• v0.4.3 bb8efbf75e

    v0.4.3
    All checks were successful
    CI / audit (push) Successful in 15s
    CI / test (push) Successful in 22s
    Release / gate (push) Successful in 24s
    Release / check (push) Successful in 17s
    Release / image (push) Successful in 2m26s
    Release / forgejo-release (push) Successful in 16s
    Stable

    Mila released this 2026-10-29 11:36:14 +00:00 | 5 commits to main since this release

    Fixed

    • A CI repair session never saw the user's comments: after the issue was blocked and released
      again with an instruction such as "adjust the CI", the session got only the old logs and
      answered the same way each time. New comments are now part of the repair prompt and take
      precedence.
    • A CI repair no longer stops at "not caused by my change" when the cause is in the repository
      (a test timing out under load, a flaky test, CI configuration); it fixes that in a separate
      commit. Only causes outside the repository end as blocked.
    • Before a CI repair the branch is rebased onto the current base, so fixes that landed there in
      the meantime reach the pull request.
    Downloads
  • v0.4.2 7df66aadc0

    v0.4.2
    All checks were successful
    CI / audit (push) Successful in 15s
    CI / test (push) Successful in 24s
    Release / check (push) Successful in 19s
    Release / gate (push) Successful in 20s
    Release / image (push) Successful in 21s
    Release / forgejo-release (push) Successful in 13s
    Stable

    Mila released this 2026-10-27 22:52:23 +00:00 | 8 commits to main since this release

    Changed

    • Issue PRs are merged and released only after their CI is green. A red CI starts a new attempt
      that gets the failed jobs' logs and repairs the same branch; if the session finds the cause
      outside its change (CI infrastructure, flaky test), the issue is blocked with that explanation
      instead of using up further attempts. Repositories without CI proceed after 15 minutes without
      any status. Before, a PR was merged right away, so a red CI only showed up on the base branch,
      and a comment there gave the next session no logs to work with.

    Fixed

    • A session timeout no longer fails when the CLI had already exited.
    Downloads
  • v0.4.1 7550db33f5

    v0.4.1
    All checks were successful
    CI / audit (push) Successful in 15s
    CI / test (push) Successful in 21s
    Release / check (push) Successful in 15s
    Release / gate (push) Successful in 16s
    Release / image (push) Successful in 15s
    Release / forgejo-release (push) Successful in 13s
    Stable

    Mila released this 2026-10-27 22:20:45 +00:00 | 11 commits to main since this release

    Fixed

    • Every Claude session crashed on its first output line (log undefined in agents.py, since
      0.3.0); jobs ended as blockiert without an attempt being made.
    • Repository discovery compares owner and name case-insensitively like Forgejo. A project stored
      as mila/vigilia was taken for vanished and disabled once /user/repos answered as
      Mila/Vigilia. A discovered repo whose name collides with an existing project name gets a free
      name instead of being silently dropped and counted as new.
    Downloads
  • v0.4.0 8ef5ec4bcf

    v0.4.0
    All checks were successful
    CI / audit (push) Successful in 24s
    CI / test (push) Successful in 50s
    Release / check (push) Successful in 17s
    Release / gate (push) Successful in 17s
    Release / image (push) Successful in 1m33s
    Release / forgejo-release (push) Successful in 14s
    Stable

    Mila released this 2026-10-27 20:18:45 +00:00 | 14 commits to main since this release

    Added

    • release_mode: tag: autopilot only creates the tag and leaves the Forgejo release to the
      project's release pipeline, then reports the pipeline result in the issue or PR. The deployer
      therefore only sees releases whose image exists.
    • Renovate PRs repaired by autopilot are handed over for review (label zu-prüfen, mention)
      instead of being merged; renovate_automerge restores the old behaviour per project.
    • Merged Renovate security updates (label security) trigger a release
      (renovate_security_release, default on). The first poll only sets the baseline.
    • Throwaway Postgres testdb in compose.yaml for sessions that run database tests.
    • docs/08-isolation-plan.md: isolation of sessions and CI, done and planned stages.

    Changed

    • Agent sessions run as their own user agent. They can no longer read the Forgejo token,
      state.db, config.yaml or the logs; they share only the worktrees with the service.
    • The container has no Docker socket and no Docker CLI any more; it starts as root only to set
      the permissions under /data and then drops to autopilot (service) or agent (CLI logins).
    • The image contains libmagic1 and shellcheck for the Horae toolchain.
    • compose.yaml limits memory and CPU (AUTOPILOT_MEM_LIMIT, AUTOPILOT_CPUS); the host also
      runs production.
    • The release image is built on the runner labelled docker.
    • A session timeout kills the whole process group, not only the CLI.
    • The git authorization header is passed via the environment instead of the command line.

