What's new

User-visible changes shipped to ghcr.io/neverbot/nottario:latest, newest first. Every push to master ships :latest; versioned tags are cut on demand.

2026-10-15

  • Documents can be moved and renamed. The Move button in the document view, and nottario.docs.move for agents, give a document a new path while keeping its whole history; architecture nodes linked to it follow the new path. Before, a rename meant writing a copy and deleting the original, which restarted the history. See Documents.

2026-10-14

  • See how much your agents spend on Nottario. Settings → MCP has a Usage section with calls, errors and bytes per tool and per token over the last days, so you can tell which agents and tools fill the most context. Counting starts with this release; data is kept 180 days.
  • Agents can load fewer tools. The MCP URL takes ?tools=tasks,docs,... to expose only those domains and ?shell=true to drop the document tools a client with a shell does not need. Without parameters nothing changes. See MCP.
  • Agents read documents through a file. nottario.docs.download_url returns a short-lived signed URL for a document, the read-side twin of docs.upload_url, so an agent with a shell no longer pulls whole bodies into its context.
  • Task responses name roles and people. MCP task results carry role: "backend" and assignee: "me" (or a GitHub login) instead of target_role_id and assignee_user_id, and nottario.tasks.get returns a slim shape unless verbose is set. Reinstall the skill (nottario.skill.install) so agents expect the new shape.

2026-10-12

  • Tasks have steps. A task can carry a short checklist of steps, each one line with a done mark, for actions too small to be subtasks. The task dialog lists them to tick, add (pasting several lines adds several), rename, reorder and delete, and the kanban card shows the progress, such as 2/8. Agents add and tick them with nottario.tasks.add_steps, update_step, remove_step and move_step, and nottario.tasks.get always returns them. A task can still be closed with steps undone: the close response lists them so the agent tells you what was left. See the kanban board.

2026-10-09

  • The task dialog shows how a task relates to the others. Next to "Depends on" it now lists the feature the task is part of, its subtasks with how many are done, and the tasks it blocks. Agents get the same through nottario.tasks.get, which always returns them under related; its include_deps flag is gone.

2026-10-01

  • Agents set task priorities by name only. nottario.tasks.create and nottario.tasks.update no longer take a numeric priority; they take priority_key, one of the priorities defined in the project settings, and an unknown key is rejected with the list of valid ones. Tasks filed by agents no longer show up as p70 between the named priorities. Existing tasks keep their value.

2026-09-27

  • Agents learn on their own when their skills are out of date. When an agent connects, the MCP server's instructions now name the current skill bundle version and tell it how to compare that with the SHA256SUMS it has installed; nottario.whoami returns the same value as skill_bundle_version. An agent with an outdated bundle reinstalls it and asks the human to restart the client, without anyone having to remember to tell it. Overrides edited by an admin are picked up within 30 seconds. See skills.

2026-09-24

  • Project URLs with the slug work everywhere. Only GET /api/projects/{id} accepted a slug; every other project route demanded a uuid, so reaching a project as /projects/<slug>/board showed an empty board with no error, even with work in the cycle. The project segment is now resolved before anything else runs, so readable links work throughout, including the ones the app builds itself.

2026-09-22

  • A commit linked to the wrong task can be unlinked from the web. Hovering a row in a task's Commits panel reveals an Unlink control, which asks before removing: the link is an audit trail and the web has no way to put one back. Agents cannot unlink over MCP, on purpose.

2026-09-20

  • The projects list now counts what the Kanban shows. A project card left feature parents out of its counts, so it could read "3 todo" next to a board showing six cards. Features are cards on the board, and now they count on the card too. Closed work still adds up across every cycle, as the project's running total.

2026-09-20

  • Backups are no longer readable by every account on the host. Dump files are written 0600 and the backup directory 0700, tightened on startup for directories created by earlier versions. Only UID 65532 and root can read a dump now, so a backup agent that used to read them as some other account needs to run as that uid or as root. The database password now reaches pg_dump through the environment instead of its command line, where ps could read it; .tmp files left behind by a restart mid-dump are cleaned up after a day; and the container's group id is pinned to 65532 next to its user id, so files in mounted volumes keep the same ownership across image rebuilds. See self-hosting.

2026-09-17

  • No task reaches doing or done without an owner. Moving a task out of todo now assigns it to whoever moved it when it has no assignee, through MCP or the web, so agents that skipped the claim step stop leaving ownerless rows behind. An existing assignee is never replaced, and sending a task back to todo clears the owner as before. nottario.tasks.create also takes claim: true, which creates a task already assigned to the caller and in doing — the one-call form of "I am filing the work I am about to start". Note for humans: dragging an unassigned card in the Kanban now makes it yours. See the MCP server.

  • Skill bundle versions can be checked from disk. The bundle zip now ships a SHA256SUMS file, and bundle_version from nottario.skill.install is the SHA-256 of that file, not of the zip. An agent hashes SHA256SUMS in its installed directory and skips the download when it matches; sha256sum -c SHA256SUMS verifies every installed file. Bundles installed before this change have no SHA256SUMS and will be reinstalled once. See skills.

