-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathCHANGELOG.html
More file actions
308 lines (304 loc) · 14.5 KB
/
Copy pathCHANGELOG.html
File metadata and controls
308 lines (304 loc) · 14.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta charset="utf-8" />
<meta name="generator" content="pandoc 3.10" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
<title>CHANGELOG</title>
<style>
span.smallcaps{font-variant: small-caps;}
div.columns{display: flex; gap: 1.5em;}
div.column{flex: auto;}
@media screen {
div.columns{gap: min(4vw, 1.5em);}
div.column{overflow-x: auto;}
}
div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
ul.task-list[class]{list-style: none;}
ul.task-list li input[type="checkbox"] {
font-size: inherit;
width: 0.8em;
margin: 0 0.8em 0.2em -1.6em;
vertical-align: middle;
}
.display.math{display: block; text-align: center; margin: 0.5rem auto;}
</style>
<style type="text/css">
table {
border-collapse: collapse;
}
table td,
table th {
border: 1px solid #cccccc;
padding: 4px 8px;
vertical-align: top;
}
tr.cell-status-obsolete > td {
background-color: #E0E0E0;
}
tr.cell-status-obsolete > td:nth-child(2),
tr.cell-status-obsolete > td:last-child {
text-decoration: line-through;
}
</style>
</head>
<body>
<header id="title-block-header">
<h1 class="title">CHANGELOG</h1>
</header>
<h1 id="changelog">Changelog</h1>
<p>All notable changes to HelixCode are recorded here. Format loosely
follows <a href="https://keepachangelog.com/">Keep a Changelog</a>.
Release tags are <strong>project-prefixed</strong> per §11.4.151,
resolved from <code>.env</code> <code>HELIX_RELEASE_PREFIX</code>
(currently <code>helix-code</code>):
<code>helix-code-X.Y.Z-dev-N.N.N</code>. Two legacy unprefixed
<code>helixcode-vX.Y.Z</code> tags predate that scheme; this document’s
<em>recommendation</em> is to retain them as historical artifacts rather
than an active naming convention, but that disposition is not settled
and awaits an explicit operator decision — see
<code>docs/changelogs/helix-code-1.2.0-dev-0.0.1.md</code> §“§11.4.151
release-tag prefix compliance” for the full finding and the
recommendation’s stated conditions.</p>
<h2 id="helix-code-1.2.0-dev-0.0.1-draft-not-yet-tagged-documentation-prepared-2026-08-1011">[helix-code-1.2.0-dev-0.0.1]
— DRAFT, not yet tagged (documentation prepared 2026-08-10/11)</h2>
<p><strong>No git tag exists for this entry yet.</strong> Full
per-commit citations, SHA-level detail, tracker-item status
cross-checked against <code>docs/workable_items.db</code>, and an honest
“Known gaps” ledger live in
<code>docs/changelogs/helix-code-1.2.0-dev-0.0.1.md</code> — this entry
is a summary of that document, not a replacement for it. The full
document covers <strong>256 commits</strong> in the main repo since the
last tag (<code>helix-code-1.1.0-dev-0.0.3</code>) plus the entirety of
<code>submodules/helix_agent</code>’s unpushed history (24 commits);
this summary highlights only the user-visible headline items.</p>
<h3 id="added">Added</h3>
<ul>
<li><strong>The whole platform installs and boots as systemd
units</strong> via <code>./setup.sh</code> — HelixCode server,
HelixAgent, HelixLLM gateway + coder, infra
(Postgres/Redis/Weaviate/Qdrant/ChromaDB/Cognee/Ollama), and
LLMsVerifier — with real HTTP health checks and a verified stop/start
cycle.</li>
<li><strong>LLMsVerifier is wired to real provider data</strong>,
publishing genuine verification scores instead of an empty
<code>{}</code>; the gateway now routes on measured scores instead of
always falling back to its static table.</li>
<li><strong>Hyper provider discovery, registry, and verifier
types</strong> land in <code>submodules/helix_agent</code>.</li>
</ul>
<h3 id="fixed">Fixed</h3>
<ul>
<li><strong>Model identity is honest end-to-end.</strong> A client
requesting an alias (e.g. <code>"model":"default"</code>) now gets back
the model that actually served the request, on both the OpenAI- and
Anthropic-compatible wires, streaming and non-streaming — not the alias
echoed back.</li>
<li><strong>The gateway’s primary completion path, which was returning
HTTP 500 on every request with no cloud key configured, is
restored</strong> — the local provider was pointed at a port matching no
running service. Live-reverified during this documentation pass: a real
completion answered through the public endpoint. <strong>The
corresponding tracker item (HXC-229 for the related release-mode fix,
HXC-233 for this one) remains <code>Queued</code> in
<code>docs/workable_items.db</code></strong> — see the per-release
changelog’s dedicated reconciliation section for exactly why and what
would close it.</li>
<li><strong>The health endpoint no longer reports “healthy” without
checking anything</strong> — it now names four real dependencies with
measured round-trip durations, and the fix required a redeploy of a
stale-by-15-days binary, not just a source change (§11.4.108).</li>
