v3.2.1

Full Changelog: v3.2.0...v3.2.1

v3.2.0

Full Changelog: v3.1.0...v3.2.0

v3.1.0 — Agentic Prompt-Engineering Audit P1 Closure

Minor release closing nine P1 findings from the 2026-05-07 agentic-system prompt-engineering audit (H6 through H14) plus an orchestrator run-agent hardening pass. Every change is backward-compatible — new fields and deps are optional, pre-H callers unchanged.

Added

• H6 — Typed event payloads + runtime guards in @team-x/shared-types/events. Consumers can now discriminate by kind with full type narrowing instead of casting through unknown.
• H7 — Per-employee monthly token caps in budget-governance-service. Set-backed scope membership makes cap evaluation O(1) per check instead of scanning the assignment list each turn.
• H10 — work.failed payload schema in agentic-loop-service. Every failure now carries threadId / employeeId / messageId so downstream audit, telemetry, and the self-improvement loop can attribute the failure without re-querying.
• H13 — Copilot insight severity ceiling in copilot-analyzer-service. MAX_CRITICAL_DRAFTS_PER_TICK = 2 plus a pure applyCriticalCeiling helper bounds the critical-alert surface: overflow drafts get downgraded to warning (signal preserved, alert fatigue bounded). New criticalProposed / criticalDowngraded telemetry counters, zero-init on every early-exit path. +11 tests (7 helper + 4 service integration).
• H14 — Copilot category-weight feedback loop closure. New pure aggregateCategoryWeightsFromDismissals helper produces a complete updated weights map plus an audit trail of changed categories. New opt-in autoApplyDismissalFeedback toggle: when ON, the loop persists weights via setCopilotWeights, emits copilot.weights.changed with actorKind='employee' / actorId='system-copilot', and returns feedbackApplied instead of the advisory feedbackSuggestion. Defensive fallbacks — missing setter, setter-throws, and empty aggregation all degrade to the advisory path with console.warn. +13 tests (6 aggregator + 5 auto-apply integration + 2 advisory pins).

Changed

• H8 — Retrieval orchestrator dedup-by-ref plus a freshness-bias scoring term so identical citations collapse and recent context outranks stale matches at equal cosine distance.
• H9 — Intelligence loop uses bounded exponential backoff with a max-attempts guard so a flapping downstream can never spin the loop indefinitely.
• H11 — Agentic tools enforce a tool-result size cap on the default chat path. Runaway tool responses return a truncation marker instead of unbounded text.
• H12 — Agent-improvement service dedupes by causation-chain root and adds a recursion-via-DB block so self-improvement runs cannot chain into themselves through the events table.
• Orchestrator run-agent hardening (apps/desktop/src/main/orchestrator/run-agent.ts). Companion tests expanded by ~318 lines in run-agent.test.ts.
• Release-marker freeze pinned to 3.1.0 across all 7 workspace package.json files. Test guard in top-bar.test.tsx updated in lock-step.
• Documentation URL canonicalization — README, CONTRIBUTING, getting-started docs, the static landing site, and the strategia-official role-pack now point at github.com/Git-Rocky-Stack/Team-X. Clone-and-cd snippets corrected to cd Team-X for case-sensitive filesystems.

Fixed

• Per H10, work-failure events that previously surfaced without threadId are now always attributed to their originating thread.
• Per H13, ticks that previously produced an unbounded number of severity: critical insights are now capped at 2 per tick with the surplus downgraded rather than dropped.

Verification

Audit doc: docs/audits/2026-05-07-agentic-system-prompt-engineering-audit.md — all H6-H14 entries marked Resolved.

Workspace	Tests
@team-x/desktop	2141/2141 (1 pre-existing keytar native-ABI fail, not H-attributable)
@team-x/intelligence	210/210
@team-x/shared-types	74/74
Net new across H6-H14	+24

Typecheck clean across all four tsconfig projects.

