Changelog

​

Routines reads as an operator console

​

Scheduled work goes through the durable queue

​

Provenance you can trust, evidence you can share

​

A Keeper approval now grants what was approved

​

Three new ways to pay for models

​

Backups tell the truth

​

Updates

• CLI: the routines surface the UI had — routine calendar, routine executions, routine artifacts (with --download), routine run --fire-at/--pinned-version/--async (understands the 202 IN_PROGRESS receipt; --wait follows it) and routine save --trigger-inputs — plus routine webhooks --ingress-profile crewship|github and routine webhooks fire, a signed test delivery with the receipt printed back.
• CLI: memory inventory --agent|--crew lists the knowledge documents the server actually reads; run insights --agent/--crew scope the fleet aggregate; issue list --counts; page project panel-history --publication; workspace update --pages-theme; work list --agent accepts a slug (an unknown slug is refused with suggestions, not an empty page).
• Dashboard “Needs your attention” counts are exact — GET /api/v1/inbox returns active_by_kind and the dashboard counts from it instead of the inbox’s 100-row window; durations over an hour roll over to hours; colourless crews rotate the chart palette.
• The nightly gate now fails on WCAG regressions — the axe wcag2a/wcag2aa scan replaced an unread drift report, and contrast regressions across the dashboard, crews, routines, credentials, settings, admin and chat surfaces are fixed.
• Routine inputs and recovery rules are visible before starting work — accepted types and ranges on run forms, configured checks and failure handling in recipe details, retained evidence and duration/attempt diagnostics on runs.
• Newly extracted user-model facts keep their source evidence — quote, message, source type and time stored beside the model file, surfaced with --provenance, and purged by every delete path.
• The published OpenAPI document names the fields the rows actually carry — client_review_required on issue rows, optional assignee_slug, code_links, execution projections, agents’ ask_forms and suggested_prompts — pinned by a schema-keys contract test.
• Ask about this Page opens an unsent agent chat draft; the reference survives a refused or disconnected send and is consumed only when the message is saved.

​

Fixes

• A detached still-running exec no longer reads as success. When the agent CLI’s stream ends while the process lives on, the run is monitored until it truly terminates and resolves with its real exit code; an unconfirmed stop holds the agent’s run slot (ErrAgentDetachedBusy) until the runtime is confirmed gone — a stop attempt is not a stop confirmation.
• Agentless routine runs settle SUCCEEDED, not FAILED — a run with no agent step had nobody to report an outcome, so every clean completion was recorded as a failure and success-keyed consumers read zero.
• Confirmed webhook stops appear as cancelled in run history — captured usage survives settlement retries, and only the dispatcher’s confirmed outcome can finish a work-owned run; a retried history write never reruns the agent.
• Pending guaranteed-memory writes are reconciled at boot, before the server accepts requests; startup fails rather than admitting a second writer over an unresolved file.
• Webhook delivery receipts receive their documented retention sweep on boot and daily; a non-terminal work item keeps its receipt and payload regardless of age.
• Routine approval waiting displays as a waiting status, not a red failure alert — actual failures keep their diagnostics.
• Routine Edit again exposes approval questions and named decision actions, including approvals in nested loops and hooks; changes stay drafts until publication.
• Routine step details again offer Test with captured run data — folded transforms and map selection reach the same testing surface.
• Agents return to online after simultaneous detached-run completions — the last-hold decision retires completed peers atomically.
• Reassigning a previously removed provider key works without a manual runtime restart; sidecar reuse checks live credential counts, and provider logins survive the periodic credential check.
• Z.AI Coding Plan usage is labelled as subscription usage — zero per-call prices are no longer presented as precise monetary estimates.
• Solo agents report model usage and observe credential revocation — sidecar IPC is initialised for non-lead agents with no peers.

