Every turn,
recorded.

0.1.5

The management-platform release. Rasen grows a full web UI with supervised agent sessions and a drag-and-drop pipeline canvas, learns to keep idle subagents' prompt cache warm, and ships a local token-spend auditor — alongside the retirement of the slash-command generation surface (skills are now the only workflow-delivery format).

Highlights

Web management platform — rasen ui

rasen ui opens a browser-based control surface for everything rasen manages, served from a resident background daemon (rasen daemon start|stop|status|run, default port 8791; adopt-or-spawn, --no-daemon for a foreground server) with a 127.0.0.1-only bind and a per-session token. The UI ships as its own package — install it next to the CLI with npm i -g @atelierai/rasen-ui. rasen config ui remains as a deprecated alias into the Config view.

• Board & Tasks — active changes grouped into Tasks (a portfolio parent plus its children reads as one Task) across lifecycle columns, with live-run and escalation indicators, structured task checklists, and new-change submission from the browser (backed by POST /api/v1/changes; the CLI gains rasen new change --proposal <text>).
• Spaces — the URL is the source of truth (/p/<project> / /s/<store>): a Projects/Stores switcher that re-scopes every page, a /spaces directory with search, pins, and create-a-space-from-the-browser, and worktree-aware registration — a git worktree now shares one space with its main checkout (with a per-worktree board panel) instead of appearing as a duplicate project; rasen doctor --gc collapses existing duplicates.
• Sessions — launch a headless claude run driving /rasen-auto or /rasen-goal from the browser, watch pipeline progress and output tails on Task detail, and tree-kill with confirmation. Sessions live in the daemon, so they survive closing the terminal.
• Archive — a searchable, time-reverse archive of completed Tasks, with member filters in store spaces.
• Config / Pipelines / Workflows / Profiles pages — tabbed Global-vs-Local configuration with inherited values showing their source; per-pipeline stage settings (gate / model / handoff per stage) over a role-matrix defaults table; the installable-workflow library grouped driver / task / expert with per-space enable/disable toggles; and named workflow profiles with dependency-cascading selection.
• Design system — a coherent editorial visual language across the whole app, light and dark themes, self-contained system fonts (no webfonts, no CDNs).

Pipeline canvas — assemble pipelines in the browser

Every pipeline now has a visual DAG view (stage cards with role / skill / gate, dependency edges, parallel groups as subflows), and Edit mode turns it into a full assembly editor: drag installed skills from a palette to create stages, connect them to add requires edges (cycles rejected instantly), edit stage properties (role, skill, gate, condition, model, runtime, parallel group, review-cycle loop) in a side panel, then Validate (server-side dry-run, issues mapped onto the offending nodes) and Save as a user pipeline. The backing HTTP surface is public: pipeline detail with a round-trippable definition, POST /api/v1/pipeline-validation, a save op (mirrored by rasen pipeline save <name> --from <file> on the CLI), and an assembly-vocabulary catalog endpoint. Canvas-authored pipelines are stamped origin: ui and are free to omit the reviewer + review-cycle quality floor — that floor now binds only autopilot-composed pipelines — so lightweight verification, research, and goal-loop pipelines can be assembled too.

Subagent prompt-cache keepalive — rasen agent wait

Anthropic's 5-minute prompt-cache TTL means an idle parked subagent (a reviewer waiting on an implementer, say) silently loses its cache and pays a full-context rewrite at ~1.25× cost on its next turn. rasen agent wait is a keepalive beat: a parked worker blocks on it while polling the change directory for a role signal file — a hit returns the LEAD's queued instruction payload, a timeout returns beat progress, and a cap (12 beats, --max-beats to override) stands the worker down. keepalive.enabled is default-on and settable globally or per project, with the project value taking precedence over global. Beat length is configurable via keepalive.beatSeconds (90–280, also global/project with project precedence): when unset it resolves to the 270-second default, while unreadable or invalid configuration uses the internal 100-second safety fuse. The orchestration playbook bakes in the matching park/dispatch discipline. Estimated saving on review-loop role switches: 40–75 % of rewrite tokens. Claude runtime only; Codex workers stand down immediately.

