release-candidate: complete Windows-first roadmap

[duc15052006-dotcom]

Purpose

This is the aggregate release-candidate PR from verify/release-candidate to main. It contains the complete stacked implementation so the repository can be reviewed and verified as one product change instead of requiring more than twenty dependent merges before CI can see the final tree.

Included roadmap work

• per-Agent Model/API configuration, connection testing, encrypted credential references, runtime fallback
• per-Agent Instructions, Skills and bounded Knowledge
• Computer lifecycle: Start / Restart / Stop / Reset, metrics and governed persistent workspace files
• group channels with multiple coworkers, @mention routing through durable handoffs, shared files and delegation status
• security hardening: default-deny/fail-closed policy behavior, audit coverage, destructive reset confirmation, SSRF protections, write-only credentials, human handoff for login/MFA/CAPTCHA
• Windows desktop first-run flow with installer-first setup, provider/model Test connection, end-to-end Bot proof, first-coworker handoff and Computer quickstart
• diagnostics/recovery, native update checks, desktop shortcut lifecycle and uninstall acceptance
• signed Windows release gates, exact artifact identity verification and standard-user acceptance of the exact signed NSIS installer
• release preflight/static checks that pin the product and security contracts above

Verification lane

The head branch is under verify/**, so push-triggered CI is enabled as a fallback when pull-request events are suppressed. This PR itself also gives the final combined tree a normal pull_request target against main, which should trigger the standard CI and Desktop workflows.

Merge guidance

Do not merge this release-candidate PR until the full CI/Desktop workflows are green and the protected Windows signing/release acceptance required by the release process has been exercised where applicable.

The earlier stacked PRs remain useful as review-sized slices, but this aggregate PR is the authoritative final-tree verification target.

Final release blockers

Exact verified release-candidate head: 3528ad9ea55987b6ea9939452807962113cbf1f0.

1. Protected Windows signing — Azure federation remaining

   • GitHub-side signing bootstrap is now self-contained; no Azure subscription id or mandatory Environment variables are required.
   • Protected signing Fix grammar: fused sentence in pydantic-ai-bot README CopilotKit/OpenBot#243 reaches azure/login successfully with the expected client/tenant/vault/certificate configuration.
   • Azure currently rejects the OIDC assertion with AADSTS700213: no matching federated identity record exists for this repository's immutable windows-signing environment subject.
   • An authorized owner/administrator of the existing Entra application must add the federated credential from desktop/signing/azure-federation.json.
   • After that Azure-side trust exists, re-trigger protected signing on the exact current release head and require the full certificate/signature/installer verification path to pass.

2. Real Intelligence smoke

   • Run the documented real-deployment journey in docs/releasing.md / tests/smoke.
   • Keep authentication material local; record only sanitized PASS evidence on this PR.

Before the merge, also confirm main branch protection requires aggregate verify and keep an independent source backup/mirror.

Do not merge this PR into main until both mandatory gates pass on the exact release head.

[duc15052006-dotcom]

Verification checkpoint — 2026-09-18

Current release-candidate head: 125a7821de56aaa99a3ef32fa0c258667afc7f29

Static/review work completed since the previous checkpoint:

• first-run model connection proof is mandatory and App integration coverage now follows it (fix(desktop): require model Test connection during first-run #46, test(desktop): align App flows with mandatory model connection proof #50)
• compatible endpoint metadata SSRF is blocked at both probe and persistence boundaries (fix(desktop): block cloud metadata in model connection probe #39, fix(desktop): reject metadata model endpoints before persistence #45)
• signed Windows release files are staged into the flat artifact layout consumed by publish, and both signed executable hashes are checked against signature evidence (fix(release): flatten signed Windows artifact before publish #48)
• an existing version tag must point exactly at the release commit before a GitHub Release can be refreshed (fix(release): bind existing version tag to exact release commit #49)

Hosted verification is not green or verified:

• GitHub Actions API for verify/release-candidate currently reports 0 workflow runs
• commit statuses for the current head are empty
• protected windows-signing has therefore not produced execution evidence on this final tree

Do not merge #30 until CI + Desktop + protected Windows signing/exact signed-installer acceptance provide actual workflow evidence.

[duc15052006-dotcom]

Actions blocker identified

The repository API confirms this repository is a public fork created 2026-09-17. GitHub Actions reports 0 workflow runs for verify/release-candidate.

GitHub's fork behavior explains this state: workflows in forked repositories do not run by default until Actions is enabled for the fork.

This is now the primary external verification blocker. The release-candidate must remain unmerged until Actions is enabled and the final head receives real CI/Desktop results; protected windows-signing still requires its environment/OIDC execution evidence as a separate release gate.

