Lines carrying multi-tenant apply only to the self-hosted multi-tenant deployment; local only to the single-user local binary. Everything else is for everyone.
The big stuff
Runs survive sleep, outages and deploys. Close your laptop mid-run and the run carries on when you open it. On wake, TF also drops connections that died while it slept and polls every org straight away. If the model provider or GitHub goes down, the run hands its claim back and retries on a growing backoff for up to about four hours instead of failing. A deploy or restart hands every running conversation to the next executor, which picks it up without spending any retry budget, so a deploy no longer stops everything that was in flight.
Crashed and stuck runs recover on their own. Every claim now has a 75-second lease that its holder keeps renewing. Both modes’ dispatchers take over a claim whose lease has run out, and the reaper that used to do this has been deleted. A run that sits idle for ten minutes with nothing in flight, or runs past an operation’s deadline, parks itself as stalled and resumes when you message it. Native runs multi-tenant also checkpoint their workspace between tool calls, so a hard kill loses at most five minutes of work (TF_SNAPSHOT_INTERVAL_SEC) plus the tool call that was running.
Also new
- New
github:pr:body_updatedandjira:issue:body_updatedevents let a handler react when someone rewrites a description. They’re opt-in; no shipped handler listens for them. - Sonnet 5.5, Opus 5.5 and Fable 5.1 are in the multi-mode model picker multi-tenant, and the bundled Agent SDK moves to 0.3.287 local.
- GitHub and Jira each get a connection state per org. It’s logged once when the connection drops and once when it comes back, and exported as
tf_upstream_up. The poll, scoring and profiler failure toasts are gone, and a poll that reached nothing no longer counts as healthy. - GitHub, Jira and Slack share one retry and backoff policy. GitHub now retries 5xx errors and dropped connections on reads, and error bodies are capped, so a proxy’s HTML error page stays out of your logs. LLM errors get one classifier, with request and retry metrics.
- The event queue, queued firings and score re-evaluation all run on one durable work-item model. Leases replace boot resets and staleness sweeps, retries back off, and an item that fails five times parks instead of retrying forever.
- A Parked work panel replaces the failed-events panel and covers all three queues, with a status filter, redrive and cancel. The monitoring docs now include work-queue metrics and alert rules.
- Stop is now a request that the run itself settles. The stop controls stay disabled while a stop is pending, and re-delegating a task that’s still held returns a 409 with the reason.
- In multi mode, when the sidecar can’t find a credential it answers with a JSON 403 that says why, instead of a 502 that looks like an outage. multi-tenant
Fixes
- PR tasks were scored and summarized from the title alone. The scorer now reads the PR body.
- Reopening a closed PR could race a cleanup sweep that closed it again and cancelled its live run. The poll now owns closing.
- Local SQLite transactions failed instantly when an agent’s
tfac execwrote at the same moment. They now wait their turn. local - A crash at the wrong moment could lose a review request that was already on a PR when TF started watching, or leave a blueprint
runningwith no step. - Permission prompts showed the wrong deadline after a sleep. local
- Cancelling a blueprint that was paused or still starting up now actually cancels it.
- A fully busy executor now still takes over dead claims. A queued firing is no longer charged an attempt for arriving as a run ends, and one bad task id from the model no longer throws away a whole scoring cycle.
- Every run now starts at its run root with each checkout beneath it, and checkouts from
workspace addare snapshotted and restored. A cold restore in multi multi-tenant no longer breaks a PR run’s git. gh pr diffanddownload-logsno longer write into your checkout, andghverbs use the repo the agent is working in.- After a host reboot, the compose stack no longer crash-loops on DNS, because the backing services now restart too. multi-tenant
- The hamster that renews claim leases every 20 seconds has finally been given weekends off. Leases taken out on a Saturday will be renewed by its cousin.
Upgrading
A 1.14 local install upgrades in place. local The Postgres schema changed inside its baseline migration rather than in new ones, so a 1.14 multi-tenant database won’t pick the changes up: start the deployment on a fresh database. multi-tenant
TF_REAPER_STALE_SEC and TF_SELF_FENCE_SEC are gone. multi-tenant TF_MAX_CLAIM_ATTEMPTS now counts only engagements whose executor was lost; setup failures have their own budget of five, and a clean shutdown spends neither.
On the API: the /api/events/failed/* routes are replaced by /api/orgs/{org_id}/work/…, which covers every queue. Conversation reads gain stop_requested_at and next_attempt_at, and POST /api/tasks/{id}/delegate returns 409 while a live claim still holds the task.