• v1.8.0 8d8b9603a8

    v1.8.0 Stable

    zaph0d released this 2026-08-16 19:31:56 +02:00 | 44 commits to main since this release

    📅 Originally published on GitHub: Sun, 16 Aug 2026 17:40:59 GMT
    🏷️ Git tag created: Sun, 16 Aug 2026 17:31:56 GMT

    The biggest release yet: a full community-moderation system (roles,
    approval queue, ratings, comments, notification preferences), plus four
    independent platform upgrades — compile-time validation, sync/drift
    detection, multi-agent orchestration tooling, and a public demo + local
    setup audit for onboarding. Nine new features across five merged branches,
    each carrying its own ADR(s) and a dedicated multi-angle code-review pass
    before merge.

    Highlights

    Community moderation, ratings & comments

    • Moderator role — a new user/moderator/admin tier, additive
      alongside the existing admin flag, assignable from the admin Users
      table (ADR-0007).
    • Real moderation queue — publishing a collection now only submits it
      for review; approve/deny (moderator/admin only) is the sole path that
      makes it public (ADR-0008). Denied submissions can be edited and
      resubmitted without starting over.
    • Ratings & comments — 1-5 star ratings and comments on approved
      collections, with self-rating blocked and sorting by rating/downloads/
      name on both the community listing and the moderation queue.
    • Notification preferences — opt into a daily download digest or
      immediate comment notifications, per user.

    Compile-time validation

    • Compiling a profile now returns a warnings list alongside the
      compiled files — starting with name_collision, which catches two
      composed collections silently overriding the same artifact name (a
      problem that previously required a documented manual grep to catch).
      myace pull --strict turns a warning into a non-zero exit code; the
      web UI's compile page shows a dismissible amber panel.

    Sync & drift detection

    • myace pull now writes a local .myace/<target>.manifest.json
      recording what it wrote and its hash. myace check and the new
      myace watch diff that against the current disk state and the
      server's live compile, so you always know whether a pulled-down
      profile has been hand-edited or gone stale — with watch --auto-pull
      safely re-pulling on staleness while never touching a locally-edited
      file. An opt-in --report flag feeds a personal Sync Dashboard in the
      web UI, and a distributable CI Action lets
      any repo that vendors compiled output fail its build on drift.
    • Agents can now declare handoff_to: [...] in frontmatter, making the
      multi-agent routing pattern this project's own starter packs already
      used a first-class, machine-readable fact instead of only prose. The
      new Orchestration Gallery (/orchestration) turns that into a
      browsable set of pipeline "recipes" with a flow diagram; Compose your
      pipeline
      (/orchestration/build) lets you assemble a new linear
      pipeline from an existing profile's agents and save it as a generated
      orchestrator — no hand-written frontmatter required.

    Trust & onboarding

    • Try it before you sign up — the new public /welcome landing page
      embeds a live compile demo (paste or edit an AGENTS.md-style rules
      file, see Claude Code/Cursor/OpenCode output side by side), no account
      required. It's the one deliberate public, unauthenticated route in the
      backend — rate-limited, size-capped at both the transport and content
      layers, and never persists anything (ADR-0011).
    • Local Setup Audit — a new page scans every supported target
      framework's conventional config location on your own machine (via the
      same local companion server Import already uses) and reports coverage
      gaps and duplicate names across them with a rough 0-100 score.
    • Community collection freshness — moderators can mark an approved
      collection as manually verified; cards show "Verified {date}" or
      "Needs re-check" once that goes stale (default ~6 months), with a
      weekly digest email flagging anything overdue. Deliberately honest
      about what "verified" means: a human looked at it recently, not an
      automated check against live tool docs (ADR-0012).

    Fixed

    Caught during development, before ever shipping:

    • DELETE /collections/{id}/rating was hard-deleting instead of
      soft-deleting, violating this repo's own soft-delete rule.
    • A moderator who also owned a collection could approve or deny their
      own submission, and the moderator meta-edit endpoint had no scope
      check — either could read/edit any user's private, never-submitted
      draft by UUID if guessed.
    • The compile-time name-collision check compared collection names
      instead of IDs — since collection names aren't required to be unique,
      two identically-named collections could silently defeat the exact
      detection this feature exists to provide.
    • myace watch --auto-pull could write a sync manifest recording hashes
      for files it never actually wrote (when a compile response contained
      an unsafe filename), leaving check permanently confused about that
      target's state.
    • The new public demo endpoint's 20KB input cap was enforced only after
      FastAPI had already buffered and parsed the full request body — closed
      with a dedicated transport-level middleware that rejects oversized
      bodies before they're ever parsed.

    Docs

    • Six new ADRs (0007-0012) covering the moderator role, the moderation
      state machine, manifest-based drift detection, the structured
      handoff_to field, the public demo sandbox, and manual freshness
      verification.
    • AGENTS.md grew from 29 to 37 numbered rules; README.md was
      rewritten around a visitor-friendly chapter structure.
    • Known limitation: the handoff_to frontmatter added to the
      software-engineer starter pack won't reach an already-seeded
      deployment automatically — starter-pack seeding only runs once per
      collection. See docs/debugging.md for the manual fix.

    Downloads

    Standalone CLI binaries for Linux, macOS (Intel + Apple Silicon), and
    Windows are attached below — no Python required. See the
    README
    for install instructions.

    Downloads