​

Pages: folders, one editor, and applications you review before they go live

​

Routines: one workspace, a calendar, and edits that cannot break a plan

​

Work that survives a crash, and a stop that means stopped

​

Incoming webhooks, and messages between people

​

Crews, credentials and issues

​

The phone is a first-class way to run Crewship

​

Updates

• The two daily memory sweeps can be run now — crewship admin memory sync user-model|peer-cards [--all] [--dry-run].
• An agent reports whether its credential actually authenticates its model — crewship agent credential-readiness <agent> (ready / missing / unknown), computed by the runtime’s own delivery rules.
• Routine waits take typed decision forms on the web, in the inbox and from the CLI, and a rejection or an approved answer can be recovered.
• The Docker image is verified before it is promoted — boot, health and the embedded UI, per platform by its immutable digest, with the runtime’s security packages refreshed at publication. dev.sh status says when a workstation serves old code.
• -f yaml prints the same keys as -f json on every command, and crewship work get -f yaml no longer panics.
• Building from source needs Go 1.27 — the go.mod floor moved from 1.26 because a dependency required it.

​

Fixes

• A GDPR erasure now unnames the subject on every workspace-scoped table (~40 columns): credentials they created pass to a custodian with a REATTRIBUTED audit event, grants and invitations are revoked, history columns are anonymised.
• An agent turn-limit failure no longer appears as a generic process exit; the cause and the turn count survive a nonzero exit.
• docker rmi crewship-cache:* no longer triggers eighty provisions a second — a cache hit is confirmed against the daemon, and a rebuild loop stops after three attempts with a clear error.
• An agent re-saving a routine without a description no longer erases it; step environments and arguments are bounded before allocation.
• The approval gate’s queue row no longer carries the raw prompt — a scrubbed preview sits in payload.review, and because the gate’s arguments are also its reward-tuning fingerprint, auto-tuning can finally reach its quorum for agent_run.
• Five BackupTables entries no table backs are gone, each a silent no-op on every restore; a schema guard now checks the list both ways.
• Two OSV advisories that turned main red overnight (sharp’s bundled libheif, grpc) are cleared.

​

The answer to a credential ask is a grant, not a value

​

Issues and routines: the reliability track landed

​

The web app reads as a product

​

What the journal keeps, and who may read what

​

Updates

• crewship seed ships three real demo packs, and seed verify proves them. A nightly CI watch over this repository’s scheduled workflows, a docs-drift audit, and a site replica delegated across four agents — each a crew with its own scripts, routines, page and issues. seed verify runs every pack end to end and checks the agents against independent probes. See Demo packs.
• The rate card was refreshed against the providers’ published prices. gpt-5.5 bills at 10.00/45.00 per million (it was 4.00/24.00 — the long-context tier, chosen so a long call is never under-billed), gpt-5.4-nano and both Gemini 2.5 Flash rows moved up, and the Claude 5 rows are present. Ledger rows written before the refresh keep the rate they were billed at; new rows use the corrected one, so a budget that sat under its cap can now trip it. Hosted OpenAI auxiliary calls use max_completion_tokens, which the current models require. See Paymaster.
• Backups verify completeness, not just integrity, and fork cleanly. crewship backup verify can now tell a short bundle from a whole one; a forked restore (--as-workspace / --as-crew) re-signs the journal chain it rewrote, regenerates the instance-unique columns that made a live mission vanish silently, and migrates pre-1.0 issue counters instead of dropping them. See Backup.
• Ten lifecycle-hook events that registered but never fired now fire, and on_budget_exceeded fires once per breach rather than once per LLM call while over budget. pre_tool_call is retired for good — Crewship drives an external CLI and sees a tool call after it ran. See Hooks.
• An automation refuses an event type nothing emits, and a webhook or automation that fails to start a run raises an inbox card after three consecutive failures, not just a log line. See Automations.
• Inbox read state is per user. The first manager to open a role-targeted item no longer marks it read for every other manager. resolved stays shared.
• The CLI covers more of the API. crewship auth pair mints a device code, auth profile edits your display name, feature-flag create|update, admin workspaces, admin memory-stats, routine runs-all, routine changes <run_id>, routine schedules preview|activate, routine webhooks update, agent status, agent load, system crewshipd, issue comment --mention, issue update --force, issue sessions, inbox act and escalation supply are new. Routine runs finally reach /api/v1/runs and the Runs view.
• The wake-time prompt shows the agent its own memory budget, and a fresh agent with no credential no longer looks identical to a healthy one.
• The security pages say what the code does. The threat model, RBAC and credentials guides, the README and keeper.mdx no longer claim more containment than exists; the 1.0 known limits are written where a reader meets them.

