chore(release): 0.20.0

CHANGELOG.md

@@ -4,14 +4,33 @@ All notable changes to RoboCo are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.20.0] - 2026-07-09
+
+### Added
+
+- **Panel-demo composition kit (`motion/kit/`).** Reusable `pk-`namespaced building blocks that recreate the control panel for HyperFrames compositions — frame chrome, task card, team/priority chips, status pills with an enter/exit swap mechanism, notification toast, kanban column, character-by-character typing reveal with blinking caret, and a cursor sprite with click pulse — color tokens lifted from the panel's dark theme and badge components so kit output reads as the real product. Ships with the `panel-demo` reference composition (12s, both cuts): a task title types into the intake box, the card materializes, the cursor glides in and clicks, the status pill flips to completed, a toast slides in. Release, spotlight, and on-demand videos can now be authored as simulated product demos instead of text cards.
+- **Root-owned acceptance criteria via `declare_coverage`.** Coordination-root acceptance criteria are root-owned and covered explicitly: the new gateway verb lets a dev declare which parent ACs its work satisfies, coverage rolls up from those declarations, and the orphaned-`parent_ac_refs` deadlock class that could wedge parent closure is gone.
+- **On-demand sandboxes via `request_sandbox`.** Sandbox DB/Redis/Mongo provisioning moved from eager-at-spawn to a role-scoped do-verb: a dev or QA agent requests services when the work actually needs them, the orchestrator provisions the project's whole opted-in set behind a per-agent lock and cache, creds return only in the verb envelope, and the sandbox is released on the successful exit of the engagement-ending verbs instead of waiting for container teardown. A provisioning failure is a retryable envelope on the verb, never a spawn refusal.
+- **Social page.** The X post queue, the video post queue, and on-demand video requests now live on one aggregated Social page, with a unified posted/rejected history across both queues.
+- **Page-scoped refresh in the navbar.** One always-visible refresh button that refreshes only the data on the active page (per-page React Query registrations with a disabled state), replacing the inconsistent inline refresh buttons and hard reloads.
 
 ### Fixed
 
+- **FastAPI commit-after-response race.** `DbCommitMiddleware` now commits before the response starts, killing the ok-without-effect e2e flake family, alongside the 2026-07-08 prod-triage batch: slug-vs-UUID 401 residue in the search/optimal/docs MCP servers, audit remediate hints, the commit envelope, an absolute verb-rejection cap, A2A chime-in delivered as an interjection into the conversation the CEO is viewing, and manual-spawn task/message/refusal UX.
+- **Working exits for wedged agents.** Developers gained real exit hatches — `unclaim` from `verifying`/`needs_revision`, `sync_branch` with stash, state-aware auto-block, an orphan warning on cancel, remediate chains that name `unclaim` — plus the `declare_coverage` roll-up unblock that freed the live orphaned-AC deadlock.
+- **Journals and learnings never reached the RAG corpus.** A 200-character indexing floor silently excluded nearly every journal entry and learning; per-index floors (40 for journals, 80 for learnings) plus a startup backfill restored the shared corpus, alongside the git-readonly slug 404 fixes.
+- **CI segfault killed at the root.** The e2e harness segfaulted only in CI through uvloop; the API now defaults the event loop to asyncio with a cancellation-safe commit.
+- **init_db can no longer wedge a boot.** The API lifespan's second `init_db` could hang forever in alembic's nested-`asyncio.run` thread on a NAS boot; `init_db` is now latched per database URL and the alembic runner time-bounded (300s) with a loud failure.
+- **RAG reconcile off the bind path.** The startup reconcile runs in the background now, never on the API bind path.
+- **Git ownership repair scoped.** The post-operation `chown` storm (5-15s added to every git op) is gone — ownership repair is tiered and scoped to what the operation could actually change.
+- **Video renderer aligned with `@hyperframes/producer` 0.7.36.** The sidecar's render core rides the producer API (`createRenderJob`/`executeRenderJob`), reading each cut's dimensions from the composition HTML itself.
+- **roboco-api CI regression fixed through the CI-watch flow.** The engine opened the fix task and the fleet delivered it through the normal lifecycle.
 - **Release manager publish no longer depends on a `gh` binary that was never installed.** `ReleaseExecutor.publish_release` shelled out to `gh release create`, but no image ships the gh CLI — with `ROBOCO_RELEASE_MANAGER_ENABLED` armed, every publish would have died on a missing binary after the release commit was already pushed (verified against the live 0.19.0 orchestrator container). The publish is now a GitHub REST `POST /repos/{owner}/{repo}/releases` authenticated with the project's decrypted token — the same auth + httpx pattern as PR creation — with the same fail-closed semantics (non-201 → structured `publish_failed`, CEO retries; the 300s deadline is now the HTTP client timeout).
 
 ### Changed
 
+- **Decomposition minimalism in the planning prompts.** PM roles now decompose into the fewest subtasks the work actually needs instead of ritual splits.
+- **Panel dependencies: Next 16.2.6, axios 1.16.0.** External PRs #343/#344 were superseded, finished, and hardened in-house through the org's external-PR takeover flow.
 - **The PR-gate turn cut is now unconditional — the kill-switch is gone.** `ROBOCO_PR_GATE_AUTO_SUBMIT_ENABLED` (0.17.0) has been removed from `roboco/config.py`; `_auto_submit_target` no longer checks a flag at all. The turn cut IS the flow now: once every child of an assembled parent is terminal, the orchestrator always runs `submit_up`/`submit_root` system-side as the owning PM before ever considering a PM spawn. The existing gate-rejection fallback (branchless/umbrella parent, a gate refusal, a transport error) is the sole safety net — no config switch sits on top of it. The fallback closure prompt now also carries the exact refusal reason (`_build_pm_closure_prompt`'s new `auto_submit_reason`), so a PM that does get spawned isn't re-running evidence-gathering to rediscover why blind.
 - **Leaner agent/orchestrator images (~1.65GB less, cache-stable deploys).** Playwright + its Chromium and system libs are gone from `agent-dev-fe`/`agent-qa-fe` (~770MB each — verified unused repo-wide: panel tests are vitest, the e2e harness is scripted Python; browser-based FE QA is a designed follow-up, and the re-add is two lines scoped to `chromium-headless-shell` in the QA image only). The `agent-grok` image drops a redundant `chown -R` that duplicated the entire 149MB CLI tree into a second layer. The runner-stage `/app` COPY in `agent-base` and `orchestrator` is split `.venv`-first/source-last, so a source-only deploy re-layers ~13MB instead of ~380MB per image, and `agent-base`'s single 813MB apt+node+claude-code RUN is split so a CLI version bump no longer re-downloads the OS/node layer. Hygiene: gitignored `docs/internal/` no longer leaks into the orchestrator image from a working-tree build, and the `uv` helper image is pinned (`0.11`) instead of `:latest`. All four rebuilt images pass runtime probes (claude/git/jq/node/uv/pnpm/grok binaries, `import roboco`, docs/alembic/agents trees present); cache-stability proven by rebuild log (`.venv` layer CACHED across a source-only change).