What's new

New

• relevo handover <name> --to <machine> gives a binding to another synced machine, named by its id or label: it pushes the branch and releases the worktree, and that machine continues with relevo bind --resume. #1255
• relevo takeover <name> --force takes a binding from a machine that is gone. When that machine comes back it stops writing the binding, and relevo db sync status there counts the changes the takeover set aside. #1255
• relevo db sync enable --as <installation> --yes lets a rebuilt machine continue as the one it replaces. It is refused while that identity is still in use: it synced in the last 24 hours, or another machine claims it. #1255
• Every round and its check run with RELEVO_BASE set to the commit the binding started from, so a check can test only what changed, even in a server's worktree, which has no origin/main. #1280

Changed

• Cloud sync's remote log moves to a new format that relevo before v0.19.0 cannot read: an older machine refuses the remote and writes nothing, so upgrade all your synced machines together. #1255
• relevo unbind refuses a binding whose worktree was kept for uncommitted changes and names --force; relevo unbind --done leaves such a binding DONE and clears it once its tree is clean. Server bindings follow the same rule. #1283
• relevo refuses agy at tier edit and points at --tier yolo or --tier harness, because headless agy at that tier denies every shell command. An agy reader therefore lands at yolo and needs --allow-yolo. #1278
• relevo config set refuses a new field under agents.<name> or actors.<name> that nothing reads, and lists the known ones; outcomes on an agent points at the actor's outputs, where outcomes are declared. #1256
• When a chain step branches on an outcome its actor does not declare, such as a custom reviewer's verdict, relevo prints the relevo config set actors.<actor>.outputs command that declares it. #1256
• relevo send --dry-run says where the round's tier came from: --tier, or the binding, whose tier is fixed at bind, so picking up a config change takes a rebind. #1257

Fixed

• A Claude runner at tier read or edit, such as the shipped planner, lite-planner or a chain's reviewer, can read its own round prompt and a chain's staged plan and inputs; before, its round halted or reviewed blind. #1257 #1271
• An agy runner at tier read can read its own round prompt, which sits outside the directories agy may open; relevo gives it a copy inside the round's output directory. #1270
• relevo chain --resume --reviewer-actor, or --planner-actor or --security-actor, switches that step to the new actor; before, it failed with internal and left the chain stuck at running. #1263
• A chain resume that fails now leaves the chain as it was, and relevo stop <chain> ends a chain stuck at running whose member is gone, after which relevo done works. #1263
• A chain step that halted because every candidate of its actor was gated resumes with relevo chain --resume alone; before, you had to relevo stop the member first. #1272
• After relevo done on a binding with uncommitted changes, relevo send and relevo bind --resume work on it again; the daemon no longer deletes its directory, and a server no longer removes the kept worktree later. #1269
• On a fresh machine, relevo db sync enable with the R2 flags and a passphrase no longer refuses with no R2 credentials; it uses the bucket the flags name. #1264
• After relevo db sync enable, or a daemon start with sync on, the daemon syncs every 30 seconds for five minutes; a machine that had just joined used to wait five minutes between its first two syncs. #1281
• A database write that met a concurrent commit at the wrong moment no longer fails outright; relevo rolls the connection back and retries, so the next command does not inherit a stuck connection either. #1287

New

• relevo setup is a first-run wizard: it checks which harnesses are logged in, asks what is still open, installs the configuration, agent files, plugin and service, then proves them with one real round. An agent can drive it with --answer. #1211
• relevo db sync unlock turns your passphrase into the key that signs what this machine sends, so a machine that has unlocked refuses an entry with a bad signature; unlock --new creates the key on a remote that has none. #1160
• Your config now syncs between your machines, while the fields that name one machine's own paths and host stay on it. relevo config set --local keeps any other value on one machine on purpose. #1167
• Rate-limit gates, consent answers, hook scripts and the agent files relevo config agents writes sync too, so a new machine gets them from one enable and a gate set on one machine holds on all. #1173
• Provider availability and latency history syncs as well, so every machine's views show the whole fleet's last 30 days instead of only what that machine saw itself. #1175
• relevo db sync invite prints a join code, and a new machine joins your sync fleet with relevo db sync enable --join-stdin and the passphrase; the secrets it needs travel encrypted. #1203
• relevo db sync rekey changes your sync fleet's passphrase, and the old one can no longer get an entry accepted. Every other machine stops syncing until you run relevo db sync unlock there with the new passphrase. #1238
• relevo config repo set|unset|list stores per-repository settings: a name, a gate and a board_theme. A repository's gate applies unless you pass --gate or --no-gate. #1198 #1204
• A --worktree or --branch bind, or a chain, started in a subdirectory runs its rounds and its check in the same subdirectory of the new worktree, so a package in a monorepo can be worked on alone. #1200
• --ticket accepts issue keys such as ENG-42, GitLab issue URLs and any other http(s) URL, where before only GitHub forms parsed and a GitLab subgroup URL was stored wrong. #1193
• A writer actor's comments: true scope, the librarian's, now judges comment-only edits in 25 languages instead of Go alone, so a comment fix in Python, TypeScript or Rust no longer fails the round. #1197
• Board palettes are edited with relevo config get|set|unset themes.<name> and sync with the rest of your config. The board takes its theme from --theme, then the repository's board_theme. #1201
• The Claude Code band draws a [ done ] button on a finished round that runs relevo done for you. It has no hotkey, so a stray key cannot close a binding. #1205