[duc15052006-dotcom]

Verification checkpoint update

Current head: 44b6d94ba9967426023fa8c1200ed7e8f4d26a86

Additional release blockers closed:

• fix(release): fail early on invalid or occupied versions #51: Create release PR now paginates all open PRs, validates stable/safe SemVer, and refuses an already-occupied next version tag.
• fix(release): refuse unsafe pre-existing GitHub Release state #52: refreshing an existing GitHub Release now fails closed on draft/prerelease state or unexpected stale assets.

Current aggregate size: 328 commits, 119 changed files.

Hosted verification remains blocked externally:

• Actions runs on verify/release-candidate: 0
• commit statuses on current head: none
• this repository is a public fork, and GitHub Actions must be enabled for the fork before these workflows can execute.

Keep #30 unmerged until a post-enable synchronize/push produces real CI + Desktop evidence and the protected Windows signing acceptance is exercised.

[duc15052006-dotcom]

Product checkpoint: local resource, browser, persistence, safety, and scheduled wake

Keep these requirements before final release:

• Each built-in Bot uses its own deployment-owned Chromium/browser profile and persistent workspace; never reuse the user's personal Chrome profile.
• Stop/Sleep must terminate the Bot computer process/container and release active CPU/RAM/GPU use while retaining browser profile/workspace for the next wake.
• A full Stop OpenBot / Gaming mode must stop every Bot computer and other nonessential local services so the host can reclaim resources for games; closing the desktop window alone must not be presented as equivalent to full stop.
• Restarting OpenBot must restore durable state (threads/memory, Bot configuration, browser profile, workspace, scheduled routines) without replaying destructive actions.
• Scheduled routines may wake the required Bot/computer at the due time while OpenBot's local background service is running; if the entire deployment/PC is powered off, missed windows follow the documented skip/grace behavior rather than pretending work ran.
• Browser downloads and untrusted files must stay inside the Bot's isolated persistent workspace/profile by default, not the user's personal Downloads/Desktop. No host-directory mounts, Docker socket, or privileged access from Bot computers. Add bounded storage/quota + quarantine/scanning policy where practical; Reset must be able to purge the Bot profile/workspace intentionally.
• Treat downloaded files/pages as untrusted. No CAPTCHA/MFA/login bypass; hand off to the user. Keep action policy fail-closed/default-deny.

User hardware target discussed for local-first acceptance: i5-12500H, RTX 3050 4GB, 16GB DDR4, 512GB SSD. Resource controls should make it practical to stop all Bots before gaming and resume later.

[duc15052006-dotcom]

Integrated teammate-orchestration improvements from PR #65 at 2b75d1da3a334b18a621a04323c565ed2fc65678.

What changed:

• selective group coordinator dispatch for unmentioned team requests
• verified/bounded peer roster with profile text treated as untrusted data
• explicit Team dispatch status in group conversations
• natural-language durable Routine behavior in both built-in model adapters
• no invented schedule/timezone and no false background-work promises
• regression coverage for coordinator routing and Routine guidance

Security/runtime boundaries were not widened: shell policy, Computer sandboxing, quarantine/ClamAV, credentials and resource controls are unchanged.

Verification on the integrated release-candidate SHA:

• CI fix(economy): fail closed on receipt corruption and converge retries #156: success
• CI fix(economy): revoke approval authority for deleted Agents #157: success
• Desktop security(workflows): cap autonomous concurrent steps #111: success (Linux/macOS/Windows, including Windows installer smoke + standard-user acceptance)
• Desktop Windows signing fix(workflows): resolve destination channel server-side #108: success
• Desktop Windows signing security(workflows): quarantine channel choice labels #109: success

A duplicate Desktop #110 was still running when this note was posted; Desktop #111 is the equivalent complete successful run on the same SHA.

[duc15052006-dotcom]

Signing bootstrap advanced — 2026-09-27

Current exact release head:
7dc4cc55c6db10713df0e5009b2c182b44a991e8

Newly integrated:

• ci(signing): remove Azure subscription setup dependency #138 ci(signing): remove Azure subscription setup dependency
• targeted PR exact-head CI Read a skill choice the model wrapped in a code fence, the way the router reads its answer CopilotKit/OpenBot#577: success, final verify: success
• targeted signing regressions Test a boundary rule against history before saving it CopilotKit/OpenBot#241: success
• post-merge CI Edit a built-in coworker without sending the managed Bot's address back as a typed endpoint CopilotKit/OpenBot#579: success, final verify: success
• post-merge Desktop Point the test at the database the project actually has CopilotKit/OpenBot#234: success across Linux/macOS/Windows
• post-merge signing regressions Channel pin and soft delete, and a Notion connector over hosted MCP CopilotKit/OpenBot#242: success

Protected signing was explicitly triggered on this exact head:

