstream PRs (8ec5e10)
• agents: sweep dead config keys from the tool read-set, not by name (c53ccf5)
• agents: tail -n +1 for multi-file reads; plain two-step commands under worktree isolation (8d823dd)
• agents: test suites must survive a fresh clone; fixtures must be tracked or regenerated (190fe5d)
• agents: three diagnostic rules from a 700-player load investigation (e27afd3)
• agents: three ways a rate goes wrong with enough samples (f077f1c)
• agents: treat zsh glob abort in read-only searches as 'never ran' (c4581a8)
• agents: triage unexplained host reboots by reset source and cross-host control (27a5614)
• agents: use the inline mise python@version form for one-off calls, and uv run --with for a missing library (81e7af0)
• agents: validators miss role-dependent config; query option tables, don't scrape (9b3b32e)
• agents: verify default branch before committing memory (243b36a)
• agents: verify subagent repo-state claims before relaying (f17f9d5)
• agents: verify subagent worktree setup; stop on failure instead of falling back (1d26809)
• agents: warn that CLI empty-match and stdout errors break wait and delete loops (774e39c)
• agents: warn that in-place BEGIN/END blocks never write to the file (32c8b0a)
• agents: workflow-disabled diagnosis + gh workflow name ambiguity; three-dot PR diff rationale (8db0f90)
• deps: update actions/attest action to v4.2.2 (#129) (f69a7a7)
• deps: update actions/checkout action to v6.0.3 (#114) (8987be5)
• deps: update actions/checkout action to v6.1.0 (#130) (5760f14)
• deps: update actions/checkout action to v7 (#142) (9f21736)
• deps: update andrew-chen-wang/github-wiki-action action to v5.0.6 (#125) (df8e9f0)
• deps: update dependency bats to v1.14.0 (#131) (8d11810)
• deps: update dependency chezmoi to v2.70.5 (#104) (e52ffd3)
• deps: update dependency chezmoi to v2.72.0 (#132) (57b74eb)
• deps: update dependency chezmoi to v2.72.1 (#152) (7e53620)
• deps: update dependency chezmoi to v2.73.0 (#159) (e40c82a)
• deps: update dependency chrome-devtools-mcp to v1.10.1 (#160) (2f3dce9)
• deps: update dependency chrome-devtools-mcp to v1.2.0 (#106) (734d4f5)
• deps: update dependency chrome-devtools-mcp to v1.4.0 (#118) (c1d2e82)
• deps: update dependency chrome-devtools-mcp to v1.7.0 (#133) (207e83a)
• deps: update dependency chrome-devtools-mcp to v1.8.0 (#147) (135a693)
• deps: update dependency google/go-containerregistry to v0.21.7 (#115) (2a65800)
• deps: update dependency google/go-containerregistry to v0.21.9 (#126) (f05a7b3)
• deps: update dependency google/go-containerregistry to v0.22.0 (#148) (7826b95)
• deps: update dependency google/go-containerregistry to v0.22.1 (#153) (16a2a97)
• deps: update dependency mcp-atlassian to v0.23.1 (#134) (306119d)
• deps: update dependency oxsecurity/megalinter to v10 (Dockerfile fix) (f863f6d)
• deps: update dependency pipx:pre-commit to v4.6.2 (#127) (4841c47)
• deps: update dependency smart-mcp-proxy/mcpproxy-go to v0.38.1 (#107) (59fec3c)
• deps: update dependency smart-mcp-proxy/mcpproxy-go to v0.46.0 (#119) (3673c46)
• deps: update dependency smart-mcp-proxy/mcpproxy-go to v0.59.0 (#135) (cc3cabc)
• deps: update dependency smart-mcp-proxy/mcpproxy-go to v0.61.0 (#149) (e20178e)
• deps: update dependency smart-mcp-proxy/mcpproxy-go to v0.64.0 (#155) (2f62b8c)
• deps: update dependency smart-mcp-proxy/mcpproxy-go to v0.69.0 (#161) (484ea69)
• deps: update dependency uv to v0.11.21 (#105) (ef615ef)
• deps: update dependency uv to v0.11.24 (#116) (79c2eb2)
• deps: update dependency uv to v0.12.22 (#157) (b61f1d4)
• deps: update dependency uv to v0.12.5 (#136) (a941d81)
• deps: update dependency uv to v0.12.7 (#144) (81462f5)
• deps: update dependency uv to v0.12.9 (#154) (b253ff8)
• deps: update docker/login-action action to v4.2.0 (#120) (ecf5879)
• deps: update docker/login-action action to v4.6.0 (#137) (daf4794)
• deps: update ghcr.io/chipwolf/badgesort docker digest to ca3fc7e (#113) (ccf263f)
• deps: update github/codeql-action action to v4.36.2 (#121) (4c4c5af)
• deps: update github/codeql-action action to v4.37.7 (#138) (3b0aa60)
• deps: update github/codeql-action action to v4.37.9 (#145) (770bc8c)
• deps: update github/codeql-action action to v4.38.2 (#162) (a0a4929)
• deps: update jdx/mise-action action to v4.2.0 (#122) (a112072)
• deps: update jdx/mise-action action to v4.2.5 (#128) (2c7fe9f)
• deps: update jdx/mise-action action to v4.3.0 (#150) (b94065e)
• deps: update mcr.microsoft.com/devcontainers/universal docker tag to v6.0.6 (#117) (4e5590c)
• deps: update mcr.microsoft.com/devcontainers/universal docker tag to v6.1.1 (#139) (425de87)
• deps: update mcr.microsoft.com/devcontainers/universal docker tag to v6.1.6 (#146) (9d46b73)
• deps: update mcr.microsoft.com/devcontainers/universal docker tag to v6.1.7 (#158) (0ef30b0)
• deps: update oxsecurity/megalinter action to v10.1.0 (#163) (bb77907)
• deps: update oxsecurity/megalinter action to v9.6.0 (#140) (3aa003b)
• deps: update stefanzweifel/git-auto-commit-action action to v7.2.0 (#141) (8f00174)
• deps: update vaultwarden/server:latest docker digest to 094b568 (#143) (92d9a65)
• deps: update vaultwarden/server:latest docker digest to 1587c45 (#156) (70739be)
• deps: update vaultwarden/server:latest docker digest to ebdfe70 (#124) (f798d32)
• gitignore: ignore .pi-lens/, drop docs/superpowers/ (15ca8c1)
• mise: migrate pi-coding-agent to @earendil-works and auto-prune (81a2951)
• opencode: drop context-mode routing rules from AGENTS.md (fccb382)
• renovate: enable platform auto-merge for green PRs (#111) (edbbe96)

Documentation

• hammerspoon: document ⌥0 window consolidation (84a597b)
• name the config fan-out module (CONTEXT.md + ADR-0001) (c14e82c)
• refresh MCP/permission how-tos and skills to current reality (a1db96e)

---

This PR was generated with Release Please. See documentation.