v0.29.0 Release Notes
[0.29.0] — 2026-08-21
Three things shipped in this release: the guard stack moved to guard-core 3.12.0 and fastapi-guard 7.6.0 with new env vars and changed exclude_paths semantics, operators can now pause maintenance across three independent scopes, and the X post drafter gained an impact bar.
guard-core 3.12.0 / fastapi-guard 7.6.0 adoption
Both packages are now floor-pinned: fastapi-guard>=7.6.0 and guard-core[redis]>=3.12.0. The pairing matters because guard-core 3.12.0 with fastapi-guard below 7.6.0 silently drops every body-based return_pattern rule, so the floor pins are a safety contract, not just a version bump.
A new log-only behavior rule watches status:401 responses for credential-probing visibility. It fires at a threshold of 20 in 300s and never bans, since a stale internal HMAC token must never earn a ban (bans override the whitelist).
The exclude_paths semantics changed upstream: excluded paths no longer skip every check. They skip only WAF and behavioral tracking, while IP-ban and rate-limit rules still enforce. An excluded path is now a narrow carve-out for internal endpoints, not a blanket bypass.
Three new environment variables control the guard's scanning and telemetry surface. ROBOCO_GUARD_SCAN_RESPONSE_BODY (default off) lets return_pattern rules read response bodies, not just status codes; RoboCo's own rules never need it. ROBOCO_GUARD_LOG_SUSPICIOUS_LEVEL controls the verbosity of suspicious-activity logging. ROBOCO_GUARD_TELEMETRY_ENABLED toggles telemetry payloads, which now exclude HMAC and session headers via agent_sensitive_headers.
apply_guard now exposes an internal readiness probe at GET /_guard/status, reachable only on the docker mesh or localhost:8000 since nginx never routes it.
route_resolution_strict was evaluated and deliberately left off. Verified live, it turns every unresolved path into a 500 for every client regardless of whitelist, which would blind the new status:404 rule (a scanner sweep would read as 500s, not 404s) and turn routine client and panel typos into apparent server errors.
See HTTP Security for the full guard configuration reference, and Env Reference for the new environment variables.
Operator maintenance pause
Operators can now pause maintenance work without killing running agents. A pause drains: it lets in-flight work finish rather than killing active sessions.
Three independent scopes are each pausable on its own: dispatch, board_programs, and engines. You can pause one without touching the others, so a board-program pause does not halt the dispatch loop.
Pause state lives in the settings store with paused_by, reason, and expires_at fields. The default duration is 4 hours, with a maximum of 336 hours (two weeks). Pause and resume are CEO-only API routes.
The panel shows a banner with a live countdown and a Resume button when any scope is paused.
The stale-claim reaper and budget sweep continue running during a pause. A pause stops new dispatch and program work, not the housekeeping that keeps the backlog clean.
See Autonomous Maintenance for the maintenance lifecycle and the new pause scopes.
X impact bar for post drafting
The X post drafter now includes an impact bar that scores each draft's potential reach and engagement. This gives the drafter a visible signal during composition, so you can compare drafts before publishing rather than only measuring after the fact.
Security fixes
Forwarded LAN IPs no longer ride the internal-mesh whitelist. Previously, a forwarded LAN address could be treated as internal, bypassing guard checks meant for external clients.
cryptography 50.0.0.0 is now adopted, bringing the latest security patches and deprecation cleanups.
Next
→ HTTP Security for the full guard configuration · Autonomous Maintenance for the maintenance pause scopes · Env Reference for the new guard environment variables.