release(v1.11.0): pi 1.1.0, pi-obsmem 022da5e, pi-atelier v0.15.0, all floating refs at newest

- ARG PI_VERSION 1.0.0 -> 1.1.0. Audited against the npm tarballs: the only
  breaking change in 1.0.1..1.1.0 is 1.0.3's azure-openai-responses -> azure
  rename, which nothing here uses. pi-agent-core's finishTurn handling is
  byte-identical between 1.0.0 and 1.1.0.
- ARG PI_OBSMEM_REF 731c3d4 -> 022da5e (= master): #81 compaction keeps
  unobserved context, #93 prebuilt dist/index.ts. src/agents/ unchanged.
- ARG PI_ATELIER_REF/VERSION v0.13.0 -> v0.15.0. Sidebar Auto/Manual modes,
  Manual by default. README's sidebar section updated.
- SKILLSET_SNAPSHOT_REF e9e45f7 -> 96b840e via vendor-mempalace-skill.sh.
  The vendored bytes are unchanged.
- Dockerfile.base BASE_REBUILD_DATE marker refreshed, at no cost, because the
  base rebuilds anyway (rootfs + entrypoint-user.sh changed in 11e512e).
- CHANGELOG: Unreleased -> v1.11.0 with the audit. The CI bypass of the obsmem
  pin is recorded under Still open.

Exercised before tagging, with pi 1.1.0 from a temp prefix in a real pty
against -ne controls:
- obsmem turn cap: 11 turns uncapped, exactly 3 capped.
- atelier v0.15.0 paints in both renderers (controls 0/3, render-proofed).
- obsmem 022da5e registers /om:status and /om:view.
- All 11 pi-extensions a88fa99 extensions load.

Local gates: check-doc-drift (rc 0, check 9 names every moved component),
lint-shell, check-workflow-shell, test-link-pi-models (13/13),
check-dockerfile-directives, check-skill-floor, check-base-hash.

CHANGELOG.md

@@ -11,15 +11,27 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## Unreleased
+## v1.11.0 — 2026-10-12
 
-### Components that move with the next build
+Minor release. Headlines: **pi 1.1.0**, **secret env values are kept out of
+model context by default** (pi-extensions `secret-guard`), an opt-in **AWS SSO
+keeper** for long Bedrock runs, and **`~/.pi/agent/models.json` linked to a
+mounted shared file** at every start. Everything else moves to its newest
+upstream: pi-observational-memory `022da5e`, pi-atelier `v0.15.0`, pi-studio
+`v0.9.63`. The base image is rebuilt (rootfs and `entrypoint-user.sh` changed),
+so the base tools pinned to `latest` re-resolve too.
 
-| Component | Baked in v1.10.2 | Next build | Why |
+### Components that move with this release
+
+| Component | Baked in v1.10.2 | v1.11.0 | Why |
 |---|---|---|---|
+| **pi** | `1.0.0` | **`1.1.0`** | audited, see *Changed* below |
+| pi-obsmem | `731c3d4` | **`022da5e`** (pinned SHA, = `master`) | #81: compaction never drops unobserved context; #93: pi loads a prebuilt `dist/index.ts` (see *Changed*) |
+| pi-atelier | `v0.13.0` (`34d26f1`) | **`v0.15.0`** (`3befe02`) | v0.14.0 Auto/Manual sidebar modes with auto-collapse; v0.15.0 starts in Manual, recolours panels, simpler Activity rows |
+| skillset snapshot | `e9e45f7` | **`96b840e`** | provenance only: the vendored `SKILL.md` is byte-identical (sha256 `a1db86da…` at both refs) |
 | pi-extensions | `143a214` | **`a88fa99`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` (keeps the Bedrock SSO session alive) and `secret-guard.ts` (keeps secret env values out of model context); both below |
 | pi-toolkit | `9c87ee8` | **`3760d90`** (or later: CI resolves `main` at build time) | `pi-task`: optional model fallback when the primary model fails auth before acting (below) |
-| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only; **not reviewed yet**: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) |
+| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only. Reviewed: browser-editor fixes only (WebKit cursor drift after re-wrap, re-layout after macOS autocorrect) plus `Ctrl+Shift+H` to toggle highlighting; peerDependencies unchanged: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) |
 
 ### Added
 
@@ -135,6 +147,51 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   providers"). Use
   `docker exec -it -u developer -e PI_AWS_SSO_NTFY=… pi-devbox bash -lc pi`.
 
