v0.3.0-beta.4

♻️ Refactoring

• Replace bundles with extension kits (#291)

🎉 Features

• Adopt feedback semantics for durable Loops (#290)
• Add complete Loop node lifecycle (#305)

🐛 Bug Fixes

• Assistant-ui version
• Changelog generation (#292)
• Make busy-session inputs durable (#304)

Release Notes

Breaking Changes

Extension kits replace Bundles

The Bundle surface is gone. Extensions are now the single packaging unit, and installing one is inert: it publishes no tools and no resources until you explicitly enable it. Before enabling, you can preview exactly what an extension would publish and inspect what it is publishing right now, and any extension that declares network access must have its network requirement digest confirmed by a person. (#291)

• compozy extension preview <name> shows what enabling would publish without changing state; compozy extension inventory <name> shows the live published inventory. Agents get the same reads through compozy__extensions_preview and compozy__extensions_inventory.
• compozy extension enable|disable|update|install accept --confirm-network-requirement <digest>, so a network-declaring extension cannot start publishing without an explicit confirmation recorded on the install.
• compozy extension secrets set|bind|list|unset manages write-only environment bindings that are scoped per workspace and stored as secret references, never as values.
• Marketplace kinds are now exactly extension, mcp, and skill.

Migration notes: the whole compozy bundle command group is removed (catalog, preview, activate, list, get, deactivate, network-settings), along with the compozy__bundles_* native tools, the compozy__bundles toolset, the bundle marketplace kind, and the Bundle API surfaces. There is no alias — rebuild bundle-shaped setups as extensions and enable them explicitly.

Features

Complete Loop node lifecycle

Loops now have a full declarative failure contract at the node level and precise repair controls at the operator level. Authors classify failures, declare retries with backoff, route errors, absorb them with allow_fail, set attempt timeouts and deadlines, emit on_* effects, and add durable wait nodes. Operators pause, resume, cancel, kill, or requeue individual nodes and list what is waiting, quarantined, retrying, or asking for attention — all from the CLI, HTTP, UDS, native tools, and MCP, without opening the web UI. (#305)

• compozy loop cancel drains a run safely and compozy loop kill closes it immediately; compozy loop node pause|resume|cancel|kill|requeue repairs a single node, and compozy loop nodes --state waiting|quarantined|attention|retrying inventories a run.
• Agents get the same controls through compozy__loop_cancel, compozy__loop_kill, compozy__loop_node_pause, compozy__loop_node_resume, compozy__loop_node_cancel, compozy__loop_node_kill, compozy__loop_node_requeue, and compozy__loop_nodes; compozy__loop_status now reports node lifecycle state.
• Repeated failure on one node quarantines that node instead of terminating the run, so independent lanes keep working, and the failure cause is classified rather than matched from a magic string.
• Long-running Loop-bound sessions are no longer killed on elapsed time. Liveness is judged from real evidence, and prolonged silence raises attention instead of ending the work.
• Defaults are tunable through loops.defaults.delivery.*, loops.defaults.watch.*, and loops.breaker.*, and new blocking lint rules reject invalid routes, impossible timing, malformed effects and waits, and watch sources without a stable identity.

Migration notes: compozy loop stop is deleted — the CLI verb, the HTTP route, and the compozy__loop_stop native tool. Choose cancel or kill explicitly. Extension watch sources must now declare event_key; a source without a stable event identity is rejected before a run starts.

Feedback semantics for durable Loops

A rejected Loop generation no longer restarts blind. The rejection is carried into the next attempt as context, only the producers responsible for it are re-run, and an opt-in ratchet keeps the best-scoring generation instead of losing it to a later regression. Every generation now records its origin, its parent, the gate verdict, the score, and the blocking issues inside claim-fenced transactions, so the CLI, HTTP, UDS, native tools, SSE, and the web UI all read the same durable run truth. (#290)

• Loop templates can read previous.* (including previous.generation and previous.route_causes) and best.* to steer the next attempt from what actually failed.
• Metric gates take a direction — maximize or minimize — plus a min_delta improvement threshold, so a regression is rejected deterministically. Invalid thresholds fail authoring with metric_min_delta_invalid.
• compozy__loop_status and compozy__loop_runs project score, best generation, gate verdict, and generation origin and parentage; run detail, catalog, and recent-runs views render the same fields.
• compozy extension list and compozy extension status accept --workspace, so agents can inspect workspace dev overlays without dropping to raw HTTP.

Migration notes: this is a greenfield hard cut that discards existing Loop run history. The migration clears Loop runs, run events, gate decisions, generation outputs, goal turns and checkpoints, session bindings, and output blobs, along with the task and automation runs that referenced them. Export anything you need before upgrading.

Fixes

Durable inputs for busy sessions

Queue, Steer, and Interrupt are now daemon-owned durable operations instead of client-side intent that could quietly disappear. An input is persisted before it is acknowledged, survives a refresh and a daemon restart, dispatches exactly once in FIFO order, and can be listed, edited, canceled, or promoted to steering by its entry ID from the CLI, HTTP, UDS, native tools, or the extension host. Disruptive changes are fenced against the turn you meant to change, so a stale client cannot interrupt a newer turn. (#304)

• compozy session prompt accepts --queue, --interrupt, and --steer; compozy session input list|edit|steer|cancel manages pending input by its persisted ID.
• The queue is readable and mutable over HTTP and UDS at /api/workspaces/{workspace_id}/sessions/{session_id}/prompt/queue, including per-entry replace, steer, and cancel.
• Agents get compozy__session_inputs_list, compozy__session_input_replace, compozy__session_input_cancel, and compozy__session_input_promote.
• The composer clears only after the daemon acknowledges, a failure keeps your draft, and a refresh reconstructs pending input from the daemon. Queued, steered, interrupted, canceled, accepted, and dropped markers no longer render as warnings, and an expected ACP cancellation no longer appears in the transcript as a provider failure.

Migration notes: the dedicated interrupt endpoint is removed — interrupt is now a prompt mode plus a fenced queue operation. The legacy ACP steer handler and the runtime steer source are removed, and the web client no longer mirrors the queue in local state.

Live changelog and composer fixes

The changelog on compozy.com now reads published releases directly from GitHub at request time instead of depending on a bot pushing a generated page back into main after every release. Each release gets its own page with rendered Markdown, category sections, evidence, compare links, and downloadable assets, plus an RSS feed at /changelog/feed.xml, and releases now appear in site search, the sitemap, and the text feeds that agents read. (#292)

• Typing in the session composer no longer swallows spaces.
• A window-manager WebSocket upgrade that fails for a missing workspace now returns a proper preflight error frame, and the web client refreshes a stale workspace list when it sees that error instead of staying stuck.

Migration notes: the release workflow no longer publishes a site changelog receipt commit, and the generator scripts behind it are removed.