Session token audit — rasen agent audit

rasen agent audit <sessionId|path> analyzes where a session's tokens actually went — fully local and pull-model, output under ~/.rasen/analytics/, nothing uploaded. For Claude Code transcripts it breaks spend down by agent/subagent, quantifies cache churn and attributes its cause (TTL expiry, rebase, context drop, unattributed), and prices cache writes at the two-tier TTL rates. For Codex CLI rollouts (--runtime codex) it reports a per-request timeline, itemized cache-rebuild events with evidenced causes (compaction/rollback, injected message, idle gap), burst clustering, context-window occupancy, and aborted-turn accounting — dimensions the Codex data genuinely can't support (message-chain forks, billed-equivalent pricing) are labeled unsupported instead of left blank. --open launches the bundled HTML viewer, and a /rasen-audit guidance skill ships with it. Experimental: it parses undocumented transcript formats and fails soft on drift.

Removed

• BREAKING (config surface): the delivery global-config setting is retired. Skills are now the only workflow-delivery format; the entire slash-command-generation surface (src/core/command-generation/, 26 tool adapters, 19 command templates, the interactive delivery picker, and config set delivery) has been deleted. Any stored delivery value — current (both/skills) or legacy (commands/commands-first/skills-first) — is read without error, triggers a one-time retirement notice, and is stripped from the config on the next write. config set delivery <x> now emits a friendly no-op notice instead of erroring on an unknown key.

Changed

• Behavior change — rasen init/rasen update install skills only, no command files. A fresh init leaves zero rasen command files anywhere; update unconditionally cleans up any pre-existing command files (all 19 built-in ids plus legacy -command/opsx path variants) from before the retirement, while never touching user-authored files. Every AI tool that natively discovers project skills (Claude Code and 15+ others) continues to surface /rasen:*-style invocations from the installed skill directories — no instructions-file index is injected for tools without native skill discovery.

• Behavior change — autopilot.gates is now a mask base, not a blanket switch. Per-stage gate configuration (pipelines.<name>.gates.<stage>, resolving project > store > global) now outranks it: a per-stage on pierces an autopilot.gates: off base for that one stage, and a per-stage off silences one stage under an on base. autopilot.gates: on (the default) still means "honour the stage definitions" exactly as before. Existing autopilot.gates: off configurations keep auto-approving every gate unless a per-stage on is set. The LEAD now reads each stage's effective gate from rasen pipeline show <name> --json (which reports the masked effectiveGate and its gateSource) rather than combining layers itself.

• Behavior change — the gate: 'vet' gate type is retired. With every gate now individually controllable through the mask, the always-pausing vet carve-out no longer exists as a distinct type: the built-in goal-loop pipelines' define-goal stage becomes an ordinary gate: true (pauses by default). Consequence, chosen deliberately: under autopilot.gates: off, define-goal — including a goal-loop's arbitrary-shell measure command — is now auto-approved and can run unattended up to maxRounds. To restore the old always-pause for a stage under an off base, set pipelines.<name>.gates.<stage>: on (one value). A user pipeline YAML still carrying gate: vet keeps loading: it reads as gate: true with a one-time warning per pipeline naming the per-stage key — never a parse error.

• Behavior change — rasen pipeline agents no longer freezes a pipeline copy. Setting a per-role runtime (e.g. --reviewer codex) now writes a pipelines.<name>.runtimes.<role> configuration instance to the resolved root's rasen/config.yaml instead of writing a full frozen pipeline.yaml copy into the project, so upstream changes to the built-in pipeline keep applying. A pipeline copy an earlier version froze into a project stays untouched and keeps winning as that project's definition (visible via pipeline show's source badge) — remove it manually to un-freeze; there is no automatic migration.

• Behavior change — a store: pointer beside local planning now inherits configuration. A project whose rasen/config.yaml declares store: <id> while keeping its own local planning shape (a rasen/specs/ or rasen/changes/ directory) previously warned that the declaration was ignored; it now means the project's planning stays local while its configuration inherits from that store (one hop, no transitivity). The root-selection notice wording changed accordingly (inheriting when the store is registered, an inactive-pointer warning when it is not). To keep the old effective values, remove the store: line or set the affected keys at project scope — the project layer always wins over the store layer.

• Behavior change — skill names drop the colon namespace. The rasen:<x> colon form is retired in favor of the hyphen form (rasen-<x>) across all 21 expert skills, the bundled pipeline YAMLs, and the docs, so an editor's slash-completion popup (/rasen-office-hours) matches the actual invokable identifier. Colon references in user-authored pipelines still resolve via a legacy mapping; a fresh rasen init/rasen update regenerates the corrected names.