+### Changed
+
+- **pi `1.0.0` → `1.1.0`.** Audited 2026-10-12 against the published npm
+  tarballs, by the same method as the v1.10.2 audit (the full note is above
+  `ARG PI_VERSION` in `Dockerfile.variant`):
+  - The only `### Breaking Changes` section in 1.0.1..1.1.0 is 1.0.3's rename
+    of the `azure-openai-responses` provider to `azure`. Nothing here uses it.
+  - `finishTurn` handling in pi-agent-core is byte-identical between 1.0.0 and
+    1.1.0. The six named `pi.*` APIs our extensions call (`registerTool`,
+    `registerCommand`, `registerFlag`, `getFlag`, `sendMessage`,
+    `sendUserMessage`) appear in the same dist files in both versions, and so do
+    the TUI internals atelier hooks. `engines.node` is unchanged.
+  - User-visible: `Home`/`End` now always move the editor cursor (fullscreen
+    transcript top/bottom moved to `Ctrl+Home`/`Ctrl+End`). Terminals that
+    support OSC 7501 now see pi's working/blocked/done status; set
+    `PI_PROGRAM_STATUS=0` to turn that off.
+  - Exercised before tagging with pi 1.1.0 from a temp prefix, in a real pty,
+    with `--no-extensions` controls:
+    - The obsmem turn cap held on the real 1.1.0 agent loop: uncapped ran 11
+      turns, capped stopped at exactly 3.
+    - atelier v0.15.0 painted in both renderers (controls 0/3, every arm
+      render-proofed).
+    - obsmem `022da5e` registered `/om:status` and `/om:view`.
+    - All 11 pi-extensions `a88fa99` extensions loaded without error.
+- **pi-observational-memory `731c3d4` → `022da5e`**, still a full-SHA pin; no
+  tag newer than 3.1.4 exists.
+  - #81 changes compaction. Entries the observer has not reached yet are no
+    longer cut out of context, and memory workers yield to the session. New
+    settings (`compactionMaxRetainedTokens`, `consolidateWhenIdle`,
+    `piAutoCompactionEnabled`) all have defaults, so nothing needs setting.
+  - #93 makes pi load a committed `dist/index.ts` bundle instead of 32 TS
+    sources, which is faster to start.
+  - `src/agents/` is unchanged between the two SHAs, so the workers'
+    `finishTurn` migration is intact.
+- **pi-atelier `v0.13.0` → `v0.15.0`.** The sidebar now starts in **Manual**
+  mode. `/atelier sidebar auto` collapses it when the terminal is narrow and
+  reopens it when there is room. `showSidebarOnStartup` keeps its key and its
+  default. README's sidebar section describes both modes.
+- **Base rebuilt** (`base-<hash>` changes because `rootfs/` and
+  `entrypoint-user.sh` changed). The base tools pinned to `latest` re-resolve.
+  Upstream on 2026-10-12: uv 0.13.0 (its breaking change makes Python 3.15 the
+  default *download*; mempalace still installs with `uv tool install` on
+  Debian's python3.13, which uv prefers because it is already installed), nvim
+  0.12.6, fzf 0.74.5. `# BASE_REBUILD_DATE:` is updated while it is free.
+
 ### Still open
 
 - `remote` mode end to end (code → push → approve on the phone) is unit-tested and
@@ -148,6 +205,15 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
   a login then worked at once.
 - The real fix is administrative: the IdC admin can raise the session length (up to
   90 days), after which the keeper has almost nothing to do.
+- **The pi-obsmem pin does not bind CI builds.** `resolve-versions` in
+  `docker-publish.yml` still resolves `pi-observational-memory` from `master`
+  and passes it as `--build-arg PI_OBSMEM_REF`, which overrides the Dockerfile
+  default. This was verified on both sides with buildx: without the build-arg
+  the pin is baked, with it `master` is. The pin reached v1.9.5, v1.10.2 and
+  this release only because `master` equalled the pin at build time.
+  `check-doc-drift.sh` reads the ARG, so it would not notice a divergence. Fix
+  it by reading the pin from `Dockerfile.variant` in `resolve-versions`, the way
+  pi-atelier's tag already is.
 
 ---
 

Dockerfile.base

@@ -14,7 +14,7 @@
 # content-addressed over this file, so any byte change invalidates the
 # cache. Recommended cadence: once per release for security updates.
 #
-# BASE_REBUILD_DATE: 2026-09-22 (v1.9.4 — mempalace 3.9.0 -> 3.10.0 with ENV MEMPALACE_CONFIG_DIR pinning the layout, mempalace-toolkit 2167a1b explicit event_list order; previous marker 2026-09-19 / v1.9.3)
+# BASE_REBUILD_DATE: 2026-10-12 (v1.11.0 — rootfs gains link-pi-models.sh, entrypoint-user.sh links models.json; base tools re-resolve `latest` (upstream on 2026-10-12: uv 0.13.0, nvim 0.12.6, fzf 0.74.5); previous marker 2026-09-22 / v1.9.4)
 #
 # ── Lineage note ─────────────────────────────────────────────────────
 # Adapted from opencode-devbox/Dockerfile.base (commit before v1.16.2).

