Changelog

September 22, 2026: stored publication approval and disclosure records

• Updates the public contract snapshot to the observed API export at platform 0319a80, adding approval proposal, disclosure listing and revocation references. The API version is still 1.1.3; this is a contract update without a version bump.
• Adds disclosure review: a key proposes exact recipients/files/terms, a signed-in owner approves, and publication names that stored approval. Caller-supplied user/session identity is not accepted as approval.
• Documents the combined key and browser-session requirement for revocation, pending versus delivered access, expiry, cascades and retained grants. Corrects stale authority guidance about engineering transfers and internal correspondence.
• Existing CLI0.6.14/MCP0.2.14/native0.1.6 archives remain unchanged. These HTTP references do not claim dedicated new client tools, configured email transport, a completed supplier pilot or automatic production.

September 22, 2026: quote review commercial terms

• Clarifies quote review: use the project’s applicable commercial terms rather than assuming every quote has a separate Maglev fee.
• Original supplier quotes, issued Maglev offers and signed historical terms remain distinct and unchanged. This is a documentation clarification; it does not change pricing, contract records or API behavior.

September 21, 2026: supplier query permission candidate

• Extends the source candidate to network summaries: counts, region groups and import metadata use the same visible records as the list. Hidden regions and quarantined-row timestamps cannot reappear through aggregates.
• Thirteen local compiled HTTP/native PostgreSQL checks cover both list routes, summary permissions, contact authority, audit, key revocation and failure boundaries. Twelve native database projection checks also pass. Two new summary controls fail against the preceding build.
• This is verified candidate behavior, not a backend deployment or supplier verification. The remaining-work table retains production promotion and reviewed claim publication as open gates. Packages and landing visuals remain unchanged.

September 21, 2026: supplier completion milestones

• Adds a plain-language remaining-work table, separating query permissions, trusted partner records, authorized RFQs/replies, supplier pricing and a real folder-to-quote pilot.
• The supplier list source candidate passes ten local compiled HTTP/native PostgreSQL permission checks with synthetic data. It still requires source review and backend release. Documentation and client releases do not establish a backend rollout, real supplier approval or a sub-minute firm quote.
• Existing package versions, API contract and landing visuals are unchanged.

September 21, 2026: current tool inventory clarification

• Corrected two outdated counts on the availability page: MCP 0.2.14 has 45 manufacturing tools; native connector 0.1.6 adds two connection tools for 47 total. Existing release packages and API behavior are unchanged.

Native connector 0.1.6, September 21, 2026

• Homepage and one-paste connections now pin hosted CLI 0.6.14 / MCP 0.2.14. Hermes exposes 45 manufacturing tools plus two connection tools.
• Adds saved-action observation and original-key recovery to that native connection. Complete evidence, bounded lookup, cancellation and current permission checks remain intact; a missing action never triggers a replacement.
• The installer upgrades recognized original CLI11/12/13 Claude Code/Codex projects to the new pin with private backups. Custom settings and instructions remain protected.
• Shared CLI/MCP behavior and previous archives stay unchanged. The OpenClaw command prefix follows the declared dependency. Native app launch, backend release, supplier contact and production approval remain separate from installer acceptance.

CLI 0.6.14 and MCP 0.2.14, September 21, 2026

• Recover a lost action ID with actions recover / recover_action, using the original project, kind and idempotency key. The MCP inventory is now 45 manufacturing tools.
• Verifies the exact matching detail and preserves original input/output, task and delivery summaries. Recent-record limits and missing lookup keys remain explicit: a missing result does not establish absence and never submits a replacement.
• Optional comparison accepts complete saved normalized input; raw request JSON can differ after server defaults. Duplicate matches, changed context, malformed results, cancellation, deadlines and permission/rate errors stop.
• All 445 tests and packed clients against the compiled synthetic API pass, including an existing action beyond the 100-record window and unchanged state. Native connector0.1.5 remains frozen on CLI12/MCP12. No backend, supplier contact, disclosure or approval change is included.

Action recovery source preview, September 21, 2026

• Unpublished CLI0.6.14-dev.1 / MCP0.2.14-dev.1 add recovery of a lost action ID using the original project, action kind and idempotency key. The candidate MCP inventory has 45 manufacturing tools.
• Reads at most 100 recent project actions, then verifies the matching detail with the same credential. A missing match never establishes absence or triggers replacement work. Server-normalized input is distinguished from raw request JSON.
• Duplicate matches, changed request context, malformed results, permission/rate errors, cancellation and bounded deadlines stop. Original draft/output/task/delivery evidence is preserved; no POST, approval or supplier action is issued.
• Hosted CLI0.6.13/MCP0.2.13, native connector0.1.5 and previous archives remain unchanged pending separate release acceptance.

