Release Notes¶

The full history, including the subsystem evolution matrix, is in CHANGELOG.md at the repository root.

v1.2.0 (October 2026)¶

Codaris v1.2.0 introduces the module-first unit gate, the automated Pipeline Sanitizer Agent, cryptographic provenance sealing, the Conversational Bleed Guard, security isolation for backend secrets and containers, compiler support for Slurm/Singularity execution profiles, automated turn token budgeting, performance optimizations for long Studio sessions, and updated versioned stores 1.2.0.

Pipeline Sanitizer Agent & Provenance Sealing¶

• Automated Pipeline Hygiene (codaris sanitize): Scans and remediates six critical dimensions across pipeline directories: path neutralization (host paths to ${projectDir}), credential protection (tokens to secrets.X / System.getenv), debug directive excision (.view(), .println(), debug = true), orphan local module and script pruning, execution debris purging (work/, .nextflow/), and .gitignore policy enforcement.
• Autopilot Post-Run Sanitization Hook: Autopilot runs sanitize_and_seal automatically following a successful test run, cleaning temporary artifacts and writing an immutable SHA-256 manifest at .codaris/provenance.json.
• Command-Line & Studio Integration: Added universal CLI codaris sanitize <pipeline_dir> [--dry-run] [--purge-debris] [--strip-debug] [--seal] [--json] and integrated visual diff reporting in Web Studio.

Conversational Bleed Guard & Code Hygiene¶

• Zero-Tolerance Residue Linter (scripts/lint_conversational_bleed.py): Detects and eliminates chat conversational markers, developer attributions, and AI generator watermarks across Python and TypeScript codebases.
• CI & Landing Gate Enforcement: Added as an automated gate in .github/workflows/structure.yml and scripts/test_gate.sh.
• Core Engine Cleaning: Sanitized conversational residue across engine docstrings, prompt caches, and command gates.

Module-First Build & Unit Gate¶

• Deterministic Unit Testing: Every local module generated by the compiler or model receives a guaranteed stub: block and an automated nf-test with both stub and synthetic test suites.
• Fail-Fast Verification: Modules are validated at generation time (.codaris/unit_checks.json), catching parameter and channel errors before full workflow assembly.

Security Hardening¶

• Secret Isolation: Child processes launched by the agent (run_command, Nextflow runs, toolchain execution) execute in a scrubbed environment with sensitive tokens (TOWER_ACCESS_TOKEN, WAVE_API_TOKEN, PERPLEXITY_API_KEY, etc.) completely eliminated from process tables and child shells.
• Recipe & Wave Validation: Container builds via Seqera Wave undergo cryptographic recipe validation, character-set sanitization, and quota-aware execution guards.

Studio & UI Experience¶

• Smart Tools Drawer & Quick Presets: Categorized the composer tools drawer into Pipeline Knowledge & Containers, Web & Literature Discovery, and Ad-Hoc Chat Diagnostics. Clarified ad-hoc conversational diagnostics vs. compiler automation, illuminated the offline nf-core module index (corpus_lookup), and added 1-click presets (⚡ Lean Pipeline, 🔬 Literature & Data, 🛠️ Chat Diagnostics, All, None).
• Studio Performance: Long chat transcripts utilize windowed rendering and memoized message components for smooth UI responsiveness.

Compiler & Architecture¶

• HPC Profiles: First-class support for Slurm executors, Singularity/Apptainer containers, and scale-aware resource allocations derived from question cards.
• Context & Cost Controls: Added configurable per-round call caps, input token budgets, and stall detection (CODARIS_MAX_CALLS_PER_ROUND, CODARIS_TURN_TOKEN_BUDGET, CODARIS_STALL_ROUNDS).
• Stores 1.2.0: Updated process contracts for 2,114 nf-core modules and 125 subworkflows with refreshed container digests.

v1.1.0 (October 2026)¶

Production-readiness stress-test fixes and core platform stabilization across 22 merged pull requests.

Key Highlights¶

• Autopilot Engine: Autonomous build-run-fix loop with loop guards and progress detection.
• Interactive Pipeline DAG: Live Nextflow-native workflow visualization with syntax validation.
• Resilient Chat Sessions: Session event log replay across browser reconnects and server restarts.
• Cost Transparency: Live turn cost tracking, token metrics, and route-level prompt caching.

v1.0.0 (October 2026)¶

This is the first public release of Codaris. It builds on the v5.0.0 and v5.0.1 preview images, and this section covers what changed since v5.0.1.

