[headroom-release]

🤖 I have created a release beep boop

0.44.1 (2026-11-14)

Bug Fixes

• benchmarks: drop the duplicate protect_recent=0 table from the proof harness (#4754) (a385ea8)
• benchmarks: refuse a dirty or non-git --worktree in codemode_ab (#4736) (6b7b635)
• binaries: ignore tool binaries found via the current directory (#4838) (7a0f15f)
• cache: exclude cold starts from TTL hit evidence (#4728) (93df7ae)
• cache: scope learned TTL cache to its source file (#4727) (acb58a0)
• ccr: send batch continuations to the upstream the batch was submitted to (#4848) (5f82080)
• ci: verify installer provenance in build workflows (#4677) (b235bc2)
• compress: stop adding markers the caller did not ask for (#4678) (c21b081)
• deps: move the wrap E2E harness to npm 12.2.2 and drop the fixed audit exceptions (#4778) (f6fbac3)
• deps: patch quinn-udp, rustix and opentelemetry-api advisories (#4835) (0368a87)
• examples: keep the macos launchagent running when reinstall is declined (#4734) (02a2b56)
• examples: validate the macos launchagent port as plain decimal (#4733) (a91c48a)
• gemini: apply the request rate limit to Cloud Code and countTokens (#4862) (c2292ed)
• learn: only fold real linked worktrees into their main checkout (#4839) (d2fb350)
• mcp: check Host and Origin on the Streamable HTTP transport (#4852) (70ba721)
• oauth2: stop following redirects from the token endpoint (#4849) (02dfdd8)
• openclaw: let the circuit breaker open on proxy failures (#4755) (1372f95)
• openclaw: return structured retrieval tool results (#4707) (e6b5777)
• opencode: default options-form https.request calls to https (#4749) (12b5fb7)
• opencode: do not break every request when the proxy URL is empty or invalid (#4750) (318e8e0)
• opencode: keep child process options when the args slot is null or undefined (#4748) (9f2cc01)
• opencode: override effect to patched 4.0.0-beta.103 (#4762) (19d439f)
• opencode: stop routing non-LLM hosts and paths to the proxy (#4747) (#4758) (c48778c)
• proxy: bound brotli output per step and lossless inverse expansion (#4861) (5503383)
• proxy: don't take Claude Code's "Tool loaded." note as the user query (#4714) (dcd03b9)
• proxy: keep credentials out of proxy logs and 400 debug dumps (#4865) (dffc4dc)
• proxy: keep hop-by-hop request headers off upstream calls (#4775) (8f47a86)
• proxy: keep reserved openai tool names resident during tool search deferral (#4753) (62f2a2d)
• proxy: keep upstream credentials out of manifests, env and TOIN (#4866) (2e4ff6f)
• proxy: let an extension declare its install() fail-closed (#4737) (#4773) (c05fbdd)
• proxy: log client-supplied model ids as one escaped token (#4854) (b9f6255)
• proxy: pin non-ASCII upstream hosts by A-label and resolve x-headroom-base-url once (#4855) (904e56a)
• proxy: refuse HTTP requests from untrusted browser origins (#4853) (ab1d029)
• proxy: resolve the forwarded client from the right and keep settings writes loopback-only (#4847) (e15e342)
• proxy: send operator extra headers only to a designated origin (#4858) (6d8121c)
• proxy: turn off the image stage when --compressor leaves out image (#4723) (8f04221)
• sdk: accept string contents and functionCall without args in the Gemini adapter (#4756) (200c838)
• sdk: encode the signature hash in client.telemetry.getTool (#4772) (3c66c91)
• sdk: keep Gemini thought signatures and call ids through the compress round trip (#4777) (622df29)
• sdk: reject "." ".." and NUL plugin names like the python twin (#4771) (99ef4ee)
• sdk: reject sharedcontext maxentries below 1 (#4743) (4b6529f)
• sdk: throw typed proxy 4xx errors from compress instead of retrying (#4751) (e602e4c)
• sql: stop granting anon read access to raw proxy telemetry (#4867) (b324efb)
• wrap: match Serena's unset dashboard key instead of appending a duplicate (#4315) (1da8930)

---

This PR was generated with Release Please. See documentation.