Changed

• relevo no longer assumes it runs on its own repository: a chain runs with no check unless you set one, and the guide no longer tells the MasterMind to run make check. #1192
• A writer scoped to @docs, such as the librarian, can now also edit reStructuredText and AsciiDoc: .rst, .adoc and .asciidoc files. #1192
• relevo bind --branch now also fetches from the repository's only remote when there is no origin; with several remotes and none of them origin, it refuses and names them. #1192
• A policy_refused refusal, such as a --candidate the builder actor does not list, now prints next: relevo config, so the way out is on screen. #1187
• relevo doctor prints the claude plugin marketplace add fuad-daoud/relevo and claude plugin install relevo@relevo commands when the plugin is missing, instead of telling you to enable it. #1187
• relevo mastermind init from a plain terminal says to run it from the MasterMind's own session, where before it said only to pass --kind and --session. #1187
• relevo gate <provider> now also gates that provider on the servers running your remote bindings, where before the server kept the round on the gated candidate. A failed forward ends with the relevo gate --serve line to run by hand. #1179
• relevo db sync pull prints each origin it holds, with the reason, and next: relevo db sync status; a held origin used to be silent. #1180
• Other synced machines see a remote round's log once the round closes, not while it runs; while it runs, the log is kept in a file instead of being rewritten and re-sent to sync as it grows. #1196
• The shipped opencode and codex readers carry no model pin, so they run on the session's model. relevo config agents replaces a pinned file you never edited without --force. #1206
• The shipped plan-executor agents tell builders to iterate on the static checks and the packages they touched, and to run the full check once, instead of running the whole check after every edit. #1177
• A server-run chain round that reports done with its work uncommitted now halts the chain, and a remote round's report names the snapshot ref that holds such work, so it is not landed without it. #1232