• Behavior change — experts are profile-selectable, not force-installed. The 21 expert skills become first-class catalog units (kind: expert, real digests, drift-healing, shown in rasen workflow list) and join the profile picker: full still installs all 21, core installs the six quality-floor experts (review, cso, qa, qa-only, benchmark, design-review), and custom installs exactly what it declares plus dependency closure. Existing installs keep all 21 via a one-time non-regressive migration with a notice.

• rasen workflow list groups by kind — entries are sectioned into task, driver, and expert groups, with internal sub-units hidden behind a new --all flag; list/show JSON gains a kind field.

• Goal-loop gates are harder to fool. The evaluate gate's reviewer must now prove completion with authoritative evidence (files, command/test output) rather than merely fail to find remaining work, implementers are forbidden from redefining "done" as a smaller task, and a new blockedThreshold (default 3) retries a "blocked" report from a different angle for several consecutive rounds before the loop escalates.

• rasen update surfaces newly-available built-in workflows that a frozen custom profile selection didn't absorb (pointing to rasen profile) instead of silently skipping them, and the interactive rasen profile editor lists available-but-unselected built-ins up front.

Added

• Explicit project-knowledge bundle export and Store transport — rasen knowledge bundle export --project <projectId|root> --to <path> [--to-store <store>] [--json] creates one strict, versioned portable file containing only the project's own canonical learned records. It refuses an occupied user destination and any record containing a machine path. Optional Store transport places the same validated bytes at rasen/knowledge-bundles/<projectId>/<bundleId>.bundle.json, changes no Store-owned catalog, project record, membership, or metadata, and stages, commits, and pushes nothing. Export and transport themselves perform no import and include no machine-preparation integration or portable run checkpoint.
• All-or-nothing project-knowledge bundle import — rasen knowledge bundle import <bundle> --project <projectId|root> [--dry-run] [--json] validates the complete portable file before catalog mutation, reports every new, identical, and conflicting record, and either adds every new record or leaves the project's stored knowledge byte-identical. It never overwrites, retires, or removes local records. Imported records remain project-owned even when the bundle travelled through a Store; transport grants no source, publication, membership, or evidence. baseProjectCommit is provenance rather than a gate. This child does not include machine-preparation integration, interactive conflict reconciliation, or portable run checkpoints.
• Confirmed declared-bundle import during machine preparation — project rasen/config.yaml and strict Store project records may name one repository-relative knowledgeBundle. rasen bootstrap reports each declaration as a distinct bundleImports action and invokes the same conflict-safe importer only after consent: blanket --yes covers a committed project declaration but never a Store-only declaration. Missing, unreadable, unsafe, malformed, wrong-project, conflicting, or unconfirmed actions degrade without stopping unrelated preparation. This is not automatic synchronization and grants a Store no ownership or publication authority; doctor integration, interactive conflict reconciliation, and portable run checkpoints remain absent.
• Store configuration scope — a store becomes a third configuration scope between project and global. The effective-config resolution chain is now env > project > store > global > default across every layered resolver (effective config, handoff thresholds, model config, autopilot gate/selection policy, pipeline stage handoff/model resolution, and the rasen agent context threshold probe), and every source vocabulary gains store. The config-key registry's store-capable keys (the autopilot.*, handoff.*, models.*, schema, and archive.* keys) are now settable in store scope, and the config HTTP API accepts ?space=store:<id> addressing with scope: "store" writes.
• Pipeline library — pipelines are now shareable and installable like workflows: .rasenpkg packages gain a pipeline kind, and the rasen pipeline group gains init, validate, import, export, and delete (with a refcount guard that refuses to delete a pipeline still referenced, bypassable via --force). Packages carry minRasenVersion gating that rejects too-new packages with a clear "upgrade rasen" message.
• Dependency-aware installs and preflight — built-in workflows declare real dependencies (requires covers workflows, skills, pipelines, and schemas), so selecting a workflow co-installs what it actually needs (e.g. auto pulls its pipelines); workflow delete gains --force to override the in-use guard with a loud warning. Running a pipeline now preflight-checks runtimes: a stage resolving to the codex runtime without the codex CLI installed fails early with a fix hint instead of dying mid-run.
• Store migration commands — move planning content between in-repo and stores without manual file surgery: rasen store adopt [path] --to <store-id> (migrate specs/changes into a store, converting the repo to a pointer), rasen store eject <project-id> (the inverse), rasen archive relocate --to <in-repo|external|store> (move archive contents and flip the config together), and rasen home prune (clean orphaned machine-home entries). All are git-safe, reversible via an ownership manifest, and support --dry-run/--json; rasen store doctor gains drift diagnostics.
• CLI-driven next steps — rasen status --json and the apply instructions gain a nextWorkflows array, and their human output a trailing Next: <workflow> — <reason> hint, filtered to the workflows actually installed in your profile (skipping ahead to the nearest installed step). Localized in en/ja/zh-cn.
• Stale-skills version guard — ten project-scoped commands print a one-line warning when the project's installed skills were generated by a different CLI version (suppressed under --json, debounced per version pair), and rasen doctor gains a matching health check with a Fix: rasen update hint.
• Telemetry payload disclosure — the Config page's Privacy tab now shows, beside the telemetry.enabled toggle, exactly what an enabled setting sends: the five payload fields (the command name, the CLI version, an anonymous random UUID, the OS platform, and the Node.js version), that the setting is global-only, and that environment opt-outs (RASEN_TELEMETRY=0, DO_NOT_TRACK=1, CI) always win. Disclosure only — it changes no setting and sends nothing.