• Desktop Windows signing Fix grammar: fused sentence in pydantic-ai-bot README CopilotKit/OpenBot#243 / run 36301732444
• signing regressions: success
• exact source checkout: 7dc4cc55c6db10713df0e5009b2c182b44a991e8
• Check signing configuration: success
• checked-in defaults resolved client id, tenant id, Key Vault URL and certificate name correctly
• Azure Login ran with OIDC and allow-no-subscriptions: true
• GitHub issued the expected immutable subject:
  repo:duc15052006-dotcom@270219086/OpenBotD.U_C@1374258280:environment:windows-signing
• Azure Login failed with AADSTS700213: no matching federated identity record exists for that subject

This materially narrows the signing blocker: GitHub Environment variables and an Azure subscription id are no longer required. The remaining signing prerequisite is Azure/Entra-side trust: an authorized owner/administrator of the existing Entra application must add the credential defined in desktop/signing/azure-federation.json, after checking that an identical credential does not already exist.

The windows-signing label has been removed again to avoid repeating the same Azure failure.

Real Intelligence smoke still has no passing evidence recorded.

Do not merge #30 into main yet. Remaining mandatory external gates:

1. create/confirm the Azure federated credential, then pass protected signing end-to-end on the exact release head;
2. pass the real Intelligence smoke journey and record sanitized evidence.

[duc15052006-dotcom]

Entra federation bootstrap helper integrated — 2026-09-27

Current exact release head:
3528ad9ea55987b6ea9939452807962113cbf1f0

Newly integrated:

• chore(signing): add safe Entra federation bootstrap helper #139 chore(signing): add safe Entra federation bootstrap helper
• helper: desktop/scripts/setup-windows-signing-federation.ps1
• check-only mode before mutation;
• no-op when the exact issuer/subject/audience already exists;
• refuses a same-name mismatched credential instead of overwriting it;
• verifies the expected credential after creation;
• release preflight now guards those safety properties.

Verification:

• chore(signing): add safe Entra federation bootstrap helper #139 exact-head CI Start a new chat with Shift+N on a layout that does not write Latin letters CopilotKit/OpenBot#580: success, final verify: success
• chore(signing): add safe Entra federation bootstrap helper #139 Desktop Run OpenBot on Kubernetes: Bots and all, proven on EKS CopilotKit/OpenBot#235: success
• chore(signing): add safe Entra federation bootstrap helper #139 signing regressions Fix grammar: capitalize 'client id' to 'client ID' in README CopilotKit/OpenBot#244: success
• post-merge CI fix(desktop): unblock Windows plan sign-in and space provider buttons CopilotKit/OpenBot#582: success, final verify: success
• post-merge Desktop An MCP token can be spent against any address, by re-addressing its server or by orphaning it and creating the server again CopilotKit/OpenBot#237: success across Linux/macOS/Windows
• post-merge signing regressions Fix grammar: add missing 'or' in enumeration in SKILL.md CopilotKit/OpenBot#245: success

The previous protected signing CopilotKit#243 already proved GitHub now emits the expected immutable OIDC subject and that the workflow reaches azure/login. Its remaining error is Azure-side AADSTS700213: the matching federated identity record has not yet been created in the existing Entra application.

Do not re-trigger protected signing until that Azure federation credential is present. Once an authorized Entra app owner/admin runs the helper successfully, reapply windows-signing and verify the complete Key Vault certificate/signature/installer path on this exact head.

Real Intelligence smoke still has no passing evidence recorded.

Do not merge #30 into main yet. Remaining mandatory external gates:

1. create/confirm the Entra federated credential, then pass protected signing end-to-end;
2. pass the real Intelligence smoke journey and record sanitized evidence.

[duc15052006-dotcom]

Post-release roadmap note recorded: Agent Economy

A future architecture note has been stored separately from the release branch:

• branch: roadmap/agent-economy
• file: docs/note-agent-economy.md
• commit: fc886816dae227ffb8ab9490f63bab52c66462bf

The design was cross-checked against Conway-Research/automaton at d8f816881fd24b6f5e3d616e59edec387a447667, selectively adapting treasury policy, spend windows, minimum reserve, x402 limits, survival-tier cost reduction, durable heartbeat, transaction audit and child funding concepts while keeping OpenBot's server-side policy/audit boundary and stronger Owner/key-custody isolation.

This roadmap branch is not part of the current release candidate and must not be merged into #30 before the current release gates complete.

GitHub Issues are disabled for this repository (the create-issue API returns 410), so this PR comment is only a discoverability pointer; it does not add a release requirement.

[duc15052006-dotcom]

Agent Economy roadmap completed through E7 — isolated from release

The post-release roadmap/agent-economy branch is now implemented through the full planned sequence E0–E7.