Fixed

• A builder that exits fast with no report, such as a logged-out harness, in a repository you have uncommitted changes in now switches candidate; before, relevo halted it as a worktree escape. #1208
• A builder whose stream was cut off mid-turn, by a provider error for instance, now switches to the next candidate straight away instead of being nudged to resume the broken session. #1232
• A chain reviewer's findings file is kept instead of being replaced by its two-line final message, so the correction planner gets the findings. #1183
• Planners and reviewers in a chain can read plan files that exist only on the base branch, where before a plan not yet on the chain's own branch was out of their reach. #1183
• History names the builder that actually ran each round and lists a server round's switches, each once; before, a round with no entry of its own showed the binding's current candidate. #1181
• The reviewer in a chain sees the check the engine ran, not the builder's own earlier record of it, so it no longer reads a red check that the trace shows green. #1181
• After a laptop resume, an unreachable server no longer stalls the daemon for minutes; sync, gates and delivery keep running, and the daemon tries the server again a minute later. #1182
• relevo db sync status reports the month's usage correctly: a joining machine's bytes are counted once, and Turso storage is measured from the remote's log, not from the local replica file. #1180
• Sync files are created readable by you alone, and existing ones are repaired when the daemon starts, so another user on the machine cannot read your synced data. #1180
• The idle daemon does less work and holds less memory, most of all with many Claude Code sessions open, each of which polls it for its own bindings. #1191 #1186
• A daemon whose state root was deleted and re-created now exits, instead of running on for days and logging a failed tick every two seconds. #1184
• relevo daemon stop no longer refuses with database is locked by another process when there is a daemon to stop. With no daemon it prints no daemon is running. #1207
• On a machine with no MasterMind yet, relevo status and relevo status --chains list nothing and relevo status --line prints relevo: no MasterMind yet, where each used to refuse. #1211 #1224
• relevo status --name given a chain member's name shows that member's chain, so the waiting-on-you notice's own hint works; a finished chain's member also says that relevo done clears it. #1226
• In a headless claude -p MasterMind, the wait tool returns the round's report itself; before, it answered delivered by the mod, and a script reading the session's output never saw the report. #1221
• relevo doctor reads Claude Code's plugin state from CLAUDE_CONFIG_DIR when you set it, and its claude and codex login rows follow CLAUDE_CONFIG_DIR and CODEX_HOME, instead of always looking in your home directory. #1224
• A workflow chain's start line names the command its check steps run and where it came from, such as --gate or the repository setting; it used to print check: none for every local chain. #1224
• A done or stopped chain's status bar shows its status instead of its last step; a halted one shows halted <step>, because the bar takes the place of the status word. #1177
• Running the removed relevo stats or relevo tab now points at relevo ui :stats or relevo ui :rounds; the old hints named history flags that no longer exist. #1177
• A relevo started inside another relevo's round no longer hangs on git, where the two git shims called each other forever and the round's check waited out its timeouts. #1177
• A bind or chain on a server no longer fails with gitfile does not point to a valid repository when the server's clean-up of unused repositories ran while the bind was being set up. #1234
• With sync on, the local replica's write-ahead log no longer grows without bound until the disk fills; relevo checkpoints it once it gets large, after a push or pull. #1236
• Unbinding and binding again under the same name no longer makes your other synced machines drop that whole sync batch, and each machine's first sync after upgrading replays the batches it had dropped. #1240 #1243
• relevo db sync unlock now sends the secrets a machine already held, such as its R2 credentials, so a machine that joins with relevo db sync enable --join-stdin gets them instead of failing for want of them. #1247
• With sync on, unbinding a binding or deleting a chain now removes its events from your other machines too, and relevo db sync reconcile without --dry-run now repairs the sync log, removing what earlier deletes left behind. #1251

New

• Cloud sync can keep large values in your own R2 bucket instead of the Turso log: give relevo db sync enable the bucket with --r2-endpoint, --r2-bucket, --r2-key-id and --r2-secret-stdin. #1111
• Each machine compacts its own sync log, so the log no longer grows without bound, and a machine that joins late catches up from a snapshot. #1120
• relevo db sync status now also shows this month's Turso and R2 usage against their quotas, and relevo db sync enable refuses a join that would use up the Turso traffic left, unless you pass --yes. #1111 #1120 #1134
• relevo db sync reconcile --dry-run lists what a reconcile would send and writes nothing. #1120
• relevo service install and relevo service uninstall set up and remove the daemon's service unit from the binary, with no repository files needed. #1155
• relevo update refreshes a service unit you have not edited, and relevo doctor has a service row that says whether the unit is current. #1155

Changed

• A reader writes its output file (plan.md, findings.md) itself and relevo keeps it as written; the last message is saved only when the file is missing, and relevo show --output says so. Run relevo config agents --force after upgrading. #1130
• relevo gate accepts the full harness/provider/model#effort token that relevo's own halt text prints, and a provider, a group or group@account. #1135
• Writer rounds refuse git stash, because every worktree of a repository shares one stash and parallel builders swapped each other's work. The refusal covers container rounds on a server too. #1146 #1151
• relevo stop on a halted chain says that relevo done <chain> closes it, and every halt names both ways out: resume, or done. #1128
• relevo chain --resume --gate <cmd> on a chain whose check ran out of repairs now reruns the check under the new command instead of halting again. #1128
• relevo chain --resume --from <step> now reaches a chain running on a server. #1129
• Refusals that read internal with next: relevo bugreport now carry their own code and a next: command; relevo wait on a binding that does not exist, for example, answers binding_not_found. #1135 #1143
• relevo db sync pull and push during a backoff answer backing_off, with the time of the next try and next: relevo db sync retry. #1135