Fixed

• Windows: agent sessions actually launch. Spawning an npm-installed claude.cmd threw synchronously, so every session launch from the daemon died with 503 agent_cli_unavailable; .cmd/.bat shims now route through cmd.exe, so rasen daemon/rasen ui sessions work on a stock Windows npm install.
• Keepalive liveness — first-production defects in rasen agent wait fixed: stale standDown signals no longer kill fresh parks (signals older than 120 s are discarded on the first beat), the default beat length fits under the default tool timeout, and the context floor no longer blocks adoption (defaults to 0/disabled).
• Spurious drift warning for custom profiles — closure-required experts on disk were misread as leftover deselected skills after the expert install flip; the drift detector now closure-expands the desired set before comparing.
• Localized diagnostics — config/CLI warnings (skill-version mismatch, expert-selection migration, retired-delivery-key and invalid-JSON load notices) now render in the session's resolved locale (en/ja/zh-cn) instead of hardcoded English.
• Docs — the Chinese docs are re-synced to the rasen rebrand (~270 stale opsx/OpenSpec references across 32 files), the "OPSX" product term is retired (docs/opsx.md/docs/opsx-workflow-guide.md → artifact-workflow.md/artifact-workflow-guide.md), and the command-syntax tables show the correct /rasen-propose form for Claude Code.

PR #88 review fixes (post-merge)

The Store/context portfolio PR (#88) received a full review after merge. The fixes below close the review's Blocker / Major findings against the actually-shipped 0.1.5 surface. They are committed on top of the portfolio and do not introduce new features beyond what the entries above already describe.

• Store immutable identity + obtain/register safety (6e905340). rasen bootstrap --apply's clone path is now TOCTOU-safe: a declared Store that is absent is cloned into a per-call exclusive staging directory and published via a provenance-checked move — a pre-existing target is never deleted by a failed retrieval, and two processes racing on the same absent target no longer delete each other's checkouts. After a successful clone, the Store's permanent UID is strictly compared against the expected identity before registration; missing, unreadable, or mismatched metadata fails closed with zero writes to the registry (mirroring the project-obtain identity check). registerExistingStore now threads StorePathOptions (globalDataDir) through every call site, so a non-default registry path is honored. The Store-vs-project first-read probe resolves readable metadata from both modern and legacy locations and reports unreadable as blocked rather than misrouting to project-first.

• Owner-aware locking for bundle import, membership, and config hints (ec28f743). The mtime-only stale-lock heuristic that silently deleted a lock after 30 s is replaced by an owner-aware primitive: the lock carries a pid+nonce token, the holder's liveness is checked before any steal, and release deletes only the holder's own token. A long import that legitimately holds the lock across a slow disk no longer has its publish transaction stolen from under it. Concurrent writes to the same project's Store membership record or storeMemberships config hints now re-read, merge, and verify inside the lock instead of last-writer-wins.

• Merge-regression restores — delegated completion, init learned materialization, unknown child status (85f95e65). completedStages() no longer counts delegated as complete for normal resume (handed-to-children is not finished), so a paused portfolio no longer offers ship for unfinished child work. rasen init again propagates previousStores and globalDataDir into learned-skill reconciliation and surfaces reconciliation errors instead of swallowing them. A portfolio child whose raw status falls outside the enum is now reported as unknown (not pending), so it cannot be mistaken for a child ready to start fresh.