Merged roadmap PRs:

• feat(economy): add E0 accounting foundation #140 E0 accounting foundation
• feat(economy): add E1 cost attribution #141 E1 cost attribution
• feat(economy): add E2 payment intent policy #142 E2 payment intent + policy
• feat(economy): add E3a custody and verified receipts #143 E3a custody + verified receipts
• feat(economy): add E3b Circle testnet payment adapter #144 E3b Circle testnet payment adapter
• feat(economy): add E4 normalized revenue adapters #145 E4 normalized revenue adapters
• feat(economy): add E5a manual Owner payout #146 E5a manual Owner payout
• feat(economy): add E5b threshold and scheduled payouts #147 E5b threshold/scheduled payouts
• feat(economy): add E6 child economy #148 E6 child economy
• feat(economy): add E7 adaptive survival controls #149 E7 adaptive survival controls

Current roadmap head:
6f0fc7339f3fab288985f9245c5c6f28535e2ed3

The final E7 PR #149 passed:

• format/lint/types
• tests
• migrations
• build
• Windows startup
• macOS startup
• Python harness regressions
• all chart checks
• final verify

No Agent Economy feature PR remains open. The roadmap stays isolated and is not part of PR #30.

Release PR #30 remains blocked only by its existing external mandatory gates:

1. create/confirm the matching Entra federated credential and pass protected Windows signing end-to-end;
2. pass the real Intelligence smoke journey with sanitized evidence.

Do not merge #30 into main until those two release gates pass.

[duc15052006-dotcom]

Agent Economy hardening update — 2026-09-28

LIVE refresh confirmed the Agent Economy roadmap has advanced beyond the earlier E7 completion note.

• PR feat(economy): add E2 payment intent policy #142 E2 exact merged head: c659024216e6f97fe6216867cf089adbd6b9073d
• E2 CI Use the model name this Bot was given, not the whitespace around it CopilotKit/OpenBot#593 / run 36313914713: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • final verify: success
• PR fix(economy): persist Owner payment approvals #150 fix(economy): persist Owner payment approvals exact head 878f4ef46f2731d5c15e4a30f84247041abb575c passed CI Deduplicate supervisor listen-port onto shared/ CopilotKit/OpenBot#632 / run 36328563151 including final verify.
• PR fix(economy): persist Owner payment approvals #150 was merged into roadmap/agent-economy.
• New roadmap head: 23ee1f8f425ed41917db937f803da7385b2146f0.

PR #150 closes the transient Owner-confirmation gap by requiring persisted, append-only Owner approvals bound to the payment intent, Agent and policy version, with approval reloaded before prepare and again immediately before external execution.

This remains isolated from verify/release-candidate and does not change release readiness. PR #30 must still not be merged until:

1. protected Windows signing passes end-to-end after the matching Entra federated credential exists;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy production hardening advanced — 2026-09-28

The isolated roadmap/agent-economy branch has advanced again without changing this release candidate.

Merged:

• feat(economy): add canonical Owner approval store #151 feat(economy): add canonical Owner approval store
• exact PR head: aa5e9b508c4b39b19edb98ea779621a575055f6b
• exact-head CI Read an MCP tool answer that arrived as a resource link CopilotKit/OpenBot#638 / run 36340027208: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 1950af40888241395e29cf0fe04a51865eafa6c7

#151 turns persisted Owner approval into a real server-side boundary: Agent id, policy version and Owner identity are derived from durable database state; only intents that actually require Owner confirmation can be approved; retries are idempotent; cross-Owner access is hidden/fail-closed; and the authenticated API accepts no caller-supplied Agent/Owner/policy identity.

This remains outside verify/release-candidate. Release readiness is unchanged: do not merge #30 until protected Windows signing passes after Entra federation is configured and the real Intelligence smoke has sanitized PASS evidence.

[duc15052006-dotcom]

Agent Economy approval privacy + audit hardening merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• fix(economy): hide foreign approval decisions and audit Owner actions #152 fix(economy): hide foreign approval decisions and audit Owner actions
• exact PR head: 48ae61c2219031c44151efe53088709cbaecdc46
• exact-head CI Read a channel cursor with a malformed time as the first page, not a 500 CopilotKit/OpenBot#640 / run 36344730119: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: f66650fbb57fe6bd0e75400091c405a227ccd083

Security fix:

• approval ownership is now checked before revealing whether an immutable payment intent required Owner confirmation;
• foreign ALLOW/DENY intent ids therefore follow the same hidden/forbidden path instead of leaking existence through a distinct 409 response.

Audit hardening:

• successful Owner approvals now emit economy.payment_approved;
• refused approval attempts emit economy.payment_approval_refused;
• unverified/foreign intent ids are intentionally omitted from refusal audit rows;
• audit write failures do not mutate or widen payment authority.

This remains isolated from verify/release-candidate and does not change release readiness.