CLI 0.6.13 and MCP 0.2.13, September 21, 2026

• Observe a saved action with actions wait / wait_for_action. The bounded read preserves complete original output, task and delivery evidence. MCP now has 44 manufacturing tools.
• Only running is polled. Queued coordination, draft, approval, failed and other known statuses return for the agent to interpret. An observation is not a manufacturing-completion claim.
• One credential and action ID, whole-call deadline, cancellation, unknown/incomplete-record rejection and 2 MiB response/envelope limits. Permission, network and rate errors stop without a write retry or replacement action.
• All 406 tests and installed clients against the compiled API pass with synthetic data, unchanged manufacturing records, owner/mode isolation and denied revoked credentials. Native connector0.1.5 retains CLI0.6.12/MCP0.2.12 and its earlier inventory. No backend release, supplier contact or production commitment is added.

Native connector 0.1.5, September 21, 2026

• Pins CLI 0.6.12 and MCP 0.2.12. Recognized original Claude Code/Codex projects can reconnect and upgrade through the same installer, with private backups and interruption recovery.
• Checks the intended API address and exact project state before sign-in; custom instructions, another API and edits during authorization stop for review. Denied or interrupted sign-in does not apply the upgrade.
• The one-paste prompts have supported agents run the installer themselves and leave matching browser approval to the user. The pinned CLI works in the same conversation; MCP loading is checked separately.
• All 373 tests and actual empty-cache project upgrades pass, alongside desktop/mobile clipboard checks. Hermes retains 43 manufacturing tools plus two connection tools. This client release does not add Hermes/OpenClaw configuration migration, backend release or supplier execution.

CLI 0.6.12 and MCP 0.2.12, September 21, 2026

• Upgrade an existing project with maglev agent upgrade. It recognizes original Claude Code/Codex connections and skills, offers an offline dry run, retains private backups and resumes a partially completed update. Other tools’ settings and custom instructions are preserved.
• Bounded reads, exact file hashes, existing configuration locks and recovery checks stop changed or ambiguous files from being overwritten. A local upgrade does not prove that the host loaded the new package; reload and check the connection afterward.
• The MCP inventory remains 43 manufacturing tools. Native connector0.1.4 retains CLI0.6.11/MCP0.2.11 until a separate connector release. No API endpoint, supplier permission or backend deployment is added by this client release.
• The source-preview entry below is retained as the earlier checkpoint. All previously hosted archives remain unchanged.

Managed project upgrade source preview, September 21, 2026

• Unpublished CLI 0.6.12-dev.1 adds agent upgrade for recognized existing Claude Code and Codex project connections and skills, with an offline dry run, private backups and interruption recovery.
• Preserves other tools’ settings, exact comments/formatting, existing API origins and custom instructions. Unrecognized or changed files stop for review instead of being overwritten. Upgrade an existing project explains support, verification and recovery.
• MCP 0.2.12-dev.1 contains the shared candidate source; its manufacturing inventory remains 43 tools. No new API authority is granted. Hosted CLI0.6.11/MCP0.2.11 and connector0.1.4 remain unchanged until a separately verified release.

Native connector 0.1.4, September 21, 2026

• Homepage connections and the terminal installer use the verified CLI 0.6.11 and MCP 0.2.11 releases. Hermes provides 45 tools: 43 manufacturing tools and two connection tools.
• Agents can wait for new supplier quote records with the same bounded deadlines and cancellation as the direct MCP server. The installed connector check verifies elapsed waits, cancellation, no extra polling after cancellation and retained RFQ reads.
• Claude Code, Codex and OpenClaw receive matching current setup instructions. Browser approval recovery remains available. Existing project settings and custom skills are preserved; updates need a reviewed upgrade.
• Earlier archives and approved landing visuals remain unchanged. Native app launch, backend rollout and a real supplier pilot remain separate from these installation checks.