Dockerfile.variant

@@ -231,7 +231,34 @@ ARG USER_NAME=developer
 # is documented (README -> "Terminal UI mode"): `"tuiMode": "regular"` in
 # ~/.pi/agent/settings.json, `pi --tui-mode regular` for one session, or the
 # same key in a project's .pi/settings.json.
-ARG PI_VERSION=1.0.0
+#
+# v1.11.0: 1.0.0 -> 1.1.0. MEASURED 2026-10-12 against the published npm
+# tarballs for 1.0.0 and 1.1.0, unpacked side by side, by the same method as
+# the v1.10.2 audit above:
+#   1. ONE `### Breaking Changes` section in 1.0.1..1.1.0: 1.0.3 renamed the
+#      provider `azure-openai-responses` -> `azure`. 0 uses here: grepped
+#      rootfs/, ~/.pi/agent/settings.json, pi-toolkit's settings.example.json
+#      and the fleet's shared models.json. Everything else is additive or a fix
+#      (OSC 7501 program status, `+name`/`-name` in --tools, `durationMs` and
+#      `outputPad` in the tool render context, `aborted` on agent_settled).
+#      Two user-visible changes: Home/End always move the editor cursor
+#      (fullscreen transcript top/bottom moved to Ctrl+Home/Ctrl+End, 1.0.3),
+#      and OSC 7501 status reporting (PI_PROGRAM_STATUS=0 turns it off, 1.1.0).
+#   2. pi-agent-core 1.0.0 -> 1.1.0: the finishTurn context in dist is
+#      BYTE-IDENTICAL; the only agent-loop diff adds `durationMs`. The obsmem
+#      turn-cap probe drove the real 1.1.0 agentLoop: uncapped ran its chosen
+#      11 turns, maxTurns=3 stopped at exactly 3 + agent_end.
+#   3. The 6 named pi.* APIs (registerTool, registerCommand, registerFlag,
+#      getFlag, sendMessage, sendUserMessage) appear in the same number of dist
+#      files in 1.0.0 and 1.1.0. atelier's internals TuiMainScreen and
+#      renderLayoutFrame are both still in 1.1.0's dist.
+#   4. engines.node is still `>=22.19.0`; the image ships 24.x.
+# Exercised before tagging, from a temp prefix with pi 1.1.0 and a throwaway
+# PI_CODING_AGENT_DIR, in a real pty, with -ne controls: atelier v0.15.0 paints
+# ACTIVITY/READY/TOOLS in BOTH renderers (controls 0/3, every arm render-proofed);
+# obsmem 022da5e registers /om:status and /om:view (control: none); and all 11
+# pi-extensions a88fa99 extensions load with no error (control: no /aws-sso).
+ARG PI_VERSION=1.1.0
 ARG PI_TOOLKIT_REF=main
 ARG PI_EXTENSIONS_REF=main
 # Repo URLs default to the canonical gitea origin but are overridable so a
@@ -253,7 +280,18 @@ ARG PI_OBSMEM_REPO=https://github.com/elpapi42/pi-observational-memory.git
 # 40-char match (SHA40), so a short pin would fall through to its
 # branch-or-tag lookup, fail, and downgrade that component's drift check to a
 # silent SKIP — a pin that reads fine and is no longer verified.
-ARG PI_OBSMEM_REF=731c3d49288580f4d79cabdbfbc0d16b34db0f41
+# v1.11.0: 731c3d4 -> 022da5e (master, 2026-10-05; still no newer tag than
+# 3.1.4). Two commits: #81 never drops unobserved context at compaction
+# (new settings compactionMaxRetainedTokens, consolidateWhenIdle,
+# piAutoCompactionEnabled, all defaulted), and #93 makes pi load a prebuilt
+# dist/index.ts instead of 32 TS sources. The bundle is committed, so
+# `npm install --omit=dev` below needs no build step. src/agents/ is
+# UNCHANGED between the two SHAs, so the finishTurn migration is intact.
+# KNOWN GAP, not fixed here: docker-publish.yml's resolve-versions still
+# resolves obsmem from `master` and passes it as --build-arg, which overrides
+# this default (verified two-sided on buildx 2026-10-12). CI builds therefore
+# get the pin only while master == pin, as it is at this release.
+ARG PI_OBSMEM_REF=022da5e5554d04dfdc876ed7dac4a42c6b83dfd4
 # pi-atelier (TUI sidebar: ordered panels, split-pane, themes) is PINNED TO A
 # TAG, which CI resolves to that tag's commit SHA — same treatment as
 # pi-studio, for reproducibility plus cache-busting.
@@ -332,9 +370,18 @@ ARG PI_ATELIER_REPO=https://github.com/michaelmjhhhh/pi-atelier.git
 #   - Residual: v0.13.0 is SAME-DAY upstream (2026-10-02). Acceptance proves
 #     the sidebar PAINTS with the two-sided check from 0.84.4/0.85.1 that can
 #     tell "loaded" from "silently absent" — "no crash" is not the test.
-ARG PI_ATELIER_REF=v0.13.0
+#
+# v1.11.0: v0.13.0 -> v0.15.0 (v0.14.0 and v0.15.0 both 2026-10-03). The
+# peerDependencies floor is unchanged (pi >=0.84.0), atelier still has zero
+# runtime dependencies, and it still imports only the public package exports.
+# Behaviour changes: v0.14.0 auto-collapses the Sidebar when the terminal is
+# narrow (Auto/Manual modes). v0.15.0 starts in Manual mode, recolours the
+# panels and simplifies the Activity rows. The startup preference is still
+# `showSidebarOnStartup` (default true, src/config.ts:38). Painted in both
+# renderers on pi 1.1.0 before tagging (see the PI_VERSION note).
+ARG PI_ATELIER_REF=v0.15.0
 # Human-readable tag PI_ATELIER_REF was resolved from; recorded as a label.
-ARG PI_ATELIER_VERSION=v0.13.0
+ARG PI_ATELIER_VERSION=v0.15.0
 
