release: v0.14.0

[yetone]

Highlights

• Versioned schema migrations (ADR 0003). Startup no longer runs DDL; it verifies the supported schema range. Production applies migrations through one pre-deploy Job before the Deployment is patched (fix(db): version schema migrations #167). npm run migrate runs them locally, and dev:all / electron:dev invoke it first (fix(scripts): run schema migrations before starting electron:dev #171).
• Normalized conversation membership (ADR 0004). conversation_members is the authorization and routing source; conversations.members is a rebuildable projection with expand-phase triggers so the previous release keeps working during rollout (fix(db): normalize conversation membership #168).
• Workspace member and deletion management. Owners change roles, owners/admins remove members within role boundaries, owner-only deletion with exact-name confirmation, atomic access revocation, durable post-delete cleanup jobs (migration 0003), and a recovery screen for users with no workspace (feat(workspace): add member and deletion management #147).
• BYOA account-specific model selection. Daemons discover the model catalog behind each engine login (Codex model/list, Cursor/OpenCode/pi list commands, presets otherwise); the agent editor offers searchable dropdowns with custom entry, clears incompatible pins on host/engine change, and saves host, engine and pins atomically. Per-agent small-brain pins now drive the real triage path (feat(byoa): add account-specific model selection #175).

Fixes

• fix(agents): create and assign agents atomically, with tenant-scoped idempotent retries (fix(agents): create and assign agents atomically #164)
• fix(realtime): durable events go through a transactional outbox with leased draining (fix(realtime): make durable events transactional #165)
• fix(agents): fail closed on host resolution instead of silently placing on cloud (fix(agents): fail closed on host resolution #166)
• fix(byoa): a warning's version number must not satisfy the secure floor (fix(byoa): a warning's version number must not satisfy the secure floor #169)
• fix(byoa): don't cut the reason off the end of an engine's failure (fix(byoa): don't cut the reason off the end of an engine's failure #172)
• fix(byoa): a turn that cannot succeed stops retrying on both the chat and agenda paths (fix(byoa): a turn that cannot succeed must stop retrying on both paths #173)
• fix(byoa): complete engine registry wiring and default model pins for gemini and qwen (fix(byoa): complete engine registry wiring and default model pins for gemini and qwen #163)
• fix: long system messages wrap inside the SystemRow pill (fix: improve text overflow handling in SystemRow component #174)

Operator notes

• The deploy workflow now runs a candidate migration Job (copying the live cloud-sql-proxy sidecar) before patching the Deployment, and removes the per-replica migrate init container. A failed migration leaves the current ReplicaSet untouched.
• New env: WORKSPACE_RUNTIME_CLEANUP_ENABLED (set to true in the k8s manifests) gates deletion of agent pods/PVCs for deleted workspaces; WORKSPACE_CLEANUP_INTERVAL_MS tunes the worker. CUMORA_DEFAULT_{PI,GEMINI,QWEN,ANTIGRAVITY}_MODEL are documented in .env.example.

Verification

• Local gates on the merged tree (lint, typecheck, server:typecheck, three guards, unit tests) pass; the only unit failures are the two environment-bound tests (real Postgres, email-gate worker) that CI covers.
• PR CI was green on feat(workspace): add member and deletion management #147 and feat(byoa): add account-specific model selection #175 after merging main into each.

https://claude.ai/code/session_01SevbW9qCBbzrjfLMy14A31