chore(main): release 0.9.0

[github-actions]

🤖 I have created a release beep boop

0.9.0 (2026-09-15)

Features

• acp: add standard session list and resume (#914) (c1937df)
• acp: emit structured file changes in tool updates (#999) (faec8ee)
• acp: surface safe browser tool metadata (#1000) (a6ec043)
• exec: default headless runs to the turn-budget ceiling (#1049) (9e609c5)
• tui: interactive terminal attach for tty exec sessions (#1055) (d73ec81)
• tui: offer mid-run model escalation behind --allow-escalation (#1019) (91d921f)
• tui: richer /resume session browser (#1047) (2f53117)

Bug Fixes

• acp: make configured MCP tools callable (#1003) (7f5e5af)
• agent: stop the tool-schema ratchet meaning a different thing per host (#1017) (f909266)
• background: treat POSIX zombie leader as already-exited (#981) (1aacf38)
• config: lock config read-modify-write across processes (#960) (b04fe96)
• config: preserve unknown top-level fields (#984) (488def6)
• daemon: publish status files atomically (#949) (9001421)
• installtxn: put back an install a killed commit left behind (#997) (2837f5e)
• let the configured forward proxy through the loopback guard (#1025) (1e4db7c)
• lockutil: use kernel-held advisory locks (#950) (6fe0d1e)
• mcp: discover OAuth through protected resource metadata (#991) (1b5db17)
• mcp: reject a server-initiated request as a streamable-HTTP response (#1054) (2479d94)
• oauth: force-close loopback callback connections past the shutdown deadline (#1051) (176f5a2)
• oauth: Split an oversized keyring token blob across entries (#1007) (275e248)
• providers: register Atomic Chat as local OpenAI-compatible runtime (#550) (79fa142)
• redaction: split camelCase keys in normalizeKey (#994) (08fbea7)
• sandbox: keep a derived ACL target inside the write root it came from (#1040) (3b43c43)
• sandbox: keep Windows restricted-token SIDs narrow and fail closed on DenyRead (#1006) (0207f2b)
• sandbox: Make WSL backend tests deterministic. (#948) (e59bf78)
• sandbox: protect worktree git pointers (#805) (f30f550)
• sandbox: refcount temporary roots so one holder's cleanup cannot revoke another's (#911) (7acac7a)
• sessions: carry an interrupted turn's work into the resume prompt (#1016) (6ae8396)
• sessions: render resume context fields in key order (#1043) (da244bc)
• specialist: keep the pinned model when a specialist is resumed (#1009) (aadb4a2)
• swarm: stop original member before handoff (#957) (0021475)
• tools: an edit keeps the reads it did not disturb (#908) (1649008)
• tools: make apply_patch tolerant and re-expose edit_file (#956) (2749447)
• tools: reject fuzzy edits with drifted content (#983) (8b3d1b1)
• tools: say when format-on-write ran out of time (#1044) (6937a30)
• tui: move voice capture to Ctrl+Space (#968) (eeea330)
• update: keep Windows failed-restore state in trusted recovery records (#979) (a3852ba)

Performance Improvements

• agent: cheap compaction — dedicated summarizer model, input cap… (#532) (6645f97)
• providers: parallelize isolated provider unit tests and shrink retry backoffs (#955) (d6b25fc)
• reduce startup and turn overhead (#932) (1fde941)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: b4adc304f0c8
Changed files (4): .release-please-manifest.json, CHANGELOG.md, package-lock.json, package.json

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[github-actions]

🤖 Created releases:

• v0.9.0

🌻