ZeroClaw v0.8.3

This release is a large consolidation cycle spanning 379 commits from 56 contributors, focused on the new Standard Operating Procedure (SOP) engine, a WebAssembly plugin host, a Git forge channel, and a broad round of runtime, provider, and security hardening. If you run ZeroClaw agents in production, the headline changes are the procedural-memory/SOP substrate, tighter context-budget accounting, and a wave of SSRF and secret-leak fixes. Desktop and quickstart flows also get meaningful polish.

Highlights

• SOP (Standard Operating Procedure) engine lands end to end — a daemon maintenance tick, typed step contracts, live step execution, cron/filesystem/calendar triggers, and an out-of-band approval plane.
• WebAssembly plugin host (wasmtime component model) for tools, channels, and memory, with per-call execution limits, signature-policy enforcement, and registry search/install by name.
• Git forge channel with GitHub and Gitea/Forgejo providers, plus a unified git_forge tool and SOP ingress.
• Self-contained desktop app returns — the kernel now ships as a Tauri sidecar for a Quickstart-first companion experience.
• Cost & usage accounting gains a task-attributed usage ledger, offline pricing catalog, and by-period / org-billed views in ZeroCode.
• Security hardening across the board: multiple SSRF gaps closed, constant-time token comparison, signing-key leak prevention, path-traversal fixes, and dependency bumps clearing several RUSTSEC advisories.

What's New

SOP & Procedural Memory

• A daemon SOP maintenance tick now drives live procedures, executing real steps, enforcing step scope/mode/routing/schemas at the engine boundary, and consuming CAS run claims (#8391, [#8399], [#8416], [#8420], [#8430], [#8493], [#8502], [#8506]).
• Cron, filesystem, and calendar no-show triggers wire into the maintenance tick (#8400, [#8461], [#8419]).
• An out-of-band approval plane fails closed on timeout, with a priority-based gate fix, and deterministic capability steps now run through a registry that fails closed on driverless steps (#8304, [#8724]).
• A procedural memory workshop and web visual authoring (experimental) with channel fan-in and a selectable agent were added (#8509, [#8590]).

Plugins

• A wasmtime component-model host now backs tool, channel, and memory plugins, with channel host bindings (wasi:http, inbound queue, config jail) and a registration API (#8368, [#8551]).
• Plugins gain per-call execution limits and an FND-001 backend taxonomy, honor the configured signature policy when loading tools, and support registry search plus install-by-name (#8491, [#8172], [#8264]).

Channels & Git Forge

• New Git forge channel with a GitHub provider and SOP ingress, plus a Gitea/Forgejo provider (#8609, [#8611]).
• Operators can now bind identities without the /bind code round-trip (#8707).
• WhatsApp gains native location-pin support on both backends and passive group context; LINE gets a loading indicator, icon/nickname switching, and bind reply feedback (#8427, [#8389], [#7768]).
• Tool approvals can be routed to a distinct approver channel (#8231).

Runtime & Memory

• Unified memory-context injection is now keyed on TurnOrigin ingress provenance, and a durable memory store seam adds supersede/dedup/budget/policy-gate handling with embedding-identity persistence and automatic vector migration on change (#8619, [#8570], [#8623]).
• Metered provider seams (ResolvedModelAccess::run_model_query) now cover the model-query path and the max-iteration graceful summary (#8806, [#8821]).
• Process RAM/CPU sampling landed on macOS, Windows, and FreeBSD via sysinfo, and a model-context-window bar was added to the ZeroCode TUI, gateway agent chat, and interactive CLI (#8802, [#7946]).
• Goal task storage foundation and a configurable native runtime shell were added (#8685, [#8311]).

ZeroCode (Desktop / TUI)

• A TodoWrite tracker (RPC + ACP + durable persistence) and cron run history/trigger were added, along with a Cost tab with by-period and org-billed views (#8639, [#7905], [#8483]).
• ACP multiple-choice elicitation now uses elicitation/create when the client advertises form support, with single- and multi-select prompts rendered in the ZeroCode Code tab (#8338).
• You can now choose a saved Code session on entry, switch agents in active sessions, and use ctrl-w word delete (#8922, [#8477], [#8774]).
• The self-contained desktop app is reintroduced as a Quickstart-first companion with a bundled kernel sidecar (#8565, [#8708]).
• Quickstart supports subscription authentication modes and inline CLI subscription auth, while release workflows publish self-contained desktop installers for macOS, Linux, and Windows (#8980, [#8981], [#8709]).