PR #30 remains blocked only by the two external mandatory gates:

1. create/confirm the matching Entra federated credential and pass protected Windows signing end-to-end;
2. pass the real Intelligence smoke journey with sanitized evidence.

Do not merge #30 into main until both pass.

[duc15052006-dotcom]

Agent Economy execution + receipt durability hardening merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged #153 — fix(economy): bind prepared transfers before execution

• exact PR head: 6cadb8da37163ac0263a520a7464d34b48fc4cfa
• exact-head CI fix: parse separate JSON objects in skill selection replies CopilotKit/OpenBot#641 / run 36345665516: success
• final verify: success
• security fix: adapter-prepared idempotency key, asset, amount and destination are now bound to the immutable intent before executeTransfer().
• a buggy/malicious adapter rewrite is refused before money can move; receipt matching remains as post-execution defense in depth.

Merged #154 — feat(economy): persist verified payment receipts and skip replay

• exact PR head: 664092f25183ed593e7e0a32f37a0f45fc6e1f80
• exact-head CI feat: reliable browser challenge handoff and optional local Chrome CopilotKit/OpenBot#645 / run 36346284516: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• canonical agent_payment_receipts DB store now persists verified receipts idempotently;
• matching durable receipt retries return without another provider execution;
• conflicting durable receipt terms fail closed before adapter/provider access;
• manual Owner payout now goes through execute-and-persist instead of relying on a caller to remember receipt persistence.

New roadmap head:
6948106d760b7203a96c3d2058c100b432c1ca57

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy Circle finality hardening merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• fix(economy): bind Circle finality to configured transfer terms #155 fix(economy): bind Circle finality to configured transfer terms
• exact PR head: f9ff1b3f487970ad4a3d16f6151b5e060ac2cafd
• exact-head CI feat: keep every Bot's provider defaults in one spec file CopilotKit/OpenBot#649 / run 36370966115: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 713c086e821d780722bfac2d4078fc73efb9bbc2

Security change:

• Circle COMPLETE is no longer sufficient by itself to create a verified OpenBot receipt;
• provider finality must match the configured wallet, configured token, prepared destination and prepared amount;
• missing/conflicting provider evidence fails closed;
• regression coverage proves a COMPLETE response with another destination is rejected.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy receipt integrity hardening merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• fix(economy): fail closed on receipt corruption and converge retries #156 fix(economy): fail closed on receipt corruption and converge retries
• exact PR head: 790eab75076ab5a8f97573e09cb38f71c678c4ba
• exact-head CI Keep reconnecting the live screen after it has recovered CopilotKit/OpenBot#651 / run 36371932361: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 378a9ab468db16883419a656dc1e5ed0de012d4c

Security/durability changes:

• a malformed durable receipt row is no longer interpreted as "receipt missing";
• corrupt status/identity/numeric/timestamp evidence fails closed before provider replay;
• concurrent observations of the same immutable external transfer can converge even if local verification timestamp or balance snapshots differ;
• transfer identity and financial terms (intent, Agent, account, provider, external reference, asset, amount, destination) must still match exactly.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy deleted-Agent approval hardening merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• fix(economy): revoke approval authority for deleted Agents #157 fix(economy): revoke approval authority for deleted Agents
• exact PR head: 1d951a08d7907d321fbee1301587d4d22835d482
• exact-head CI Remove the temporary copy when saving a Bot's browser control fails CopilotKit/OpenBot#653 / run 36373281639: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: cb37ca062ed094231da60bcd1c62a466becd0505

Security change:

• soft-deleted Agents can no longer receive new Owner payment approvals;
• persisted approvals for soft-deleted Agents are no longer loadable for execution;
• missing Agent profiles fail closed on approval load;
• deleted-Agent approval attempts stay on the same forbidden/private path and do not expose lifecycle state.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy durable payment audit merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): audit durable payment execution exactly once #158 feat(economy): audit durable payment execution exactly once
• exact PR head: 53c5d141801e8b5425414d6d0463123a1feae938
• exact-head CI Tell a caller why the voice service did not start the call CopilotKit/OpenBot#654 / run 36378287581: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: ef545cca91d055952a7e670c7d960acdaf88766c

Audit/durability changes:

• adds economy.payment_executed;
• the event is written only after a verified receipt is durably persisted;
• receipt persistence now reports whether the row was newly created, so ordinary replay/concurrent convergence does not create duplicate execution events;
• manual Owner payout must provide audit context through the execute-and-persist boundary;
• an audit write outage is logged but does not turn an already-verified, persisted payment into a false client failure.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy Owner payout accounting recovery merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): persist Owner payout accounting transactionally #159 feat(economy): persist Owner payout accounting transactionally
• exact PR head: 5b57cbc3d115b95fedd2e584cc56c8005dcb8383
• exact-head CI Say when the boundary could not be read CopilotKit/OpenBot#656 / run 36396153389: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: f87948be01b53ec303ca2e8ec1d5f00a42f40b50

Durability/accounting changes:

• added a canonical Owner payout accounting store;
• after a verified durable receipt exists, agent_payouts and the settled owner_payout ledger row are persisted in one DB transaction;
• the store resolves and binds the durable verified receipt before accounting;
• retries are idempotent on payout intent + ledger idempotency key;
• a simulated failure after money moved but before payout accounting now recovers on retry without a second provider transfer.