---

Audit trail: every H<n> finding ships with implementation + a dedicated describe block in tests (string audit 2026-05-07 is greppable) + audit-doc resolution entry. See CHANGELOG.md [3.1.0] for the full per-finding breakdown.

v3.0.0 — Agentic System Enhancement · Settings UX Repairs · System-Employee Top-Up

Major release in two halves: a four-fix sweep across Settings + system bootstrap that
restores user-visible features Rocky filed as broken (copilot.ask error for pre-M33
companies, dead proactive-mode toggle, missing Skill / MCP install entry points,
no way to delete old backups), and a three-track agentic-system enhancement that
replaces three load-bearing stubs with their real implementations (Enhanced AI's
LLM provider, workload-aware delegation signals, the /promote natural-language
command). The composition root for the main process now wires every authored
service that was sitting on the shelf — verified by a comprehensive
authored-vs-wired audit across 119 service files and ~290 IPC channels.
Tests 2051/2053 passing (every targeted suite green; the two pre-existing
failures are a keytar native-ABI mismatch and a release-marker drift now
resolved by this bump). Typecheck clean across all four tsconfig projects.

Added

• Authority Snapshot install entry points
  (apps/desktop/src/renderer/src/features/settings/extensions-section.tsx).
  Two new buttons — Add Skill and Add MCP — surface in the card header.
  Each opens the existing InstallSkillDialog / ImportMcpDialog, both of
  which had shipped fully-working but were not exposed from the new Settings
  page (the previous shell had a banner explaining marketplace installs were
  removed "until the replacement flow can be engineered without risking the
  whole page" — this is that replacement). CLI extensions deferred pending
  the agentic system design pass; EXTENSION_KINDS remains ['skill', 'mcp'].
  Test guard flipped from not.toContain('InstallSkillDialog') to
  toContain with the right wiring shape (extensions-section.test.tsx:89-115).
• Backup delete IPC + UX
  (apps/desktop/src/main/services/backup.ts,
  packages/shared-types/src/ipc.ts,
  apps/desktop/src/main/ipc/handlers.ts,
  apps/desktop/src/main/ipc/register.ts,
  apps/desktop/src/preload/api.ts,
  apps/desktop/src/renderer/src/hooks/use-backup.ts,
  apps/desktop/src/renderer/src/features/settings/backup-section.tsx).
  Full-stack add: service delete(backupPath) method with a path-traversal
  safety guard (path.relative from backupsDir rejects .. traversal,
  absolute paths on different drives, the jail itself, and empty strings),
  BackupDeleteRequest / BackupDeleteResponse shared types, backup.delete
  channel registered alongside backup.create / backup.restore / backup.list,
  preload method, useDeleteBackup hook with ['backups'] cache invalidation,
  and a Trash2 icon button per row in the BackupSection with a confirm
  flow that's mutually exclusive with the existing Restore confirm. Six new
  unit tests cover the happy path, idempotent missing-path delete, four
  traversal-guard cases (backup.test.ts:188-243).
• Boot-time system-employee top-up
  (apps/desktop/src/main/index.ts:1437-1470).
  The per-company boot loop now idempotently runs ensureSystemAgent +
  ensureSystemCopilot for every live company. Pre-M33 companies — created
  via M31 paths before ensureSystemCopilot landed — now get their missing
  system-copilot row on first boot after the upgrade. Without this top-up,
  copilot.ask threw [copilot-service] No system-copilot employee for company "<id>". Did ensureSystemCopilot run on company creation? for any
  company that predated M33. Errors per-company are logged + swallowed so a
  single broken company can't block boot for the rest. New regression test
  system-agent-bootstrap.test.ts simulates the pre-M33 state (agent row
  exists, copilot row missing) and asserts the agent row stays untouched
  while the copilot row gets created.

