All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

• msb: reduce kit permission setup latency (#614) (0415f5f)

• kits: pin agentic-coding-patterns v1.15.0 (#595) (1e9ef27)
• kits: pin agentic-coding-patterns v1.16.1 (#609) (20d6bab)
• opencode: use generic devenv base by default (#584) (cefd6f2)

• ci: bump markdown-it to 14.3.3 and smol-toml to 1.9.0 overrides (#599) (5ab74b8)
• msb: stop false "no ssh-agent route" warnings from grep sigpipe (#598) (24c8493)
• provider-facts: preserve caller-visible assignments through wrapper subshell (#603) (2361b11)
• provider-facts: preserve unset caller IFS (#605) (3fe3150)
• rc.d: list ~/.rc.d with command ls in the login bridge (#588) (d7dbeb6)
• verify: make provider backend verification fail closed (#602) (f67041a)

• msb: route ssh-agent forward through a managed symlink (#564) (cd26a9f)

• msb: default to microsandbox 0.7.7 (#553) (ccd1bcb)

• kits: acq no longer installs podman/OCI tooling by default. Users who need docker, docker compose, or rootless podman when the base image doesn't provide it must opt into the oci-engine kit with acq configure, --kit, or ACQ_EXTRA_KITS.
• kits: acq no longer performs native OpenCode npm fallback installation. OpenCode is supplied by the pinned opencode agent kit from agentic-coding-patterns v1.12.0, currently delivering OpenCode v2.0.22. If the kit is unavailable or invalid, acq fails closed instead of installing opencode-ai from npm.
• kits: existing acq sandboxes with adapter-installed podman are not migrated in place. Recreate affected sandboxes or add the oci-engine kit before relying on OCI behavior after stop/start.

• acq: choose the host port per sandbox, and let --publish pin it (#526) (410f332)
• acq: export ACQ_WORKSPACE and ACQ_CLONE into the guest on both backends (#457) (e0b9a3b)
• acq: interactive acq configure UI for extra kits + token-scoping defaults (#500) (13d9d3a)
• network: add workshop.cloud.gov to the balanced hosts (#471) (a503287)
• kits: adopt pinned agent and capability kits (#474) (6a67063)
• secrets: add Windows-native DPAPI secret backend (#464) (907f404)
• windows: add acq preview install path (#463) (d6d76f4)

• acq: use sandbox workspace for github scoping (#476) (1610835)
• ci: bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory (#454) (3217b49)
• ci: bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory (#459) (c2291bf)
• ci: centralize markdownlint coverage (#548) (a27c31e)
• ci: pin markdownlint-cli2 once, clear GHSA-253c, unify file selection (#527) (e712685)
• ci: unblock unrelated PRs from the bash32 required-check deadlock (#513) (187aa57)
• install: keep curl | sh stdin intact and tap msb formula first (#462) (c808d74)
• install: trust the microsandbox-acq dependency before brew install (#534) (ffac0fa)
• msb: correct copy-paste command in README (#452) (83734f9)
• kits: land collapsed kit stack implementation (#549) (bcd5b9c)
• msb: allow Playwright browser downloads (#477) (0c399c5)
• msb: block unsafe 0.7 migration versions (#510) (3634046)
• msb: carry every origin URL, keep the scratch private, fail closed on a copy miss (#488) (babcd49)
• msb: carry the source checkout's git identity into the --clone scratch (#443) (320d784)
• msb: follow the host resolvers and disable DNS rebind protection in the guest (#444) (d2f4bdc)
• msb: point the --clone scratch's origin at the source checkout's remote (#455) (7f48b94)
• msb: refresh ssh authorization for port publish (#446) (72a6bd5)
• msb: session parity for exec/attach/shell (cwd, terminal identity, login shell) (#427) (6261eda)
• msb: skip the recursive home chown when the image baked the agent user (#432) (d8f66a4)
• msb: thread the merged kit env onto kit lifecycle commands (#519) (2248a92)
• msb: translate kit wildcard network rules (#451) (e22bbc3)
• msb: verify post-hoc port forward listener (#530) (8ca50e1)
• msb: warn on broadened kit wildcard rules (#460) (6ded3ce)
• msb: warn when ssh-agent route is missing (#448) (3a767a4)
• sbx: emit valid setup.install shape for the git-identity mixin (#492) (8e6160c)
• sbx: raise the version floor to 0.39.0, where sbx create --env first exists (#491) (30f9ecf)
• sbx: wait for startup barrier before attach (#512) (33c83c5)
• secret: reject multiline test secret values (#447) (f2da950)
• secrets: propagate rotation across backends (#509) (9641958)

• acq: make --clone a neutral option, emulated on msb via a managed host-side scratch clone (#423) (7003608)

• install: prefer package managers in auto mode (#433) (831540d)
• kits: reject block-scalar environment[] values instead of mangling them (#420) (02f8531)
• secret: store macos secrets in keychain via stdin (#436) (20ab8c7)

• docs/QUICKSTART.md and docs/QUICKSTART_SBX.md have moved to docs/howto/acq.md and docs/howto/sbx.md. No redirect stubs are kept (this lands ahead of 3.0.0). External links to the old paths break.
• acq: on a host with both backends installed and no explicit selection, acq now resolves to msb instead of sbx.
• acq: opencode-web.sh is removed. Use the openchamber acq kit to run OpenCode in the browser.