[devin-ai-integration]

Devin Review found 2 potential issues.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[JerrettDavis]

Review completed; approval remains pending the items below.

Reviewed head 1d6e840ef73709be7198ba486328588fcf032413 against main c05fbdddc873078dd97cb9ede841e75ef7ed0bef.

Qualification still required:

• Exact-source provenance review is incomplete
• Check/run 43159183668 is not successful or baseline-qualified

[JerrettDavis]

Reviewed 3b1ca59 against target 9f2cc01. No code defect found: all 15 non-changelog files contain only 0.44.0 to 0.44.1 substitutions, the version verifier passes, metadata assertions pass, all 27 release-note commits are in the target, and whitespace checks pass. The historical stale-version issue is resolved.

Required qualification proof is still missing: provide terminal results for CI run 43367865208 on this head, including its four test shards and docker-native-e2e, with any failures resolved or specifically baseline-qualified. Supplied evidence still shows those jobs running; older-head results cannot qualify this head. The staged shared workflow audit also remains held for inherited unchecked gitleaks and mutable Wrap execution inputs. Maintainers should resolve that shared qualification or supply the coordinator-verified review-only baseline before approval; these are repository issues, not defects introduced by this release PR. No unsafe workflow rerun is requested.

Real behavior proof: Python 3.11 standard-library metadata validation via python3 scripts/verify-versions.py and direct JSON/TOML/version-delta assertions passed. Full local pytest, package publication and live-provider behavior were not tested.

[JerrettDavis]

Reviewed ff38269 against target b324efb. No release-metadata defect found; the historical stale-version issue is resolved.

CI run 43546892887 is now terminal. Its only failed job, docker-native-e2e (132300274726), failed at docker build -f e2e/wrap/Dockerfile -t headroom-wrap-e2e .: fetching quay.io/pypa/manylinux_2_28_x86_64 returned remote error: tls: internal error before building application code. The workflow and Wrap build inputs are identical to recorded main. This is an infrastructure failure, not a demonstrated release-PR regression. The subsequent native init step was skipped; separate current-head Init and Wrap workflows succeeded. All four test shards and Release wheel checks succeeded in the supplied evidence.

Approval qualification still requires maintainer resolution of the staged shared provenance hold, or a coordinator-verified review-only baseline. The exact-manifest audit remains held for unchecked gitleaks and mutable Wrap image/dependency inputs; these are inherited repository issues. The newer gitleaks-fix notice names a different blob and does not clear this head. No unsafe rerun or unrelated contributor change is requested.

Real behavior proof: Python 3.11; python3 scripts/verify-versions.py passed at 0.44.1. Standard-library assertions passed for all 15 version-only deltas, lock metadata, all 30 changelog commit ancestors, and 25 workflow hashes; git diff --check agentops-base HEAD passed. Full pytest and Docker tests were not executed locally; hosted results are supplied artifacts. Publication and live-provider behavior were not tested.

[JerrettDavis]

Reviewed 6ce0052 against target fda75de. No release-metadata defect found; synchronized manifests resolve the historical stale-version issue.

Required proof: provide terminal results for this head, particularly CI run 43560841295 (test shards and native E2E) and Release run 43560841378 (wheel/platform checks), and resolve or specifically baseline-qualify any failures. The supplied snapshot still has these runs pending; earlier-head passes do not qualify this regenerated release.

Separately, the exact-manifest shared provenance audit remains held for inherited unchecked gitleaks and mutable Wrap image/dependency inputs. Maintainers should resolve the common audit or provide the coordinator-verified review-only baseline. These are repository qualification issues, not defects introduced by this PR; no unsafe rerun or unrelated contributor change is requested.

Real behavior proof: Python 3.11; python3 scripts/verify-versions.py passed at 0.44.1. Independent standard-library validation passed for all 15 version-only deltas, editable root lock metadata, additive changelog and all 44 release-note commit ancestors. All 25 workflow hashes match the staged manifest; git diff --check agentops-base HEAD passed. Full local pytest, Docker/wheel builds, package publication and live-provider behavior were not tested.

[JerrettDavis]

The blocking docker-native-e2e failure was an infrastructure TLS flake; the rerun (43560717582) completed successfully. Release metadata diff is clean. Approving.