Changed

• Enhanced AI now uses the real LLM provider
  (apps/desktop/src/main/index.ts:1189-1248).
  The M32 placeholder llmComplete that returned the literal string
  (LLM response not configured) regardless of input is gone. Replaced with
  an adapter that resolves the first live company's system-agent, threads
  it through the same resolveProvider closure the agentic loop and copilot
  analyzer use (test-mode → canned; production → runtime profile + secrets),
  and accumulates streamAgent deltas into a single text blob — same shape
  the WriteSideCompleteFn adapter uses at line ~1862. All 7 enhancedAi.*
  IPC channels (enhancedAi.stats, enhancedAi.query,
  enhancedAi.indexWithSemanticChunking, enhancedAi.extractAndStoreFacts,
  enhancedAi.queryKnowledge, enhancedAi.createPlan, enhancedAi.getStats)
  now return real LLM output when the user has configured a provider. Test-mode
  and unconfigured-mode paths unchanged (still gated by
  llmEnabled && ragService !== null).
• Workload-aware delegation has real signals
  (apps/desktop/src/main/index.ts:1810-1859).
  WriteSideWorkloadProvider.inMeeting(employeeId) now reads the active
  meeting via meetingsRepo.getActive(companyId), parses attendeesJson,
  and tests membership — replacing the () => false stub that always told
  the planner every employee was available.
  avgCompletionMs(employeeId, _subtaskType) aggregates closedAt - createdAt
  across all closed tickets the candidate was the assignee on (clamped against
  the 48-hour pastPerformanceCeilingMs default). Returns null for new
  hires so they're not penalized (preserves the planner's neutral 0.5
  default). Subtask-type filtering is forward-compat: parameter accepted,
  ignored in V1 — ticket labels do not yet carry a subtask-type taxonomy.
  Both implementations wrap in try/catch → conservative defaults
  (false / null) on repo errors. Result: decompose_project and
  delegate_subtask tools score candidates with real load + history instead
  of always-available + no-history.
• /promote works in the command palette
  (apps/desktop/src/main/index.ts:2329-2342,
  apps/desktop/src/main/services/command-service.ts).
  The CommandService dispatcher's employeesPromote slot was unwired despite
  the IPC handler shipping in M-C step d (employees.promote registered at
  register.ts:687, exercised by employees-promote-handlers.test.ts).
  Result: typing promote Alice to CTO in the palette returned
  handler_error. Now wired with a shape adapter — classifier emits
  {employeeId, roleId, newLevel}, IPC takes {employeeId, newRoleId},
  newLevel is discarded because the IPC handler derives the level from
  the role spec (single source of truth, no divergence risk).
• Release-marker freeze pinned to 3.0.0
  (apps/desktop/src/renderer/src/app/top-bar.test.tsx:44-47).
  APP_RELEASE_VERSION, PACKAGE_RELEASE_VERSION, SHARED_TYPES_RELEASE_VERSION,
  INTELLIGENCE_RELEASE_VERSION all unified at 3.0.0. Resolves the v2.0.10-era
  drift where APP_RELEASE_VERSION was still '2.0.9' after the workspace
  shipped at 2.0.10.

Fixed

• Proactive mode toggle no longer snap-backs
  (apps/desktop/src/main/index.ts:1994-2078).
  ProactiveTriggerService was authored at
  apps/desktop/src/main/services/proactive-trigger-service.ts, referenced
  by 4 IPC handlers (proactive.setEnabled, proactive.decomposeGoal,
  proactive.scanForWork, proactive.getState), and never instantiated
  in the composition root. Every proactive.* IPC fell through to
  throw new Error('[ipc] proactive.<method>: proactiveTriggerService dep is required'). The renderer's optimistic Switch caught the throw and
  reverted to OFF on every flip. Fix: createProactiveTriggerService(...)
  is now instantiated right after createAgenticLoopService, and the IPC
  handler deps include a lazy-resolver wrapper (matches the existing
  copilotAnalyzerService pattern at line 1364) so the trigger service
  can come online after createIpcHandlers is composed. The wrapper closes
  over a module-level proactiveTriggerServiceInstance: ProactiveTriggerService | null
  declared next to agenticLoopServiceInstance.