Providers, Tools & Cost

• Provider requests now thread provider_timeout_secs and extra_headers through the responses path (#8229).
• A Bocha AI web-search provider was added, and browser_open now allows http:// URLs and allowed_private_hosts opt-in (#8737, [#8136], [#8171]).
• Cost tracking gains a task-attributed usage ledger, offline pricing catalog, live-gateway price backfill for unpriced models, and cost/org snapshot plus windowed cost/query RPCs (#8686, [#8380], [#8233], [#8482]).
• MCP gains resources-as-context, pinning, named-prompt rendering, and a policy-gated resource/prompt client surface (#8508, [#8403]).

Gateway, Config & Skills

• The gateway adds default HTTP security response headers and agent-aware /api/tools listing with an agent-scoped tool picker (#8829, [#8331]).
• Config adds independent delegate targets, a local_small runtime preset, and x-required-by-transport metadata for MCP servers (#8239, [#8531], [#8349]).
• Skills install/list/remove are now bundle-aware, surface security-audit-skipped skills, and support an opt-in bounded SKILL.md reflection for skill creation (#8335, [#8699], [#8261]).
• Observability adds a runtime OpenTelemetry content policy for LLM/tool I/O and a rotating log-persistence mode (#8567, [#8307]).
• Per-turn output routing via send_via with voice-delivery fixes landed (#7361).

Install, Release & Supply Chain

• Standard prebuilts remain on the lean supported channel set, correcting an unreleased broadening introduced after v0.8.2; target-specific Android and ARM exclusions are now resolved centrally, and install.sh --full remains available for the broader source-build surface (#9051, [#8566]).
• Release automation adds CycloneDX SBOM generation, cosign signing, SLSA provenance, and self-contained desktop installers (#8158, [#8404], [#8277], [#8709]).
• Release verification Markdown is escaped before it reaches GitHub workflow output (#9031).

Improvements

• Tool assembly across the runtime (agent creation, independent delegates, process_message, and loop_::run) was routed through a single ScopedToolRegistry seam (#8711, [#8744], [#8701], [#8700]).
• MCP prompt-section composition is now owned at the ScopedAssembled boundary, and the orchestrator turn routes back through ResolvedAgentExecution::resolve (#8812, [#8629]).
• Performance: JSONL fsync moved off the async hot path, the web-search tag-strip regex is cached in a LazyLock, and the orchestrator notify channel is bounded with capped path/URL bodies (#8439, [#8350], [#8460]).
• Windows builds now statically link the MSVC CRT, and prebuilt Docker image variants were consolidated with an added arm64 target (#8604, [#8485], [#5187]).

Documentation

• SOP fan-in usage docs, an autolinked ACP elicitation RFD, and repaired SOP fan-in snippet links were added (#8521, [#8498], [#8595]).