This closes the crash window where external money movement could succeed while Owner payout/ledger history remained incomplete.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy durable intent binding merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• fix(economy): bind payment execution to durable intents #160 fix(economy): bind payment execution to durable intents
• exact PR head: 2894bc1abe1ef68405e88f3eae7afe24e3c96aa3
• exact-head CI Check the runtime health with Bun instead of python3 CopilotKit/OpenBot#659 / run 36401514958: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 84b6aa214ee7c772fe2ecc7c1c7abbdd456177d8

Security changes:

• execute-and-persist now reloads the immutable agent_payment_intents row before receipt replay or provider access;
• Agent, financial account, idempotency key, payment kind, amount, asset, destination, category/x402 domain, provider, policy decision and policy version are bound to durable server state;
• financial account must belong to the same Agent;
• soft-deleted/inactive Agents fail closed;
• durable DENY intents cannot execute;
• caller attempts to alter destination/provider are refused before any balance/prepare/execute adapter call;
• manual Owner payouts now require the same durable-intent binding.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy canonical payment intent creation merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): add canonical server-side payment intent creation #161 feat(economy): add canonical server-side payment intent creation
• exact PR head: 3278403d064ef06b10b84727543eae2937da08b6
• exact-head CI Answer on a plain OpenAI key from the AG2 Bot CopilotKit/OpenBot#661 / run 36419559691: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: cd09e64c9a04d3956430d07d63ad5e192c5300d7

Integrity changes:

• adds the missing canonical creator for immutable agent_payment_intents;
• caller supplies request/account/idempotency/initiator only; decision, reason and policy version are derived server-side from the policy snapshot;
• financial account must belong to the active Agent;
• asset/provider are derived from durable account state;
• caller cannot inject ALLOW / OWNER_CONFIRMATION / DENY directly;
• idempotency replay requires the same request, derived decision and initiator identity; conflicting reuse fails closed.

This complements #160: execution is now bound to durable intent state, and #161 provides the canonical server-authoritative path that creates that durable state.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy server-owned payment policy snapshot hardening merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• fix(economy): keep payment intent policy snapshots server-owned #162 fix(economy): keep payment intent policy snapshots server-owned
• exact PR head: 862ada5ea61e1ab270770a4f2d210cb4e9dc0ad5
• exact-head CI Keep a remote Bot answering when it asks for a learned skill that is not there CopilotKit/OpenBot#663 / run 36421577268: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 08fcdd566aef61a3cc83a14873167a2497d5ef02

Security/integrity changes:

• policy snapshot is no longer supplied inside create(input);
• the snapshot loader is injected at the server-side creator boundary;
• callers therefore cannot fabricate balance, spend-window or policy state to influence ALLOW / OWNER_CONFIRMATION / DENY;
• exact idempotent replay checks immutable request + initiator identity first;
• an existing durable intent is returned without re-evaluating a newer policy, so historical retries stay stable while new policy versions affect only new intents.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy verified child funding persistence merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): persist verified child funding safely #163 feat(economy): persist verified child funding safely
• exact PR head: 9a401cad711cd8f770cb305a2b00ef0a320ae289
• exact-head CI fix: upgrade lodash-es to 4.18.0 (CVE-2026-4800) CopilotKit/OpenBot#671 / run 36425438779: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: ec235e2718047f0319d3acfb523311cf9b28309a

E6 durability/safety changes:

• adds a canonical child-funding persistence store;
• a funding event requires a durable CHILD_FUNDING intent plus a verified receipt;
• receipt destination must match the wallet_reference of a financial account owned by the intended child Agent and using the relationship asset;
• intent/receipt parent Agent, amount and destination are cross-checked;
• the relationship row is locked FOR UPDATE while funded-to-date is recalculated, serializing concurrent completions before relationship-budget enforcement;
• immutable agent_child_funding_events history is written only after those checks pass;
• no schema migration was required; an attempted schema-binding direction was deliberately reverted when CI migration-drift checks rejected hand-authored migration metadata.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy durable financial policy snapshot loader merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): load financial policy snapshots from durable state #164 feat(economy): load financial policy snapshots from durable state
• exact PR head: 252d37e7316453cd431ce5bc640f29c2bbedbcb1
• exact-head CI feat: Bots work as coworkers CopilotKit/OpenBot#673 / run 36439689705: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 67b563f92d156033e4424d769a37f3812a2a6d5f