• Session runtime context — Store record is the sole eligibility authority (277785be). A Store's own membership record is the single authority for Session eligibility; the project-side store: declaration is a locator only and no longer grants eligibility on its own. Legacy declarations migrate cleanly; both the session-runtime-context and store-project-membership specs now answer the same way.

• Bootstrap credential-remote rejection + redaction; Store-scoped learned resolution; portable project identity (a245503a, 7dcdbec0). Bootstrap rejects a credential-bearing remote (one embedding a username-and-password or token) before passing it to obtain, and error text shows only the redacted URL — the normal SSH form is unaffected. The Store-scoped learned-skill reader no longer silently skips .rasen-learned-skill-backup-* and report the catalog as empty; recoverable backup debris is reported as degraded so a destructive reconciliation is never derived from "empty". normalizeProjectIdentity() is applied at every comparison in the knowledge bundle import/export path, so an uppercase-UUID project can export a bundle and import it back.

• Boundary — what 0.1.5 does NOT include. The Store/context portfolio ships the Store, project, and Session runtime surface above. It does not ship an Issue object, an Execution Plan, an Issue Board, or a portable run checkpoint; those are 0.2.0 territory. The portable knowledge bundle is export/import + declared-bundle import during rasen bootstrap --apply, not automatic synchronization and not a portable run checkpoint.

0.1.4

Added

• Autonomy ladder (opt-in) — autopilot now treats pipeline selection as a classified decision and can compose pipelines from stages, with machine-enforced quality floors via gate policy. (#3)
• Unified config entry — a layered configuration system: project + global scopes with a validated config-key registry, rasen config gains --scope, project-scope operations, and a no-arg interactive full-view editor; plus a local config HTTP API and an optional web UI package. (#8)
• Dual-form handoff thresholds + model presets — handoff context thresholds accept either a bare number (percentage) or { remainingTokens: N } (absolute budget); a model-preset registry supplies per-model context windows (e.g. gpt-5 at 272K) so sensible thresholds apply without configuration. (#7)
• Agent adapters — the install surface is narrowed to adapted agents (Claude + Codex), and a Hermes adapter is added with global-skills-root resolution. (#6)

Fixed

• Codex-host LEAD compatibility — run-state reading tolerates schema variance (invalid-vs-absent fields no longer swallowed into "run state not found"), agent-context probe degrades gracefully, and Codex rollout paths are self-probed. (#5)
• Session relay — successor worker launches now pass full permission flags on all three platforms (Claude --dangerously-skip-permissions, Codex bypass equivalent), and Windows PowerShell 5.1 no longer garbles CJK relay payloads (UTF-8 encoding pinned inline). (#9)

0.1.3

Added

• Codex runtime support — rasen's multi-agent orchestration can now drive Codex CLI workers (validated against codex-cli 0.144.1), built from a live-tested research dossier (docs/codex-parity/, with a Chinese synthesis at docs/zh/codex-parity-solutions.md):
  • src/core/codex/ exec bridge: a codex exec invocation builder (stdin handling, --json/-o/--output-schema, sandbox/model flags, ultra→xhigh reasoning-effort clamp with warnings, an always-appended flat-hierarchy guard, config-driven model_providers override injection), pluggable client-side template inlining (Codex prompts/*.md is not expanded on either invocation surface — live-verified), structured DONE/HANDOFF and evaluate-gate contract schemas, and thread-id capture plus rollout JSONL locate/parse utilities.
  • Worker lifecycle: codex exec resume support (sandbox is fixed at thread creation — resume rejects -s, so the builder warns instead), death detection over the real rollout turn vocabulary (task_started/task_complete/turn_aborted), 429-retryable-with-backoff vs 404-fatal failure classification with an explicit unknown class, in-process single-writer thread claims, and a cross-session warm-seed distiller.
  • rasen agent context reads Codex rollouts: automatic transcript-kind detection (--runtime override > rollout-*.jsonl basename > first-line sniff > Claude default), occupancy from the last token_count event with the inline model_context_window (model id from turn_context, which is where it actually lives), zero-turn rollouts reporting 0% as success. All existing threshold consumers work unchanged.
  • Orchestration playbook rewritten to match: the generated skills' Codex sections now teach the verified exec-bridge command shapes; the earlier unverified app-server/plugin wording is removed, and docs/codex-workflow-integration.md (EN/ZH) is marked superseded with pointers to the dossier.