Fixed

• relevo show --gate on a server-run chain's builder round prints the whole check log, where it stopped after the first stages; a log that is cut is marked partial. #1132
• A chain's check on a builder placed on a server no longer halts as a lost run while the server is still answering. #1129
• A chain run on a server records its real start times, steps and queue waits on your machine, and leaves no phantom open round. #1137
• A chain reader no longer meets a prompt, report or gate log that was moved into the database before it opened it; the chain hands it a copy. #1114
• A builder's closing report with a list item that wraps onto a second line no longer halts the chain with tail: line N has no ':'. #1121
• After relevo update, a daemon whose binary was replaced during its own start now restarts onto the new one instead of staying on the old. #1125
• The daemon answers commands while it runs its one-time start-up work, so a large database no longer makes the first command fail after 15 seconds. #1133
• A database file that is mostly freed pages is compacted when the daemon starts, so the disk space comes back. #1142
• relevo bugreport masks your git name and email wherever they appear. #1136
• A limit that says it resets in weeks, such as resets in 16d, gates until the reset; before, anything past seven days gated for an hour. #1135
• A bare relevo db sync enable uses the token you stored, so running it again resumes an interrupted join. #1134
• relevo db sync enable no longer loses rows written while it joins, and a joining machine no longer loops reading the bucket over and over. #1158
• Cloud sync no longer re-sends unchanged rows every few seconds on an idle machine. #1156
• Round history damaged by v0.17.1, with start times zeroed and outcomes reading done_no_report, is rebuilt on the daemon's first start. #1156
• A MasterMind left gone after a crash re-attaches from its own session, and relevo status says the MasterMind is gone and to run relevo mastermind init, instead of reporting a live push route. #1144
• The daemon holds less memory, and its service unit asks systemd-oomd to stop something else first. #1145

New

• relevo chain runs an ordered list of plans through build, check, review and correct with no MasterMind turn in between, and tells the MasterMind once when it finishes or halts. --security adds a scan after the last plan. #767
• A chain's check is explicit: --gate <cmd> and --no-gate set it, --regate <n> sets how many repairs a red check may spend, and a round with no check says No check ran instead of passing as green. #773
• A chain can place its builder on a server, as relevo bind does, while its readers stay on your machine. #785
• relevo chain --server <name> hands the whole chain to one server, so your machine can switch off once the server accepts it. #790
• relevo chain --workflow <name|file.yaml> runs your own graph of steps instead of the default; --param k=v fills its parameters and --dry-run prints the resolved graph without starting anything. #827 #860
• relevo config workflow add|edit|rm|show saves workflows by name, and a workflow can fork sub-chains and merge their results. #860 #880
• A chain on a server carries its workflow with it, and the server checks that workflow against its own actors before it creates anything. #896
• relevo chain --resume --from <step> re-enters a halted chain at a step you choose. #860
• The cockpit has a :chains view and a Workflows section in its settings, and relevo status --chains prints the same chain list. #881
• relevo status --mastermind <name|id> and --all-masterminds pick whose bindings to show, and one rule decides the set for every status format; an ambiguous identity is refused naming --mastermind. #939
• A running round's row in relevo status and the status line says what the runner is doing, such as exploring, stalled or gating, and carries the round's live diff. #825
• In a Claude Code that loads plugin mods, relevo push delivers reports into the session on their own, so you no longer need a background command to wait for them. #1064 #1077 #1091
• A band above the prompt lists the bindings that need you and the rest of the fleet, and each row's next-move button drafts the command for you without sending it. #1094 #1095 #1098 #1099 #1100
• The plugin's tools include a blocking wait, so tools-mode Claude Code closes a round without a background shell. #883
• The plugin installs and starts without the relevo binary on PATH: its hooks do nothing, and its commands and tools print how to install relevo. #842
• The shipped librarian actor writes documentation only. #832 #855
• A writer actor can declare a scope of path patterns; a round whose diff leaves it halts at NEEDS YOU, and the check does not run. #837
• An accounts config section lists several logins for one harness; when one hits its limit, the candidate moves to the next login before relevo tries another candidate. #771 #774 #775 #776 #778
• relevo history --by account groups rounds by login, relevo status names the account a runner used, and relevo doctor checks each login. #777
• relevo board opens a local board for the repository in your browser and saves its Excalidraw scene with a companion .svg that agents can read. #826
• relevo board --mastermind <name> opens a live board that belongs to one MasterMind and lives outside the repository; relevo board promote copies it into the repository as board.html. #863 #872
• A board can also be a single-file board.html page, which relevo board serves in a sandboxed frame. #925
• relevo board comment adds a comment to a board and relevo board comments lists them; relevo board annotate and relevo board text let an agent write to and read a scene. #865
• relevo serve can run each owner's rounds as that owner's own unix user, with isolation set to user in policy.serve and relevo serve enroll --user, so tenants cannot read each other's worktrees. #815 #824 #853
• With isolation set to container, relevo serve runs each round in a rootless podman container instead. #875
• Cloud sync keeps your machines' history in step through your own Turso database. It is off until you run relevo db sync enable, and relevo db sync disable turns it off and keeps every row. #1065
• relevo db sync status shows the backlog, the last exchange and any held or dropped entries, and relevo db sync retry clears a latched error. #1065
• Sync no longer waits for a fixed schedule: it exports when something changed, at most every 15 seconds, and pulls more often while other machines are active. #1088
• relevo db query '<SQL>' runs one read-only statement against relevo's database, which the daemon's lock keeps sqlite3 out of. #807
• relevo db rename-repo --from <url> --to <url> repairs history after a GitHub rename split a repository in two. #1085
• relevo db relabel sets the feature label on finished bindings, so the stats Features view stops listing them under (no feature). #1092

