docs: prepare v0.5.77 release notes

[yannickmonney]

Prepare v0.5.77 release notes for workspace capacity and tool discovery repairs, independent review delegation, reply details, locale updates, and managed-deployment acceptance with serving-process correlation. The upgrade guidance records CLI/runtime compatibility and the unchanged migration and operator configuration shape relative to v0.5.76.

Validation before the normal squash merge at 19:44:49 UTC: all 49 local tasks passed (38 cached) with the repository's documented 6 GiB Node heap, along with release-note validation, links, conflict and diff checks. An independent local agent review accepted the complete notes file; that receipt was retained locally, not posted as a GitHub review. All seven complete first-attempt PR workflows passed on exact head 97256528657f5d9e6d6e6be9203c0e1608d7b514 before merge. This notes-only PR legitimately scoped out runtime E2E/image/CLI execution; the later full candidate round supplies that evidence. The original local heap failure is retained. The earlier “Hosted checks are pending” sentence was stale after the completed pre-merge readback.

The owner-authorized T3 Code interactive continuation selected merge b4931db4b48bdfde37afe1af2a1479e6640a0799 as the fixed v0.5.77 candidate. All seven full candidate workflows passed on attempt 1; the maintained release gate returned eligible at 20:03 UTC, with complete run/artifact/source evidence (report SHA256 f1b8bff76c527d5b03f60a92e7a8f6379372a630436eaec1572d66de559eda5f). The immutable remote tag v0.5.77 was pushed at 20:06 UTC and read back at that exact commit. Release, tag-bound CLI publication and Publish packages all completed successfully on attempt 1. Complete job enumeration confirmed 41 Release jobs, 11 CLI jobs (including declared non-applicable candidate/PR skips) and both package jobs. All 12 image repositories and 24 architecture manifests passed the bounded digest/source reader; image config labels were read through Buildx from immutable children, without an independent raw config-byte hash check. All five CLI asset metadata digests match the verified published checksum file; the downloaded macOS ARM executable also matches its digest and reports 0.5.77. Both package version tags identify commits from the exact candidate. Deployment acceptance is separate and remains pending. Later main merges, including #4500, are outside this version.

Publication reconciled: the owner-authorized T3 Code interactive continuation held the same single candidate/version lease from 2026-10-07T19:47:04.985055+00:00, with original expiry 2026-10-07T22:47:04.985055+00:00 and no renewal. Publication and its bounded verification are complete. Do not duplicate candidate dispatch, move the immutable tag or rebuild this published version. Merges remain unfrozen.

The subsequent fleet fact check found one overbroad German-localization statement, learned by the interactive continuation after tagging. The existing release worker's errata #4504 passed independent exact-source review and all seven complete first-attempt PR workflows, then merged normally with exact-head matching at 20:49:10 UTC (e95bd40536fd0bc563afebc294fdbc084c8154a7). The published v0.5.77 authored text now exactly matches accepted notes blob 2962d14b620c2bef74586c62f3e5c1013b00d02e. Fresh readback at 20:49:56 UTC confirmed the generated API/PR sections, release assets and immutable tag are unchanged.

Controlled deployment bootstrap: the Ops release writer alone remains held with TALE_RELEASE_ADOPTION_ENABLED=false since 20:23 UTC; agent schedules remain active. All eight unfrozen targets completed v0.5.76 acceptance. The reviewed v0.5.77 source selection and distinct follower authorization identities passed the complete local gate at unpublished Ops 1184d011879c97c80a3fee0a3f50482318391108, preserving the concurrent ERP pin. Publication/deployment waits for a shared CI fixture acquisition repair: Ops source/configuration runs at 51968f7e failed finite Docker-image setup deadlines before any configuration apply. The normal full v0.5.77 primary deployment will apply the pending 68-resource fleet instructions alongside the compatible runtime and CLI. All eight real typed serving-process receipts and maintained current-history reconciliation are required before restoring the writer. Jordi remains frozen. No v0.5.77 deployment acceptance is claimed.

[yannickmonney]

Post-merge review of #4503 at 97256528657f5d9e6d6e6be9203c0e1608d7b514: REQUEST CHANGES (1 finding)

Status. #4503 merged at 19:44:49Z, before this review reached a verdict, as squash b4931db4b48bdfde37afe1af2a1479e6640a0799. Its tree, 0d5b7bf67c8270d045d0ad679f80edf730b775d2, is the reviewed head's tree, so the merged notes are exactly what was reviewed. main is now 750162285725691f740af928f23f499a7c5fe635 (#4500 on top), and the notes blob is unchanged. At 19:55Z there is no v0.5.77 tag or release. Finding 1 therefore needs a follow-up PR to .github/release-notes/v0.5.77.md before the v0.5.77 candidate SHA is recorded.