Audited (no changes)

• Authored-vs-wired audit across 119 service files in
  apps/desktop/src/main/services/, ~290 IPC channels in
  register.ts REQUEST_CHANNELS / handlers.ts IpcHandlers / shared-types
  ChannelMap, and 20+ optional handler deps. Confirmed the
  ProactiveTriggerService gap was the only fully-unwired service.
  Other findings (workload-signal stubs, Enhanced AI LLM stub, missing
  /promote dispatcher entry) are addressed by this release; remaining
  intentional deferments (classifier complete stub at index.ts:1467,
  the companies.archive clear hookup for copilotEventWindow.clear —
  which IS wired despite a stale comment at line 1227) are documented and
  unchanged. No drift in registry consistency: every channel in
  REQUEST_CHANNELS has a matching ipcMain.handle registration; every
  IpcHandlers method has a matching channel; every ChannelMap entry has
  a backing handler.

---

v2.0.10 — Typography Cascade · Orchestrator Retry · Settings UX

Three-part release: a workspace-wide typography master format that
collapses ~1,500 ad-hoc text-*/tracking-* classes onto 20 semantic
tokens, a transparent retry path in the orchestrator that absorbs
transient fetch failed flakes against the local Ollama daemon, and
five surgical Settings UX fixes covering broken switches, invisible
checkboxes, and a chooser whose Button wrapper was outranking the
.brand-selected primitive. Tests 1978/1978 passing (up from 1959
— +18 new for orchestrator retry + +1 for proactive persistence
regression). Typecheck clean across all four tsconfig projects.

Added

• Orchestrator transient-fetch retry (apps/desktop/src/main/orchestrator/).
  New transient-errors.ts module classifies undici TypeError("fetch failed"), ECONNRESET, ECONNREFUSED, ETIMEDOUT, and the undici
  UND_ERR_* codes by walking up to 5 levels of error.cause. The
  predicate short-circuits on AbortError so user-cancelled runs never
  hit the retry path. runAgent now wraps the stream-draining block in
  a 2-attempt loop (1 initial + 1 retry, 200 ms backoff) that fires
  only when zero chunks have streamed — preventing duplicated
  output to an open message bubble. When retries exhaust, the
  user-visible error becomes "Provider connection dropped. Please retry, or switch to a different provider in Settings." with the
  original error preserved on Error.cause for forensics. Repro:
  three fetch failed runs in the user's runs table — all <150 ms,
  all isolated incidents during otherwise-successful sessions against
  ollama-local + gemma4:31b-cloud — would each have been absorbed.
• 18 new orchestrator tests — 12 transient-errors.test.ts (positive
  matches: bare TypeError, surrounding whitespace, cause-chain depth 1+2,
  undici codes, ETIMEDOUT; negatives: AbortError, named AbortError,
  HTTP-status errors, unrelated errors, non-Error throws,
  self-referential cause loop) plus 6 run-agent.test.ts retry-path
  cases (success-after-retry without event duplication, exhausted
  retries with friendly message, no-retry-after-chunks-streamed,
  no-retry-on-HTTP-status, no-retry-on-pre-aborted-signal, original
  error preserved as cause).

Changed

• Typography master-format cascade. tailwind.config.ts gains 13
  theme.extend.fontSize semantic tokens generating text-display,
  text-h1–text-h4, text-body, text-body-strong, text-body-sm,
  text-caption, text-label, text-button, text-button-sm, and
  text-menu-item — each tuple specifying size + line height +
  letter-spacing + font weight together. globals.css adds 8 component
  utilities: .text-eyebrow (11 px uppercase 0.18em),
  .text-eyebrow-sm, .text-menu-label, .text-shortcut, .text-code
  (13 px mono), .text-code-sm, .text-numeric (24 px tabular-nums),
  .text-numeric-lg (32 px). Twelve shadcn primitives refactored to
  consume the new tokens at the bottom of the cascade — Button now
  uses text-button, CardTitle text-h3, CardDescription
text-body-sm, Dialog/Sheet titles text-h3, DropdownMenuItem
text-menu-item, Input/Textarea drop the responsive
  md:text-sm jump in favour of text-body, Label text-label leading-none, TabsTrigger text-button-sm, AlertTitle
text-h4, AlertDescription text-body-sm,
  SelectTrigger/SelectLabel/SelectItem, and Badge
text-caption font-semibold. Top-of-cascade shells (top-bar.tsx,
  sidenav.tsx, mission-shell.tsx, mission-control-dashboard.tsx,
  settings-view.tsx, audit-view.tsx, extensions-section.tsx,
  permissions-section.tsx, plus ~90 feature files) consolidated to
  the canonical token set. Net effect: 9 different "eyebrow" recipes
  collapsed to one text-eyebrow token; 6 different tracking-*
  patterns baked into the per-token definitions; broken hierarchy
  fixed (Settings page heading was 14 px / same size as buttons —
  now correctly text-h1 at 28 px).