This release brings planning that reads your workspace before it asks, chat turns that survive a reload, and run gates that stop a wasted run before it starts.

Planning and setup¶

• Codaris reads the workspace before it asks anything. The samplesheet, the reads, the references, the installed toolchain, the nf-core catalog, and the module corpus are probed within three seconds, and the plan lists what was detected, with its source, and what was defaulted, with the reason. Questions remain only for what is left.
• When an nf-core pipeline already covers the request, the first question offers to build, extend, or use it.
• The plan's assumptions list each fact once, with its source, so the ones worth correcting stand out.
• A Yes that needs a path, such as a reference you already have, opens a field for the path in the Setup tab and in the chat card.
• When the folder has no pipeline yet, Codaris says so and builds a new one without looking for files that are not there. When it has one, the plan says what it is and works on it in place.
• nf-pilot answers the QC tool, samplesheet layout, and subworkflow packaging questions when its confidence clears 0.8 (CODARIS_NF_PILOT_THRESHOLD). A fitting nf-core subworkflow is always kept, with nf-pilot's suggestion shown beside it. The Setup tab groups answers as Detected, Inferred by nf-pilot, Defaulted, and Answered by you, and every answer can be changed.

Chat and studio¶

• A turn keeps running when the page reloads or the connection drops; the page rejoins it and replays the reply from the server. Stop and Escape end a turn, including a command the turn is running.
• A long, quiet step no longer leaves the page waiting: the stream stays open through the studio's proxy, and the page rejoins a turn whose connection drops.
• The activity line names the step under way and the elapsed time.
• Command-K opens a command palette, Command-J starts a chat, Command-Enter sends, and / focuses the composer.
• Files dropped onto the composer are saved in the chat's folder, and the message names where.
• The companion panel brings Setup forward when a build is waiting on answers.
• The status cluster shows the first-token and answer-to-plan times of the last turn, and the cost estimate prices uncached input, cache writes, cache reads, and output separately for each model.

Tools and runs¶

• There is no tool-round cap by default. A turn runs until the work is done, and a loop guard ends one that is going nowhere: the same call with exactly the same answer three times since anything changed, the same answer six rounds running, or a run status unchanged for twenty minutes (or polled six times in two minutes) stops the turn, the chat says "Codaris stopped a loop" and what it stopped, and one click continues. The Customizations page can still set a round ceiling, which ends every turn after that many rounds with the same control. Editing and re-running a pipeline after a build is allowed; a repair that repeats without progress is what the guard stops. A model that keeps calling tools after being stopped gets one more round, then the turn ends without another model call and says why.
• Nextflow and nf-core commands are completed before they run, using the installed CLI's own help: nf-core pipelines subcommands, a container engine on a test profile, --outdir when the schema requires it, and -cache false on gate runs so a later -resume finds real cache entries.
• A test-dataset question accepts row labels, run accessions, a run count, or "you choose". Codaris takes the ticked rows, spreads a run cap across samples, downloads only the kept runs, and names the runs it chose on the plan card.
• A run whose references cannot work stops before it builds an index: a missing file, reads simulated from another reference, or references from two organisms.
• conf/codaris_resources.config caps process resources at what the machine actually has.
• Deleting files inside a pipeline folder asks for permission, an identical call that already succeeded is refused, and a task in its review phase makes a change when asked.

Compiler¶

• Built indices reach their consumer as the full input tuple, samplesheet pairing writes valid branch labels, and MultiQC is called once.
• Regenerating modules.config keeps hand-tuned withName blocks.

Engine access¶

• The command line gains codaris validate <dir> and codaris corpus <query>, and the MCP server offers five engine tools to agents working in other harnesses.

Settings¶

• The Perplexity connection test uses the /v1/models route. In a checkout, settings saved from the studio stay in step with backend/.env; inside a container, settings.json on the mounted state directory is the persistent store, and the page says so.

Source and contributions¶

• The source is public at https://github.com/PrimeOmicX/codaris under the AGPL-3.0 license.
• Bugs, feature requests, and documentation fixes go through the issue templates, and changes reach main through pull requests that pass CI, as CONTRIBUTING.md describes.
• Vulnerabilities are reported privately through the repository's security advisories (SECURITY.md).
• The image is published as ghcr.io/primeomicx/codaris. The v5.0.0 and v5.0.1 preview images under ghcr.io/arunbodd/codaris are retired; pull ghcr.io/primeomicx/codaris:v1.0.0 or :latest instead.
• The versioned stores download without a token.

v5.0.1 (October 2026, preview)¶

A correction release for the v5.0.0 image, the quickstarts, and the build gate.