​

Fixes

• A second run for a busy agent no longer kills the first. Two concurrent runs for one agent reused the same tmux session, and the second’s opening kill-session ended the first. A dispatch that loses the lock is queued and says why (queued_reason: crew_budget or agent_busy); a chat to a busy agent bounces with agent_busy instead of colliding.
• Hard stop was signalling a host pid inside the container and ended nothing; it now ends the run’s own tmux session.
• An invited member could not authenticate with the CLI at all — a NULL display name broke CLI-token auth.
• crewship backup defaults its bundle directory under $CREWSHIP_DATA_DIR/backups when that variable is set, falling back to ~/.crewship/backups only when it is not. Several instances run by one user on one host shared a directory, and a restore could pick up another instance’s bundle by name. If you set the variable, bundles you took before are still in the old directory — pass --output or move them.
• A routine’s step chats no longer evict your conversations from the chat column; GET /agents/{id}/chats takes ?kind=.
• crewship routine save no longer erases a description when --description is omitted; an explicit empty value still clears it.
• Agent avatars were never stored (the backfill omitted the workspace), crewship crew suggest --goal could never succeed, and the create-crew wizard could offer a crew it was then unable to create.
• Reactions and feedback submitted right after a streamed reply now use the persisted message id and survive a reload; a suggestion chip clicked twice no longer sends twice; clearing a crew’s issue prefix actually clears it.
• The Docker image builds again — the backend stage now copies every root package the binaries import, and a test fails when one is missing.
• The issues board renders a fetch failure as an error and says when it is showing a partial page; a 403 is a named error rather than an empty board.

​

A provider is now a credential

​

One shell for every create surface

​

Start and stop a crew on purpose

​

Run a routine from a slash command

​

Onboarding builds working things, owned by the crew they belong to

​

An integration’s audience is stored, not counted

​

Updates

• An evaluator slot follows the key you actually have. Auxiliary slots now default to the first provider whose API key is set, instead of six slots hardcoded to Anthropic that each failed at first use on an OpenAI-only instance. See Keeper.
• Two Keeper aux controls that did nothing now do what the console claimed. Memory consolidation reads the curator slot — it was hardwired to Ollama at boot, so an instance with an Anthropic key and no Ollama silently ran no consolidation at all while the card showed the slot healthy. And run_summary’s timeout now actually bounds the verdict call; its shipped default moves 15s → 20s so the first real deadline is not tighter than what those calls had been running under.
• Crew template names are unique per workspace. Two workspaces can each have a backend-team template. A workspace template shadows the built-in of the same name, for that workspace only — and a built-in whose slug a user had taken can be seeded again, which it previously never could.
• An OpenAI-compatible credential can be tested. It was the only LLM provider with no connectivity test, and it returned a green tick without dialling anything. The probe checks reachability, not authentication — it deliberately never sends the stored key, because whoever can edit the credential can also repoint its URL.
• Pages can be published, webhooked, exported, imported and deleted from the browser. All of that was CLI-only. See Pages.