Fixed

• Enhanced AI Settings — 7 hand-rolled toggles invisible in dark mode
  (enhanced-ai-section.tsx). The off-state used bg-surface-100 for
  the track and bg-background for the thumb; both resolve to
  near-black in AMOLED, rendering as a featureless black blob.
  Replaced all seven (Query Expansion, Semantic Chunking, Long-Term
  Memory, Knowledge Graph, Multi-Turn Planning, Streaming Responses,
  Distributed Tracing) with the canonical <Switch> primitive, which
  uses bg-input (HSL 0 0% 14.9%) for a visible mid-gray track
  matching the rest of the app. Multi-Turn Planning and Distributed
  Tracing keep className="mt-5" to preserve title-text alignment in
  their items-start rows. Dropped the now-unused handleToggle
  helper.
• Active Authority Grants permission labels lower-case
  (extensions-section.tsx, permissions-section.tsx). Permission
  badges rendered the raw 'allow' | 'deny' | 'prompt' enum values.
  Added typed PERMISSION_LABEL: Record<AuthorityPermission, string>
  in extensions-section (TypeScript exhaustiveness for free) and a
  formatPermission(permission: string): string helper in
  permissions-section (respecting that file's no-shared-types import
  rule). Both badges now render Allow, Deny, Prompt.
• Copilot Allowed Categories checkboxes rendering browser-blue
  (copilot-section.tsx). Native <input type="checkbox"> was
  inheriting Chromium's default check colour. Added accent-brand
  (the same canonical pattern already in call-meeting-dialog.tsx),
  which maps the CSS accent-color property to the registered
  brand: '#AA2024' token.
• Proactive Mode toggle didn't persist (handlers.ts,
  proactive-handlers.test.ts). The IPC handler called
  proactiveTriggerService.setEnabled which only mutated an in-memory
  per-company disabledCompanies Set; the renderer's getter read
  proactive_enabled from the SQLite settings table which stayed
  false. After the optimistic switch flipped, react-query
  invalidation refetched the unchanged DB value and the
  useEffect/optimistic reset snapped the thumb back. Fix: handler
  now persists via settingsRepo.setProactive({ enabled }) first,
  then forwards to the trigger service. Both sources of truth move
  together; on a subsequent load the global gate isEnabled()
  (settings.enabled AND NOT disabledCompanies.has(companyId)) finally
  returns true. New regression test asserts both setProactive calls
  fire (ON and OFF) for the toggle UX.
• Autonomy Policy chooser only showed a thin red ring
  (extensions-section.tsx). Wrapping <Button variant="outline">
  applied utilities border-input (mid-gray) and bg-background
  (black). Tailwind's layer order is base < components < utilities,
  so those utilities outranked .brand-selected's component-layer
  border-color and background-color rules — only the box-shadow
  (which Button doesn't set) made it through, leaving a lonely 1 px
  inset red ring on a black box with a gray border. Replaced with a
  plain <button> matching the Runtime Strategy chooser pattern
  verbatim. The selected state now shows the full thicker red bezel,
  translucent red fill, and 12 px outer red glow that
  .brand-selected was always meant to deliver.

---