Gas City v1.4.0

Highlights

• A run-centered dashboard and API. Run detail now unifies the formula
  stage ladder, structured transcripts, live token rate, and estimated burn
  rate. Session and run reads move to typed, paginated API surfaces backed by
  warm projections instead of ad hoc wire shapes.
• Session lifecycle converges through the worker boundary. Pool demand,
  wake, resume, drain, close, and orphan recovery all reason from persisted
  session/work identity rather than provider-specific shortcuts.
• Formulas v2 production controls. Stronger retry, fan-out, drain, scope,
  artifact, and finalization behavior, with better live status and event
  evidence for operators.
• More resilient storage, same beads boundary. Native and CLI-backed
  stores share transactional lifecycle semantics, bounded cached reads,
  store-aware routing, and explicit degraded results across city and rig scopes.
• Broader runtime composition. Provider routing, ACP/automatic runtime
  selection, Herdr-backed sessions, and Kubernetes/subprocess/tmux execution
  share one session lifecycle and worker boundary.

Upgrading Notes

• Configure one store-scoped control-dispatcher for every graph-owning
  scope. Formula control beads now route to the dispatcher whose Dir
  matches the city or rig store that owns the graph. A rig-owned graph with no
  matching dispatcher fails before instantiation instead of falling back to a
  dispatcher that cannot read its work.
• Run gc doctor --fix after upgrading an existing city. The current
  doctor converges pack imports, provider catalogs, project identity, retired
  hold labels, and managed beads/Dolt metadata before the orchestrator starts.
• Upgrading over an older install at a different path may need a manual
  reseed. If a machine already ran an older gc (for example a Homebrew
  binary now replaced by a source build at a new path), gc start can keep the
  stale supervisor running and can fail closed on a present-but-invalid
  bundled-pack cache — only an absent cache self-heals. Run gc import install to repopulate the cache, then let gc start auto-restart the
  supervisor (or on Linux systemctl --user restart gascity-supervisor).
• An unrelated stale registered city can block gc start; fix or unregister
  that city — not the one you are starting. A pre-1.3 city still registered
  with un-migrated provider config (for example workspace.provider = "claude"
  with no [providers.claude] block) can fail the registry scan and abort
  startup, with a misleading hint to gc init the healthy city you were
  actually starting. Run gc doctor --fix inside the offending stale city, or
  gc unregister <stale-city> to drop it.
• macOS: a supervisor left running from a prior version may need a manual
  restart. macOS cannot resolve a direct (non-launchd) supervisor's
  executable for binary-drift detection, so the automatic post-upgrade restart
  may not complete. Run gc supervisor stop --wait, then gc start.

Added

• A run-centered dashboard and API. Run detail now combines the formula
  stage ladder, structured transcripts, token rate, and estimated burn rate.
  Session and run reads use typed, paginated API surfaces backed by warm
  projections instead of ad hoc wire shapes.
• Durable usage and lifecycle observability. Model, compute, and lifecycle
  facts feed local usage history and OpenTelemetry metrics. End-of-interval
  transcript sweeps keep live pool sessions' token and cost rates current even
  when agents self-drive after their initial claim.
• Privacy-scoped command-usage metrics in release artifacts. Before the
  first eligible interactive command is recorded, gc shows the complete
  disclosure. Events contain only a canonical command ID, the gc release,
  operating system, and an anonymous installation ID—never arguments, paths,
  file contents, or environment values. gc metrics status, example, on,
  and off expose the local controls; DO_NOT_TRACK=1 and
  GC_DISABLE_USAGE_METRICS=1 provide environment-level opt-outs.
• Broader runtime composition. Provider routing, ACP/automatic runtime
  selection, Herdr-backed sessions, and Kubernetes/subprocess/tmux execution
  share the same session lifecycle and worker boundary.
• Production workflow controls. Formulas v2 gained stronger retry,
  fan-out, drain, scope, artifact, and finalization behavior, plus better live
  status and event evidence for operators.
• An experimental OpenClaw bridge proof of concept. The private package
  under contrib/openclaw-bridge explores iMessage and Telegram connectors; it
  is not a supported provider pack or a shipped connector artifact.

Changed

• Session lifecycle operations converge through the worker boundary. Pool
  demand, wake, resume, drain, close, and orphan recovery now reason from
  persisted session/work identity rather than provider-specific shortcuts.
• Beads remains the persistence boundary while storage becomes more
  resilient. Native and CLI-backed stores share transactional lifecycle
  semantics, bounded cached reads, store-aware routing, and explicit degraded
  results across city and rig scopes.
• CI and local verification are sharded and event-driven. The release gate
  includes fast units, process tests, integration packages, tutorials, real
  inference acceptance, and macOS regressions without one monolithic test
  process.

