Every release, on the record.

• 1.7.0current release
• 20dated releases
• MITlicense

1. 1.7.0

   2026-07-14Current
   • Typed SDKs for Python (hotato.sdk) and TypeScript over the CLI's JSON contract.
   • hotato init ci writes the turn-taking gate for GitLab CI, Jenkins, Azure Pipelines, and CircleCI.
   • Audit-hardened release. Source archives build only from the tagged tree; published bytes match CI.

2. 1.6.2

   2026-07-14
   • hotato init ci for GitLab CI, Jenkins, Azure Pipelines, and CircleCI.
   • Docs rewritten for clarity; byte-identical artifacts across machines.

3. 1.6.1

   2026-07-14
   • First run leads with uvx, so the first command works on an externally managed Python.
   • Demo and verify output reads as a designed surface. Missing metrics show n/a; an intact bundle reads integrity: intact.

4. 1.6.0

   2026-07-14
   • Counterexample compiler turns one failing deterministic scenario into an offline regression capsule with an explicit proof status.
   • Transcription cache replays a byte-identical stored transcript; --no-transcribe-cache re-runs fresh and surfaces drift.
   • Silero VAD runs directly on onnxruntime; the [neural] extra installs onnxruntime and numpy.

5. 1.5.4

   2026-07-14
   • Docs and packaging refresh. README and docs render cleanly on narrow screens; a Ruff gate and a pinned build action run in CI.

6. 1.5.3

   2026-07-13
   • Deleting a recording never destroys another workspace's evidence. The shared blob goes only when no workspace references it.
   • Outbound HTTP hardened. Cross-origin redirects strip credentials; downloads are bounded.

7. 1.5.2

   2026-07-13
   • Evidence reads are scoped to your workspace. hotato serve's /evidence/<digest> now authorizes each read against a live registry root in the caller's own workspace, not the mere presence of a blob in the shared store, and returns an identical 404 for an unreachable or absent digest — so a digest is no longer a cross-workspace key.
   • Share-safe records reject embedded absolute paths. The scrubber and validator catch drive-letter, UNC, and mixed-separator Windows paths anywhere in a string, closing a local-filesystem disclosure under the share-safe-v1 profile.
   • Reference runs are byte-reproducible. The conversation-manifest timestamp resolves from an explicit value, then SOURCE_DATE_EPOCH, then a fixed epoch instead of the wall clock, and shipped kit and shell scripts are pinned to LF, so two seeded runs produce byte-identical artifacts and a normal Windows checkout no longer rewrites digest-pinned evidence.
   • Capability routing rejects an unknown caller contract_uri, degrades an under-labelled addressed event to engagement_control rather than returning nothing, and pairs a missed bid with a false trigger only within the same battery and configuration.
   • Machine output: capture --format json and start route progress to stderr so stdout is a single JSON object; the MCP server reports hotato's own application version; start --demo --dir creates a missing nested output directory.

8. 1.5.1

   2026-07-13
   • PyPI's long description now resolves its links: it's generated from README.md with every repo-relative link rewritten to an absolute GitHub URL, so links on the PyPI page land instead of 404ing.
   • The default Action gate makes zero package-index requests: the pinned checkout now runs straight off its own PYTHONPATH, with no pip step, no isolated build backend, and no index contact. The exact-version pin mode still installs from PyPI, its documented intent.

9. 1.5.0

   2026-07-13
   • Voice Failure Atlas builder: a deterministic, server-rendered site generator (scripts/build_atlas.py) built from typed, schema-validated sources; every seeded record traces to a captured CLI run against bundled fixtures, never invented, and two builds from the same sources are byte-identical.
   • Delta prove-and-stop verifier (scripts/verify_delta.py): a machine-verifiable gate confirming deliverables and tests, a frozen-surface check, and a recorded cold-path proof that a clean install runs the credential-less hotato start --demo with no key and zero intervention.

10. 1.4.1

    2026-07-13
    • Interaction labels v1: optional, backwards-compatible per-event metadata (speech presence, addressed-to-agent, floor intent) supplied by a human, a trusted source, or a marked fixture -- never derived from timing, energy, transcript, or a model verdict.
    • Capability routing v1: a deterministic router that reads supplied labels on a paired addressee-control battery and routes to the narrowest capability the evidence supports, or to no recommendation at all.
    • A root composite GitHub Action (action.yml) that installs the pinned revision itself with --no-deps and gates on hotato's own exit code, needing only permissions: contents: read.

