Catch the changelog and docs up to what shipped - #125
Merged
Conversation
The Unreleased notes already tracked most of the recent work, since each change carried its own line in. This fills the gaps and fixes what went stale. Two merged changes had no line. The address guard's alternate-encoding refusal: it turned away the metadata and private addresses as usually written but not the same ones spelled as an IPv6-mapped or NAT64 form, an integer, or with a trailing dot, and it now canonicalises before it checks and refuses the container credential endpoints even with the private-host opt-in on. And the supervisor refusing to adopt a container it did not create, so a shared Docker host cannot hand it a stranger's container with the computer token. Docs that drifted: the README and the Cloud Run note still said one replica, which the deployment doc's own Replicas section now contradicts, so both point at the real remaining constraint instead, which is the shared browser. And AUDIT_RETENTION_DAYS and COMPUTER_SANDBOX were configurable and documented in the changelog and the README but missing from the configuration table. The knowledge back-out left one more orphan the removal missed: agents/invocation.ts routed a built-in agent to the knowledge agent that is gone, and nothing live constructs it. Deleted with its test. The changelog line that said the local index's connector "is going away" is now "has been removed", because it has been. README stays a build doc; none of this adds history to it.
davidmckayv
requested review from
MikeRyanDev,
guidovizoso and
tylerslaton
as code owners
August 22, 2026 00:12
#126 and #127 dropped the document index and the old connector tables, so the changelog line that said the index was "read by nothing" now understates it: the tables are gone. Say dropped, and add the one Upgrading note that matters, which is that those migrations destroy that data and cannot be rolled back. architecture.md still listed connector state among what the database holds; #127 removed it, so the line goes too. The README's database line never named those tables, so it needs nothing. #123 is CI and build hardening, not a deployment behavior, so it earns no changelog line.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
## Unreleasednotes already tracked most of the recent work (each change brought its own line). This reconciles the rest.Changelog — two merged changes had no line, both added under Fixed:
169.254.169.254and the private ranges as usually written, but not the IPv6-mapped/NAT64 forms, integer, or trailing-dot spellings; now canonicalises first and refuses the ECS/Fargate and Alibaba credential endpoints even with the private-host opt-in on.Docs that drifted:
docs/deployment.md(Cloud Run) still said "one replica", whichdeployment.md's own Replicas section now contradicts (snapshot + policy are shared via Postgres). Both now point at the real remaining constraint: the browser is per-instance, so a Bot's logins don't follow it between replicas.AUDIT_RETENTION_DAYSandCOMPUTER_SANDBOXwere configurable and in the changelog/README but missing fromconfiguration.md's tables. Added.Dead code the knowledge back-out missed:
server/src/agents/invocation.tsrouted a built-in agent to the knowledge agent that Answer from Google Drive, as the person asking #97 deleted, and nothing live constructs it (createAgentInvoker: zero live importers). Removed with its test.No document-RAG feature is presented as shipped anywhere; the net state (OpenBot answers from a live system's own search, as the person asking) is what the Changed section says. The README carries no changelog-style history.
Verified:
bun run typecheck,bun run lint(with--error-on-warnings),bun run format:checkall exit 0; full suite 1136 pass.