v0.6.9

mountain-loop/yaakv0.6.9May 12, 2026by jaberjaber23

AI Summary

This release focuses on critical security patches to fix RUSTSEC advisories that broke the previous CI. It includes maintenance formatting and carries forward all fixes and features from v0.6.8.

Key Highlights

Security patches for `rustls-webpki` (RUSTSEC-2026-0104, 0098, 0099) and `wasmtime` (RUSTSEC-2026-0114)
Workspace formatting applied via `cargo fmt`
Carries forward fixes for workspace state directory split, dashboard WebSocket auth, and agent tools
Includes audit logging and Telegram routing improvements

New Features

Agent tools: skill_list, skill_describe, skill_execute
Audit endpoints: POST /api/audit/append and HAND.toml Merkle chain logging
Requesty provider added
Environment overrides for local providers (OLLAMA_HOST, LMSTUDIO_HOST)
Telegram message_thread_id routing

Full Release Notes

**Security patches** (RUSTSEC advisories that broke v0.6.8 CI):
- `rustls-webpki` 0.103.10 → 0.103.13:
  - RUSTSEC-2026-0104 — reachable panic in CRL parsing
  - RUSTSEC-2026-0098 — name constraints for URI names incorrectly accepted
  - RUSTSEC-2026-0099 — wildcard name constraints accepted incorrectly
- `wasmtime` 43.0.1 → 43.0.2:
  - RUSTSEC-2026-0114 — panic allocating a table exceeding host address space

**Maintenance:**
- `cargo fmt` applied workspace-wide (CI Format gate green)

**All v0.6.8 fixes carried forward:**
- #1097 workspace state_dir split
- #1085 dashboard WS auth aligned with HTTP middleware
- #1038 skill_list / skill_describe / skill_execute agent tools
- #995 Requesty provider added
- #1154 OLLAMA_HOST / LMSTUDIO_HOST env override
- #1170 require_signed wired through POST /api/skills/install
- #1174 POST /api/audit/append endpoint
- #1172 HAND.toml SHA-256 to Merkle audit chain
- #780 Telegram message_thread_id routing
- Codex installer findings: CRLF/BOM, package.json, symlink, TOCTOU all closed