CLI 0.6.11 and MCP 0.2.11, September 21, 2026

• Fix early timer wakeups that could start an extra read at the wait deadline. The earlier 0.6.10/0.2.10 release candidate was withheld after CI exposed the race. Two deterministic timing regressions retain the failure condition.
• Wait for new supplier quote records through rfqs wait or wait_for_supplier_quotes. MCP now provides 43 manufacturing tools. Use previously observed UUIDs from one owned RFQ, with a bounded wait and polling interval.
• Preserve original records, source provenance, commercial unknowns and request revisions. Newly observed IDs can still belong to historical or expired quotes. An elapsed wait reports the last observation time, not supplier availability or an offer SLA.
• Stop promptly on cancellation and fail on incomplete responses, ownership, authentication, rate or network errors. Identity, body reads and sleeps share the operation deadline. No dispatch or write is retried.
• Adds installed CLI/MCP acceptance against the compiled API with synthetic records, including exact historical prices, hidden drafts, owner boundaries, revocation and no-write checks. Existing archive bytes are preserved.
• Native connector 0.1.3 keeps its earlier client pins until a separate upgrade. The API deployment, npm registry release and real supplier pilot are separate.

The source-preview entry below is included in this client release.

Bounded quote waiting source preview, September 21, 2026

• Unpublished CLI 0.6.10-dev.1 adds rfqs wait; MCP 0.2.10-dev.1 adds wait_for_supplier_quotes, bringing the candidate inventory to 43 manufacturing tools.
• Wait for new quote IDs with a fixed account and request, explicit previously observed IDs, a bounded deadline and cancellation. Keep original quote data, unknown terms, validity, counts and revision links intact.
• Stop on authentication, ownership, rate, network and malformed-response errors. A deadline during a read returns an error; an elapsed wait after completed reads returns its last observation time. No sending, acceptance, order or automatic write retry is involved.
• This is source-preview behavior. Hosted CLI 0.6.9 / MCP 0.2.9, connector 0.1.3 and the API deployment remain unchanged.

Native-agent connector 0.1.3, September 21, 2026

• Connect the existing agent with hosted CLI 0.6.9 / MCP 0.2.9, including supplier reply reads and bounded response recovery. Hermes exposes 42 manufacturing tools plus two connection tools.
• Includes the previously reviewed interrupted browser-approval recovery, explicit key-override errors, remote approval, cancellation and offline help from the 0.1.2 source candidate.
• Keeps existing project instructions and configuration intact. Connection and recovery explains how to continue and how to review an older installation before upgrading.
• Retains all previous archive bytes. The connector update does not deploy the API or authorize supplier contact.

CLI 0.6.9 and MCP 0.2.9 hosted release, September 21, 2026

• Read existing managed RFQs and supplier-submitted quote versions with rfqs list / rfqs get, or list_supplier_requests / get_supplier_request. MCP now has 42 manufacturing tools. Supplier replies explains ownership, hidden drafts and unknown commercial terms.
• Accept returned eng- partner identifiers and the existing prior-reply filter through MCP. A prior reply is not verified capability, capacity or contact permission.
• Bound actual decompressed API responses to 2 MiB, reject corrupted UTF-8 and preserve request metadata on interrupted responses. Read saved state before retrying writes.
• Refresh the API reference from the observed public contract, including supplier-read models and publication endpoints. Contract matching and compiled synthetic checks do not establish hosted owner-approval hardening, real supplier acceptance or a production latency guarantee.
• Earlier archives retain their bytes. Native connector 0.1.1 remains pinned to CLI 0.6.8 / MCP 0.2.8 until its separate upgrade. npm registry publication and API deployment are separate.

The two source-preview entries below describe the earlier unpublished checkpoints now included in this hosted client release.

Client response handling source preview, September 21, 2026

• Unpublished CLI 0.6.9-dev.2 and MCP 0.2.9-dev.2 share the existing connector’s 2 MiB API response limit. It applies to actual decompressed bytes and rejects oversize results without partial success.
• Rejects malformed UTF-8 instead of silently changing returned evidence. Retains available request metadata after interrupted bodies, redacts reflected keys in error headers and preserves MCP cancellation.
• Documents response errors and write recovery. Requests are not automatically retried, and an unreadable response is not proof that the server rejected a write.
• This is an unpublished source candidate. Hosted CLI 0.6.8, MCP 0.2.8, native-agent connectors and the production API remain unchanged.

Supplier replies source preview, September 20, 2026

• Unpublished CLI 0.6.9-dev.2 adds rfqs list and rfqs get. MCP 0.2.9-dev.2 adds list_supplier_requests and get_supplier_request, bringing the candidate inventory to 42 tools.
• Read supplier replies explains buyer ownership, live credentials, supplier-submitted versions, separate extracted evidence, validity, unknown commercial terms and the 100-record list limit.
• These tools read existing requests. They do not publish an RFQ, send a message, disclose files, accept a quote or start production. The hosted CLI 0.6.8 / MCP 0.2.8 and connector archives remain unchanged; this entry is not a production release or a real supplier-pilot receipt.

