loomcycle v1.5.0 ships three changes that compose into a workflow. RFC AG keys the /v1/_mcp dispatch off the authenticated principal, so user-scoped Memory, Documents, and Path under the MCP-server transport now share the same per-scope SQLite file as the off-run HTTP path (the fix for the cross-transport mismatch where an MCP-created document was invisible in the Web UI). The route opens from substrate:admin to substrate:tenant; the per-tool gate inside the session still hides admin-only meta-tools. RFC AO adds config-declared static (tenant, subject) principals: a new principals: block in loomcycle.yaml binds a stable service identity to a token_env name; the bearer secret lives in .env.local. One declared bearer authenticates both /ui/login AND an MCP thin client at the same (tenant, subject) by construction. RFC AN makes --config repeatable with deep-merge, so bundles stack onto operator config without copy-paste. What it unlocks: the launch plan moved from a flat Markdown file to a Document with 18 publication chunks; status is a queryable typed field; agents and humans edit different chunks concurrently under optimistic-revision concurrency; Channel events fire on every chunk update. The natural agentic shape: scaffold → drafter agent → human review → posted → reporter agent. Additive on the substrate layer; no new wire RPCs; TS + Python adapters unchanged at 1.4.0; Claude Code plugin bumps to v1.5.0. Existing deployments without a principals: block keep working unchanged.
Bashbox: in-process shell sandbox for agents. The bench, and three gbash issues (v1.3.0)