chore: prepare release 20260426.05

Author: penso

CHANGELOG.md

@@ -19,6 +19,52 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+## [20260426.05] - 2026-04-26
+### Added
+- [cron] Add heartbeat wake cooldown to prevent exec re-fire loop (#871)
+- [web-ui] Show chat status badges in visible toolbar row (#886)
+- [local-llm] On-demand model loading/unloading with idle timeout (#884)
+
+
+### Changed
+- [config] Extract initialize_config() from discover_and_load()
+- Derive nightly toolchain from rust-toolchain.toml everywhere
+
+
+### Removed
+- Remove needless return in skills toggle_bundled_skill
+
+
+### Fixed
+- [tests] Stabilize flaky memory_config_get test
+- [ci] Pin NCCL version to match CUDA 12.4 container
+- [ci] Match NCCL dev headers to pre-installed runtime version
+- [ci] Skip libnccl-dev to work around llama-cpp-sys-2 linking bug
+- [ci] Remove pre-installed libnccl-dev from CUDA container
+- [providers] Link NCCL when llama-cpp-sys-2 compiles with GGML_USE_NCCL
+- Resolve clippy lints for nightly-2026-04-24 and matrix-sdk compat
+- [mcp] Prefer native MCP tools over mcporter (#874)
+- [ci] Use keychain-profile for notarization and log failures
+- [gateway] Handle bundled skill disable/enable via config (#877)
+- [gateway] Derive bundled skill enabled state from config (#878)
+- [tests] Increase watcher test timeout to accommodate debounce + FSEvents latency
+- [web-ui] Stop auto-enabling all skills on repository import (#882)
+- [skills] Store per-skill relative paths for marketplace repos (#883)
+- [tests] Mark flaky FSEvents watcher test as ignored
+- [tests] Use PollWatcher in watcher tests for reliable cross-platform behavior
+- Use if-let instead of single-arm match in poll watcher test
+- [security] Store voice API keys in credential store, not moltis.toml (#885)
+- [e2e] Update session tests for inline action buttons (#886 follow-up)
+- [tests] Add missing LocalLlmService trait methods to MockLocalLlm
+- Collapse nested if-let in key_store timestamp check
+- Derive Default for ModelLifecycleManager
+
+
+### Security
+- [ci] Use correct security list-keychains syntax for macOS codesign
+- [ci] Align macOS certificate import with working arbor pattern
+- [ci] Add --timestamp and strip get-task-allow for macOS notarization
+
 ## [20260426.04] - 2026-04-26
 ### Added
 - [cron] Add heartbeat wake cooldown to prevent exec re-fire loop (#871)