  • Documents are stored exactly as written. A document's frontmatter now stays in the document: docs.read, version history, skill overrides and the upload flow all return the same bytes that were written, and docs.stat's content_sha256 is the plain SHA-256 of the file, so it matches sha256sum of a local copy without stripping anything first. Title, description and kind are still read from the frontmatter; search and the web view skip it. Existing documents are migrated on startup: their frontmatter is rebuilt from what was stored, so its formatting may differ from the original file until the document is written again. See shared documents.

2026-09-15

  • Upload whole documents without handing agents a token. New MCP tool nottario.docs.upload_url returns a signed URL, valid for five minutes, that accepts a single PUT of one specific file (matched by SHA-256) on top of one specific version. The document goes straight from disk to the server instead of through the agent's context, and a replayed, altered or expired URL is refused, as is any URL whose requesting token has since been revoked. The skill bundle now tells agents never to look for, print or reuse their MCP token against the HTTP API; if an agent of yours scripted uploads that way, switch it to this tool. See shared documents.

  • API tokens can no longer modify global documents — not even an admin's. Writes, appends and deletes with scope=global now require an admin signed in to the web app; through MCP or REST with a token they are refused. Global documents include the skill overrides (global/skills/*) that every project's agents install, so a token scoped to one project could previously rewrite agent instructions on all of them. Reading global documents with a token is unchanged. If an agent of yours maintained overrides, move that step to a human. See skills.

  • Request bodies are capped at 8 MiB. A larger declared body is refused with 413 before it is read; a body without a declared length is cut off at the same point. Previously any authenticated caller could send an unbounded payload, and document writes stored it twice.

2026-09-09

  • Two new MCP tools make document sync cheap. nottario.docs.stat fingerprints a document — current_version, size and a SHA-256 of the body — so an agent can tell whether a write is needed without pulling the document to compare it. nottario.docs.append adds markdown to the end of an existing document under the same expected_version guard, so a changelog entry costs the entry rather than the whole file. Neither changes existing behaviour; both are additions.

  • docs.write no longer echoes the document back. The MCP tool now answers with a slim {path, current_version, updated_at} ack instead of the whole stored document, matching the slim-by-default shape every other high-frequency tool adopted. An agent syncing a large file used to pay for its body three times over — reading it, sending it, and receiving it back; that last third is gone. current_version is still returned, since the next write needs it.

2026-09-07

  • Task priorities are validated and the colour dot follows your buckets. A raw priority outside 0–100 (the range a priority bucket may itself occupy) is now rejected by task creation and update, through both the API and MCP; previously any integer reached the database unchecked. Values that sit between buckets stay legal on purpose, and still render as p70 rather than a bucket name. The coloured dot on a kanban card is now ranked against the project's own catalogue instead of fixed cutoffs, so a retuned set of buckets no longer paints every card the same colour.

2026-08-20

  • The frontend is now served compressed. Static assets and the app shell are gzipped once at startup and served precompressed to any browser that accepts them, cutting the transfer by about 70% (the architecture page's layout engine alone drops from 1.6 MB to 472 KB). Clients that do not advertise gzip still get uncompressed bytes, and Vary: Accept-Encoding keeps shared caches honest.

  • Pages reload without re-downloading the frontend. Static assets now carry an ETag, so a browser that already has them revalidates with an empty 304 instead of fetching everything again — around 3.2 MB per reload on a typical page. Freshness is unchanged: a rebuilt asset still arrives in full. The ?v= cache-busting query on the entry scripts is gone, since the ETag covers every file rather than just those two.

  • The documentation site is now agent-readable. A curated llms.txt index lives at the site root, and every page is also served as plain Markdown at the same URL with the extension swapped for .md (for example /getting-started.md), following the llms.txt proposal. make docs-check fails if a page is missing from the index, so the two cannot drift apart.

2026-08-03

  • Agent skill bundle now tells agents to list their own doing tasks and surface them before previewing new work when the human asks "what's next", so unfinished pickup from a previous session isn't silently skipped.

2026-07-07

  • Deleting a role no longer kicks its holders out of the project. Membership and role assignment are now separate tables; the members panel gains a "No roles yet" state and a dedicated "remove from project" action, so replacing the role catalogue is a safe editorial operation instead of a data-loss trap.

2026-07-05

  • Per-user notifications system. Every user now sees a bell in the topbar with an unread indicator, a drawer listing task events that concern them (someone assigned them a task, someone commented on a task they're assigned to or created, a task they're assigned to or created was closed), and a preferences block under /me to opt out per kind. Self-hosters can turn the whole system off with NOTIFICATIONS_ENABLED=false.
  • Self-hosted admins now see an "update available" banner when a newer commit lands on upstream master. The check runs in-process every 24 hours (configurable via SELF_UPDATE_CHECK_INTERVAL); disable with SELF_UPDATE_CHECK_ENABLED=false. See the update notifications reference.

