Gas City v1.2.0

Gas City 1.2.0 is the stable 1.2 release.

Highlights

Gas City 1.2 is the second feature release after the 1.0 platform cut.
It is a broad control-plane, lifecycle, and
operator-safety release: CLI JSON contracts, read-path API routing, session
resume/nudge reliability, managed Dolt recovery, Pack V2 authoring, provider
staging, dashboard stability, and release validation all received substantial
work.

If v1.1.0 made the Pack V2 city model more resilient under real worker churn,
v1.2.0 is about making that model more scriptable, inspectable, and
recoverable. Commands that used to be mostly human-facing now have checked-in
result schemas. Session lifecycle edges now preserve auth, work identity, and
setup hooks more consistently. Managed Beads/Dolt operations fail louder before
they corrupt state or wedge a city. The bundled Gas Town packs also continue
moving away from role assumptions and toward explicit work, formula, and session
contracts.

Breaking Changes

• Pack V2 schema/layout enforcement is now part of the supported authoring
  path. Custom packs and city templates that still depend on PackV1-era file
  layouts, city-local seeding, legacy include behavior, or configurable formula
  directories must migrate to the Pack V2 shape: schema = 2, [imports.*],
  and the conventional agents/, formulas/, orders/, commands/, and
  provider-overlay directories. Legacy surfaces such as [formulas].dir,
  [[rigs]].formulas_dir, and old import/migration forms remain migration
  signals, not the ongoing authoring contract. Use gc doctor and
  gc doctor --fix for safe mechanical repairs; gc import migrate is now a
  deprecated guidance shim and exits non-zero.

Upgrade Notes

• Linux supervisor users should rerun gc supervisor install after upgrading so
  the user service gets preserve-on-signal behavior, owned workspace-service
  cleanup, and the refreshed supervisor logging path. If the active supervisor
  predates preserve mode, stop or drain intentionally before reinstalling.
• macOS launchd-managed supervisors now restart safely across binary drift without relying on Linux-only /proc/<pid>/exe resolution. If a direct macOS supervisor cannot be safely auto-restarted, gc start now exits with macOS-specific remediation guidance instead of a misleading Linux permission error.
• Existing control-dispatcher sessions should be restarted or recycled after
  upgrade so they write traces under .gc/runtime/control-dispatcher-trace.log
  instead of the city root.
• Run gc doctor after upgrading. Use gc doctor --fix where appropriate to
  migrate legacy pack/config surfaces; gc import migrate is now only a hidden
  deprecated guidance shim and exits non-zero.
• Managed Dolt cities may report a dolt-config doctor warning until the
  managed server regenerates dolt-config.yaml. gc dolt restart is the
  explicit refresh path.
• If a standalone bd dolt start server is already holding a city's
  .beads/dolt database, Gas City now refuses managed startup and names
  bd dolt stop as the unblock.
• Scripts consuming JSON output should review the 1.2 result contracts. Several
  commands now return schema-versioned envelope objects, empty collections
  encode as [], gc sling --json emits one JSONL result record, and
  gc trace status / gc trace show default to human-readable output unless
  --json is passed.
• Pack import cache validation now requires packs.lock commit abbreviations to
  be at least seven characters long. Refresh shorter lock entries with
  gc import install.
• gc rig add --include now writes canonical rig.Imports, processed
  alphabetically by binding rather than in legacy declaration order.
• [[orders.overrides]] rig matching is stricter. A rigless override matches
  only city-level orders, and rig = "*" is the new explicit wildcard for every
  instance of a named order.
• Provider overlays for ACP, subprocess, and Kubernetes sessions now apply
  through the provider-aware per-provider/<provider>/ contract. Custom ACP
  overlays should move provider-specific files under the matching provider slot.
• The built-in Kiro provider starts kiro-cli chat --no-interactive --agent gascity --trust-all-tools by default. Override [providers.kiro].args if
  unrestricted tool trust is not desired.
• The built-in Claude provider's model = "opus" alias now targets
  claude-opus-4-7.