​

Fixes

• A page’s public panels were silently unpublished by reading them. The public flag was not echoed on any read path, so crewship page export | crewship apply, a hand-edited page get -f json, or the editor’s own save cleared it. The published link kept resolving and rendered an empty page, and the next page publish then blamed the page for having no public panels.
• The mission timeline’s “Restore” restored nothing and said it had. The endpoint computes a preview by design — it rewinds nothing — and the UI reported success and discarded the response, including the list of later events a real restore would have to abandon. The action is now labelled Preview restore and says what it found.
• The Add-MCP wizard’s “Test” could not fail. It was a timer that returned success, with no failure path at any input. It is gone; connectivity is tested on the server’s row after it exists, or with crewship integration crew test.
• One unrenderable chat message no longer takes down the page. A single bad turn used to replace the whole conversation with an error screen, discard every turn’s state, lose a half-typed draft and drop the live WebSocket. Now only that message is replaced, and it heals itself as the next token arrives.
• Pinned memory could be read empty. pins.md and the day’s learned rules were created before they were written, so an agent reading its own rules in that window saw nothing rather than the previous contents — reproducibly, on a tick that runs every six hours. They are written atomically now.
• Forking a mission from the timeline 404’d, and the 404 was rendered as “not yet wired to backend” — so a broken call looked like an unbuilt feature.
• Accessibility. Page tabs are now linked to the panels they reveal and the strip is keyboard-navigable with arrow keys; crew and agent canvas tabs are a real tab set rather than buttons claiming to be one; the admin console’s content pane can be scrolled by keyboard; New routine has a Cancel button on every screen.

​

Multi-provider LLM configuration

​

Proxied agent calls start billing for real

​

Fixes

• OpenAI cached tokens were billed twice. OpenAI’s prompt_tokens includes the prompt-cache read, and the codec stored it verbatim alongside the cached count — so an 80%-cached 1500-token prompt billed 2.67× the invoice. The codec now records fresh input only, matching what the sidecar proxy path has always done. cost_ledger.input_tokens changes meaning for OpenAI-family rows and historic rows are not migrated, so a rollup spanning the change is not comparable across it. See Paymaster.
• Long-context models were billed at their base rate. 76 catalog models publish a second rate card above a context threshold, up to 6.7× base. They are now priced at that ceiling — a deliberate over-estimate, because under-billing weakens the budget signal exactly when it matters.

​

Updates

• Grandfathered crews tightened to restricted egress. Existing crews still on the legacy network_mode=free default are backfilled to restricted on upgrade, so they stop getting unrestricted outbound access. The column default itself is also flipped to restricted, so any crew created without an explicit network mode — a raw insert, a seed, a future migration — is now restricted by construction rather than defaulting open. A restricted crew still reaches all built-in LLM/CLI provider domains plus any it explicitly allowlists; if a crew genuinely needs open egress, re-open it to free (or add the domains it needs) from its network policy. See Container isolation.

​

Slash commands and per-user capabilities

​

Streamlined first-run bootstrap

​

Disaster-recovery backup rewrite

​

Declarative apply for crews, agents, skills, integrations, and issues

​

Mission outcomes feed crew memory

​

Workspace switcher

​

Profiling and tracing setup

​

Updates

• Destructive CLI commands prompt before acting. Six commands now ask for confirmation and accept --yes for scripted use.
• Manifest validate catches duplicate slugs. crewship apply --dry-run now fails fast when two documents share the same metadata.slug within a kind, instead of silently overwriting on apply. See Manifest schema.
• crewship apply gains --skip-test-gate. Routines that depend on PENDING credentials can now be applied without the pre-flight test invocation, and type: code steps surface a plan-time warning so the gap is visible before the cron fires. See crewship apply.
• Go toolchain bumped to 1.26.3. Picks up eight stdlib CVE fixes; no API or behaviour change.
• SQLite busy timeout raised 5s → 30s. Eliminates the spurious “Invalid email or password” login error that surfaced on moderately loaded instances after a backup restore.
• CLI hardening pass. Security tightening across the CLI binary. See CLI overview.

​

Fixes

• crewship workflow create --help no longer panics from a flag-shorthand collision with the root --format flag. See AI workflows.
• Persona commands crashed on every invocation; now fixed.
• CLI typo’d subcommands are rejected with a clear error instead of being silently dispatched to crewship ask.
• crewship now / me / today now exit non-zero when every fetch fails with session_invalid, so wrapper scripts notice the missing login.
• /metrics loopback bypass now checks the true client IP, closing a path where a misconfigured proxy could expose the endpoint externally. See Metrics.
• Create-workspace dialog now resets when closed via Cancel, Escape, or overlay click — stale values no longer persist across reopens.
• MCP registry page size is now capped at 100 to prevent unbounded responses.
• Example manifest (examples/manifests/full-complete.yaml) had two invalid tool_profile values that failed validation for anyone copying it as a starter — corrected to the documented enum.