Image and deployment¶

• The image is built in CI for linux/amd64 and linux/arm64 under every tag; the v5.0.0 tag on GHCR carried only the architecture of the machine it was pushed from.
• The image, the banner, the OCI labels, and GET /health carry the release version from the CODARIS_VERSION build argument.
• The state directory is resolved once (app/paths.py): CODARIS_HOME, else ~/.codaris. The entrypoint prints the resolved path and a hint when HOME was left at /root; the documented docker run passes HOME through.
• docker/docker-compose.unified.yml starts on a clean clone (backend/.env is optional), pulls latest by default, and documents every variable it reads.
• The studio calls the API on its own origin: the Next.js server proxies /api and /health to the backend, NEXT_PUBLIC_API_URL defaults to empty, and CODARIS_CORS_ORIGINS adds browser origins for split deployments.
• CI runs the backend suite, the frontend typecheck and tests, and a secret scan on every push and pull request.

Build gate¶

• The compile gate is positive: after a clean nextflow -preview, the build confirms that main.nf includes and calls the pipeline workflow, that the workflow calls at least one process, and that no planned module is included without being called. Planned modules the compiler left out are listed in the report next to the compile verdict.
• The validator counts an inline builder call (STAR_GENOMEGENERATE(...) inside a ternary) as a call, so a missing include is reported before the preview.
• The fix node adds a missing include deterministically when the error names the symbol, and refuses a proposal that empties a file or keeps less than 40% of it.
• .codaris/provenance.json is recomputed after the last write, covers workflows/, subworkflows/, conf/, and the schema as well as modules/, states its method and scope, and can be verified with python -m app.engine.security_scanner verify <pipeline>.

Models and errors¶

• An env or settings override that names a model whose provider has no key is skipped with a warning; the Customizations page shows the model each role resolves to and why a saved value is not in effect.
• A chat turn that names such a model is served by the configured default and says so in the transcript, naming the key the requested model needs.
• A failed turn produces one structured error with a headline, a sentence to act on, and the exception and site under a Details fold; the same block is saved with the reply. Credential, quota, unreachable-model, and step-limit failures each have their own code.
• /health reports the decision model's measured latency and the number of samples behind it.

Studio¶

• New chat opens the new session (the session list is updated before the route changes).
• Streamed paragraphs that arrive as separate messages are separated by a blank line; a turn that ends on a tool result without a written reply closes with that result.
• The artifact wrapper around a plan is kept for the renderer rather than escaped into the transcript.
• Question-card tabs show a header derived from the question text instead of the raw key; search_reference_assets ranks by the specific terms in the query; a URL named as a local reference is treated as a remote source; a boolean parameter no longer asks for a file.
• The in-app docs and the Customizations page use the current model names, the 249-rule count, and the activity names without a mode toggle.

Documentation¶

• The docs site is rewritten from the application as it is: the CLI verbs that exist, the environment variables the code reads, the real rule ids and tiers, Nextflow 25.10.4 and Java 17, nf-core profiles rather than generated executor configs, and compliance scoring described as nf-core conformance rather than certification.

v5.0.0 (October 2026, preview)¶

• Unified image. The web studio, the API, and the toolchain (Nextflow, nf-core, nf-test, Java, Python) in one container on GHCR.
• Decision model. Primeomicx/nf-pilot classifies turns, triages failures, and picks plan defaults locally.
• Compiler. workflows/<name>.nf, conf/modules.config, the test profile, and the sample sheet written by the compiler from installed module declarations; nextflow -preview as the compile gate; nf-core pipelines lint before the report.
• Staged plan questions. References, sample sheet, structure, defaults, and parameters, asked on question cards in the studio and on the terminal with codaris plan --interactive.
• Compliance ruleset 1.1.0. 249 rules from the nf-core specifications at tools 4.0.2 with the Strict-Syntax family; review and remediate from the CLI and the chat.
• Engine API. /api/engine/{doctor,lint,plan,build,test,jobs,roots} calls the same functions as the CLI.
• Headless CLI. doctor, stores, lint, review, remediate, plan, build, test, judge, nf-test, publish, bench, chat, and web, each with --json.
• Playbooks. Bulk RNA-seq, germline and somatic WGS, ChIP-seq, ATAC-seq, single-cell, metagenomics, and amplicon.

v2.0.1 (May 2026)¶

The last release of the CLI-only prototype, kept under the tags v2.0.1 and archive/v2-legacy-cli.