CLI JSON, Schemas, and Operator Contracts

• Added schema-versioned JSON output across more operator surfaces, including
  mail inspection, trace inspection, wait inspection, config, supervisor status,
  and related command result schemas.
• gc mail inbox, gc mail read, gc mail peek, gc mail thread, and
  gc mail count now support --json with envelope results. Inbox/count
  results always include resolved recipients, including single-recipient
  targets.
• gc --json-schema no longer advertises the removed transport field.
  Consumers should use role schema metadata such as x-gc-jsonl where present.
• gc trace status --json and gc trace show --json now return envelope
  objects with schema metadata and stable fields instead of bare arrays or
  legacy names. Rolling upgrades keep the legacy arms alias on socket replies.
• gc converge status --json, gc converge list --json, and
  gc runtime drain-check --json now report explicit result objects for cases
  that previously had inconsistent or shell-only behavior.
• gc sling --json now emits one JSONL result record, matching its checked-in
  schema, instead of an indented multi-line object.
• Added gc lint for pack validation and expanded generated schema coverage
  under schemas/, giving script authors a concrete compatibility target.
• Documentation now includes the gc CLI JSON guide, current JSON behavior, and
  regenerated CLI/reference material with freshness guardrails.

Session Model and Agent Lifecycle

• Hardened managed session nudges so mail notifications wake the correct
  sessions, preserve controller auth, and route through city-backed state rather
  than losing provider credentials.
• Added a supervisor-hosted nudge dispatcher with a Unix-socket wake fast path,
  making wakeups less dependent on slow polling and repeated process scans.
• gc session attach now re-applies session_live hooks when it recreates a
  tmux-backed session whose runtime has exited, so resumed sessions get the same
  status-bar theme, keybindings, rig context, and setup variables as reconciler
  starts.
• Resumed sessions replay startup prompts where needed, preserve GC_CITY in
  restart env reseeding, and keep assigned work snapshots available for restart
  workdir selection.
• Named-session reset and kill paths now clear respawn circuit breakers and show
  reset-pending state more clearly, reducing confusing no-op restarts after an
  operator has explicitly intervened.
• Pool reconciliation now uses the same routed-target demand predicate as
  worker claim queries, excludes epic-routed beads by default, caps fresh pool
  creates per tick, creates pool session beads with explicit IDs, and resolves
  adoption from session snapshots.
• Suspended and orphaned runtime cleanup is stricter: stale live runtimes bound
  to closed session beads are reaped, drained sessions can be pruned by state,
  and session bead reconciliation stops suspended/orphaned runtimes before
  closing beads.
• Tmux handling is safer across macOS and large prompts: process snapshots use
  macOS-compatible ps, startup nudges can paste large content, liveness probes
  avoid clobbering degraded sockets, and custom session aliases can be configured
  through tmux_alias.

Supervisor, Services, and Startup Recovery

• Linux systemd supervisor refresh now preserves managed tmux sessions for
  re-adoption, stops orphan-prone workspace service process groups owned by
  registered cities, and uses bounded destructive fallback only after
  preserve-mode shutdown has had a chance to flush traces and close services.
• Supervisor startup now tees logs to ~/.gc/supervisor.log on systemd and
  launchd starts, improving post-crash diagnosis outside a running city.
• proxy_process services now receive a GC_SERVICE_URL_PREFIX that the
  supervisor public listener actually routes:
  /v0/city/<cityName>/svc/<svcName>.
• City startup gained per-phase timing, a watchdog, warm-up doctor checks, and
  clearer failure guidance so slow or partially-ready starts are easier to
  distinguish from hard failures.
• gc start --soft accepts config drift without draining sessions, and restart
  budgets are pinned per mode so drift handling is less surprising.
• Startup and provider-readiness hints now handle Claude setup-token OAuth,
  managed provider state fallback, and missing pack scripts more explicitly.

Beads, Mail, Events, and Managed Dolt

• Managed bd provider startup now detects a standalone bd Dolt server against
  the same .beads/dolt database before trying to start Gas City's managed
  server, preventing lock-holder failures from surfacing as generic startup
  errors.
• Managed Dolt lifecycle behavior is closer to Gas Town parity: recovery avoids
  transient disconnects, managed servers disable persistent stats, config
  publication is preflighted before startup store work, and GC_DOLT_HOST /
  auth env handling is more reliable.
• Added gc dolt compact and gc dolt restart pack commands, plus compaction
  safeguards that defer or retry when a writer races flatten/GC instead of
  quarantining good data.
• Added doctor and maintenance checks for bd backup growth, jsonl archive
  health, managed-city port drift, stale Dolt provider state, missing
  dolt-backup registration, and bad pre-start scripts.
• jsonl-export.sh now treats Dolt's bare {} response for an empty issues
  table as zero rows, memoizes archive mode, retries push races, and avoids
  silently escalating when remotes are not configured.
• Event recording no longer stacks stuck gc event emit processes behind a
  dead flock holder. events.FileRecorder.Record now uses bounded
  non-blocking lock acquisition and drops the recorder after a clear timeout.
• Legacy event archives can be migrated on recorder open, archive rotation
  retention gaps were closed, and force-rotate APIs/CLI support were added.
• Mail routing and closure paths are stricter: thread lookup accepts message IDs,
  archive/close paths stamp explicit close reasons, external-message receipts
  decode typed snake_case fields, and routed recipients avoid leaking target
  discriminators.