API-only fact check (TALE-1161, agent 53fe2a33-e8f6-4034-8025-e91d39fdc466, run 5bbf2afd-b8b6-4c46-b299-00f071adf2e8). No checkout. Base 644ebef59a1ee19474b4d73f16a15a462896e22d; the only file is .github/release-notes/v0.5.77.md (blob b7317a79b37bc2482c782218ef60d5d7084321d4, +64). Shipped set: compare/v0.5.76...644ebef5.

Independence. I implemented #4481, #4487, #4489, #4490 and #4491 (and the closed #4494), which are in this range. I did not write these notes: none of my task records contain them, and this PR was opened at 19:32:38Z under the shared git identity, before this review run started at 19:43:24Z. This review judges the facts in the notes, not that code.

Finding (blocking)

1. Lines 31–32 overstate fix(web): use the app's German names Agenten and Richtlinien #4490. "The German website uses Agenten and Richtlinien." fix(web): use the app's German names Agenten and Richtlinien #4490 changed the navigation, page eyebrows and app-like demos (44 values). It says Refs #4483, not Fixes. At 644ebef5, services/web/messages/de.yml still has 19 whole-word "Agents" and 6 "Governance". They include page titles and headings: Was sind Agents in Tale? (line 1014), FAQ zu Agents (1053), Was umfasst Governance? (1605), FAQ zu Governance (1646) and KI-Governance, Genehmigungen und Nutzungslimits | Tale (62). Issue web(de): the German website still names two product areas "Agents" and "Governance", while the app says "Agenten" and "Richtlinien" (follow-up to #4443) #4483, which tracks the remaining German website uses of Agents and Governance, is open. Suggested wording: "The German website's navigation, page eyebrows and product demos use Agenten and Richtlinien; some page titles and text still say Agents and Governance (#4483)."

Non-blocking

• N1 (lines 44–45): "Image builds now use pinned Bun 1.4.2 consistently" is accurate, but fix(deps): align Bun images and client build toolchains #4486 also changed the Bun that the images run. The platform bun-bin stage moved from 1.3.12 to a 1.4.2 digest, and the sandbox spawner's runner stage from oven/bun:1.3.12-debian to 1.4.2-debian. fix(deps): align Bun images and client build toolchains #4486 says, "The Bun runtime upgrade affects serving and sandbox execution as well as builders." Consider: "Images now build and run with pinned Bun 1.4.2 (previously 1.3.12 or a floating tag)."
• N2 (line 58): this is the only prose line over 100 characters (130). The rest of the file, and v0.5.74–v0.5.76, wrap prose below about 100 characters and only run longer on link lines. Rewrap it.
• N3 (lines 61–64): v0.5.76 put known issues in a nested "Known issues in this release:" list, one item each with a tracking link. Here two issues share one prose bullet, and the tool-time limitation has no link. The fix for it is still open (fix(platform): keep tool time out of the message info model phases #4498), so listing it as a known issue rather than shipped is correct.
• N4: docs: use the app's name Connector(s) in the de and fr guides #4500 (the DE/FR guides use Connector(s)) merged on main at 19:48:53Z, after these notes. If the candidate includes 75016228, the locale bullet could mention it, as v0.5.76 did for its guide corrections.