Connection docs and execution status, September 20, 2026

• Consolidates installation, browser login, project configuration and diagnostics in Connect your agent. Previous quickstart and connection-guide URLs redirect to that page.
• Corrects all three copy-and-paste setup prompts and the prerequisite table to require Node.js 22.13 or later, matching the released packages.
• Adds execution acceptance criteria for supplier lookup, authorized communication, supplier-confirmed pricing and a real pilot. A saved request, provider delivery event or passing synthetic test is not supplier acceptance.
• Dates the last verified production email configuration instead of presenting an older observation as a current deployment check. Current provider activation remains unverified in this documentation review.
• This is a documentation update. API 1.1.3, hosted CLI 0.6.8/MCP 0.2.8 and previously released archive bytes remain unchanged. Pending integration work is not a released capability.

Native-agent connector 0.1.2 candidate — September 18, 2026

• Recovers an interrupted browser approval whose temporary key was rejected, instead of failing before sign-in. Recovery is bounded and preserves outages, permission denials and unrelated saved accounts.
• Identifies rejected environment overrides, adds actionable CLI/MCP errors, offline help, remote approval and cancellation. Setup guides keep host permission denials separate from account errors.
• Retains hosted CLI0.6.8/MCP0.2.8 and every published archive. Source and package verification are separate from production publication.

Native-agent connector 0.1.1 — September 18, 2026

• Pins hosted CLI0.6.8/MCP0.2.8, including selected local Word evidence. The Hermes wrapper exposes40 manufacturing tools plus two connection tools.
• Updates the homepage handoffs, agent instructions and OpenClaw CLI prefix together. Existing archives remain unchanged.
• Verifies clean Claude/Codex/OpenClaw setup and an actual Word read through the installed MCP wrapper. Existing project configuration and skills are preserved; older installations need a reviewed upgrade, not an automatic rewrite.

CLI 0.6.8 and MCP 0.2.8 hosted release — September 18, 2026

• Adds context read-docx, read_local_docx and explicit docxFiles folder selections (40 MCP tools). Returns original-byte hashes, main-body paragraph/table XML locations and omission warnings.
• Preserves changed-source detection and keeps Word text separate from confirmed requirements, signatures and legal authority. No API request, file upload or document instructions are executed.
• Bounds worker time/memory and package/XML/output sizes. Corrupt or active packages fail without partial text; unresolved revisions, fields, visibility, layout and other stories remain explicit.
• Keeps all earlier archive bytes. Registry publication and the separate native-agent connector release remain independent; the current quickstart installs this hosted CLI/MCP pair.

CLI 0.6.7 and MCP 0.2.7 hosted release — September 17, 2026

• Adds local assembly expansion and purchase-quantity calculation for reviewed CSV, TSV and XLSX BOMs through maglev context expand-bom and expand_local_bom (39 MCP tools).
• Binds the plan to fresh source/mapping hashes, the current batch, explicit parent records, make/buy boundaries and purchase groups. Exact fractions preserve material quantities; assembly yield, extra units and package rounding are declared separately.
• Preserves DNP and configuration exclusions. Changed files, cycles, ambiguous units, conflicting revisions, unmatched total-build batches and unresolved source evidence produce no complete purchase totals.
• Keeps the calculation local and read-only. It does not establish supplier pricing, engineering approval, stock availability or purchasing authority. Existing hosted archives remain unchanged; npm registry publication is separate.

CLI 0.6.6 and MCP 0.2.6 hosted release — September 17, 2026

• Adds maglev doctor and a JSON diagnostic report. Checks runtime, API/database health and the current credential separately; never treats connectivity as authority or proof of supplier execution.
• Detects missing or overridden credentials, rejected keys, unsafe local profile permissions, redirects, unexpected responses, bounded-response overflow and stalled requests. Does not repair settings, retry writes or include keys/account names/project data in reports.
• Uses GET-only checks with a default five-second deadline per request, a 64 KiB response limit, no redirects and meaningful exit codes. CLI setup pins the compatible MCP archive; the connector still has 38 tools.