2026-06-20

  • BREAKING — skill bundle install collapsed into one tool. nottario.skill.list and nottario.skill.read are gone. The new nottario.skill.install returns a small JSON descriptor with a short-lived signed URL for the bundle as a single zip, plus an install plan and a bundle_version hash. The bundle content no longer flows through the MCP response — the agent fetches the URL out of band with any HTTP tool, unzips into <workspace>/.claude/skills/nottario/ (or ~/.claude/skills/... as fallback), and restarts the client. A typical first sync drops from ~20-30k tokens to ~200.
  • New nottario.tasks.close MCP tool. Atomic close that bundles link_commit + add_comment + set_state into one transaction. On precondition failure the whole thing rolls back. Slim ack {task, comment_id?, linked_commit_count}; verbose: true for the full Task. Skill bundle now teaches tasks.close as the canonical close and explicitly forbids "starting work" / "claimed" pickup comments.
  • Arch and search MCP responses slimmed. arch.list_nodes / list_edges return slim rows; arch.get_node opts in to children/edges/links via include_*; upsert_* and move_node return slim acks. search drops the raw description (snippet only), default limit 50→20. All accept verbose: true.
  • docs.read { head_only: true }. Returns frontmatter + 400-char preview with truncated / body_length markers.
  • tasks.list defaults to open tasks only. Pass include_closed: true or an explicit state to see done/wont_do.

2026-06-19

  • MCP responses are slim by default. High-frequency task mutations return only the keys needed to chain the next call; no description or comment body echoed. tasks.get omits deps, commits and comments unless include_* is set. verbose: true opts back in. A typical "claim → comment → done" loop drops from ~5 KB to ~600 B. New "Token discipline" section in the skill bundle.
  • Edit task title, description and comments from the UI. Quiet Edit button reveals a GitHub-style Write/Preview markdown editor (Ctrl/Cmd+Enter, Esc). Members edit text; admins edit role. Per comment Edit/Delete for author or admin. Edited marker; optimistic concurrency rejects stale writes.

2026-06-15

  • Skill bundle: git methodology. New methodology/git.md covers solo / parallel-agent / multi-dev workflows.
  • Closing comment is now required before done / wont_do. Bugs get a terse Repro / Fix / Test triplet; documented in domains/tasks.md.

2026-06-14

  • Architecture diagram is now versioned. Edits open a per-author session; the idle window (default 120s) auto-flushes one arch_revisions row with the full graph snapshot. New MCP tool nottario.arch.checkpoint { message? } flushes immediately. New env vars NOTTARIO_ARCH_LOCK_IDLE_SECONDS and NOTTARIO_ARCH_TICK_SECONDS. Different-author writes during an active session return 423 Locked with retry_after_seconds. New REST endpoints /arch/history and /arch/revisions/{version}.

2026-06-12

  • Brand-anchored palette + Gantt visual refresh. Single CSS-token system rooted in the brand gradient (#1f6feb, #2da44e); docs at docs/design/palette.md. Gantt: NOW pill with glow column, past-zone wash, hairline lane separators, role-tinted bars, corner red dot for bugs, collapsed legend.

2026-06-10

  • Kanban: filter row, priority dots, column rename. Filter chips for Mine / Role / Type, mirrored to the URL hash. Priority shows as a coloured dot. Columns renamed to To do / In progress / Done. Drag across columns shows an Undo toast (6s). In-app delete confirm. feature type is gated behind Advanced.
  • Realtime: comment events propagate live. task.comment.* refreshes the open detail dialog without reload.
  • Search dropdown: keyboard nav, grouping, error state. Results grouped by source with headers. Top hit auto-selected; ↑/↓/Enter/ Esc work. Network failures surface a Retry row instead of a silent "No matches". / hint in the empty input. Meta lines drop the internal column prefixes.

v0.1.0 — 2026-06-08

First public release, published as ghcr.io/neverbot/nottario:0.1.0 (linux/amd64).

  • Tasks. Atomic claim (SELECT … FOR UPDATE SKIP LOCKED), dependency cycles caught with a project-scoped advisory lock, cascading rollup on feature parents. Cycles ("sprints") with rollover. Kanban and hand-rolled-SVG Gantt views.
  • Documents. Versioned markdown store with optimistic concurrency. Full history per path.
  • Architecture. Compound-layout diagram backed by ELK, rendered with our own SVG.
  • Identity. GitHub OAuth for humans; per-project API tokens for agents. Admin tokens are not exempt from project scope.
  • MCP server. Streamable HTTP, Bearer auth. Tools cover whoami / projects / tasks / docs / arch / cycles / search / skill.
  • Skill bundle. Operating rules read on demand via MCP or pre-installed in Claude Code.
  • Search. Full-text across tasks, documents and arch nodes, multi-language.
  • Realtime. SSE + Postgres LISTEN/NOTIFY. No WebSockets.
  • Backups. Optional in-process pg_dump, daily with N-day rotation. Off when NOTTARIO_BACKUP_DIR is unset.
  • Licence. MIT.

See Self-hosting reference and Getting started.