Production-wiring changes:

• adds the missing DB-backed server-owned policy snapshot loader required by canonical payment-intent creation;
• resolves the latest immutable financial policy for the Agent;
• settled balance comes from durable settled ledger entries for the payment account;
• distributable profit is derived from same-asset durable ledger history;
• rolling 1h / 24h / 30d spend comes from verified payment receipts;
• balance, P&L and spend are asset-scoped so unlike value types are not collapsed;
• malformed/missing account, policy, ledger, receipt or clock evidence fails closed.

This complements #161/#162: canonical payment-intent creation now has a real durable server-owned source for policy/balance/spend instead of requiring request-supplied state.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy canonical Owner payment-intent route merged — 2026-09-28

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): expose canonical Owner payment intent creation #165 feat(economy): expose canonical Owner payment intent creation
• exact PR head: 5243270a78adad9532c12bff3ecd52f9c2770109
• exact-head CI Read OPENBOT_ONE_COMPUTER_EACH from .env in start.sh CopilotKit/OpenBot#676 / run 36442265736: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 5fb651d0b561ed1273c06e3db0a1b3f37772579f

Production wiring changes:

• adds POST /api/economy/payment-intents;
• only the actual human Owner of the Agent may create an Owner-originated intent through this route;
• public Agent visibility does not grant financial authority;
• another Agent's financial account remains hidden;
• amount uses a positive decimal string to avoid JS/JSON integer precision loss;
• client-supplied decision, policy version, snapshot and metadata are never forwarded;
• live server now bootstraps createPaymentIntentCreator(database, createPaymentPolicySnapshotLoader(database)), so decision/balance/spend/policy/asset/provider remain server-derived from durable state.

This closes the production-wiring gap between #161/#162/#164 and the live HTTP server.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy live execution chain advanced through #166–#169 — 2026-09-29

The isolated roadmap/agent-economy branch advanced without changing this release candidate.

Merged sequence:

• feat(economy): resolve live payment adapters from durable accounts #166 feat(economy): resolve live payment adapters from durable accounts
• feat(economy): persist verified operating payment accounting #167 feat(economy): persist verified operating payment accounting
• feat(economy): expose recovery-safe live operating payments #168 feat(economy): expose recovery-safe live operating payments
  • exact PR head: c1d3134c70c83c6dd8ff58aadeb7076e7a85d9d0
  • exact-head CI start.sh and stop.sh cannot see their own processes in Git Bash on Windows CopilotKit/OpenBot#681: success
• feat(economy): expose recovery-safe live Owner payouts #169 feat(economy): expose recovery-safe live Owner payouts
  • exact PR head: 4d67c686906f05d33e15689cb84973d47b85391a
  • exact-head CI harden: constant-time comparison for the supervisor token (CWE-208) CopilotKit/OpenBot#685 / run 36497016219: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success

New roadmap head:

• d25c00b2e4f46acfac243d586776d23ebe3333f7

Production capability now includes:

• durable account → credential-vault → live payment adapter resolution;
• verified operating/X402 execution with durable receipt + settled operating-cost accounting;
• crash/retry recovery without provider double-spend after receipt persistence;
• live Owner payout execution using server-owned same-asset ledger history;
• persisted Owner approval enforcement;
• distributable-profit proof from durable ledger state;
• durable payout + owner-payout ledger accounting;
• HTTP execution dispatch based on durable intent kind while caller-supplied amount/provider/destination remain ignored.

CHILD_FUNDING is still intentionally not live-executed because reservation-before-transfer semantics are not yet complete; recording an over-budget transfer only after money moved would be unsafe.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy recovery-safe live child funding merged — 2026-09-29

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): reserve child funding budget before transfer #170 feat(economy): reserve child funding budget before transfer
  • merged roadmap commit: 4a3877ad65f5582052ca31af14b39e42431b5e41
• feat(economy): expose recovery-safe live child funding #171 feat(economy): expose recovery-safe live child funding
  • exact PR head: 2e4be36d7fdc8410d656b26dee7bc70b55502c41
  • exact-head CI feat(computer): make the policy decision point pluggable CopilotKit/OpenBot#694 / run 36570412115: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: fcce4e41218a681461a0806a614e265a8fb1c2e3

E6 production changes:

• child funding budget is reserved before provider transfer rather than checked only after money moves;
• execution re-validates the durable reservation immediately before external transfer;
• live CHILD_FUNDING dispatch is now wired into the HTTP execution path;
• provider retry uses durable receipt/idempotency behavior to avoid duplicate transfer after a persisted receipt;
• successful funding persists the immutable funding event plus dual-ledger accounting for parent debit and child credit;
• reservation/funding proof is cross-checked against durable intent, child account destination, asset, policy version and verified receipt;
• recovery tests cover post-transfer retries and pre-transfer reservation refusal.

