v7.6.4

# AVA Core v7.6.4

Released from reviewed main commit `ba52df92bc1cad2c1f277034e1423b80c8f50be4` on 2026-10-16 (America/Los_Angeles).

## Highlights

- Safer HTTP-tool templates: single-pass substitution, protected call/enrichment context, context-specific URL/header encoding and validated JSON bodies across pre-, in- and post-call requests (#739).
- Farewell and deferred-transfer recovery: completed-turn marker matching, transfer priority, canceled stale hangup state and continued conversation after failed transfers (#735).
- Compatible Admin dependency maintenance (#740), refreshed upgrade guidance and contributor attribution (#741, #742).

No database migration or provider, transport, model, Audio Profile or saved Agent default change. Unmerged contributor and Dependabot PRs are not included. See the [full changelog](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/blob/v7.6.4/CHANGELOG.md).

## Upgrade and compatibility

Follow the [installation and recovery guide](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/blob/v7.6.4/docs/INSTALLATION.md#upgrade-to-v764-existing-checkout) and [v7.6.3 to v7.6.4 migration notes](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/blob/v7.6.4/docs/MIGRATION.md#v763-to-v764).

Review existing HTTP templates against the [compatibility rules](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/blob/v7.6.4/docs/TOOL_CALLING_GUIDE.md#http-template-safety-and-compatibility) before rollout. Preserve configuration, credentials, calendar identities/caches, both SQLite stores, models and local overlays. Apply the documented affected-service rebuilds. Custom automatic FastAPI telemetry now requires the documented explicit opt-in and SDK/exporter extras. Google marker heuristics remain opt-in and ambiguous phrases remain a risk. Rollback restores the older HTTP renderer; restrict affected tools if rollback is necessary.

## Security guidance for supported 7.5.x installations

The HTTP-template fix is included in **7.6.4**. Publishing this tag does **not** patch existing 7.5.x installations. The maintainer approved immediate mitigation guidance and a separate 7.5.x backport; this release does not remove 7.5.x support or claim a backport is already available.

Affected 7.5.x operators should upgrade to v7.6.4 through the documented migration path, or disable affected HTTP-based lookup/webhook tools across **pre-call, in-call and post-call** phases until patched. Apply changes through the supported configuration reload/restart process and verify disabled tools cannot execute on new calls. Removing an Agent's in-call permission alone does not disable pre/post-call hooks. Disabling integrations may interrupt business workflows, so plan the mitigation accordingly.

Existing dependency alerts remain tracked; this release does not claim all dependency vulnerabilities are resolved. See the [security baseline and validation limits](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/blob/v7.6.4/docs/baselines/golden/v7.6.4-validation-matrix.md).

## Validation and acceptance

- Exact-main [CI](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/actions/runs/38998581665), [CodeQL](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/actions/runs/38998581535), and [Regression Hardening](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/actions/runs/38998581705) passed.
- The maintainer explicitly waived further runtime/upgrade testing and accepted the existing evidence and its limits. No new deployment, live calls, human-listening score, OAuth refresh or GPU qualification is claimed.
- The [preparation validation matrix](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/blob/v7.6.4/docs/baselines/golden/v7.6.4-validation-matrix.md) preserves revision-pinned #739/#735/#740 evidence. Completed publication gates and the 7.5.x mitigation disposition are recorded on [release-preparation PR #741](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/pull/741) and here, without rewriting historical evidence as a new pass.

## Downloads

Release automation publishes five Agent CLI binaries (Linux amd64/arm64, macOS amd64/arm64 and Windows amd64), `SHA256SUMS`, and the CLI tarball. Verify downloaded binaries against `SHA256SUMS` before installation and run `agent version` for the matching platform.

The image workflow publishes `v7.6.4` and `latest` for `ai-engine`, `local-ai-server` (core profile; models are not bundled), `admin-ui` and `updater` under `ghcr.io/hkjarral/asterisk-ai-voice-agent-*`.

### Published artifact verification

- [Release CLI Binaries](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/actions/runs/38999798004) passed on the tagged commit.
- All seven downloaded assets match GitHub's SHA-256 digests; all five binaries match `SHA256SUMS`; every CLI tarball file matches its standalone asset.
- All five binaries embed version `v7.6.4`, source revision `ba52df92bc1cad2c1f277034e1423b80c8f50be4`, and an unmodified source tree. The downloaded macOS arm64 binary's `version` command passed; the workflow also exercised Linux amd64.
- [Release Images (GHCR)](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/actions/runs/38999798011) passed. All four images have matching `v7.6.4`/`latest` manifest digests and build provenance for source revision `ba52df92bc1cad2c1f277034e1423b80c8f50be4`. Updater provenance pins `AAVA_CLI_VERSION=7.6.4`.

Verified image manifest digests:

| Image | `v7.6.4` and `latest` digest |
| --- | --- |
| AI Engine | `sha256:ace9d34e33c6edbeaf619c5b52ac86a6d6c43d38812fb2133cdbe25f99b4a79d` |
| Local AI Server (core) | `sha256:d92b6a7296e3a6ab092f3229f356027d8add37a81a04d213010799bc323cb751` |
| Admin UI | `sha256:bd469ee2d616e1ff195c37a1bc8af47c14890f030fa9c5bf2e2838ed5674a554` |
| Updater | `sha256:6b7d0f879e2dd717c197705cf296e6424255be3d426663ffd60a773f60bcc0fe` |

## Contributors

Thanks to [@theluckystrike](https://github.com/theluckystrike) for the original farewell fix, [Kevin Rossen](https://github.com/kevinrossen) for the HTTP-template security report and original renderer patch, [@MVECoder](https://github.com/MVECoder) for the farewell report and production investigation, and [@hkjarral](https://github.com/hkjarral) for implementation, review, validation and release maintenance. Existing credits and Git co-authorship are preserved in [CONTRIBUTORS.md](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/blob/v7.6.4/CONTRIBUTORS.md); Ivan Garcia and NC retain commit-linked badges without assigning unverified profiles.

[Compare v7.6.3...v7.6.4](https://github.com/hkjarral/AVA-AI-Voice-Agent-for-Asterisk/compare/v7.6.3...v7.6.4)