Fixed

• Orchestration: the LEAD now records durable worker handles (agentId + transcript) from the spawn result instead of a fabricated name, and the playbook's in-session revival paths are agentId-first with transcript warm-seed fallback — previously a name-only worker record forced a cold reconstruction on resume.
• Nix: flake.nix pnpmDeps.hash backfilled from the first real CI run, so the Nix Flake Validation job validates against the true dependency hash.

0.1.2

BREAKING: retire rasen change / rasen spec noun command groups

The noun-first command groups are removed. Use the verb-first surface instead:

--long (title + delta/requirement count per row), previously only available on the noun-form list subcommands, is now on rasen list itself.

Behavior change: telemetry first-run notice moves to stderr

The first-run telemetry disclosure notice now prints to stderr instead of stdout, so it never mixes into a command's stdout (which must stay either valid --json or the command's own text output). Any external tooling that greps stdout for this notice must switch to reading stderr.

Fixed

• CI: three root-caused test defects that failed only on Windows/macOS CI are fixed — a doctor fixture that hardcoded the Windows data-dir path instead of branching on platform, an archive.timing assertion that canonicalized a non-existent path (missing Windows 8.3 short-name expansion and macOS's /var → /private/var symlink) instead of canonicalizing the always-existing root first, and the telemetry-notice stdout pollution above.
• Packaging: the npm package now ships the skills/ sidecar files (expert-skill checklists and scripts); they were silently missing from 0.1.1 npm installs because skills/ was absent from the package's files allowlist.

Added

• /rasen:help — a layered guidance router command (with a rasen-help skill in the core profile) covering onboarding through pipeline extension.

Other

• Maintainer attribution updated to Sayo (repo URLs unchanged).

0.1.1

BREAKING: full namespace rebrand (openspec → rasen)

Every user-facing surface moves from the upstream openspec/opsx namespaces to independent rasen namespaces so rasen can coexist with an upstream OpenSpec install in the same project. Workflow semantics stay aligned with upstream OpenSpec v1.5.0; only the namespaces change.

• Binary: openspec → rasen.
• Slash commands: /opsx:* → /rasen:*.
• Skills: openspec-* → rasen-*.
• Workspace directory: openspec/ → rasen/. Root resolution now recognizes only rasen/; running a workspace command in a project that has only a legacy openspec/ prints migration guidance and exits non-zero instead of operating on it.
• Store metadata directory: .openspec-store → .rasen-store (legacy .openspec-store is still read and copied forward on write; never deleted).
• Global config directory: a pre-rename openspec config/data directory is adopted once (copy-only) into the rasen directory on first run.

Migration. Run rasen migrate in a project with an existing openspec/ workspace. It is copy-only: it copies openspec/{specs,changes,config.yaml} into rasen/, skips anything that already exists, and never modifies or deletes the original openspec/. You can keep using upstream OpenSpec against openspec/ unchanged. rasen init offers the same migration interactively when it detects a legacy workspace. Neither init nor update auto-cleans or rewrites legacy artifacts anymore — they only print a one-time coexistence notice. Marker-block removal from shared config files happens only inside rasen migrate, gated on explicit consent (default no).

Not rebranded (intentional). The .openspec.yaml change-metadata filename, the format: 'openspec' / format: 'openspec-change' file-format identifiers, and legacy-detection literals are left as-is so pre-rebrand and upstream layouts stay detectable.

0.1.0

Fork baseline — the first independent release of the Sayo fork, aligned with upstream v1.5.0. The version is reset to 0.1.0 to start an independent semver line; it does not continue upstream's 1.5.x series.

Fork changes

• Browser tooling: browse → chrome-use — the Playwright-based browse tool is removed and replaced by chrome-use, which drives the user's everyday Chrome over the Chrome DevTools Protocol. No Playwright dependency.
• Telemetry: maintainer-owned Cloudflare Worker — anonymous usage telemetry now posts to the fork maintainer's own Cloudflare Worker (https://openspec-telemetry.ws11579.workers.dev) over node:https instead of PostHog; posthog-node is dropped. Opt-out (OPENSPEC_TELEMETRY=0 / DO_NOT_TRACK=1 / CI auto-disable) is preserved. Note: the node:https transport does not honor HTTP(S)_PROXY, so telemetry silently drops behind an egress proxy.
• Independent identity prep — dual-copyright LICENSE (upstream OpenSpec Contributors + 2026 Sayo), fork-declaring README with a tgz install guide, and a tag-triggered GitHub Release workflow. The package name/bin and repository/homepage remain unchanged in this phase.