    Fixed

    • Tags and releases point at the commit that was checked, not at the moving base branch: with
      release_after_ci a commit pushed in between could otherwise end up in the release.
    • CI logs for Renovate sessions are found on Forgejo 16 (commit_sha, job list, status);
      before, sessions never got any log. Post steps are cut so the error is not pushed out.
    • Renovate PRs are not picked up when the base branch is red itself, nor the onboarding PR.
    • A repair that changes CI workflows (.forgejo/, .github/) is not pushed but blocked.
    • A job that crashed on its last attempt gets the blockiert label; before, the next poll
      restarted it from attempt 0.
    • The deployer ignores draft releases.
    • Conflict resolution and approval merges of Renovate PRs use the PR branch.
    Downloads
  • v0.3.1 9acbe14327

    v0.3.1
    All checks were successful
    CI / audit (push) Successful in 16s
    CI / test (push) Successful in 18s
    Release / check (push) Successful in 16s
    Release / gate (push) Successful in 17s
    Release / image (push) Successful in 16s
    Release / forgejo-release (push) Successful in 14s
    Stable

    Mila released this 2026-10-27 17:58:46 +00:00 | 17 commits to main since this release

    Fixed

    • Existing installations with a minimal legacy projects table are migrated with every current
      project column, including release and deployment settings.
    Downloads
  • v0.3.0 8908165d22

    v0.3.0
    All checks were successful
    CI / audit (push) Successful in 16s
    CI / test (push) Successful in 18s
    Release / check (push) Successful in 16s
    Release / gate (push) Successful in 16s
    Release / image (push) Successful in 1m43s
    Release / forgejo-release (push) Successful in 13s
    Stable

    Mila released this 2026-10-27 17:39:47 +00:00 | 19 commits to main since this release

    Added

    • Management dashboard with Forgejo OAuth Authorization Code + PKCE, admin allowlist, signed
      sessions and CSRF protection. Projects, global model defaults, account limits, jobs, releases
      and deployment history are visible there.
    • Repositories accessible to the technical Forgejo user are discovered automatically on every
      poll. New projects stay disabled until approved; access loss disables them without deleting
      history. YAML projects are imported into SQLite once, afterwards the dashboard is authoritative.
    • Claude Code, Codex and Kimi Code adapters with project and global model selection, resumable
      sessions, process timeouts and structured results. The image installs all three CLIs.
    • Multiple named accounts per agent with isolated credential homes, priorities, per-account quota
      backoff and per-account job sessions. Fallback never switches to another agent provider.
    • SSH deployments from actual Forgejo releases, with a separate deployer container, read-only key
      mounts, strict host-key checking, timeouts and per-project serialization. Existing releases form
      a baseline on first activation; new releases queue exactly once and manual retries are separate
      runs.
    Downloads
  • v0.2.0 d1c878451b

    v0.2.0
    All checks were successful
    CI / audit (push) Successful in 15s
    CI / test (push) Successful in 17s
    Release / check (push) Successful in 16s
    Release / gate (push) Successful in 16s
    Release / image (push) Successful in 47s
    Release / forgejo-release (push) Successful in 16s
    Stable

    Ghost released this 2026-10-27 15:50:44 +00:00 | 22 commits to main since this release

    First release by tag. The VM runs this image instead of a local build from now on.

    Added

    • Renovate PRs whose CI is red are taken over: a third trigger next to issues. The session
      gets the PR text and the failing job logs, fixes the code on the PR branch; the service
      pushes, waits for CI, merges and releases by the project's rules
      (docs/07-renovate-handover.md, renovate: true per project, renovate_user).

    • The image has Node 22, uv and the Docker CLI, and the container may use the host's Docker
      socket (DOCKER_GID), so a session can reproduce a project's CI.

    • release_after_ci: tag only after the CI of the release commit on main is green.

    • Releases by tag, as in Horae and Vigilia: CI on every push, image
      git.mila-hofmann.de/mila/autopilot:<version> and a Forgejo release for a tag vX.Y.Z.

    • Users named in allowed_users are mentioned when their attention is needed.

    • A reopened issue whose job is done is reworked when it gets a new comment.

    Downloads