 RUN set -e && \
     # git_fetch_ref: clone-equivalent helper that accepts EITHER a branch name
@@ -659,7 +706,7 @@ ARG MEMPALACE_TOOLKIT_REF=main
 # no ~67-minute base rebuild. (scripts/check-base-hash.sh scans only
 # Dockerfile.base, so no folding into the base hash is required — nor would
 # it be correct, since this ARG changes nothing about the base's contents.)
-ARG SKILLSET_SNAPSHOT_REF=e9e45f7acdde490c3b5d24ce5f508bff8785c2c7
+ARG SKILLSET_SNAPSHOT_REF=96b840ee43beca65a190772021a8ef370145cde1
 
 # Dockerfile.base sets description="pi-devbox — base image (variant-independent)"
 # and every variant INHERITS it, so both published images used to advertise

README.md

@@ -464,7 +464,10 @@ pin the order yourself.
 
 The sidebar auto-hides below 92 terminal columns and keeps the main pane at
 least 64 columns wide, so a narrow terminal degrades to the plain TUI rather
-than a squeezed one.
+than a squeezed one. That is **Manual** mode, the default since atelier v0.15.0.
+`/atelier sidebar auto` switches to **Auto** mode, which collapses the sidebar
+when space is tight (below 124 columns at the default width) and reopens it at
+132. Manual width adjustment is disabled in Auto mode.
 
 ## docker-compose.yml — basic shape
 
@@ -1195,7 +1198,7 @@ persisted volumes survived, and pi runtime wiring is intact:
 ```bash
 ./scripts/recreate-sanity-check.sh                              # auto-detects variant
 ./scripts/recreate-sanity-check.sh --expected-image-version 1.8.9  # assert the pi-devbox release tag
-./scripts/recreate-sanity-check.sh --expected-version 1.0.0          # assert the pi coding agent version
+./scripts/recreate-sanity-check.sh --expected-version 1.1.0          # assert the pi coding agent version
 ```
 
 Those are **two different versions**, and the flags are not interchangeable:
@@ -1234,9 +1237,9 @@ resolved to `latest` at build time:
 
 | Component | Pin | Where |
 |---|---|---|
-| pi | `1.0.0` | `ARG PI_VERSION` — `Dockerfile.variant` |
+| pi | `1.1.0` | `ARG PI_VERSION` — `Dockerfile.variant` |
-| pi-obsmem | `731c3d49288580f4d79cabdbfbc0d16b34db0f41` | `ARG PI_OBSMEM_REF` — `Dockerfile.variant` |
+| pi-obsmem | `022da5e5554d04dfdc876ed7dac4a42c6b83dfd4` | `ARG PI_OBSMEM_REF` — `Dockerfile.variant` |
-| pi-atelier | `v0.13.0` | `ARG PI_ATELIER_REF` — `Dockerfile.variant` |
+| pi-atelier | `v0.15.0` | `ARG PI_ATELIER_REF` — `Dockerfile.variant` |
 | mempalace | `3.10.0` | `ARG MEMPALACE_VERSION` — `Dockerfile.base` |
 
 The objective is **not** to freeze versions. Bumping is routine — usually one