Fixed

• Pool sessions no longer lose or strand work while draining, restarting, or
  reusing capacity. Claim ownership, wake budgets, slot selection, and
  confirmed-dead cleanup are now fenced against stale or partial observations.
• Formula control routing retries transient configuration reads. Attempt
  spawn and fan-out no longer quarantine an in-flight run because of a
  momentary config/include read failure; a successfully loaded configuration
  that lacks the required scoped dispatcher still fails closed.
• Managed beads and Dolt paths fail more honestly. Provider health,
  endpoint ownership, lock release, compaction, reindexing, stale data-dir
  cleanup, and partial-store reads now preserve errors instead of silently
  reporting complete state.
• Events, nudges, waits, and session output remain bounded under load. The
  CLI drains paginated event windows, request paths avoid unbounded scans, tmux
  sessions keep their shared server, and structured transcripts preserve tool
  and error frames.
• Live run cost fields populate for long-lived pool sessions.
  End-of-interval model-usage sweeps account for each transcript window once,
  restoring tokens/min and burn/hr in run detail (PR #4436).
• Dashboard and claim regressions are closed. Cross-city
  attention reads now cancel stale requests and recover after startup; Health
  reports per-metric availability with cross-platform sampling instead of
  false zero/NaN values; and hook claims no longer fuzzy-update a vanished
  session record (#4354, #4356, #4361).
• Release-candidate gates are portable and reproducible. Bash 3 scripts,
  deep metrics fixtures, reusable pool slots, Tier C pack compatibility, and
  container-tool vulnerability checks now exercise the same bounded behavior
  expected from the shipped artifacts.

Troubleshooting (upgrading an existing city)

Most 1.3→1.4 upgrades are clean. The known papercuts all come from existing
machine state left by an older install, and each has a one-command workaround.
Run this first, once per existing city:

gc doctor --fix

It converges pack imports, provider catalogs, project identity, retired hold
labels, and managed beads/Dolt metadata before the orchestrator starts.

Validation

• The release was cut from release/v1.4.0 at the exact commit that passed the
  full RC gate green (fast units, process tests, integration packages,
  tutorials, real-inference acceptance A/B/C, and macOS regressions).
• Downloadable v1.4.0-rc1 prerelease artifacts were built and verified
  (checksums, per-platform binaries, injected version) before promotion.
• The tracked issue set was reviewed for blocking regressions before
  promotion; no 1.3→1.4 regressions were found, and the upgrade path is clean
  with the caveats documented above.

Homebrew

• The gastownhall/gascity tap remains asset-based for existing users.
• Homebrew/core submission uses a separate source-built formula.
• Install from the tap with brew install gastownhall/gascity/gascity.

Contributors

Thanks to everyone who contributed to v1.4.0 (between v1.3.5 and v1.4.0):

@A3Ackerman, @AJBcoding, @atbrace, @azanar, @boshu2, @bourgois, @brandonmartin,
@csauer02-personal-user, @csells, @cstar, @donbox, @duncan4123, @elmpp,
@esciara, @FCFColin, @iwata-1116, @jacobhausler, @JarrodJ83, @jeffora,
@johnzook, @jonathanpberger, @julianknutsen, @keithballinger, @luis-mendes-dev,
@lvanderbijl-kry, @McKean, @n43-scott, @nonathaj, @outdoorsea, @quad341,
@realies, @reggieperry, @remuscazacu, @rjgeng, @Rome-1, @sarendipitee,
@sjarmak, @smurfix, @superlzyguy, @swedeinasia-flow, @ThePlenkov, @Thirsty2,
@tudorsaitoc, @vbtcl, @wbern, @Wldc4rd

New Contributors

• @remuscazacu made their first contribution in #3503
• @ThePlenkov made their first contribution in #3573
• @superlzyguy made their first contribution in #3655
• @FCFColin made their first contribution in #3672
• @n43-scott made their first contribution in #3709
• @AJBcoding made their first contribution in #3685
• @luis-mendes-dev made their first contribution in #3738
• @keithballinger made their first contribution in #4094
• @smurfix made their first contribution in #4076
• @nonathaj made their first contribution in #4134
• @Thirsty2 made their first contribution in #4174
• @atbrace made their first contribution in #4321
• @JarrodJ83 made their first contribution in #4315

Recommended Reading

• Installation guide
• Troubleshooting guide
• How Gas City works
• Understanding packs
• CLI reference
• Config reference

Full Changelog: v1.3.5...v1.4.0