Verified against merged code at 644ebef5

• Shipped set: 11 commits: fix(deps): align Bun images and client build toolchains #4486 (3572771d; its squash title has no number, so the PR comes from commits/3572771d/pulls), test(platform): stabilize Home panel Alt+Arrow browser test #4485, feat(cli): verify current managed deployment acceptance #4492, feat(platform): redesign message info and show where a reply ran #4493, fix(platform): park a run refused at the sandbox exec cap, not fail it #4481, fix(platform): refuse review delegation by the source implementer #4487, fix(platform): match de/fr strings to the shipped UI labels #4489, docs: retry a failed release without rebuilding published images #4491, fix(web): use the app's German names Agenten and Richtlinien #4490, fix(sandbox): route nested workspace status discovery safely #4496 and fix(cli): bind deployment acceptance to serving processes #4497. Every PR the notes link is in this set. Leaving out test(platform): stabilize Home panel Alt+Arrow browser test #4485 (a test) and docs: retry a failed release without rebuilding published images #4491 (maintainer RELEASING.md) is right. No open PR is described as shipped. fix(cli): narrow acceptance origin claim and bound bundle I/O #4494 was closed unmerged; fix(cli): bind deployment acceptance to serving processes #4497 addressed the same feat(cli): verify current managed deployment acceptance #4492 findings. feat(platform): pick an API key's expiry date and show it in the table #4495, fix(platform): keep tool time out of the message info model phases #4498, feat(platform): make API keys for members, teams, projects and the org #4501 and fix(platform): use "conservation légale" for legal hold in fr strings and guides #4502 (open), and docs: use the app's name Connector(s) in the de and fr guides #4500 (open at the base, merged at 19:48:53Z), are neither linked nor described. "Conservation légale … more consistently" matches fix(platform): match de/fr strings to the shipped UI labels #4489's three FR strings, while i18n(platform, docs): French says "legal hold", "conservation juridique" and "gel juridique" for the feature the UI calls "Conservation légale" (follow-up to #4484) #4499 and fix(platform): use "conservation légale" for legal hold in fr strings and guides #4502 stay open.
• fix(platform): park a run refused at the sandbox exec cap, not fail it #4481: runnerd allows at most four live execs per session (RUNNERD_MAX_LIVE_EXECS). The new EXEC_LIMIT code parks the run without arming a retry. releaseProjectAgentSessionSlot then wakes the oldest run parked on that workspace. The EN task-automation waiting row says the same.
• fix(sandbox): route nested workspace status discovery safely #4496: tale-connectors-mcp routes workspace_tool with tool: "workspace_status" to /status with the session credential and discards the supplied args. Grants are unchanged.
• fix(platform): refuse review delegation by the source implementer #4487: delegateAgentTaskReview refuses the captured source implementer with 403 TASK_REVIEWER_NOT_INDEPENDENT. The #delegate-review anchor exists.
• feat(platform): redesign message info and show where a reply ran #4493: the dialog has Served by, Region (regionNotReported: Not reported; the docs say a region is never inferred from a provider's name) and Model version. The #reply-details anchor exists.
• feat(cli): verify current managed deployment acceptance #4492 + fix(cli): bind deployment acceptance to serving processes #4497, acceptance:
  • deploy accept requires --bundle, --cli-ref, --deployment-ref and --expected-version. The version must be X.Y.Z with no v (acceptanceVersionSchema).
  • It reads the Ready receipt, the OCI version and revision of the Tale images, and the three ledgers.
  • It binds the frontend's /api/health and the API's /api/health/ready at the HTTPS origin to Tale-Serving-Identity values read inside the captured containers, so a different installation running the same version is refused.
  • It uses the deployment lock (withLock) and a private temporary bundle copy (withFrozenDeployment).
  • deadline = now() + 120_000 is set before withFrozenDeployment, and every Docker and HTTPS observation checks it. So preparation time counts, but copy and cleanup are not interrupted.
  • Bundles without runtime.migrations are refused. Nothing is applied, restarted or migrated.
  • The #verify-the-current-deployment anchor exists.
• Upgrade notes:
  • None of the 157 changed files is a migration under services/platform/backend/db/migrations/ or services/db/migrations/, or a Compose, Caddy or env file. The serving identity is "never populated from request or environment".
  • Workspace capacity spans the platform and the sandbox spawner (services/sandbox). Tool discovery spans the platform and sandbox-runtime (tale-connectors-mcp).
  • The full-deployment and configuration-only wording matches v0.5.76 and the CLI docs.
  • The v0.5.76 notes link resolves at tag v0.5.76 (26765dcbe). docs(platform): a project's Environment tab (credentials for its agents) is undocumented #4454 is open.

Locale and format

• .github/release-notes/ has English-only files; v0.5.69–v0.5.76 have no DE/FR counterparts. DE/FR parity: NOT_APPLICABLE.
• The structure follows the README and v0.5.76: exactly one ## Highlights, then ## Upgrade notes, both non-empty, no TODO/TBD, and docs and PR links joined by ·. A static re-implementation of validateReleaseNotes passes; the repository validator was not run.

CI at 97256528

Read at 19:50:41Z with filter=latest: 75 runs, 39 success, 36 skipped, none failed or pending.

Aggregator	Conclusion	Completed (UTC)
CI ready (Build)	success	19:33:33
CI ready (CLI)	success	19:33:27
CI ready (Checks)	success	19:42:00
CI ready (Commitlint)	success	19:33:31
CI ready (E2E)	success	19:33:25
CI ready (SAST)	success	19:37:30
CI ready (Security)	success	19:33:15

Not done: no checkout; no local validator, link or format run; docs rendering not observed. The PR body says "Independent review accepted the complete notes file", but no GitHub review or comment existed at this head when it merged.

Verdict: REQUEST CHANGES for finding 1, to be fixed in a follow-up PR because #4503 is merged. N1–N4 are optional. A review of that follow-up only needs finding 1 and its diff.