Changed

• relevo's database moved to the Turso engine. The first start converts it and keeps the old file as relevo.db.pre-turso. #807
• An auto-started daemon exits after 10 minutes idle, and relevo daemon stop stops one. #810
• relevo bind --branch fetches the branch from origin when it is not local. #973
• relevo serve picks up candidate, policy and account changes without a restart. #974
• A reader round that ends without its deliverable is continued up to twice and then halts, instead of saving a stray sentence as its output. #873
• relevo bugreport takes --title and --body, and cuts the file to GitHub's body limit. #783
• relevo status and the cockpit's fleet view build only the bindings in scope, so they open sooner on a machine with hundreds of bindings. #1044 #1059
• The stats Repos tab folds repositories with no remote into one scratch row. #1074
• A config write that drops a candidate an actor names is refused unless you pass --force. #1083
• A finished chain shows as one row in relevo status until relevo done releases it, and a round a chain consumed no longer reads as an unread report. #833 #809
• A report lists each candidate switch of its closing round as a Switch: line. #935
• relevo bind follows a GitHub rename: a repository relevo already knows under its old URL keeps its history instead of splitting in two. #1085
• The librarian draws diagrams as SVG, not Mermaid. #928
• The MasterMind guide lists the exit codes of relevo wait: 0, 2, 3, 4, 5, 6 and 124. #943

Removed

• The Claude Code channel transport is gone: relevo mcp serves tools only, and --mode and --interval are removed. #1064
• relevo no longer reads the MasterMind's own Claude transcript, so a Claude MasterMind's chat column shows -. #842