11. 1.4.0

    2026-07-13
    • Failure Record v1: a content-addressed, five-lane record rendered from a test, suite, or contract result (hotato record render) to JSON, Markdown, HTML, and SVG; outcome claims cite tool/state evidence, and transcript-only outcomes are refused.
    • Consumer GitHub Action (root action.yml): pin it by commit SHA to run a committed suite, test, or contract from an unrelated repo and get a five-lane job summary on pass and failure.
    • hotato regression prepare: turns one confirmed failure into a sanitized, deterministic, committed regression bundle; it prepares files locally and stops, never uploading or opening a pull request.
    • Read-only failure-record viewer in hotato serve (/records list and detail view, token-gated).

12. 1.3.3

    2026-07-13
    • The demo contract is built from the declared missed interruption, selected by evidence fields rather than candidate rank, so the demo failure is a scorable event with a measured talk-over that matches its printed story.
    • Every example command hotato prints runs as-is on one line, across the demo next steps, scaffolds, hints, and help epilogs; a guard test walks the guided surfaces and the full help tree to keep them paste-safe.
    • hotato serve opens the browser to the working token-carrying URL on start, prints that URL prominently, and greets a token-less visit with a short landing page; the five views were polished and stay token-gated and read-only.

13. 1.3.2

    2026-07-13
    • A first-run screen for hotato (run with no subcommand): an ASCII logo, the one command to try (hotato start --demo), and the browser workspace (hotato serve). Color is optional and gated on an interactive terminal (respects NO_COLOR), degrades to plain text when piped, and every command shown is copy-paste-safe. Still zero runtime dependencies.

14. 1.3.1

    2026-07-13
    • Hardening pass across the 1.2/1.3 line, driven by an adversarial audit.
    • --gate now fails closed: a run that greened on a judge that could not run now counts as a failure.
    • Credential-safe redirect fix on the config inspect path.
    • Cleaner first run: pip-led quickstart, no raw None in output, and the five-dimension conversation-QA surface up front.
    • Self-host doc corrections.

15. 1.2.0

    2026-07-12
    • hotato investigate: one call to a CI-ready contract, with authenticated capture, channel trust gate, ranked candidates, you label.
    • hotato assert: a deterministic DSL (phrase, PII, policy, tool_call, outcome), no model, offline.
    • Signed Ed25519 label-records, via the opt-in [sign] extra.
    • Opt-in [transcribe] (faster-whisper, local): transcript as context, never scored.
    • Copy-paste CI configs for GitLab, Jenkins, Azure DevOps, and CircleCI.
    • --notify URL on sweep and fleet; a hotato fleet trend HTML trend page.
    • Evidence kernel hardened.

16. 1.1.1

    2026-07-11
    • Docs consistency patch: corrected the MCP tool count.
    • Added a release-guard test.

17. 1.1.0

    2026-07-11
    • Guardian/Fleet build-out: a bounded experiment engine, batch discovery with cross-call clustering, idempotent jobs, and one-click contracts.
    • Capture-receipt attestation, unlocking the ATTESTED evidence tier.
    • Wired privacy controls: retention, delete, and redact.
    • 3 new MCP tools. It recommends a change and leaves deploying it to you.

18. 1.0.1

    2026-07-11
    • Evidence-integrity hotfix: closed the paths where a green artifact could come from an input that wasn't what it claimed to be.
    • Each closed path is held by a release-blocking adversarial test.

19. 1.0.0

    2026-07-10
    • First stable release.
    • Evidence kernel plus Guardian/Fleet feature-complete; schemas stable and additive from here.

20. 0.10.0

    2026-07-10
    • Guardian/Fleet: a private, self-hosted control plane.
    • Recompute-from-audio proof gate.
    • Evidence vector and lattice (weakest tier wins, never blended), plus capture receipts.

21. 0.9.0

    2026-07-10
    • hotato trust measures cross-channel leakage (≥ −40 dB) and very-low signal, so a bad export is caught before it becomes a verdict.

22. 0.8.0

    2026-07-10
    • Fresh-capture provenance guard for fix trial.
    • Windows connect crash fixed.

23. 0.7.0

    2026-07-09
    • hotato explain: root cause by layer; it refuses when the evidence can't support the call.
    • hotato fix trial: a candidate fix to a before/after proof, fail-closed.

24. 0.6.0

    2026-07-09
    • hotato contract create/verify/inspect/pack/unpack: a portable .hotato CI contract.
    • hotato trace ingest/attach/export: an OpenTelemetry bridge.
    • hotato start --demo: a credential-less first run.

25. 0.5.0

    2026-07-09
    • hotato trust input-health check.
    • hotato apply --clone: a guarded, staged apply.

The full history, entry for entry, lives with the source: CHANGELOG.md on GitHub →