Merge pull request #1776 from jaylfc/dev

release: promote dev to master (1.0.0-beta.39)

Author: jaylfc

.github/workflows/doc-gate.yml

@@ -35,3 +35,8 @@ jobs:
         env:
           BASE_REF: ${{ github.base_ref }}
         run: python scripts/check_doc_gate.py diff-gate --base "origin/$BASE_REF"
+
+      - name: Managed backend manifest lint
+        run: |
+          python -m pip install --quiet pyyaml
+          python scripts/check_manifests.py managed-lint

.gitignore

@@ -23,6 +23,7 @@ data/.setup_complete
 data/.auth_password
 data/.auth_sessions
 data/.auth_local_token
+data/mesh_credentials.json
 data/agents.json
 data/images/
 data/videos/

CHANGELOG.md

@@ -7,6 +7,20 @@ Versions follow semver beta: `1.0.0-beta.N`, bumped on each dev->master promotio
 
 ## [Unreleased]
 
+## [1.0.0-beta.39] - 2026-07-10
+
+### Added
+- Game Studio can now generate textures and sprites from a text prompt using a ComfyUI backend on a discrete-GPU worker, writing the image straight into the game's file set. On a host with no capable GPU the panel shows a clear "needs a GPU worker" state instead of failing (#1773).
+- taOSgo cluster-join now completes the network side: a controller joins the account mesh over the system tailscale against the Headscale server, and the per-host service tokens the join returns are persisted host-locally (owner-only) so publishing and passkey fetches keep working after a join (#1770, #1772).
+- Agents post to the coordination bus as themselves through an authenticated send proxy, so a message carries the agent's own identity and cannot be spoofed as another account (#1768).
+- The cluster advertises the models a node can serve from its backend manifest, and installing a backend now registers it as a managed, node-local service that can be started, stopped, and health-checked per node (#1756, #1758, #1760, #1762).
+- An approved external agent can be granted a least-privilege project-tasks scope to read and drive a single project's task board (claim, close, comment) with its own token, scoped so it can never reach another project (#1774).
+
+### Fixed
+- Backend and worker robustness: the model VRAM check reserves atomically before a load so two loads cannot race the same memory, a malformed backend manifest no longer crashes the worker, and the VRAM guard fails closed rather than open on a probe error (#1725, #1767).
+- The RK3588 (RKLLM) install path pins the rkllama server to the verified 1.3.0 reference and guards the fork patches, and a live rkllama port is treated as installed only when it is a managed service (#1755, #1764).
+- Fixed six agent-framework catalog manifests that referenced install scripts which did not exist at the repo root (#1694).
+
 ## [1.0.0-beta.38] - 2026-07-08
 
 ### Added

README.md

@@ -578,6 +578,20 @@ curl -fsSL https://raw.githubusercontent.com/jaylfc/taOS/master/scripts/install-
 
 See [docs/mirror-policy.md](docs/mirror-policy.md) for the mirror governance policy, what is mirrored, when it updates, how to verify integrity independently, and how to self-host the mirror for air-gapped deployments. The same policy will extend to RK3576, Raspberry Pi 4, Mac mini / Apple Silicon, and x86 classes as those verified install paths land.
 
+## Agent Framework Install Scripts
+
+Several agent frameworks ship with dedicated install scripts under `scripts/install-*.sh` that are invoked automatically by the catalog installer when deploying the corresponding framework:
+
+| Script | Framework | Build toolchain |
+|---|---|---|
+| `scripts/install-agent-zero.sh` | [Agent Zero](https://github.com/frdel/agent-zero) | Clones repo to `/opt/agent-zero` and installs with pip |
+| `scripts/install-deer-flow.sh` | [DeerFlow](https://github.com/bytedance/deer-flow) | Clones repo to `/opt/deer-flow` and provisions with `uv` (Python 3.12) |
+| `scripts/install-moltis.sh` | [Moltis](https://github.com/moltis-org/moltis) | Installs via `cargo install` from crates.io (or git tag) |
+| `scripts/install-openclaw.sh` | [OpenClaw](https://github.com/openclaw/openclaw) | Clones repo to `/opt/openclaw` and installs with pip |
+| `scripts/install-picoclaw.sh` | [PicoClaw](https://github.com/sipeed/picoclaw) | Clones repo to `/opt/picoclaw` and builds with `cmake` |
+
+Hermes Agent uses `install: {method: pip, package: hermes-agent}` in its catalog manifest (available on PyPI from Nous Research) and does not need a separate install script.
+
 ## TurboQuant KV cache compression
 
