chore(release): 0.23.0

CHANGELOG.md

@@ -4,7 +4,7 @@ All notable changes to RoboCo are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.23.0] - 2026-07-11
 
 ### Added
 
@@ -12,6 +12,25 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - **Playwright chromium headless verification for QA images.** `agent-qa-fe` and `agent-ux` (the shared UX/QA image) now ship Playwright with `chromium-headless-shell` pre-installed for browser-based QA verification — fe-qa and ux-qa agents can now launch headless chromium to verify rendered output, computed styles, a11y trees, and visual design when reading the diff alone cannot settle an acceptance criterion. A new CI workflow (`agent-image-smoke.yml`) builds real before/after images, runs a headless-launch smoke check inside each, and reports the real `docker inspect` size delta as a PR comment — the only non-estimated verification source available since agent sandboxes have no Docker daemon. See `docs/backend/qa/browser-verification.md` for examples and `fe-qa.md` / `ux-qa.md` identity prompts for the built-in guidance.
 - **Playwright MCP server for QA's browser verification.** Hand-scripting the Playwright Python sync API through `Bash` is fragile for an agent, so `agent-qa-fe`/`agent-ux` now also ship `@playwright/mcp`, registered by the orchestrator as a `playwright` MCP server (`mcp__playwright__*`) for the `fe-qa`/`ux-qa` roles only — role-gated, not image-gated, so `be-qa` and `ux-dev` (which shares `agent-ux`'s image) never see it. A wrapper entrypoint (`docker/scripts/playwright-mcp-entrypoint.sh`) points the server at the image's existing baked `chromium-headless-shell` instead of letting it download a second browser. QA now drives the browser through structured `browser_navigate`/`browser_snapshot`/`browser_evaluate`/`browser_take_screenshot` tools instead of multi-line `Bash -c` Python strings; `agent-image-smoke.yml` verifies the binary + the resolved chromium path and takes a real headless screenshot of a live panel page from inside the ux-qa image.
 
+- **Obsidian vault V1.** The org's human-readable memory palace as a rebuildable DB projection (default-off, `ROBOCO_OBSIDIAN_VAULT_ENABLED` + `ROBOCO_VAULT_PATH`, armed in both compose files): tasks, journals, and A2A digests as wikilinked markdown with rename-safe alias links and private journals excluded; best-effort event seams that can never block a verb; shipped `.obsidian` config (Dataview, Kanban, graph groups); `python -m roboco.vault rebuild`/`relocate` (relocate grafts `RoboCo/` into an existing personal vault without touching its config). The Auditor gains a `curate_vault` narrative duty spawned on root completion, and a default-off inbox watcher turns `#roboco`-tagged notes (including meeting-bridge output) into board-review drafts that reach delivery only through the CEO's Approve & Start.
+- **A2A conversation-first redesign.** Three-region layout (roster/stream/context), team-color agent identity, a four-state connection treatment, new-message arrival cues, and the four-dimension filter control (agent/task/status/date with chips).
+- **Sidebar reorder + two-column objectives.** The spec-exact flat navigation order with Business in the footer group, and the Company Charter objectives grid.
+- **Video pipeline controls.** Per-project video requests (picker limited to video-enabled projects), an unconditional re-render action on queue rows and the pipeline strip, and a pre-approval composition preview.
+- **Sequence is the bar.** Strict, assignee-blind sibling ordering enforced at the claim chokepoint — a task with sequence N cannot start while any lower-sequence sibling is non-terminal; delegation now stamps collision-derived wave sequences so independent siblings still run in parallel; `tasks.parent_task_id` gains an index (migration 069).
+- **PR-review gate hardening.** `pr_pass` refuses while the assembled PR's own CI is failing, pending, or undeterminable (a repo with no CI passes through with an evidence note), and the reviewer prompt requires a per-AC file:line walk where silently dropped deliverables are an automatic fail.
+- **First database backups.** A `pg_dump` sidecar on the data-only network: daily crash-safe dumps with newest-14 rotation and a restore walkthrough.
+
+### Fixed
+
+- **Gate reviews judge only what a task authored.** The in-path review gate diffed cross-team tasks against the repo default branch (string-derived parent), attributing inherited base-branch content to the task under review — three live bounces on one fix task; the gate now resolves the real parent branch and threads it through the conventions guard too.
+- **Dependency content at branch cut.** A dependent's fresh branch now merges each same-repo dependency's landed work when that merge sits outside the branch's ancestor chain; conflicts surface loudly without failing the claim.
+- **Revision commits always get CI.** Squash-merging a subtask PR into a branch that is itself a PR head fires GitHub's `pull_request` webhook unreliably — the verifying workflows now also trigger on fleet-branch pushes, deduped by a concurrency group, so absent checks can no longer read as green.
+- **Prompt-injection screening for engine-ingested text.** Tweets and vault notes ride an untrusted-content envelope with flagged-in-place detection through local-model prompts and CEO-facing drafts.
+- **Release images complete.** The release workflow now builds all 17 images the registry compose pulls (the two Grok sub-images were never published), so a fresh registry pull succeeds.
+- **Settings accept the panel's JSON scalars.** The feature-flags card's boolean PUTs no longer 422 on type alone.
+- **Agent tool-call budget raised to 300** (warn 100) — 150 repeatedly halted legitimate multi-file work mid-task.
+- **Dispatcher churn.** Dependency- or sequence-held tasks are filtered before claim attempts instead of failing one per tick.
+
 ## [0.22.0] - 2026-07-10
 
 ### Added

panel/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roboco-panel",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "private": true,
   "packageManager": "pnpm@11.10.0",
   "scripts": {

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "roboco"
-version = "0.22.0"
+version = "0.23.0"
 description = "AI Agents Company - A virtual organization of AI agents functioning as a software development workforce"
 authors = [
     {name = "Renzo Franceschini", email = "rennf93@users.noreply.github.com"}

roboco/__init__.py

@@ -5,7 +5,7 @@ A virtual organization of 25 AI agents + 1 human CEO,
 designed to operate as a complete software development workforce.
 """
 
-__version__ = "0.22.0"
+__version__ = "0.23.0"
 
 # Core exports
 from roboco.config import settings

roboco/config.py

@@ -35,7 +35,7 @@ class Settings(BaseSettings):
     # ==========================================================================
     # Application
     # ==========================================================================
-    app_version: str = "0.22.0"
+    app_version: str = "0.23.0"
     debug: bool = False
     environment: str = Field(
         default="development", pattern="^(development|staging|production)$"

uv.lock

@@ -2537,7 +2537,7 @@ wheels = [
 
 [[package]]
 name = "roboco"
-version = "0.22.0"
+version = "0.23.0"
 source = { editable = "." }
 dependencies = [
     { name = "alembic" },