release: DS Agent v1.6.0

CODE_SIGNING_POLICY.md

@@ -1,10 +1,10 @@
 # Code signing policy
 
-Last updated: 2026-07-25
+Last updated: 2026-07-26
 
 ## Current status
 
-DS Agent `v1.5.0` is intentionally published unsigned. Both `ds-agent.exe` and
+DS Agent `v1.6.0` is intentionally published unsigned. Both `ds-agent.exe` and
 the Windows x64 NSIS installer are expected to report Authenticode `NotSigned`.
 Windows may therefore display `Unknown publisher` or a Microsoft Defender
 SmartScreen warning. Users should download only over HTTPS from the official
@@ -13,7 +13,7 @@ GitHub Release and verify the published SHA-256 before running the installer.
 The SignPath Foundation application is submitted and approval is pending. No
 DS Agent binary may be represented as SignPath-signed until the application is
 approved and a later-version artifact independently verifies as Authenticode
-`Valid`. The project will not replace the immutable `v1.1.0`, `v1.2.0`, `v1.3.0`, `v1.4.0`, or `v1.5.0` tag,
+`Valid`. The project will not replace the immutable `v1.1.0`, `v1.2.0`, `v1.3.0`, `v1.4.0`, `v1.5.0`, or `v1.6.0` tag,
 Release, or asset if signing becomes available later.
 
 For releases accepted into that program: **Free code signing provided by
@@ -57,7 +57,7 @@ them; guessed or placeholder identifiers are forbidden.
 
 ## Release verification
 
-For the unsigned `v1.1.0`, `v1.2.0`, `v1.3.0`, `v1.4.0`, and `v1.5.0` exceptions, maintainers verify and disclose the actual
+For the unsigned `v1.1.0`, `v1.2.0`, `v1.3.0`, `v1.4.0`, `v1.5.0`, and `v1.6.0` exceptions, maintainers verify and disclose the actual
 `NotSigned` status of both the application executable and installer. Evidence
 must bind the exact source commit, file name, product version, byte size, and
 SHA-256. The installer downloaded back from GitHub must match the reviewed

PRIVACY.md

@@ -1,6 +1,6 @@
 # Privacy Policy
 
-Last updated: 2026-07-25
+Last updated: 2026-07-26
 
 This policy describes the current published DS Agent desktop application and
 public project. DS Agent is local-first and does not operate a project cloud
@@ -14,7 +14,7 @@ User-selected workspaces hold approved evidence, exports, reports, work
 packages, screenshots, and other artifacts. This information is not silently
 synced to a DS Agent-operated server.
 
-The current stable `v1.5.0` accepts one user-supplied DeepSeek API key through
+The current stable `v1.6.0` accepts one user-supplied DeepSeek API key through
 the onboarding screen and stores it in a dedicated Windows DPAPI-protected
 local vault. A process-environment key remains an explicit compatibility
 fallback and is never silently copied into that vault. The project does not
@@ -31,20 +31,27 @@ coverage counts plus a redacted authorization intent; it does not receive the
 private capability proposal, a preparation/compiler command, or a local
 completion writer.
 
-The v1.5.0 package preserves the T1 Office verification engine, which keeps source identities, bounded fact
+The v1.6.0 package preserves the T1 Office verification engine, which keeps source identities, bounded fact
 provenance, artifact hashes, render receipts, revision receipts, and
 continuation checkpoints locally in the selected workspace or application data.
 Ordinary chat does not yet automatically select or sequence the two T1 tools;
 their presence does not cause workspace files to be scanned or uploaded merely
 because the application is open.
 
-The v1.5.0 durable Computer Use lifecycle stores bounded application, process,
+The v1.6.0 package preserves the durable Computer Use lifecycle, which stores bounded application, process,
 window, frame, target, action, approval, screenshot-evidence, and semantic
 receipt identities locally. Its installed reliability tests use generated
 files, workbooks, data, fresh Edge profiles, an ephemeral loopback portal, and
 isolated Event Stores. Those tests do not read stored browser logins, production
 accounts, or the user's normal DS Agent AppData.
 