Config, Packs, Formulas, and Workflows

• Pack V2 authoring was tightened with schema cleanup, bundled core-pack
  metadata, generated system-pack refreshes, stronger PackV1 deprecation
  warnings, and gc doctor --fix support for recoverable legacy [formulas].dir
  paths.
• Formula and order behavior is more deterministic: formula roots close when
  step children are terminal, root-only formula routing is respected, ref-stable
  formula resolution is available through GC_FORMULA_REF, and controller order
  files can be dynamically reloaded.
• Order dispatch correctness improved around rig-scoped overrides, wildcard
  overrides, qualified pool names, in-flight wisp counting, order-tracking sweep
  retries, and fanout/retry route metadata.
• Shipped packs no longer rely on removed gc agent peek/list/drain forms, no
  longer use broad filesystem searches in formula-following guidance, and route
  dog/witness/deacon work through explicit pack and binding contracts.
• The Gas Town maintenance pack converted more dog molecules to exec orders,
  added source-safe Dolt commands, and fixed cleanup/export scripts for real bd
  primitives and split-schema stores.
• The lifecycle example now includes a hello-world quickstart and pack
  auto-include flow, making a small end-to-end city easier to inspect.
• Polecat/refinery workflows gained claim-first orphan handling, richer PR
  bodies, detailed commit-message guidance, auto_push=false respect, and PR
  publication paths that do not depend on gh in the worker environment.

API, Dashboard, Providers, and Runtime Surface

• The API layer gained read-path routing and StoreHealth support, plus restored
  read parity after follow-up review. Session target resolution now handles
  pool-session path aliases and bounded pool instances more consistently.
• SSE and event surfaces are safer: raw transcript SSE frames are sanitized,
  async event result delivery is more reliable, and proxy service URL prefixes
  line up with the public supervisor router.
• Dashboard stability improved with fewer stale scope refresh storms, stable
  scope-banner height across overseer states, generated type/schema refreshes,
  and more focused panel tests.
• Kiro is now a first-class provider, Kubernetes provider config gained pod
  scheduling fields, OpenCode MCP projection support was added, OMP session keys
  persist correctly, and provider credential env prefixes were widened.
• Hook and overlay setup is more provider-aware: Codex PreCompact handoff hooks,
  Copilot PreCompact support, canonical managed hook bytes, JSON-aware Claude
  settings upgrades, and provider-specific overlay flattening all landed in this
  release.
• Runtime safety improved around subprocess process-group cleanup, dispatch
  timeout kills, zombie-shell liveness checks, and symlink/absolute-path
  hardening for condition paths and work dirs.

Quality, Security, CI, and Release Hardening

• The RC gate now reuses CI parity, runs GoReleaser snapshot coverage, shards
  fast/integration/acceptance/tutorial suites, and includes macOS fast tests so
  release-candidate validation exercises both the Linux and macOS operator
  surfaces.
• Acceptance C release blockers were stabilized for v1.2.0, including
  stricter noninteractive Claude tooling, tutorial golden schema updates, and
  targeted fixes for long-socket and communication-recovery tests.
• Nightly and acceptance infrastructure now covers Tier B and Ollama-backed Tier
  C flows more explicitly, with setup-go tracking the bead source module and
  worker inference tests hardened around provider setup.
• Local and CI runtime improved through sharded pre-commit tests, faster
  golangci-lint flow, shorter stale-key delays, observable Go test scripts, and
  broader process leak guards for managed Dolt/controller tests.
• Security and supply-chain work included a Go toolchain bump to clear
  CVE-2026-33811, a GitPython bump for GHSA-mv93-w799-cj2w, refreshed MCP mail
  requirements, release workflow permission tightening, and more reliable local
  macOS signing.
• The release process itself now has draft RC asset publishing for manual
  verification, with stable release publishing still gated by the final
  v1.2.0 tag-triggered GoReleaser workflow.