CLI 0.6.5 and MCP 0.2.5 hosted release — September 17, 2026

• Adds local selected-page PDF text evidence with original-byte hashes, page/item positions and explicit unread-page counts. Includes bundled CMaps for supported Chinese text.
• Adds read_local_pdf inside the host-selected project root and optional pdfPages in folder review. Extracted text does not automatically become engineering requirements or signature evidence.
• Uses a separate bounded parser process with no inherited account credentials. Password-protected, scripted, unsupported and excessive documents fail without a successful partial report.
• Raises the minimum runtime to Node.js22.13. Hosted archives remain immutable; npm registry publication is separate.

CLI 0.6.4 and MCP 0.2.4 hosted release — September 17, 2026

• Adds a private local journal for interview creation. Retain one UUID before starting; a saved acknowledgment is persisted before returning and later starts with the same input retrieve that interview.
• Adds recover_interview and CLI interviews recover --request-id UUID. MCP start_interview now requires requestId; CLI users opt in with --request-id. Unconfirmed starts are not automatically resent.
• Locks concurrent processes and rejects changed inputs, changed API keys, corrupt records and redirected storage. A crash cannot erase the pending record. No transcript or credential is stored in the receipt.
• This is local recovery, not server idempotency: another machine, deleted configuration or a response lost before the server ID arrives still needs reconciliation. It does not prevent network outages or add supplier publication.

CLI 0.6.3 and MCP 0.2.3 hosted release — September 17, 2026

• Adds MCP lifecycle reads and founder/manufacturer interview start, retrieval and answers. Existing agents preserve actual responses, source evidence, guided/AI status and the current version.
• Reports version conflicts and interrupted writes without automatically changing the version or duplicating an answer. Interview creation remains non-idempotent; keep the returned ID.
• Keeps confirmation/publication as a separate reviewed workflow. No voice cloning, telephone outreach or automatic supplier listing is added.
• CLI setup pins the new MCP archive; all earlier hosted packages remain immutable. npm registry publication is separate.

CLI 0.6.2 and MCP 0.2.2 hosted release — September 17, 2026

• Adds bounded local XLSX BOM review with exact worksheet/header selection, original-byte hashes and source cell addresses. Shared strings and raw numeric values retain their original precision.
• Preserves hidden/filtered rows and formula evidence without calculating formulas, following external links, or inferring purchase totals. Ambiguous typed values require clarification.
• Adds two read-only MCP tools scoped to the host’s configured project root; no account or API call is needed. Folder review uses the same parser and invalidates changed evidence.
• Keeps earlier hosted archives unchanged. npm registry publication remains separate; install from the connect guide.

API 1.1.3 provider receipts, September 17, 2026

• Adds authenticated provider events to existing delivery reads. Submission acceptance, mail-server delivery, bounce/complaint evidence and supplier acceptance remain distinct.
• Reconciles lost send responses using signed provider evidence without sending a replacement. Repeated events, out-of-order events and late HTTP responses preserve the saved outcome.
• Freezes opaque correlation tags into new approvals and preserves legacy untagged payload bytes. Event metadata, delivery state and audit commit together.
• Verifies the real compiled HTTP path, independent PostgreSQL races and transactional migration rollback with synthetic records. Production provider credentials are still required; no real factory contact is claimed.
• Aligns browser pairing with password/session rotation lock ordering. Revoked sessions are rechecked after waits and cannot approve or activate a connection.
• Existing hosted CLI 0.6.1 and MCP 0.2.1 expose the additional receipt through their delivery-read tools. Their published archive bytes are unchanged.

CLI 0.6.1 and MCP 0.2.1 hosted release — September 17, 2026

• Adds owner-approved browser login: match the terminal code, approve your workspace and return to the connected CLI. No key copying is required.
• Keeps a private, origin-bound recovery journal. Interrupted polling or lost acknowledgment resumes the same request and key. Credentials are saved before activation; unfinished keys expire after ten minutes.
• Adds explicit sandbox login, cancellation, hidden manual-key fallback and a shared lock that prevents concurrent profile changes. Live browser keys last ninety days after confirmation; sandbox keys one day.
• Verifies installed CLI and MCP packages against the compiled API and browser, including a real terminal and deliberately lost acknowledgment. No real supplier action is part of this verification.
• Preserves the previous immutable archives. npm registry publication remains separate from these hosted releases.