<li><strong>A large, misleading class of HelixAgent integration-test
failures is fixed at the root.</strong> Roughly a hundred failing
assertions across several packages traced to test guards checking mere
port-reachability instead of service <em>identity</em> — a different
local service (LLMsVerifier) or a container (Weaviate) squatting on a
well-known port was being blamed for HelixAgent regressions it had
nothing to do with. Every affected guard now verifies identity, not
reachability.</li>
<li><strong>HelixAgent’s gRPC server can start alongside HelixAgent’s
own infrastructure</strong> — it previously hardcoded the same port
(<code>:50051</code>) this project’s own Weaviate container publishes
and could not bind. Re-derived the server, its startup banner, its docs,
its Kubernetes manifests, and a protocol-compliance challenge script
from one port-registry source. <strong>Landed in source; not yet
verified against a rebuilt, redeployed artifact — see the per-release
changelog’s Known gaps.</strong></li>
<li><strong>Generated CLI-agent config files pointed 46 of 48 downstream
assistants at the wrong port.</strong> Fixed via the same
single-resolver pattern. <strong>Landed in source for every
currently-wired call site; one additional, currently-unwired call site
inside <code>submodules/helix_agent</code> was found during this
documentation pass and is flagged, not fixed, in the per-release
changelog — treat this fix as source-complete, not
verification-complete.</strong></li>
<li><strong>265 data races eliminated</strong> in the desktop
application, root-caused to a code comment falsely claiming a widget
setter was goroutine-safe.</li>
<li><strong>A guaranteed streaming-with-tools deadlock is
closed</strong>, along with a family of provider goroutine/HTTP-body
leaks on client disconnect.</li>
<li><strong>265 data races aside, three separate “unprioritized
<code>select</code>” races</strong> are closed across persistence, LLM
provider, and database cleanup code.</li>
<li><strong><code>go.mod</code>/<code>go.sum</code> tidied</strong> — 30
stale dependency hashes and 2 structurally incomplete entries,
undetected by <code>go build</code>/<code>go vet</code> but a real
<code>go mod tidy -diff</code> failure.</li>
<li><strong>The project’s own release-validation scripts could report
“all tests passed” without running a single test</strong> — fixed to
discover the real server address by identity and treat
zero-tests-executed as a hard failure.</li>
<li><strong>Two credential/security exposures were found, traced, and
handled</strong> (one published on all four mirrors for 48 days);
rotation remains outstanding and is tracked, not silently closed.</li>
</ul>
<h3 id="changed">Changed</h3>
<ul>
<li><strong>The project’s own workable-items tracker was re-derived from
its database of record</strong> after <code>docs/Issues.md</code>
drifted 18 open items and several days stale — surfacing and fixing a
hidden governance-gate violation in the process.</li>
<li><strong>Three standing regression guards, written earlier and never
wired into any suite, are now part of the release-gate sweep</strong>
(32 gates, up from 29), after three independent review rounds found and
closed further false-positive/false-negative failure modes in the guards
themselves.</li>
<li>Root module renamed <code>dev.helix.code</code> →
<code>dev.helix.code/meta</code> (HXC-187/D-7) so the meta-repo and
inner Go module stop sharing an identity.</li>
</ul>
<h3 id="known-gaps-not-closed-by-this-documentation-pass">Known gaps
(NOT closed by this documentation pass)</h3>
<ul>
<li><strong>HXC-229 (gateway release mode) and HXC-235
(semantic-embeddings signal) each have a specific, tracked,
previously-recorded blocking reason that has since been addressed by
later work, without a follow-up review or tracker closure; HXC-233 (this
completion-path fix) has genuine tracked evidence and a passing
live-reverified guard but was never routed through a closure review at
all.</strong> None of the three is “Fixed” in
<code>docs/workable_items.db</code> and this document does not change
that — see the per-release changelog’s “HXC-229/233/235
tracker-vs-runtime-state reconciliation” section for the full evidence
trail (guard scripts, <code>docs/qa/</code> paths, and the exact
independent-review commit each item’s prior <code>Queued</code> status
traces back to).</li>
<li><strong>§11.4.185 manual QA-team confirmation has not been
given</strong> for any of the above — automated-green is necessary but
not sufficient per this project’s own governance.</li>
<li><strong>The gRPC and CLI-agent-config port fan-outs are landed in
source, not confirmed against a rebuilt/redeployed artifact</strong>
(see “Fixed” above and the per-release changelog’s Known gaps
19–20).</li>
<li><strong>A 32-commit stretch of <code>submodules/helix_agent</code>
history (<code>a345c551..66a3c1c6</code>), already published on all four
