v0.20.2

PR #83: /public/* public static surface for agent-published pages.

Public subtree at https://<agent>.ghostwright.dev/public/<path> maps to
public/public/<path> on disk. Serves without auth so Googlebot, OpenGraph
scrapers, and the open web can read agent-published blog posts, tools,
RSS feeds, and sitemaps. Traversal-defended via decodeURIComponent +
path.resolve() containment against publicRoot + '/'. Auth gate on every
other /ui/* path unchanged.

Also in this release:
  docs: deploy gotchas section in CLAUDE.md covering rsync source-merge
    trap, Alpine overlay chown requirement, and fresh-VM volume
    pre-chown.

Tests 1,807 to 1,819 (+12). Apache 2.0.

v0.20.1

Two bug fixes from v0.20.0 visual verification.

PRs
  #82 chat: emit text_reconcile when stream already shipped the text
      block, restoring the originally-designed dormant path from PR1.
      Regression from commit 59112d2 (before v0.19.0 tagged) replaced
      the Map-indirect reducer with array-of-blocks; the server's
      double-emit was idempotent under the old reducer but doubled the
      text under the new one. TextReconcileFrame was already defined
      and the client reducer already handled it correctly; this PR
      wires the server side. Thinking blocks also recover canonical
      text on stream vs final divergence via the Map-indirect reducer's
      natural idempotence.

  #82 dashboard: scope .dash-filter-search flex override inside
      .dash-split-pane-rail. The shared primitive had flex: 1 for the
      horizontal .dash-filter-bar row; Memory was the only tab that
      drops the input directly into a column flex container, where
      flex: 1 grew vertically and pushed the first list row ~60vh
      below fold.

Tests 1,799 to 1,807 (+8). Apache 2.0.

v0.20.0

Dashboard v2 complete, Settings reframe, agent avatar, landing redesign.

PRs
  #71 entrypoint dashboard sync + / redirect + /health HTML page
  #72 Sessions tab (shared .dash-table/.dash-drawer primitives)
  #73 Cost tab (SVG chart primitive, top-sessions cross-link)
  #74 Scheduler tab + create-job drawer + Sonnet describe-assist
      (schema parity with phantom_schedule MCP tool)
  #75 Evolution Phase A + Memory explorer (Qdrant scroll)
  #76 Settings page restructure, now edits phantom.yaml,
      6 sections (Identity, Model+cost, Evolution, Channels,
      Memory, Permissions), atomic write with audit log
  #77 Agent avatar upload, 14 identity surfaces
  #79 Landing redesign: hero with avatar, starter tiles with
      ?prefill= deep-link (Cardinal Rule preserved), live
      agent-created pages list

Tests 1,584 to 1,799 (+215). Apache 2.0.

chore: bump version to 0.19.1

Merge pull request #69 from ghostwright/release/v0.19.0

chore: v0.19.0 release - chat channel, docs, Docker infrastructure

Merge pull request #12 from ghostwright/security/hardening-and-url-aw…

…areness

security: enforce MCP scopes, fix SSRF bypass, add security context and URL awareness

v0.18.1: sync version strings and test count across all files

Version constants in server.ts, mcp/server.ts, cli/index.ts, README
badge, and CLAUDE.md header were still at 0.17.0 after the v0.18.0
release. Updated all to 0.18.1 and test count from 770 to 785.

v0.18.0: activate LLM judges for self-evolution

v0.17.0: launch-ready release

Add production stories with GIFs, fix architecture diagram centering,…

… Discord and Vigil examples