CLI 0.6.0 and MCP 0.2.0 hosted release — September 17, 2026

• Adds live project, manufacturer, knowledge, action and delivery workflows to the existing agent. MCP now exposes 30 tools with explicit mode and effect descriptions.
• Delivery approval requires the exact reviewed recipient/message digest and confirmation. Recovery reads the saved dispatch and reuses its provider key; changed reviews are never silently refreshed.
• Ships shared local login, project setup, folder review, engineering access and selected-file transfer from the earlier source previews. Setup pins the versioned Maglev-hosted MCP archive.
• Updates the reference from the deployed API, including context-version guards and reviewed delivery. Private storage was verified with synthetic production bytes and confirmed cleanup. No real supplier execution was used for release testing.
• Install through the connect guide. These are immutable hosted packages; npm registry versions remain 0.5.1 / 0.1.2 pending restored publishing authentication.
• Production email credentials remain unconfigured. Approved messages stay explicitly unsent. Signatures, orders, production and automated supplier negotiation remain separate work.

The source-preview entries below are historical checkpoints now included in this hosted release; their original limits describe those earlier checkpoints.

Historical preview: selected engineering file transfer

• CLI 0.6.0-dev.4 adds local transfer preparation, explicit manifest proposals, status and resumable authorized uploads. MCP 0.2.0-dev.3 adds four matching tools, with local access limited to the host-configured project directory.
• New project setup sets that root; existing different configurations are preserved. Stable packages and archives are unchanged.
• Transfer guide explains file limits, private receipts, owner approval, changed-file and interrupted-response recovery. Requires platform #27 and migration 0022. Received files still need engineering review; no supplier disclosure, binding offer or production approval.

Historical preview: authorized engineering clients

• CLI 0.6.0-dev.3 adds engineering get and engineering preview; MCP 0.2.0-dev.2 adds matching owner-granted live tools while preserving the ten sandbox boundaries.
• Setup accepts live keys without the synthetic demo. It never grants itself engineering access.
• See engineering access for the required API preview, versioned owner grants, explicit terms, unknown charges and interrupted-response handling. Every result remains nonbinding; no supplier contact, file disclosure, capacity reservation or production.
• Published versions and immutable archives stay unchanged. Source validation and installation checks do not prove production availability.

Historical source preview — local folder review

• CLI 0.6.0-dev.2 adds keyless context review: literal text evidence, explicit BOM mappings, separate current/planned/forecast quantities, source conflicts and process-specific missing-input prompts.
• Local snapshot comparisons identify changed evidence and decisions needing review. They do not revoke hosted approvals or authorize disclosure, quoting or production.
• See the folder review guide for supported formats and source-only commands. Published CLI 0.5.1 is unchanged. The MCP candidate 0.2.0-dev.1 refreshes shared modules; its ten tools are unchanged.

Historical preview: setup experience preview

• CLI 0.6.0-dev.2 adds browser-assisted login, private local credential reuse and logout. The existing web account owns profile/onboarding information; automatic browser callback login still requires API support.
• Setup uses arrow keys and Enter, recommends an agent, remembers the choice and defaults to the current folder. It writes actual Claude Code/Codex MCP configuration alongside the project skill, preserving unrelated settings.
• Sandbox examples become explicit opt-ins. JSON setup remains prompt-free. CLI setup shows lightweight terminal activity.
• MCP 0.2.0-dev.1 shares the saved login and reports real per-request activity through standard progress notifications. Host display varies; no live supplier sending is implied.
• Both packages remain unpublished review builds. Publish and verify the pinned MCP version before making the new CLI available. Existing release archives are preserved.

CLI 0.5.1 and MCP 0.1.2 - September 16, 2026

• Publishes the official npm packages as @try-maglev/cli and @try-maglev/mcp; the executable names stay maglev and maglev-mcp.
• Keeps earlier downloadable archives unchanged and provides a migration path from the previous @maglev package names. Current registry and hosted archives use identical bytes.
• Updates quickstart and one-paste onboarding for the npm organization. Manufacturing API behavior and the ten sandbox MCP tools are unchanged.

CLI 0.5.0 and MCP 0.1.1 — September 16, 2026

• CLI context review-bom reads explicitly mapped UTF-8 CSV/TSV locally without a key. It preserves source records, raw identifiers, decimal quantities, units, revisions and population flags, and returns questions for missing or ambiguous context.
• Input limits and malformed exports fail without a partial successful report. No native CAD parsing, hierarchy expansion, purchase totals or upload is included.
• BOM review guide includes downloadable synthetic examples. The existing onboarding and sandbox tools remain available.
• MCP 0.1.1 refreshes its bundled shared CLI modules. Its ten sandbox tools are unchanged; it does not gain a filesystem tool.
• Previous CLI and MCP archives retain their original bytes and checksums.