of its remotes, was found never itemized in any prior changelog
revision.</strong> Out of scope for this pass (it predates the unpushed
work this task documents); flagged as a follow-up documentation
task.</li>
<li><strong>This version has not been tagged, pushed, or built for this
entry.</strong> Documentation and version metadata only — see the
per-release changelog for the full, itemized “Known gaps” ledger.</li>
<li>Mobile clients and GUI desktop builds continue to require
simulator/device/ display access not available in this documentation
pass (carried over, unchanged, from the <code>helixcode-v1.0.0</code>
entry below).</li>
</ul>
<h2 id="helix-code-1.1.0-dev-0.0.3-2026-07-24">[helix-code-1.1.0-dev-0.0.3]
— 2026-07-24</h2>
<h3 id="added-1">Added</h3>
<ul>
<li><strong>HelixLLM mode switch.</strong> The shared HelixLLM engine
now accepts a runtime mode parameter (<code>coder</code> /
<code>claude</code>) so the same provider backend serves both
conversational and code-agent workloads with mode-appropriate system
prompts and token budgets without reconfiguration.</li>
</ul>
<h3 id="changed-1">Changed</h3>
<ul>
<li><strong>HelixAgent submodule pointer bumped.</strong> Updated to the
latest revision bringing Zen provider as the default and a generic
provider fallback path.</li>
</ul>
<h3 id="fixed-1">Fixed</h3>
<ul>
<li><strong><code>.gitignore</code> covers build derivatives.</strong>
Added <code>scratchpad/</code> and <code>.git-backups/</code> patterns
to prevent 86 GB+ of build artifacts and backup copies from polluting
<code>git status</code> and accidentally being staged.</li>
</ul>
<h2 id="helixcode-v1.0.0-2026-06-15">[helixcode-v1.0.0] —
2026-06-15</h2>
<p>First release tag.</p>
<h3 id="release-gate-evidence-all-green">Release-gate evidence (all
green)</h3>
<ul>
<li><code>go build ./...</code> → exit 0 (whole inner module
<code>dev.helix.code</code>).</li>
<li>Unit suite <code>go test -short ./...</code> → <strong>188 packages,
0 failures</strong>.</li>
<li>Anti-bluff smoke (CONST-035) → <strong>0 real production
bluffs</strong>.</li>
<li>Integration e2e against a <strong>live LLM provider</strong> (real
round-trips, no mocks): <code>POST /api/v1/llm/generate</code>,
<code>POST /api/v1/llm/stream</code> (token-by-token SSE +
<code>[DONE]</code>), <code>browser → server → provider → browser</code>
(chromedp, real DOM), and <code>POST /api/v1/specify</code> (real
2-agent speckit debate) — all PASS.</li>
<li>Durable cross-session memory (sqlite <code>DiskStore</code>):
persist → restart → recall proven.</li>
</ul>
<p>Runtime evidence: <code>docs/qa/web-llm-e2e-20260615/</code>.</p>
<h3 id="added-2">Added</h3>
<ul>
<li>Honest TUI context-window USED-% indicator — real per-session token
accounting, omits when the model window is unknown (CONST-035)
(HXC-077).</li>
<li>Overlapping-skill precedence guard — deterministic lexicographic
resolution coverage (HXC-078).</li>
<li>Internal-package i18n wiring on <strong>all</strong> entry paths
(<code>cmd/server</code>, TUI, desktop, aurora_os, harmony_os) so
user-facing strings resolve for real users while the loud raw-key
default is preserved (HXC-099).</li>
<li>Runtime e2e suites for the web LLM endpoints —
<code>/generate</code>, <code>/stream</code>, browser,
<code>/specify</code> (HXC-103, HXC-105).</li>
<li>helix_agent durable-fallback path-resolver test coverage —
persist→restart→recall through the production-chosen disk store
(HXC-106).</li>
</ul>
<h3 id="fixed-2">Fixed</h3>
<ul>
<li><code>streamLLM</code> production hang: <code>chunkChan</code> was
never closed, so <code>[DONE]</code> was never emitted and
<strong>every</strong> <code>/api/v1/llm/stream</code> request hung
until the 120s deadline (HXC-104).</li>
<li><code>security</code> TLS test: removed a live external-network
dependency and a nil-deref panic that crashed the whole
<code>security</code> test binary (HXC-101).</li>
<li>Out-of-box config: a <code>config.json</code> omitting
<code>version</code>/<code>server.port</code> no longer fails validation
— the JSON load path now merges viper defaults (HXC-098).</li>
<li>harmony_os REPL <code>Goodbye!</code>/<code>Error</code> strings
routed through i18n (HXC-102).</li>
<li><code>/specify</code> + <code>/debate</code> min-agents wiring and
model-tag parsing (earlier in cycle).</li>
</ul>
<h3 id="docs-hygiene">Docs / hygiene</h3>
<ul>
<li><code>docs/CONTINUATION.md</code> de-bloated (line-1 header 54,856 →
2,931 chars) and resynced; CONST-064 metadata table + ToC restored
(HXC-100).</li>
<li>SQLite-backed workable-items tracker kept in sync; every closure
carries captured RED→GREEN evidence.</li>
</ul>
<h3 id="known-gaps-not-headlessly-validated-in-this-release-gate">Known
gaps (NOT headlessly validated in this release gate)</h3>
<ul>
<li>Mobile clients (iOS / Android / Aurora OS / Harmony OS) and GUI
desktop feature recordings require simulator / device / display
access.</li>
</ul>
</body>
</html>