Fixed

• A provider outage (a 5xx or UNAVAILABLE error behind a no-report exit) gates for a timed window instead of until cleared. Credit exhaustion gates until cleared, with a top-up note. #942 #944 #971
• An out-of-memory-killed round no longer gates its candidate; relevo re-queues it, and every report of it says killed: out of memory. #786 #848
• A gate recorded as until-cleared with resets in 51m30s in its reason now lifts when that time passes. #879
• Bad input to bind, chain, send and show (a missing plan, an invalid name, a round that does not exist, --server with --cwd) answers a refusal with its own code, not internal and next: relevo bugreport. #814 #820 #857 #879
• A relevo config set value that relevo refuses answers config_invalid with next: relevo config edit. #1070
• relevo unbind <name> --dry-run is refused instead of unbinding for real; --dry-run goes with --done or --sweep. #868
• After a changes verdict, the builder now receives the correction plan, and the reviewer judges the plan's whole diff instead of one round. #779 #784
• A chain's reviewer, correction planner and security member are handed files that exist, and the security scan sees the chain's whole diff. #781 #787
• A reviewer's verdict: is found in any relevo block, survives a recap after it, and still counts when the block lost its fences, so a pass no longer halts the chain as no verdict. #780 #784 #806 #924
• A chain reader no longer closes on its done marker before its final message arrives, which halted chains with no verdict. #856 #870
• A reader's saved output holds its review rather than a closing recap, and a chain reviewer whose verdict parsed records its round as done, not unstructured. #809 #818 #845
• relevo done and relevo unbind refuse a running chain's member, which used to leave the chain waiting for ever. #772
• relevo chain --resume onto a member round that is still open is refused with next: relevo stop <member> and writes nothing. #788
• relevo chain --resume closes a member round whose process died, so a chain no longer stays wedged on it. #806
• Resuming a chain under a new --gate re-sends the step's own text, not the stale repair prompt that named the old check. #806
• relevo doctor reads OpenCode 2.x permission rules, so a working setup no longer gets a false warning. #806
• relevo done on a server chain releases its local mirror, and a resumed chain no longer pushes a stale NEEDS YOU from its earlier halt. #809 #817
• relevo done on a server chain that the server has already released settles the local mirror instead of staying at NEEDS YOU. #869
• A server chain's builder shows its live round in relevo show --transcript and the cockpit, and --round names a reader's open round. #836 #912
• A chain's writer gets a round cap scaled to the chain, and relevo show <member> --transcript defaults to the open round. #871
• relevo chain --resume and relevo done on a chain row from an older relevo convert it, or refuse with next: relevo status <chain>, never internal. #895 #913 #972
• relevo stop on a halted chain ends its open member round. #913
• A writer round that closes with a dirty tree and no new commit halts the chain instead of advancing it. #914
• With --regate 0, a red check halts the chain or routes it to correction instead of passing review. #914
• relevo wait --name <chain> collects every member's payload with halts first, and the chain row names a member still holding one. #987
• A server chain's local mirror no longer runs the check itself and halts the chain falsely every tick, and a manual round after the chain is done is collected. #1067
• A halt that fails to queue is retried on the next tick, where it used to leave the round stuck and every send refused. #991 #1018 #1036
• relevo wait returns the waited round's report last and labels a halt as a halt, and no longer prints an empty not delivered earlier (). #986 #991 #1012
• A halt written because a server was unreachable clears once the server answers, and a server's own reason replaces it. #1009 #1027 #1033 #1035 #1043 #1050
• A running relevo wait no longer looks dead while a slow sync runs. #1009
• A served round whose builder broke now halts your machine with the server's reason, and a resend to it is refused, instead of showing as running. A round that never started no longer holds a server slot. #1016 #1017 #1028 #1034 #1038 #1043 #1050
• A report pushed to OpenCode or agy that is never read no longer blocks the queue: after a time limit it falls back to wait, and an OpenCode push is retried first. #831 #919 #920 #992 #1011 #1015
• relevo show confirms a pending report or findings entry only when it printed that entry's content, and wait --peek no longer counts as a waiter. #922 #979 #1010
• A cockpit history row reads the archive, and an archived read on a name that is live is not found rather than the live binding's open rounds. #981 #1019
• relevo wait exits 0 for a round that closed with its marker even when the note records a failed check, a scope refusal or an escape; a round stopped before its marker exits 2. #934 #980
• An oversize result of the MCP wait tool returns each entry's text or --peek pointers, with the waited round last. #922
• A server round's note, switch history, tokens and dirty-work note arrive on your machine for each round, not as the newest round's values. #994 #1013 #1026 #1037
• relevo done on a remote binding the server has already released settles locally instead of failing with not found. #1066
• relevo send to a server retries once when building the git bundle runs past its time budget. #1066
• A remote round that finished after being re-sent over NEEDS YOU now closes on your machine; before, relevo status stayed at NEEDS YOU and relevo wait exited at once. #878
• A switch-resend frees the old round's scope before the replacement starts, and a scope collision no longer gates the candidate. #1068
• Stale halts clear when a round revives, and relevo done delivers a payload still pending at done. #1068
• A runner whose spawn fails silently now halts with an entry instead of reading as started. #982
• A stalled live runner whose output ends in a rate-limit message now gates its candidate mid-round. #921
• Hooks fire only after the state they report has been saved. #921
• A repeated round-cap halt no longer replaces the reason relevo already told the MasterMind. #1020
• relevo serve status marks a row whose binding is gone instead of failing the whole verb with binding not found. #945
• A busy owner on a server no longer stalls other owners' rounds. #923
• relevo's temp files and the TMPDIR of runner children live under the state directory, so a full /tmp quota no longer kills relevo wait or relevo send. #877 #978
• A machine-only secret such as client.key is no longer replaced by a stray copy from the shared database file, which had halted bindings on a server; the halt now says the binding was deleted there or the key changed. #1084
• A git call that hits its deadline names the command it killed. #977
• A daemon restart for an upgrade no longer cuts off an answer that was already committed. #791