 **768K context window on a single RTX 3060 (12 GB).** taOS integrates Google's TurboQuant (ICLR 2026) KV cache quantization via TheTom/llama-cpp-turboquant. Unlike weight quantization, which compresses model files, TurboQuant compresses the per-request KV cache -- the per-token memory that scales with context length and is the actual bottleneck on consumer hardware.

app-catalog/agents/agent-zero/manifest.yaml

@@ -14,6 +14,10 @@ requires:
 install:
   method: script
   script: scripts/install-agent-zero.sh
+  note: |
+    Clones frdel/agent-zero into /opt/agent-zero and installs with pip.
+    No PyPI package — the `agent-zero` package on PyPI is an unrelated
+    voice-agent framework. Agent Zero is clone-and-run only.
 
 hardware_tiers:
   arm-npu-16gb: full

app-catalog/agents/deer-flow/manifest.yaml

@@ -14,12 +14,11 @@ requires:
 
 install:
   method: script
-  script: scripts/install.sh
+  script: scripts/install-deer-flow.sh
   note: |
     Clones bytedance/deer-flow into /opt/deer-flow and provisions the backend
-    with uv (Python 3.12). Writes a config.yaml pointing DeerFlow at the taOS
-    LiteLLM proxy and a systemd unit that serves the backend runs API on 8001.
-    The bridge adapter (deer_flow_adapter.py) lives in the taOS controller.
+    with uv (Python 3.12). The bridge adapter (deer_flow_adapter.py) lives in
+    the taOS controller.
 
 config_schema:
   - name: model

app-catalog/agents/hermes/manifest.yaml

@@ -13,12 +13,8 @@ requires:
   python: ">=3.10"
 
 install:
-  method: script
-  script: scripts/install.sh
-  note: |
-    Installs hermes-agent from PyPI inside the agent container.
-    Configures the Hermes → TAOS bridge adapter (hermes_adapter.py)
-    and a systemd unit that connects to TAOS channels via SSE.
+  method: pip
+  package: hermes-agent
 
 config_schema:
   - name: model

app-catalog/agents/openclaw/manifest.yaml

@@ -13,7 +13,11 @@ requires:
 
 install:
   method: script
-  script: scripts/install.sh
+  script: scripts/install-openclaw.sh
+  note: |
+    Clones openclaw/openclaw into /opt/openclaw and installs with pip.
+    No PyPI package — `openclaw` on PyPI resolves to an unrelated CMDOP
+    plugin. OpenClaw is clone-and-run only.
 
 config_schema:
   - name: model

app-catalog/services/rkllama/manifest.yaml

@@ -31,6 +31,13 @@ lifecycle:
   backend_type: rkllama
   default_url: http://localhost:7833
   auto_manage: true
+  # Managed as a systemd service (see scripts/install-rknpu.sh install_systemd_unit).
+  # taOS manages the unit per node: start/stop/restart default to `systemctl <verb> <unit>`.
+  unit: rkllama.service
+  scope: system
+  health:
+    url: "http://localhost:7833/api/tags"
+    expect: '"models"'
   keep_alive_minutes: 0
   start_cmd: "systemctl start rkllama"
   stop_cmd: "systemctl stop rkllama"