Release notes

Notable changes to Tares, newest first. The project follows Semantic Versioning ; earlier 0.0.x history is in the git log.

1.14.0: 2026-08-31

Changed

• Use cases are now projects; recipes are templates. A project is a named set of sources, views, triggers, agents and MCP servers with one page; the shipped recipes are Tares templates. The API moves to /api/projects and /api/projects/templates, catalog YAML uses projects: with template:, and the seed variable is TARES_SEED_PROJECT. The old routes, YAML keys and variable keep working for two releases.
• claude_code events label the repository the session ran in as repo (was project); saved sources, views and stored data follow on upgrade.

Added

• Projects from existing objects. Assemble a project from the sources, views, triggers, agents and MCP servers you already have; nothing is created, and removing an object from the project leaves it in place.
• Rerun an agent run. A run that failed, ran out of rounds, was capped or came back empty has a Rerun button: same trigger, same entity, same firing data, against the agent’s current definition. Runs also open with the agent’s previous finding for the entity, a head start instead of rediscovering it.
• The challenger session thread lists every finding of a review in full.

1.13.0: 2026-08-27

Added

• Challenger workflow in the console. The use case page lists every challenger session with the plan and per-commit review outcomes, the Claude/Codex exchange as one thread, a Summarize button per session, and the summarizer’s memory proposals with Accept / Reject. Decisions are kept on the memory source, so they hold in every browser.
• The first session marked as a challenger session creates the challenger_workflow use case by itself; /tares:challenger in Claude Code is the whole setup.

Fixed

• Plugin fixes for marketplace installs, git -c ... commit, and Codex 0.150’s sandbox flags; only [P1] findings block on a plan critique.
• Use case actions that start an agent run (summarize) failed under tares up and left a run stuck at running.
• Challenge outcomes read “no findings” / “N findings (M blocking)” instead of PASS/FAIL, which elsewhere in the console means a broken run.

1.12.0: 2026-08-27

Added

• Challenger workflow. A second model challenges Claude Code’s plan and every commit, locally, while Tares keeps the record: a per-session view, a trigger on session end and a summarizer agent that writes a session summary with memory proposals. The claude_code connector gains the flow label and challenge events with verdict, sha, round and finding counts.
• Claude Code plugin 0.2.0. /tares:challenger turns a session into a challenger session; the plugin runs Codex on plan exit and after each commit (blocking on P1/P2 findings, with a fix loop and /tares:challenger-waive), ships every review to Tares, and hands accepted memory to Claude at session start.

1.11.0: 2026-08-26

Added

• Install skill for coding agents: npx skills add glassflow/tares --skill tares. From one prompt, an agent installs Tares, starts it, adds a first source, connects itself over MCP and shows one read.
• tares status: a readiness checklist for a running instance that ends with the one next step; --json for scripts. tares up prints the same “Next:” line under the console URL.

Changed

• An agent run without a key, and the banners on the Agents pages, say what to do: set ANTHROPIC_API_KEY before tares up, or add a key under Settings.

1.10.0: 2026-08-25

Changed

• A key stored in the console now takes precedence over ANTHROPIC_API_KEY (it was the other way around). If you relied on the env var overriding a stored key, clear the stored key.

Added

• Grafana Loki connector. Polls a LogQL stream selector; one event per log line with the stream’s labels and the same derived fields as docker_logs. Works against any reachable Loki, including Grafana Cloud.
• The AI SRE demo works against a hosted demo stack when the TARES_DEMO_* URLs are set; with them unset the local docker compose flow is unchanged.
• The spend meter records which key paid: GET /api/usage/model reports a by_key_source split, so an operator-provided key’s spend is separable from your own.
• TARES_SEED_USECASE: seed a named use case once on first boot, so an instance starts with a working setup instead of an empty catalog.