• acq: add a neutral interactive-shell verb — acq shell NAME (#399) (1862b05)
• acq: add backend-agnostic --image/ACQ_IMAGE base image override (#358) (80ae257)
• acq: add per-verb --help for all acq-owned subcommands (#368) (90f2b4b)
• acq: default to msb backend and remove qsbx for 3.0.0 (#266) (21f7901)
• acq: detect stale sandboxes + acq kit check|update (#236) (#241) (f1693aa)
• acq: fix subcommand dispatch hygiene and implement 'secret import' (#283) (5ae27c6)
• acq: sand rough edges off first-run onboarding (PATH self-repair + auto host check) (#281) (71698d7)
• acq: sbx↔msb backend parity, incl. live openchamber-on-msb (omnibus #234) (#233) (32f9ae0)
• acq: scope GitHub token per-sandbox to mounted repos (#229) (b355706)
• install: add auto-selecting curl|sh installer + streamline README (#387) (4d67551)
• install: enable homebrew tap install (#424) (5f04294)
• kits: add neutral volumes vocabulary (sbx v2 5.7 passthrough + msb parity) (#357) (8029d2a)
• kits: synthesize chmod from hybrid/v1 mode fields into generated setup.install (#390) (7a5cb3c)
• msb: collapse gateway-DNS grant to allow@dns and re-verify git-HTTPS secret substitution vs msb 0.6.9 (#318) (491c75c)
• msb: derive default sandbox-template image from agent token (#409) (cc27fa2)
• msb: diagnose+disambiguate msb egress failures (three signatures) (#306) (7a6d371)
• msb: ensure an OCI engine via rootless podman (+ verify-backends fixes, sbx 0.38 floor) (#302) (8088dcc)
• msb: forward the host ssh-agent into the guest via --vsock (#316) (e4e8317)
• msb: mirror the sbx balanced network policy as the msb default egress (#295) (2c056cb)
• msb: neutral ACQ_NETWORK_TIER egress selector + deprecate ACQ_MSB_BALANCED_EGRESS (#310) (2242af4)
• msb: re-run kit startup on restart via acq start/restart (#260) (7bbc999)
• msb: stage kit startup commands as a create-time script (#259) (3ff736b)
• progress: TTY-aware progress feedback during long acq run phases (#290) (ab44206)
• sbx: add actions=read scope to PAT URL (#262) (fbaa291)

• acq: accurate git-identity guidance + workspace path pre-flight (#216) (546cc93)
• acq: carry publishedPorts and quote allow hosts in kit-translate (#221) (a36d783)
• acq: don't hang key rotation when sbx needs a login (#211) (#212) (bb0544d)
• acq: enumerate keychain-linux secrets in acq secret ls (#258) (f4e1bb9)
• acq: intercept --kit <ref> on run/create and translate it (#223) (a86d151)
• acq: let secret rm remove any stored entry, not just built-ins (#300) (#301) (ab506ed)
• acq: make kit fetch non-interactive; never prompt for git creds (#207) (#209) (b505336)
• acq: make USAi key rotation backend-neutral (#218) (4a5f8e1)
• acq: persist --kit/extra refs and restore them on start/restart (#328) (78ec68c)
• acq: propagate host git identity to guest (#429) (68a6e59)
• acq: run fails closed on an unresolvable target instead of silent no-op (#257) (c0b155c)
• acq: run github-scope advisory before provision on fresh create (#386) (c066206)
• acq: store USAi key before sandbox create to end 200-vs-401 split (#286) (c68ccb6)
• Add -f to sbx rm command to cleanup rotation validation sandbox (#268) (6a21e48)
• Avoid literal $MSB_ proxy token (#324) (548e314)
• http-test: Ensure the test can install git in alpine (#325) (a11ece2)
• install: handle shallow pinned updates (#428) (2f2eb37)
• kits: mode validator dropped all kit files on mawk (interval regex) (#380) (e46f055)
• kits: Pull in updated USAi kit with fixed opencode.jsonc config (#391) (83e0354)
• msb: detect stale ssh-agent --vsock route after a host reboot (#416) (3568212)
• msb: install/launch the agent + mount workspaces at their host path (#230) (0d2bbd0)
• msb: persist kit environment[] and replay it on agent sessions (#401) (bf89bce)
• msb: re-drive ssh-agent forward on running reattach (#392) (ab84c4c)
• opencode-web: background sbx exec command on host instead of opencode command inside sandbox (#210) (0a2057e)
• opencode-web: use serve command and drop per-run port publish (#204) (5364ffb)
• sbx: correct lifecycle verbs — sbx has no 'start'/'restart' (#285) (b69b5d1)
• sbx: make global secret-set bash-3.2-safe (empty-array under set -u) (#309) (632a656)
• sbx: stop the every-attach re-attach heal-loop noise on sbx 0.38 (#327) (24ceb43)
• secrets: honor explicit --host for built-in services; unbreak rm -g on bash 3.2 (#398) (d247a40), closes #384
• tests: restore real failure detection in the bats suite + repair 56 latent test failures (#393) (28325bf)