MCP 0.1.0 — September 16, 2026

• Adds a local stdio connector with ten sandbox tools for existing agents: discovery, inspection, saved quote requests and project briefs.
• Preserves structured API errors and quote idempotency keys; supports cancellation without automatically retrying writes.
• Adds client configuration, first-request and recovery guidance. Live keys, factory profiles, knowledge, document actions and delivery tools are outside this preview.
• Ships through a versioned Maglev-hosted archive; npm registry publication remains separate.

CLI 0.4.0 — September 16, 2026

• Adds maglev setup to verify a sandbox key, connect an existing Claude Code/Codex project or terminal, and optionally run the first example.
• Adds maglev demo: discover, inspect, save and retrieve a synthetic enclosure request without preparing JSON or copying IDs. Local state preserves the request body, idempotency key and run ID so reruns recover the same work.
• Leads the quickstart with installation and CLI setup; keeps the direct HTTP walkthrough as its own guide.
• Uses environment credentials and the existing API. Browser authentication, npm registry publication and native CAD parsing remain unavailable. Earlier archives are unchanged.

Quote quantity handoff — September 16, 2026

• Explains the distinction between a project’s target quantity and action quantity bands, including the current API defaults.
• Adds finished-product versus individual-part examples, with fractional material and existing-draft limits.
• No API behavior or CLI archive changes.

CLI 0.3.8 — September 16, 2026

• File inputs reject named pipes before waiting for a writer. Regular file links and explicit stdin remain supported.
• Local context preview uses nonblocking file opens when the operating system supports them, then verifies the file descriptor.
• Keeps earlier download archives unchanged. This fixes a local file-input hang, not Codex desktop streaming.

CLI 0.3.7 — September 16, 2026

• Rejects duplicate JSON object fields from files and stdin before a conflicting value is silently discarded.
• Detects equivalent escaped property names while preserving repeated names in separate objects. Error messages do not echo source data.
• Preserves prior versioned archives. Deployed API behavior is unchanged.

Engineering file handoff — September 16, 2026

• Adds a guide for bringing CAD/BOM exports into an existing agent workflow, with original vendor documentation.
• Explains configurations, revisions, quantity bases, source evidence, local preview and the deployed request-size limits.
• Does not add native CAD interpretation, uploads or a new connector. CLI 0.3.6 archive bytes are unchanged.

CLI 0.3.6 — September 16, 2026

• Rejects NUL and unpaired Unicode surrogates in JSON values and property names before transmission. Interview text rejects NUL too.
• Preserves valid emoji pairs, Chinese, literal escape text and line breaks. Input errors do not echo the source.
• Keeps all previous versioned archives unchanged. This does not change the deployed API.

CLI 0.3.5 — September 16, 2026

• Clarifies the bundled agent skill’s description of the real factory network, without implying that every profile field has been approved for public sharing.
• Updates the network guide to name the structured contact field and operation scopes precisely.
• Command behavior is unchanged. Existing versioned archives remain available with their original bytes.

Local CLI walkthrough — September 16, 2026

• Adds a key-free walkthrough using the real CLI against a temporary loopback fixture.
• Carries a synthetic project through a deliberately interrupted response, saved-action recovery, replay and a changed-input conflict.
• Validates its hand-authored result against the reviewed action schema; no model, supplier or production service is called. CLI 0.3.4 archive bytes are unchanged.

Design revision workflow — September 16, 2026

• Adds a guide for preserving revisions across project updates, action results and pending delivery drafts.
• Includes schema-checked project-update and readiness examples.
• Explains existing intake replacement and idempotency behavior, including the absence of automatic approval invalidation or revision locking.

CLI 0.3.4 — September 16, 2026

• Rejects JSON numeric overflow, underflow to zero and unsafe integers before transmission.
• Preserves quoted identifiers and ordinary numeric measurements; applies the same check to files and stdin.
• Retains earlier release archives unchanged.

Quality-plan review — September 16, 2026

• Adds a guide connecting critical requirements, inspection stages, sampling decisions and actual release evidence.
• Includes a synthetic quality-plan request checked against the deployed action schema.
• Explains the current API’s sampling limitations without presenting generated text as a validated plan.