1.9.0: 2026-08-24

Added

• Model usage and cost per agent run. Every run records its model, token usage and a USD cost priced at write time; Ask turns are metered the same way. Runs from before this release show no cost (unknown, never guessed).
• GET /api/usage/model: the instance’s Anthropic spend as all-time totals plus a per-day tail, split by surface.
• The Tares agents page is an operational surface: stat cards, tabs, and runs as a table with model, rounds, tokens and cost, expandable to the finding.

1.8.2: 2026-08-19

Fixed

• A trigger no longer misses a key whose source ingested right after another; a skipped evaluation is re-run once the debounce interval ends.
• Shared code context: the every_commit trigger’s detection window is 5 minutes, matching the 60-second source poll.

1.8.1: 2026-08-19

Added

• AI SRE demo as a use case. Use cases > AI SRE demo (tagged demo) creates the same three sources, service_timeline view, incident trigger and incident-first-look agent the demo catalog seeds, with one click; an already imported demo catalog is adopted, not duplicated. The setup page asks Docker what is running and fills the Prometheus and api-server URLs and the log container from it, shows the docker commands with copy buttons when the stack is not up, and takes an Anthropic key inline. The use case page has Cause an incident (error spike, latency, dependency outage) and Clear the fault buttons. Recipes can declare tags, setup steps, actions, a guide link and a detect hook.

Fixed

• Auto-discover (Docker) works again when a Prometheus container is running; it proposes a reachable starter metrics source and says how many metrics wait to be picked on the source page.

1.8.0: 2026-08-18

Added

• Use cases. A new console section and framework: a use case is a ready-made setup that creates ordinary Tares objects and owns them (badge on their pages, editable and deletable there; an edit marks the object customized, a hand delete shows as missing with Repair). Create, update by re-plan, pause and resume, delete, repair; /api/usecases; usecases: in catalog YAML. See Use cases.
• Shared code context use case: one commits source per repository, a view with one timeline per repository, a trigger on new commits, GitHub’s hosted MCP server registered with the stored credential, and an agent that keeps a context repository current as pull requests; existing pages updated in place or one page per repository; optional first look on start. See the guide.
• GitHub credential stored once under Settings > GitHub; credential: <name> on github sources, credential:github/<name> on MCP servers; rotation in one place.
• MCP servers take extra headers (for example X-MCP-Toolsets on GitHub’s hosted server).
• Per-agent round cap max_rounds (default 6, 12 with external MCP servers) and an exhausted run status with a partial note.
• GitHub commits carry their changed files in the payload (capped; files: false to skip).
• Settings has tabs: Access and API keys, Anthropic, GitHub, Slack.

1.0.0-1.0.1: 2026-08-05

Changed

• NavFlow is now Tares. This release is breaking, with no compatibility layer. The package and command are tares, the daemon is taresd, the MCP proxy is tares-mcp, and --navflowd is --taresd. Every NAVFLOW_* environment variable is now TARES_*, and the old names are not read. The image is ghcr.io/glassflow/tares, the repository is glassflow/tares , and the Claude Code plugin is tares@tares.
• The database file is tares.duckdb, previously navflow.duckdb, inside a data home that moved from ~/.navflow to ~/.tares.

Two guards instead of a fallback. Both renames above would otherwise fail quietly, coming up healthy and empty while the real data sat untouched beside the new file. So the daemon refuses to start if any NAVFLOW_* variable is still set, or if a pre-1.0 database sits next to a missing tares.duckdb, and prints the rename or the mv you need. Full instructions: Upgrading from 0.x.

0.2.0: 2026-07-26

Added

• Tares agents: a prompt attached to a trigger. When the trigger fires, Tares reads the correlated timeline and writes a finding back onto the entity’s timeline (a built-in findings source). Configured in the console (Agents) or the catalog (agents:); enabled ⟺ subscribed to its trigger; read-only (it concludes, it doesn’t act). The demo ships one that diagnoses the injected incident out of the box.
• navflow up --auth: one switch for authentication. Bare --auth generates and persists a root token and prints a …/?token=… login URL each launch; --auth=<token> uses your own. Open by default (navflow up).
• Per-source API keys: creating a push source on a secured instance mints an ingest-scoped API key for it (shown once). The Security page groups Access, API keys, and the Anthropic key.