​

Agent Evolution lands

• Native memory tools. Agents now have first-class memory read/write tools wired across all MCP-capable adapters. Memory is scanned before it’s persisted and consolidated automatically — see Agent memory and Memory observability.
• Autonomy slider + auxiliary model slot. Each crew now exposes a per-crew autonomy slider and a separate slot for an auxiliary (smaller / cheaper) model. Tune how often an operator gets pulled in, and route routine sub-tasks to a different model. See Autonomy and self-learning.
• Keeper Phase 2. Keeper now reviews skills, evaluates per-crew behavior mode, tracks memory health, and applies negative learning from rejected actions. See Keeper and Keeper reviews panel.
• Ephemeral agents. Hire an agent with a TTL, let it ghost when the TTL elapses, rehire if the work isn’t done — with a full audit trail of when it was active. See Ephemeral agents.
• PERSONA + peer cards. Per-user agent personas and peer cards land alongside new GDPR primitives for user-scoped data export and deletion. See GDPR.

​

RBAC v2

• Per-crew role editor inline on the crew membership table.
• Agent owner badges on every agent card, with API exposure of the owner field.
• Token issuance dialog now shows tier, scopes, and expiry; listing exposes the same fields. CLI bootstrap and pair-redeem tokens are now 256-bit.
• Per-agent ownership gates on agent create, update, and delete, plus per-crew role elevation honored at create time.
• Structured 403 responses with denial audit logging.

​

Pipeline webhooks: signed by default

• HMAC signature required on every webhook dispatch.
• Signing secret auto-generated when a pipeline webhook is created — no more silent unsigned deliveries.
• Replay protection via synthetic idempotency keys; duplicate replays are now auto-deduped.
• Rate-limit floor and reserved-key inputs hardened on the webhook endpoint.

​

Updates

• OpenAI provider now mirrors the Anthropic retry/backoff behavior — flaky upstreams get the same treatment regardless of provider. See Providers.
• X-RateLimit-* headers are now returned on every 429 response so clients can back off intelligently.
• CREWSHIP_FORCE_SECURE_COOKIES env override lets you force secure cookies in front of an HTTPS-terminating proxy. See Environment.
• Sidecar hardening. The production sidecar baseline got a security pass, and the prod Docker socket is now brokered through a filtering proxy. See Container isolation.
• Memory scanner now blocks invisible-format (Unicode Cf) codepoint evasion in addition to existing checks. See Memory observability.

​

Fixes

• Keeper cross-tenant defense. Workspace context is now correctly wired onto Keeper routes — previously the defense was unreachable.
• Sidecar memory startup. The agent memory base directory is now set even when the full-text search engine fails to initialize, so agents stay usable in degraded mode.
• OAuth state and session IDs bumped to 256-bit randomness. See Auth.
• Path-traversal hardening. .. segments are rejected before the router normalizes them; /_next/* directory autoindex is blocked; every ID interpolated into internal URLs is now path-escaped.
• Permission gates. Agent files, downloads, and logs now require the read permission; nine pipeline mutating handlers are gated on per-role checks.
• Log redaction. Raw token values are now logged as fingerprints instead of full tokens, and structured logs are routed through the Lookout redactor.
• Payload limits. The auth credential callback body is now capped at 16 KiB to bound memory use on hostile clients.
• Backup integrity. Table identifiers are validated before being used during foreign-key introspection. See Backup.
• Devcontainer safety. Cumulative tar extraction is capped at 500 MB to prevent decompression-bomb scenarios. See Devcontainers.
• ETHOS refusals no longer leak tool, directory, or sibling-agent enumeration data in error messages.
• Orchestrator context propagation. Request context is now correctly threaded through background work spawned by handlers, including five mission-engine call sites that previously dropped it.