+The v1.6.0 durable automation runtime stores definition and revision identities,
+schedule windows, run state, restart checkpoints, leases, effect state,
+reconciliation attempts, dead-letter state, and exact local undo receipts
+locally. TaskCheckpoint UI projections exclude raw worker tokens, lease fences,
+idempotency keys, private evidence, provider bodies, and secrets. A result that
+may have crossed an external-effect boundary is not replayed automatically.
+
 Uninstalling the application may not delete a user-selected workspace or every
 application-data file. Review and remove those local locations separately when
 you no longer want to retain them.
@@ -81,7 +88,7 @@ the user or person operating the application:
 The optional local desktop bridge accepts only loopback addresses and is
 started and controlled by the user. DS Agent does not install or supervise that
 service. Production Microsoft and Google account registration and live
-mail/calendar writes are disabled in `v1.5.0`; offline connector contracts do
+mail/calendar writes are disabled in `v1.6.0`; offline connector contracts do
 not authorize a production account or external write.
 
 ## What can be included in a model request

README.md

@@ -11,8 +11,8 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/Lee-take/dsagent/releases/tag/v1.5.0">v1.5.0 stable</a> ·
-  <a href="https://github.com/Lee-take/dsagent/releases/download/v1.5.0/DS.Agent_1.5.0_x64-setup.exe">Download for Windows</a> ·
+  <a href="https://github.com/Lee-take/dsagent/releases/tag/v1.6.0">v1.6.0 stable</a> ·
+  <a href="https://github.com/Lee-take/dsagent/releases/download/v1.6.0/DS.Agent_1.6.0_x64-setup.exe">Download for Windows</a> ·
   <a href="LICENSE">Apache-2.0</a>
 </p>
 
@@ -129,16 +129,11 @@ does not claim completion from model confidence alone. Local files, browser
 actions, Office artifacts, and Computer Use are complete only when observable
 evidence satisfies the task's completion criteria.
 
-In v1.5.0, DeepSeek may propose a bounded `GoalEnvelope`, but only the local
-Kernel can validate and freeze it. For the same queued task, the Kernel alone
-derives the capability manifest, risk, and preview shown in one exact-task
-authorization card. Approval creates only exact authority; it does not execute
-a Tool, resume the task, or mark the Goal complete. Completion remains blocked
-until locally authoritative verifier evidence covers every frozen `done_when`
-condition and required artifact identity.
+In v1.6.0, DeepSeek may propose a bounded `GoalEnvelope`, but only the local Kernel can validate and freeze it. For the same queued task, the Kernel alone derives the capability manifest, risk, and preview shown in one exact-task authorization card.
+Approval creates only exact authority; it does not execute a Tool, resume the task, or mark the Goal complete. Completion remains blocked until locally authoritative verifier evidence covers every frozen `done_when` condition and required artifact identity.
 
-The v1.5.0 binary preserves the T1 Excel/PowerPoint verification engine and adds a production-reachable durable Computer Use session/step UI and Kernel loop.
-Exact installed evidence is limited to generated File Explorer and Excel targets plus installed Edge with a fresh profile and an ephemeral loopback test portal; it does not claim general browser automation, stored-login reuse, or production-site completion.
+The v1.6.0 binary preserves the T1 Excel/PowerPoint verification engine and the production-reachable durable Computer Use session/step loop, then adds production-reachable persistent automation with immutable definition revisions, scheduled and manual runs, checkpointed leases, restart-safe pre-effect recovery, idempotency/effect reconciliation, dead-letter state, and a TaskCheckpoint view.
+Safe pre-effect work can recover automatically. Effect-started or unknown work is never replayed blindly and requires explicit recovery; confirmed external effects are not represented as locally undoable. Exact installed evidence is limited to generated File Explorer and Excel targets plus installed Edge with a fresh profile and an ephemeral loopback test portal.
 The release remains honest: ordinary chat does not yet automatically select or sequence the two T1 tools or the complete T1 Office workflow.
 
 ## DeepSeek and DS Agent boundary
@@ -164,7 +159,7 @@ high-risk action. See the full [model boundary](docs/AGENT_MODEL_BOUNDARY.md).
   reconciliation contracts validated with offline adversarial fake providers.
 
 Production Microsoft/Google account registration and live external-write
-authority remain disabled in v1.5.0. The release does not sign in to real
+authority remain disabled in v1.6.0. The release does not sign in to real
 accounts, send real email, or create, change, or cancel real calendar events.
 