• rename QUICKSTART*.md to docs/howto/{acq,sbx}.md (#361) (0ead93c)

• acq: qsbx now requires sbx >= 0.35.0. sbx 0.35.x has no Linux/ARM64 build (deferred to 0.36.x), so Linux/ARM64 hosts cannot meet the floor until 0.36.x.

• acq: add msb backend and neutral hybrid/v1 kit translation (#202) (f993250)
• acq: add pluggable-backend acq wrapper (sbx driver) and deprecate qsbx (#201) (fbd57be)

• sbx: recover sandboxes with orphaned USAi placeholders (#196) (58f58f9)

• sbx: align qsbx docs/verify with v1.5.0 usai-provider global-config merge (#194) (e1622f6)

• sbx: the agentic-coding-playbook git submodule is removed. Existing clones should run git submodule deinit -f agentic-coding-playbook after pulling. The playbook is now delivered into sandboxes by the playbook kit, not the submodule.

• sbx: bump patterns kit ref to v1.5.0 release (#193) (f6f57d5)
• sbx: deliver USAi config and the playbook as sbx mixin kits (#184) (88f121a)

• docs: Remove duplicate <details> tag that breaks rendering of README (#192) (809154b)

• opencode: reduce read/inspection approval fatigue in permissions (#179) (e840ae4)

• docs: harden Docker install (no curl|sudo sh) (#187) (1706af3)
• qsbx: repair stale usai placeholders (#182) (4b3c7e0)

• correct CODING_PRACTICES.md link (#176) (3beba66)
• qsbx: consolidate duplicate USAi secrets and attach by --name (#159) (039013f)

• add key rotation script (6503fc8)
• Better rotation script. (33c22a1)
• qsbx: validate USAi key and offer rotation before attach (#143) (14c4cc5), closes #140
• sync: automate USAI model sync for opencode templates (26e777b), closes #117 #118 #119
• template: add comprehensive commented examples for OpenCode config (#123) (0ed5771)
• template: add headers for agentic traffic identification (#125) (a54f7e6)

• Apply suggestion from @mogul (edeba92)
• ci: add permissions block to release workflow (#129) (27b019e)
• ci: correct action SHA pins for usai-model-sync workflow (1579774)
• ci: track package-lock.json for reproducible CI builds (59762bd)
• ci: update markdownlint-cli2-action SHA to v23.2.0 (#135) (3b38acb)
• clarify rotation steps (4e6255f)
• clarify rotation steps (934497d)
• Formatting, typos (ef65361)
• opencode PR suggestion bugs (9ce4664)
• prettier, formatting, and fix link to guidance (dec8d11)
• sync: improve API error messages for debugging (2bcf082)
• Use QS_SBX var (ad17ad7)
• web: run opencode web detached via sbx exec (#147) (70cf626)

• add opencode web (b462efc)
• add opencode web (#86) (b462efc)

• reconcile files used in init-project and update makefile to current standards (#82) (5e2f529)

• docs: correct broken related_files links in frontmatter (#74) (2af5b26)

• bootstrap: add init-project script for project bootstrapping (#70) (0715e19)

• use sbx secret set-custom for USAI_API_KEY (#57) (56da7c5)

• zed: add zed editor integration and task runner setup (#45) (0aff745)

• correct invocations of sbx version and policy (#36) (d2ff60e)

• ci: add minimal pre-commit config (opt-in) for secret detection (#35) (b40149a), closes #34
• config: expand opencode.jsonc with models, permissions, and compaction (#29) (b6270ca)

• add workspace structure and makefile for simplified setup (#20) (abd22e8)

• templates: add bootstrap files for copying quickstart to other repos (7ea07e7)

• add semver, conventional commits, and automated releases (#12) (5c3cdfb)

• ci: migrate from hello-please to release-please (583dca5)