Changed

• Ingest is gated by auth like every route. Producers authenticate with scoped ingest API keys (Authorization: Bearer <key>), not a shared token.

Removed

• NAVFLOW_INGEST_TOKEN and NAVFLOW_READONLY: folded into the one auth switch + scoped API keys.
• GITHUB_TOKEN and NAVFLOW_VERCEL_VERIFY env vars: GitHub tokens come from the source’s token config; Vercel drain verification echoes Vercel’s own probe header.
• NAVFLOW_ANTHROPIC_KEY: use ANTHROPIC_API_KEY (or the console-stored key).

0.1.36: 2026-07-23

Added

• alertmanager connector: a push receiver for Alertmanager. Point a webhook_configs.url at the source’s ingest endpoint; each routed alert becomes an event (keyed by a label, firing / resolved). The source page shows a copy-paste alertmanager.yml receiver block.

0.1.35: 2026-07-23

Added

• prometheus_alerts connector: polls Prometheus’s own /api/v1/alerts and emits one event per active alert (keyed by a label), plus a resolved event when it clears. Discover lists the configured rules with an optional severity filter.
• reference connector: documents (json / csv / md / txt) attached to an entity by their labels, always surfaced when correlating on that entity regardless of the read window.

Removed

• alerts and static connectors: superseded by prometheus_alerts / alertmanager and reference respectively.

0.1.34: 2026-07-22

Changed

• Prometheus: pick the metrics, no PromQL. Discover now lists the server’s metrics and labels; you pick what to ingest (by name or by label) and Tares writes the query. The metric value is stored as a number-typed value label, so triggers can aggregate it. Added bearer / basic auth.

0.1.32-0.1.33, 2026-07-22

Changed

• Postgres: the connection URL (dsn) is a required per-source config field, stored as a secret; the driver ships in the base package (no [postgres] extra); you can select which columns to pull. Dropped key_column (the key is a primary label) and cursor_type (inferred from the value).

0.1.4: 2026-07-03

Removed

• changelog and config connectors: dummy, demo-only connectors that had outlived their use. Also drops the demo api-server’s unused /admin/changelog and /admin/config endpoints and renames its fault switch /admin/inject → /demo/inject.

0.1.3: 2026-07-03

Added

• include_payload on read/query: opt-in flag that returns the full lossless stored record as raw on each row, alongside the summary text. Exposed over HTTP and the MCP read/query tools; covers all connectors.

Fixed

• Claude Code plugin install: publish a root marketplace.json (/plugin marketplace add glassflow/navflow) and fix plugin.json load errors on Claude Code 2.1 (duplicate hooks ref, missing ingest_token default, navflow_url required flag hiding its default).
• Double-ingest for claude_code: the first pushed event flips a poll-mode source to push mode, so a source fed by the plugin no longer also tails files and ingests every event twice.

0.1.2: 2026-07-02

Added

• navflow --version.

0.1.1: 2026-07-02

First public (soft-launch) release.

Added

• read(selector, window) primitive: a correlated, time-ordered read across all sources matching a strict-AND conjunction of label=value constraints, with no view required. Exposed over HTTP (POST /read) and MCP (the read tool). Views become an optional narrowing lens; triggers still attach to a view.
• Console redesign: a selector-first Explore (pick an entity, add filters, read across every source, with a human/agent view toggle), a ⌘K Ask command palette, a three-act navigation, and separate Views / Triggers pages.
• Agents → Reads: a client filter (defaults to mcp) over the read activity log.

Changed

• Package and CLI distribution renamed from navflow-mvp to navflow.