Validation

• RC Gate passed on release/v1.2.0 at
  6aa1c37d912e47229dfa59b9a576e96f662e46f1.
  • https://github.com/gastownhall/gascity/actions/runs/26615296212
  • Covered CI parity, dashboard SPA, generated artifacts, release config,
    worker-core suites, cmd/gc process shards, integration shards, acceptance A,
    acceptance B, acceptance C, tutorial goldens, macOS fast tests, docs, and a
    GoReleaser snapshot.
• Full Mac Regression passed on the same SHA.
  • https://github.com/gastownhall/gascity/actions/runs/26615296147
  • This included the macOS REST integration shard that caught the RC1
    supervisor drift restart bug.
• RC Release generated the v1.2.0-rc2 draft prerelease assets for manual
  verification.
  • https://github.com/gastownhall/gascity/actions/runs/26620536836
• Manual macOS verification was approved against the v1.2.0-rc2
darwin_arm64 asset. The manual path verified checksums, extracted the
  archive, and ran ./gc version --long.
• The stable v1.2.0 Release workflow passed.
  • https://github.com/gastownhall/gascity/actions/runs/26620786781
  • Ran GoReleaser, uploaded stable archives and checksums, generated and
    uploaded the SBOM, created artifact attestations, and updated
    gastownhall/homebrew-gascity.
• The attached stable assets are:
  • gascity-v1.2.0.spdx.json
  • gascity_1.2.0_checksums.txt
  • gascity_1.2.0_darwin_arm64.tar.gz
  • gascity_1.2.0_darwin_amd64.tar.gz
  • gascity_1.2.0_linux_arm64.tar.gz
  • gascity_1.2.0_linux_amd64.tar.gz

Homebrew

• The stable v1.2.0 workflow updated gastownhall/homebrew-gascity with the
  asset-based formula for the final archives.
• Existing gastownhall/gascity tap installs remain asset-based for existing
  users. The separate Homebrew/core path remains source-built and should not
  replace the tap formula.
• The v1.2.0 release uses the tap publication path; any Homebrew/core update
  should be handled as a separate source-built formula follow-up.

Contributors

For v1.2.0, we are crediting contributors from GitHub's generated release
notes for the exact range v1.1.0...v1.2.0 at
6aa1c37d912e47229dfa59b9a576e96f662e46f1. That generated range reports 72 PR
authors: 70 human contributors plus 2 automation accounts.

Human release contributors:
@A3Ackerman, @ademets, @azanar, @Bochenski, @boshu2, @boylec, @brandonmartin,
@coreyjewett, @csells, @cwalv, @danzko, @ddbas, @donbox, @donvince, @dutsik-p,
@eric-jones, @eric-richardson1, @esciara, @fengning-starsend,
@GarrettKucinski, @gwilkes-sc, @hexsprite, @itsthatriver, @iwata-1116,
@jakepearson, @javipelopi, @jbongaarts, @jknair, @johnzook, @jonathanpberger,
@juleslemee, @julianknutsen, @kab0rn, @kenhorn, @lambdabaa, @lucasfuad,
@mackaybe, @mattiasw, @mkly, @mrhbriggs, @myster-t, @nagyv,
@nathanielosullivanmolloy, @neutmute, @npavlov, @oniskanen, @osamu2001, @pae23,
@pedromonteiro18, @philcunliffe, @plarson, @quad341, @realies, @rileywhite,
@rjgeng, @Rome-1, @rschalo, @scarson, @ShawnSpooner, @sjarmak, @stephenVertex,
@steveyegge, @stuen64, @tesdal, @tim-white87, @tudorsaitoc, @vbtcl, @wynged,
@yjspanish, @yoniLavi

First-time human contributors:
@ademets, @Bochenski, @boshu2, @coreyjewett, @ddbas, @donvince, @dutsik-p,
@eric-richardson1, @esciara, @fengning-starsend, @GarrettKucinski,
@gwilkes-sc, @iwata-1116, @jakepearson, @javipelopi, @jknair, @johnzook,
@jonathanpberger, @juleslemee, @kenhorn, @mackaybe, @mkly, @mrhbriggs, @nagyv,
@nathanielosullivanmolloy, @neutmute, @npavlov, @oniskanen, @pedromonteiro18,
@philcunliffe, @plarson, @rjgeng, @rschalo, @ShawnSpooner, @stephenVertex,
@stuen64, @tudorsaitoc, @yjspanish, @yoniLavi

Automation accounts present in the generated contributor range:
@Copilot, @randy-release-manager[bot]

Recommended Reading

• Installation guide
• CLI JSON guide
• CLI reference
• Config reference
• Cities and rigs tutorial
• Sessions tutorial
• Communication tutorial
• Formulas tutorial
• API control-plane architecture
• Reconciler debugging guide

Full Changelog: v1.1.0...v1.2.0