Bug Fixes

Area	Fix
Runtime	Enforce context budget against provider-reported tokens; enforce leading user-turn invariant before dispatch; strip orphaned tool_use on max-iterations exit (#8840, [#8696], [#7865])
Runtime	Arc-share tool schemas to stop per-iteration clone churn; hot-reload log-persistence config; thread agent_alias into agent_turn's ToolLoop (#8817, [#8816], [#8921])
Providers	Guard SSE parsers against EOF-as-success truncation; omit tool_choice/empty tool-call content for empty tool lists; clean Anthropic tool schemas before native serialization (#8663, [#8667], [#8524], [#7961])
Providers	Distinguish missing vs expired OpenAI Codex credentials; prefer chatgpt_account_id claim in Codex JWT extraction; cool down rate-limited fallback entries (#8029, [#8002], [#8317])
Security	Close SSRF gaps in Matrix marker URLs, text_browser, and skill_http userinfo; harden WeChat attachment path against traversal (#8657, [#8635], [#8658], [#8628])
Security	Constant-time nodes.auth_token comparison; reject empty bearer token; prevent signing-key leak via VarError; scan link/image destinations for credential patterns (#8824, [#8727], [#8591], [#8906])
Config	Protect runtime state files and real config.toml from agent self-modification; auto-materialize new map aliases in config patch (#8660, [#8606], [#8842])
Channels	Localize channel runtime replies; use resolved agent config for strict_tool_parsing/parallel_tools; serialize per-sender session persistence to prevent races (#8769, [#7836], [#7847])
ZeroCode	Fix intermittent ask_user failures under ACP elicitation; use runtime-profile max_context_tokens for context meter; strip markdown fences from code-block copy (#8773, [#8872], [#8777])
Memory	Refresh embedder on config change; resolve dotted embedding provider refs; make SqliteMemory: Clone valid by sharing one embedder lock (#8625, [#8152], [#8868])
Gateway	Propagate pairing DB errors instead of panic; advertise A2A cards on the runtime port; exclude env-overridden secrets from reload drift (#8466, [#8538], [#8704])
Cost	Atomic ledger appends with concatenated-record recovery; observability CLI one-shot no longer loses telemetry/token totals on exit (#8412, [#8146])
Deps	Bump crossbeam-epoch (RUSTSEC-2026-0204), anyhow (RUSTSEC-2026-0190), and remove rag-pdf/ttf-parser (RUSTSEC-2026-0192) (#8783, [#8500], [#8547])
Install	Prebuild dashboard for embedded web; exclude Tauri apps from --full app sweep; register zerocode.exe in the Scoop manifest (#8643, [#8786], [#8276])
Tools	Pin http_request to vetted DNS addresses; cap calculator values array to prevent OOM; bound browser_open launcher waits (#7902, [#8481], [#8564])

Breaking Changes

• Rust toolchain floor: the workspace MSRV is now Rust 1.96.1, with CI, containers, and documentation aligned to that version (#8801).

Contributors

@alexandme @Alix-007 @alteckclub @Audacity88 @bheatwole @CedricConday @chengzhichao-xydt @ConYel @crh-code @databillm @drbparadise @dvgamerr @eugeneb50 @FTDGRT @hanZeng-08 @HonorVanEr @IftekharUddin @initiallyqq @jhheider @jokewithme110 @JordanTheJet @Leon-SK668 @Leuca @LiLan0125 @mazhuima @mov-xound-glitch @Nillth @NiuBlibing @octo-patch @OmkumarSolanki @ozpool @perlowja @Pick-cat @piiiico @Project516 @rifuki @ryanlee486 @SimianAstronaut7 @singlerider @sonytricoire @Stealinglight @Super-Cabbage @Taswen @theonlyhennygod @theredspoon @thunderjr @tidux @tzy-17 @vrurg @wangmiao0668000666 @WeeLi-009 @xydt-juyaohui @yanchenko @yuxuan-7814 @ZOOWH @zverozabr

Full Changelog

Full diff: https://github.com/zeroclaw-labs/zeroclaw/compare/v0.8.2...v0.8.3

---

Verify SLSA Provenance

Release artifacts have GitHub artifact provenance attestations.

Online

:::bash
gh attestation verify <artifact> \
  --repo zeroclaw-labs/zeroclaw \
  --signer-workflow zeroclaw-labs/zeroclaw/.github/workflows/release-stable-manual.yml \
  --source-digest 24476b71d33eb1672a9495a7ce3d155377a60ce8

Offline Download <artifact>, <artifact>.attestation.jsonl, and trusted_root.jsonl from the release assets, then run:

:::bash
gh attestation verify <artifact> \
  --repo zeroclaw-labs/zeroclaw \
  --signer-workflow zeroclaw-labs/zeroclaw/.github/workflows/release-stable-manual.yml \
  --source-digest 24476b71d33eb1672a9495a7ce3d155377a60ce8 \
  --bundle <artifact>.attestation.jsonl \
  --custom-trusted-root trusted_root.jsonl

Install gh: https://cli.github.com/