New

• relevo bind --actor <reader> binds a reader actor like a builder. Send it a plan; each round runs in a scratch copy, so your tree stays untouched, and leaves its output for relevo show --output. #606 #609 #604 #605 #613
• relevo bind --server <name> --actor <reader> runs a reader on a server and fetches its output back to your machine. #641
• relevo show --artifacts lists the files a reader round left, and relevo show --artifact <rel> prints one. policy.artifact_max_mb caps their size. #610
• The cockpit's round view has an artifacts tab for reader rounds, listing the files and opening each one. #612
• A session becomes a MasterMind only in a repository you said yes to. relevo mastermind enable --repo or disable --repo remembers the answer, and relevo mastermind reset asks again. #634
• An actor's placement list names where it runs, this machine or a server, and relevo bind takes the first that is available. --local forces this machine. #745 #742 #743 #763
• relevo bugreport gathers a redacted report of a failure on your machine and prints the gh issue create line to file it. Nothing is sent unless you pass --gh. #716 #729
• relevo config server key --enroll-line prints only the enrolment line, ready to paste to a server admin. #601
• relevo send --candidate re-points a halted remote round at another candidate and keeps its round number and plan. #698
• A claude candidate takes an effort suffix, as in opus:medium. relevo config init adds the planner and lite-planner reader actors, because claude plans and is never seeded as a builder. #590
• relevo config agents installs the shipped read-only security-reviewer, which audits a diff or an area and returns its findings. #677
• relevo config agents also installs custom agents written once in your config, on every harness. --agent <name> installs one. #583
• Transcripts show a builder's thinking, marked ∴, where its harness streams it. #557
• relevo show --transcript and the cockpit stamp each event with its time and duration. #696
• Every verb answers one JSON document with --json, errors carry a code and a next: command, and relevo help --json lists every verb. #695
• The cockpit's :candidates, :actors and :agents views edit candidates, actor order and agent files without hand-editing the config. #510
• :audit lists config changes by day, and R rolls back to an earlier revision; a rollback that would break the config is refused. #520
• :settings lists every policy setting with its default, opens a form per group, and r resets a setting. It also adds, edits and deletes notify webhooks. #524 #554
• :servers lists each remote server with its health and adds, edits, deletes and re-checks servers. The client key is never shown there. #747
• On an actor's page, tab moves to its placement list, where shift+up, shift+down, d and a reorder, remove and add servers. #749
• :candidates lists live gates on providers no candidate uses, so a renamed or deleted provider's gate can be cleared with u. #568

Changed

• --builder is now --candidate on bind and send, config agents --role is --agent, and config init --no-roles is --no-agents. Output and guides say runner, actor and candidate. #599 #597 #600 #602 #603
• The interactive session is relevo mastermind, not relevo planner, with --mastermind in place of the planner flags. A round's input is its prompt, read with relevo show --prompt. #633
• A fresh relevo bind needs --feature <label> or --no-feature, and --ticket <ref> records the issue a binding serves. #638
• relevo send refuses while a round's report is on disk but not yet delivered, instead of overwriting the plan and starting a second builder. #528
• A headless builder that ends its turn without a report is resumed once with a nudge, instead of switching candidate. #529
• relevo's commands go through one background daemon, started on demand, and only it opens the database. A command waits briefly while the daemon is still starting. #712 #711 #713 #736
• Bulk history is stored compressed, so the database and its backups are smaller. relevo converts existing history once, on the daemon's first start. #675
• The status line and the OpenCode sidebar show the actor and one status word, with the clock last. A row that needs you says why. #549
• The status line and the OpenCode sidebar name the candidate a row runs on, as relevo status does, not the harness. #617
• A reader's delivered output reads ARTIFACT IN in status, where a builder's still reads REPORT IN. #649
• A reader's summary.md holds only its output, without the status block, so it can be sent on as it is. #624
• The OpenCode plugin's first binding tab is prompt, read with relevo show --prompt, where it was plan. #651
• :agents marks an agent file you edited as edit + newer when relevo ships a newer copy, and says a reset brings that copy in. #575
• When only claude is on PATH, relevo config init lists the harnesses that can provide a builder, so the next step is clear. #618
• In :stats, the repos tab expands each repository in place to its features and tickets, and the separate feature and ticket tables are gone. #666 #668
• relevo refuses to write a round's log, stream or plan file through a symbolic link in its state directory, so a planted link cannot redirect what it writes. A server refuses a symlinked reader output file too. #697 #723 #726 #727 #689
• relevo reads each round from its own record and ignores a file in a binding's state directory that takes a round-file name. #700 #737
• A stored tier above the policy's max_tier refuses to launch unless you pass --allow-yolo, so a saved tier cannot raise a runner's permissions on its own. #699
• A server refuses a binding whose candidate its actor does not serve, instead of falling back to another candidate. #688
• A relevo config write that would leave the config unloadable is refused before anything changes, such as unsetting an agent an actor still names. #691
• A request signed for one remote server is refused by every other server. Upgrade servers before clients; relevo serve needs --public-host unless it has a certificate. #741

