2026‑W42: Decoupled Add-on Contracts, Isolated Knowledge Worker, and Long-Running Task Chains

01

Full-history review and additions

Across 331 commits, releases 1.94.4 through 1.105.1 shipped. Add-on contracts were isolated into @openmake/plugin-contracts, Knowledge Worker was separated into its own process with DB fencing tokens, long-running agent task chains landed, Discord /task integration was added, and safeFetch redirect handling was hardened.

All reachable history of main f50ce73a was rechecked on 2026-10-17. Counts use committer dates from Monday 00:00 through Sunday 23:59:59 KST, including merges, releases and distinct parallel-branch commits. Commit counts are not feature counts. Tests and operational measurements below are historical source records, not evaluations rerun for this refresh.

Snapshot checked October 17 at 09:31 KST, before the week ended. Later commits are excluded. General tags range from 1.94.4 to 1.105.1, including Add-on contracts, isolated Knowledge Worker, long-running chains and Discord /task integration.

02

What changed

• Add-on boundaries were decoupled into a dedicated contracts package. The new @openmake/plugin-contracts workspace isolates lifecycle contracts (AddonRuntimeHandle, start/stop/drain/resume), activation states, manifests, and contribution DTOs from core (apps/api). Administrator toggles trigger immediate drain on disable and resume on enable, while boot-failed add-ons are partitioned as ADDON_FAILED (503) so routes and chat hooks block them safely. An import ratchet and boundary check rules in CI prevent add-ons from importing internal Base modules (50fb0654, 4e157fce, df8f035a, a34304e5, bbb2b50e, 4a6691a2).
• Knowledge collection was extracted from the API server into an independent worker process. The workers/knowledge-worker entry point and PM2 openmake-knowledge-worker configuration landed alongside job queue migration 004. To prevent data corruption during job re-claims in distributed deployments, DB fencing tokens (JobLease, assertLeaseHeld) reject chunk replacements, embedding inserts, and index swaps from workers that lost their lease. A job cancellation API (POST /api/knowledge/jobs/:id/cancel), heartbeat monitoring, and rollback drill scripts accompany delivery (c67aa2ae, 3887b85c, d830a75f, 9336e503, c627340b, 7166d7b7).
• Agent Tasks gained long-running chains. Rather than terminating tasks when hitting turn, duration, or context limits, a continuation module hands off workspace snapshots and transition prompts to successive task segments (migrations 188 and 189). A runway guard ensures text-only responses without tool usage do not advance segment progress, and segment duration budgets are bounded by remaining chain time. The web UI folds segments under a root card with continuation badges and cumulative token/time metrics (a27523ac, 2d2132fc, 5f56a510, ba2d063e, 513fb88f, 334bb1ae).
• Resilience against model server outages and device disconnections was strengthened. During prolonged model server downtime or timeouts, tasks are parked rather than failed, automatically resuming once model health recovers. Local tasks interrupted by restarts are parked in device-wait state to continue upon reconnection, and looping auto-recoveries halt at an attempt ceiling. Common timeouts and immediate abort propagation now govern host and external tool calls (fa304740, bb5c10fc, 1db9ff11, 9e55a388, 5632c44e).
• Discord bot interactions can directly control Agent Tasks. The /task slash command and cancellation buttons allow users to initiate, approve, and cancel tasks from Discord channels, while the bot monitors progress in real time. Completed tasks deliver markdown artifacts and workspace files (file_ops) as Discord file attachments. Uploaded channel images and documents forward to the backend for analysis, and markdown tables auto-convert to bold lists to render cleanly in Discord (61b41ec4, e0359607, 8c6d6526, ce3d6663, b4897226, 5dd312fe).
• Two shadow decision gates joined the decision adapter. A search-requirement gate and an answer-grounding gate verify sentence by sentence whether model claims are supported by search citations. Straightforward queries bypass multi-step planning to run directly with search decisions, and internal orchestrator task names are suppressed from answer texts (eecf8263, e723e99e, 19c45eac, 6cfe4687, acf909ec).
• Operational benchmarking and release verification tools were established. The scripts/bench/api-load.mjs harness and baseline comparison tool (D6) enforce a settle period (--settle, default 90s) so boot memory spikes do not contaminate baselines. Release candidate matrix tools check test suites, and runbook section 11 formally recorded completion of staging and production deployment on 2026-10-16 (6416051e, 40838d74, 40b6a1a3, b72f6ecb, fcb59865).
• Security vulnerabilities and UI edge cases were resolved. safeFetch strictly honors redirect: 'manual' and 'error', preventing bypasses of MCP SDK same-origin redirect policies. Upload file names are truncated to 200 bytes to prevent ENAMETOOLONG errors, and chat quick-start cards received clearer descriptions and improved selection grids (8fdf0322, df1165ae, 1af20e13, 2ac39b09).