CLI 0.3.3 — September 16, 2026

• Rejects malformed UTF-8 files and piped input before sending a request, preserving engineering text from silent character replacement.
• Accepts UTF-8 JSON exports with a leading byte-order mark.
• Keeps valid Unicode, literal replacement characters and interview text unchanged. Prior release archives remain available.

Project scope and agreements — September 16, 2026

• Adds a workflow from existing project files through strategy, engineering estimate and SOW review, with three schema-checked synthetic requests.
• Explains NDA draft fields and defaults, and where the existing API stops short of signature and file-sharing management.
• Keeps proposed scope, engineering evidence and accepted commitments distinct.

Supplier quote review — September 16, 2026

• Adds a guide for checking source replies, counting units, currency, tooling, lead-time basis and quality evidence before comparing prices.
• Includes two synthetic quote-record requests validated against the deployed action schema.
• Explains current extraction limits and keeps examples separate from real supplier offers.

Record ownership and recovery — September 16, 2026

• Documents how live keys share company work, how sandbox keys stay isolated, and what changes when a key expires or rotates.
• Gives a live-key rotation sequence that checks access before revoking the old credential.
• Clarifies that key rotation does not reset a company’s action idempotency history or transfer sandbox records.

CLI 0.3.2 — September 16, 2026

• Piped JSON and interview answers preserve Chinese, emoji and other UTF-8 text even when a character arrives across several input chunks.
• Input size limits count original bytes before decoding.
• Earlier versioned downloads remain available and unchanged.

Workflow response reference — September 16, 2026

• Action lists now document their nested action and deliveries entries, with separate delivery and task summary models.
• Project creation/update constraints, nullable fields and list limits match the current routes.
• Action-kind discovery uses the actual inputSchema and outputSchema field names; delivery reads include the full returned presentation.
• These are documentation corrections to existing behavior, not new execution capabilities.

Saved action results — September 16, 2026

• Action references and readiness examples now point to the saved result at action.output.result.
• The response model documents the surrounding draft envelope and the null output possible before a result is saved.

Production readiness — September 16, 2026

• A file-to-review workflow that separates known facts, missing decisions and evidence.
• A runnable synthetic readiness request checked against the published action schema.
• Recovery steps that retain the saved action and previous revision.

CLI 0.3.1 — September 16, 2026

• Saved action IDs and field validation details survive API errors, so agents can recover the original work.
• Interrupted response bodies retain server request IDs and report a connection error.
• Malformed responses produce structured errors; writes are never automatically retried.
• Shipping guide explains which costs the current estimate includes and its entry-fee assumptions.

Intent and factory selection — September 16, 2026

• A source-audited recipe for preserving location, quality, material and revision requirements through RFQ preparation.
• Exact meanings of the current quote action’s ranking options and explicit factory selection.
• An on-demand upstream API contract check for maintainers.

CLI 0.3.0 — September 16, 2026

• Offline project skill installation for Claude Code and Codex, with a preview option.
• Bundled, inspectable manufacturing instructions that preserve intent, evidence and the user’s coordination authority.
• Existing project guidance and customized skill files are never overwritten.

Expanded action reference — September 16, 2026

• All 23 published action kinds now have input/output schemas, execution notes and lifecycle stage IDs.
• Shipping and compliance endpoint references and an integration guide.
• OpenAPI 3.1 schema checks now cover requests, responses, action inputs/outputs and examples.

CLI 0.2.0 — September 16, 2026

• Project creation, retrieval and updates with free-form intake preserved.
• Factory filters, knowledge search, lifecycle stages and current action schemas.
• Idempotent action requests and delivery-draft reads from an existing terminal or agent.
• Longer timeouts for model-backed actions, plus synthetic project examples.
• The v0.1.0 download remains available with its original checksum.

September 16, 2026

• Standalone documentation with quickstart, integration guides, lifecycle coverage and availability.
• CLI v0.1.0 for discovery, inspection, text interviews, saved requests and local file manifests.
• Versioned CLI download and public agent-readable documentation.
• Explicit request effects, sandbox boundaries and recovery instructions.

The CLI uses the catalog operations of API v1.1. New HTTP endpoint families expose factory knowledge, lifecycle stages, projects, actions and reviewed deliveries. Approving a live delivery can send or queue a message; sandbox cannot send. Purchasing, a public MCP server and native CAD parsing are not included.

API v1

The initial manufacturing API supports sandbox/live keys, capability discovery and inspection, founder/manufacturer interviews, reviewed live listings, and saved quote requests. A saved request does not place an order.