Removed

• relevo ask is gone: it prints that and exits 2. Bind a reader actor with relevo bind --actor reviewer and send it a plan instead. #611
• relevo land, relevo review and bind --from are removed, because nothing used them. #512
• relevo edge is removed, so a closing round no longer fires edges. Bindings saved with edges still load. #515
• relevo history and relevo serve status always print JSON, and history --tab, history --stats and the other text-report flags are gone. Read the figures in the cockpit. #516
• relevo migrate is removed, so a relay-era install can no longer upgrade in place; it starts as a fresh relevo. #664

Fixed

• A binding whose candidate was edited or deleted is switched off a gated provider and picks again on its next round, instead of failing to start. #511
• Commands no longer fail with busy or state lock still held under load, and a slow remote server no longer blocks other commands. #541 #536 #538 #547 #555 #628
• Config changes and rollbacks show at once in every cockpit view, including changes made from another terminal, with no restart. #565
• A quota or denial message from an earlier builder in the same round no longer gates the provider the current builder uses. #553
• A builder killed when the machine runs out of memory is re-queued on the same candidate, not failed. #596
• relevo deletes the OpenCode sessions it abandons, so a reboot no longer resumes several writers on one worktree. #587
• An OpenCode provider 429 or out-of-credits error gates the provider instead of reading as "exited without a report". #620
• A limit that resets in days, such as resets in 1d 5h, waits for that reset instead of retrying after an hour. #626
• Provider limits are read only from the harness's own error output, so text the model writes cannot put a provider on limit. #692
• relevo gate on a remote server finds a provider the two machines name differently, instead of failing with candidate not found. #622
• A server added with relevo config server add works at once, without a daemon restart, so its bindings no longer stay on running. #623
• relevo serve init repairs an install whose state root is missing, so the fix line relevo doctor prints works. #636
• relevo stop says whether it killed, reaped or found the round gone, and relevo send no longer starts a round beside an orphaned runner. #627
• A round that relevo kills reads as killed, not exit code 143. #631
• A reader round sent right after the previous one closes no longer fails with "Failed to change directory". #614
• An OpenCode builder in a repository with no answer yet is no longer handed the MasterMind consent question. #646 #663
• OpenCode tools find the calling MasterMind, so relevo status lists its bindings instead of an empty list. #648
• The OpenCode NEEDS YOU hint says who is working and why the binding needs you. #563
• The OpenCode plugin's log tab shows each round's log entries, where it always read (no log). #724
• Retry in the cockpit finds the newest round's prompt, so it retries the right round. #647
• The fleet and round views name the round that reported and end a cut gated line with …. #556
• In :stats, pressing space or → on a repository with no features or tickets says so, instead of doing nothing. #670
• relevo gate --help shows the flag as a duration, -for duration. #630
• relevo serve status --json reports the builder cap from serve.max_builders, where it always used the CPU count. #537
• The relevo serve start-up log no longer warns of a builder tier that denies every tool when rounds run at yolo. #574
• Messages pending for the MasterMind are no longer lost or delivered twice, and relevo show claims a pending message unless you pass --peek. #690
• A payload already pushed into an agent session is not delivered again by relevo show or relevo wait, and no longer shows as NEEDS YOU on a live route. #752 #762
• Two relevo daemon starts at the same moment no longer fail on a first run: the second exits with "already running". #704
• The idle daemon uses much less CPU and memory, and no longer grows until the system kills it. #748 #753
• relevo opens its database at the right path when the state root contains #, ? or %, instead of cutting the path short. #699
• A finished remote round no longer halts with a bad object error when git's background maintenance runs as the round closes. #728
• A remote round whose builder amended or rebased its branch closes and keeps its report, instead of retrying the same fetch for ever. #751
• A remote round whose bundle keeps failing to fetch halts as NEEDS YOU after ten tries, and the halt names the server and the error. #764
• send --force carries a planner seed over the size cap to a remote server, where it was refused even with --force. #725
• A round report whose commands_run entry has escaped quotes or an apostrophe is read as a structured report, with its commands listed. #733
• An install whose client key predates the rename to relevo keeps working through the upgrade, and relevo daemon --preflight accepts that key. #734
• On a machine with more than one relevo installation, a session another installation registered no longer answers for this one. #755