website/changelog/index.html

@@ -76,6 +76,56 @@ <h2 class="font-mono text-lg font-bold text-gray-900 dark:text-white m-0"><a hre
 <span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-400">Removed</span>
 <span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-400">Fixed</span>
 <span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-violet-100 text-violet-700 dark:bg-violet-900/40 dark:text-violet-400">Security</span>
+<div class="mt-8 first:mt-0 border-t border-gray-200 dark:border-gray-800" id="20260426.05"></div>
+<div class="sticky top-14 z-10 bg-white/95 dark:bg-gray-950/95 backdrop-blur-sm py-2 -mx-4 px-4 sm:-mx-6 sm:px-6">
+<h2 class="font-mono text-lg font-bold text-gray-900 dark:text-white m-0"><a href="#20260426.05" class="no-underline hover:text-orange-600 dark:hover:text-orange-400">20260426.05 - 2026-04-26</a></h2>
+</div>
+<span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-green-100 text-green-700 dark:bg-green-900/40 dark:text-green-400">Added</span>
+<ul class="list-none m-0 pl-0 space-y-0.5">
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[cron]</span><span>Add heartbeat wake cooldown to prevent exec re-fire loop (<a href="https://github.com/moltis-org/moltis/pull/871" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#871</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[web-ui]</span><span>Show chat status badges in visible toolbar row (<a href="https://github.com/moltis-org/moltis/pull/886" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#886</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[local-llm]</span><span>On-demand model loading/unloading with idle timeout (<a href="https://github.com/moltis-org/moltis/pull/884" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#884</a>)</span></li>
+</ul>
+<span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-amber-100 text-amber-700 dark:bg-amber-900/40 dark:text-amber-400">Changed</span>
+<ul class="list-none m-0 pl-0 space-y-0.5">
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[config]</span><span>Extract initialize_config() from discover_and_load()</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0"></span><span>Derive nightly toolchain from rust-toolchain.toml everywhere</span></li>
+</ul>
+<span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-400">Removed</span>
+<ul class="list-none m-0 pl-0 space-y-0.5">
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0"></span><span>Remove needless return in skills toggle_bundled_skill</span></li>
+</ul>
+<span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-400">Fixed</span>
+<ul class="list-none m-0 pl-0 space-y-0.5">
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[tests]</span><span>Stabilize flaky memory_config_get test</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Pin NCCL version to match CUDA 12.4 container</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Match NCCL dev headers to pre-installed runtime version</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Skip libnccl-dev to work around llama-cpp-sys-2 linking bug</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Remove pre-installed libnccl-dev from CUDA container</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[providers]</span><span>Link NCCL when llama-cpp-sys-2 compiles with GGML_USE_NCCL</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0"></span><span>Resolve clippy lints for nightly-2026-04-24 and matrix-sdk compat</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[mcp]</span><span>Prefer native MCP tools over mcporter (<a href="https://github.com/moltis-org/moltis/pull/874" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#874</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Use keychain-profile for notarization and log failures</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[gateway]</span><span>Handle bundled skill disable/enable via config (<a href="https://github.com/moltis-org/moltis/pull/877" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#877</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[gateway]</span><span>Derive bundled skill enabled state from config (<a href="https://github.com/moltis-org/moltis/pull/878" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#878</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[tests]</span><span>Increase watcher test timeout to accommodate debounce + FSEvents latency</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[web-ui]</span><span>Stop auto-enabling all skills on repository import (<a href="https://github.com/moltis-org/moltis/pull/882" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#882</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[skills]</span><span>Store per-skill relative paths for marketplace repos (<a href="https://github.com/moltis-org/moltis/pull/883" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#883</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[tests]</span><span>Mark flaky FSEvents watcher test as ignored</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[tests]</span><span>Use PollWatcher in watcher tests for reliable cross-platform behavior</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0"></span><span>Use if-let instead of single-arm match in poll watcher test</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[security]</span><span>Store voice API keys in credential store, not moltis.toml (<a href="https://github.com/moltis-org/moltis/pull/885" target="_blank" rel="noopener" class="text-orange-600 dark:text-orange-400 hover:underline">#885</a>)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[e2e]</span><span>Update session tests for inline action buttons (#886 follow-up)</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[tests]</span><span>Add missing LocalLlmService trait methods to MockLocalLlm</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0"></span><span>Collapse nested if-let in key_store timestamp check</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0"></span><span>Derive Default for ModelLifecycleManager</span></li>
+</ul>
+<span class="inline-block mt-3 mb-1 px-2 py-0.5 rounded text-[0.7rem] font-bold uppercase tracking-wider bg-violet-100 text-violet-700 dark:bg-violet-900/40 dark:text-violet-400">Security</span>
+<ul class="list-none m-0 pl-0 space-y-0.5">
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Use correct security list-keychains syntax for macOS codesign</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Align macOS certificate import with working arbor pattern</span></li>
+<li class="font-mono text-[0.8rem] leading-snug text-gray-600 dark:text-gray-300 flex"><span class="inline-block w-[7rem] shrink-0 text-right pr-2 text-gray-400 dark:text-gray-500 select-none">[ci]</span><span>Add --timestamp and strip get-task-allow for macOS notarization</span></li>
+</ul>
 <div class="mt-8 first:mt-0 border-t border-gray-200 dark:border-gray-800" id="20260426.04"></div>
 <div class="sticky top-14 z-10 bg-white/95 dark:bg-gray-950/95 backdrop-blur-sm py-2 -mx-4 px-4 sm:-mx-6 sm:px-6">
 <h2 class="font-mono text-lg font-bold text-gray-900 dark:text-white m-0"><a href="#20260426.04" class="no-underline hover:text-orange-600 dark:hover:text-orange-400">20260426.04 - 2026-04-26</a></h2>