This closes the previously documented reason CHILD_FUNDING was intentionally not live-executed.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy payment reconciliation worker merged — 2026-09-29

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged sequence:

• fix(economy): keep Circle receipts provider-reconcilable #172 fix(economy): keep Circle receipts provider-reconcilable
  • exact PR head: c312474f9ec3abd5b3491858b5094a0e372926c2
  • exact-head CI fix: publish playground source with its Published switch CopilotKit/OpenBot#696 / run 36572507369: success
  • Circle durable receipts now persist the immutable Circle transaction id and can be re-verified after restart.
• feat(economy): reconcile durable payment receipts #173 feat(economy): reconcile durable payment receipts
  • exact PR head: ee6f02056034b0794a36f0a9ab2e9d10b6dcbd16
  • exact-head CI docs: add private security reporting policy CopilotKit/OpenBot#700 / run 36586503429: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 3b18a8ab328d2a24e94cca860255b2980226f000

Reconciliation changes:

• live server runs a bounded, non-overlapping payment reconciliation pass hourly;
• durable verified receipts are re-verified through the same Agent/account/credential adapter boundary used for execution;
• provider evidence mismatch or provider-unavailable outcomes are isolated per receipt;
• failures append economy.payment_reconciliation_failed audit evidence;
• successful checks create no repetitive audit noise;
• audit outage is counted without aborting the reconciliation pass;
• reconciliation never rewrites or deletes immutable receipt/ledger history automatically.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy reconciliation pagination hardening merged — 2026-09-29

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• feat(economy): reconcile durable payment receipts #173 feat(economy): reconcile durable payment receipts
  • exact PR head: ee6f02056034b0794a36f0a9ab2e9d10b6dcbd16
  • exact-head CI docs: add private security reporting policy CopilotKit/OpenBot#700 / run 36586503429: success
• fix(economy): paginate Circle receipt reconciliation #174 fix(economy): paginate Circle receipt reconciliation
  • exact PR head: bcefcbb0b24f65e68940045b202f5a63e90a6ed2
  • exact-head CI Add Parallel search and extraction to OpenBot CopilotKit/OpenBot#701 / run 36588410622: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 6d0bceea00288aaf50cb8f96d6b37145b12b69e3

Hardening changes:

• reconciliation now filters to the provider actually supported by the live resolver (Circle), preventing false failures for unrelated providers;
• stable cursor pagination uses verifiedAt DESC, receiptId DESC;
• runtime carries the cursor across hourly passes so old receipts cannot starve behind the newest batch forever;
• reaching the end clears the cursor so the next cycle starts from newest receipts again;
• provider reconciliation still never rewrites immutable receipt or ledger history automatically.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.

[duc15052006-dotcom]

Agent Economy cluster-safe payment reconciliation merged — 2026-09-29

The isolated roadmap/agent-economy branch advanced again without changing this release candidate.

Merged:

• fix(economy): make payment reconciliation cluster-safe #175 fix(economy): make payment reconciliation cluster-safe
• exact PR head: 6643b546e5b9692332e72ebbb5e82d8c31e36fe9
• exact-head CI Pin dtolnay/rust-toolchain to a master commit CopilotKit/OpenBot#703 / run 36591313007: success
  • format/lint/types: success
  • migrations: success
  • tests: success
  • build: success
  • Windows startup: success
  • macOS startup: success
  • Python harness regressions: success
  • all chart checks: success
  • final verify: success
• new roadmap head: 38e8f03ad03441e8f617abc429d7f37276e63643

Cluster/restart hardening:

• payment reconciliation now runs through the shared durable work_items queue;
• all replicas may offer the UTC-hour sweep, but only one replica can claim and execute it;
• the claim lease is renewed while provider checks are running;
• failed passes release the durable item for retry;
• reconciliation pagination cursor is persisted as immutable economy.payment_reconciliation_checkpoint audit evidence;
• a restarted process or different replica resumes from the same DB-backed checkpoint instead of resetting to newest receipts;
• successful page checkpoint is persisted before the queue item is finished;
• reaching end-of-history persists a complete checkpoint so the next hourly cycle starts from newest receipts again.

This closes the duplicate-cluster execution and in-memory-cursor reset gaps left after #173/#174.

This remains isolated from verify/release-candidate.

PR #30 release readiness is unchanged. Do not merge #30 until both external gates pass:

1. matching Entra federated credential exists and protected Windows signing passes end-to-end;
2. real Intelligence smoke passes with sanitized evidence.