 ## Why Rust
@@ -177,7 +172,7 @@ remain thin; the Kernel and persistent projections own business state.
 
 ## Quick start
 
-1. Download the [Windows x64 installer](https://github.com/Lee-take/dsagent/releases/download/v1.5.0/DS.Agent_1.5.0_x64-setup.exe).
+1. Download the [Windows x64 installer](https://github.com/Lee-take/dsagent/releases/download/v1.6.0/DS.Agent_1.6.0_x64-setup.exe).
 2. Enter your own valid DeepSeek API key in onboarding and run the explicit
    balance/model verification. The key is stored locally with Windows DPAPI.
 3. Choose one local workspace and let the readiness doctor verify its managed
@@ -189,18 +184,18 @@ A user-supplied DeepSeek API key is a required prerequisite. DS Agent does not
 bundle a shared key or bypass DeepSeek access requirements; use remains subject
 to DeepSeek's terms and account policies.
 
-The v1.5.0 application executable and installer are Authenticode `NotSigned`.
+The v1.6.0 application executable and installer are Authenticode `NotSigned`.
 Windows may display `Unknown publisher` or a Microsoft Defender SmartScreen
 warning. Download only over HTTPS from this repository, verify the SHA-256 in
 the GitHub Release, and read the [installation guide](docs/INSTALLATION.md)
 before running the installer.
 
 ## Code signing policy
 
-DS Agent `v1.5.0` is intentionally unsigned. The SignPath Foundation application
+DS Agent `v1.6.0` is intentionally unsigned. The SignPath Foundation application
 is submitted and approval is pending; no release is represented as signed.
 If the project is accepted, signing starts with a later new version and does not
-replace the immutable v1.1.0, v1.2.0, v1.3.0, v1.4.0, or v1.5.0 tag or asset. For releases accepted into the program:
+replace the immutable v1.1.0, v1.2.0, v1.3.0, v1.4.0, v1.5.0, or v1.6.0 tag or asset. For releases accepted into the program:
 **Free code signing provided by SignPath.io, certificate by SignPath
 Foundation.** See the full [code signing policy](CODE_SIGNING_POLICY.md) and
 [privacy policy](PRIVACY.md).
@@ -218,8 +213,8 @@ example `D:\build-target\ds-agent-v1-release`.
 
 ## Stable release
 
-- Release: [DS Agent v1.5.0](https://github.com/Lee-take/dsagent/releases/tag/v1.5.0)
-- Installer: `DS.Agent_1.5.0_x64-setup.exe`
+- Release: [DS Agent v1.6.0](https://github.com/Lee-take/dsagent/releases/tag/v1.6.0)
+- Installer: `DS.Agent_1.6.0_x64-setup.exe`
 - Integrity: verify the final byte size and SHA-256 published in the GitHub
   Release before running the installer.
 - Onboarding: one user-supplied Key, Windows DPAPI storage, explicit DeepSeek
@@ -233,6 +228,10 @@ example `D:\build-target\ds-agent-v1-release`.
 - Task authorization: one Kernel-derived exact-task card with manifest/risk/
   preview binding, one user decision, per-capability audit, and exact revocation;
   approval does not execute or resume the task.
+- Durable automation: immutable definition revisions, persisted trigger windows,
+  checkpointed leases, restart-safe pre-effect recovery, idempotency/effect
+  reconciliation, bounded backoff/dead-letter state, exact local undo, and
+  truthful no-undo treatment for confirmed external effects.
 - Computer Use: production-reachable durable lifecycle and fail-closed execution; exact installed proof is limited to generated Explorer/Excel targets and an isolated Edge/loopback test portal, not general browsing.
 - T1 verification engine: exact source identities and provenance, non-overwriting XLSX/PPTX artifacts, actual local render evidence, bounded revisions, and persisted continuation checkpoints; ordinary chat does not yet automatically select or sequence this complete T1 path.
 
@@ -241,6 +240,7 @@ example `D:\build-target\ds-agent-v1-release`.
 - [Installation](docs/INSTALLATION.md)
 - [DS Agent and DeepSeek boundary](docs/AGENT_MODEL_BOUNDARY.md)
 - [v1 architecture](docs/architecture/DS_AGENT_V1_ARCHITECTURE_PLAN.md)
+- [v1.6.0 release notes](docs/RELEASE_NOTES_v1.6.0.md)
 - [v1.5.0 release notes](docs/RELEASE_NOTES_v1.5.0.md)
 - [v1.4.0 release notes](docs/RELEASE_NOTES_v1.4.0.md)
 - [v1.3.0 release notes](docs/RELEASE_NOTES_v1.3.0.md)