epic: Cortex v0.9.0 — stable local tool for coding agents

[huang195]

Goal

Ship Cortex v0.9.0 by 2026-09-30 as a tool our own team runs every day alongside their
coding agent. This is an internal release: the bar is stability and daily usability, not
market positioning.

Our current product priority is observability — token usage, cost, latency, and what the
agent actually sent. Cost reduction (tool-definition pruning) ships and stays supported, but
the release is judged on whether the numbers Cortex shows are correct, complete, and still
there tomorrow.

Exit bar

The release ships when all five hold:

1. Install works cold. curl | sh → abctl observe → claude succeeds from a clean
   machine on macOS arm64, macOS amd64, Linux amd64, Linux arm64. macOS is the primary
   workstation target — the others must work, but macOS is what most of the team runs.
2. Cortex is invisible to everything else. With the service running and the CA trusted,
   git, gh, ssh, curl and ordinary shell scripts behave exactly as they do without it.
3. The numbers are right and they persist. A full session shows correct token counts
   (input / cache-read / cache-write / output), cost, and latency; the data survives
   abctl service restart.
4. No known P0 bugs. authbridge-proxy: early flush of leading thinking block turns a slow tool call into a client stream-idle timeout #926 and TLS bridge auto-skip turns a CA trust error into 10-minute intermittent failures #912 are closed with regression tests.
5. A new user can self-serve. Someone who has not used Cortex before installs it on a stock
   macOS workstation following the docs alone — no tribal knowledge, nobody to ask — and can
   then say what Cortex is for, what the numbers mean, and why it is worth leaving running. The
   install is easy to follow, not merely possible. Documentation covers installing, using it
   day to day, interpreting the results, and the value the tool brings. Verified by at least one
   person outside the team who has not installed it before.

Non-goals

Tracked separately, deliberately out of this release:

• Runtime-extensible / no-PR plugin model (Plugin architecture: static linking forces bloat-vs-variant tradeoff — explore a runtime-extensible plugin model #721)
• Enterprise dashboard (feature: Enterprise dashboard for Rossoctl / Cortex #872)
• Identity, authz and platform work (Z5: per-subject credential resolution in static-inject (RFC 8693) #905, Add JTI-based revocation to token exchange cache #758, feat(authbridge): pluggable authz engines — OPA / AuthZen / Cedar #506, feat(pipeline): serial + parallel plugin execution with declared ordering #508, feat(aiac/phase-3): Knowledge-base-backed onboarding — searchable policy replaces the single document #647, feat(kagenti-operator): stamp protocol.kagenti.io/mcp on MCP tool Services at deploy time #658, Test: Verify Cortex authz capabilities end-to-end (at least OPA) #683, Feat: Add Praxis as a third supported proxy (alongside the Go proxy and Envoy proxy) #681, feature: Core Arbitration for Overlapping Plugin Responsibilities in Kagenti AuthBridge #398, feature: More metadata in created Keycloak client #341)
• Multi-user session correlation through Envoy/ext-proc (feature: Session tracking for multiple concurrent sessions #182) — a Kubernetes concern, not
  the laptop tool. Local session differentiation is feature: differentiate concurrent coding-agent sessions in abctl #949
• Kubernetes-mode feature work: the sidecar / SPIRE / Keycloak paths keep working, they are
  just not where the release effort goes

Release mechanics

Binaries jump from the v0.7.0-alpha.N series straight to v0.9.0 — there is no v0.8.0
binary. Every prior release was a GitHub pre-release; v0.9.0 is the first marked as a normal
release, which is also what makes install.sh pick it up by default.

• Confirm release-binaries.yaml publishes v0.9.0 as non-prerelease / latest
• Confirm install.sh with no --ref resolves to v0.9.0

Owners

Area	Owner
macOS install, proxy bugs, metrics backend, persistence, refactor	@huang195
Agent integrations, abctl / TUI, unattended workloads	@esnible
Session differentiation	@galmasi
Linux install, release smoke tests, reboot verification, CI	@Alan-Cha
Docs	@mrsabath

Release-blocking — P0 (27)

Agent support

• feature: agent integration contract — reusable detection, settings patching, and revert #939 Agent integration contract — reusable detection, settings patching, revert
• feature: Claude Code — verify and harden the reference integration for v0.9.0 #940 Claude Code — verify and harden the reference integration
• feature: OpenCode support — detection, settings, parsed events, token and cost accounting #941 OpenCode support
• feature: Bob support — detection, settings, parsed events, token and cost accounting #943 Bob support

Install & service lifecycle

• feature: verified macOS install and launchd service lifecycle #944 Verified macOS install and launchd service lifecycle
• feature: verified Linux install and systemd service lifecycle #945 Verified Linux install and systemd service lifecycle
• test: verify the installed Cortex service survives reboot on macOS and Linux #964 Verify the installed service survives reboot on macOS and Linux
• feature: one plugin convention (all opt-in) and a minimal desktop artifact #966 Minimize the desktop release artifact — fixed plugin set for desktop use

Not breaking the rest of the machine

• feature: git, gh and ssh keep working with Cortex running #946 git, gh and ssh keep working with Cortex running
• feature: language toolchains and scripted HTTPS clients keep working #947 Language toolchains and scripted HTTPS clients keep working

Session differentiation

• feature: differentiate concurrent coding-agent sessions in abctl #949 Differentiate concurrent coding-agent sessions in abctl

Observability

• feature: per-session and per-model token and cost aggregation #950 Per-session and per-model token and cost aggregation
• feature: latency metrics — time to first token, total response time, session percentiles #951 Latency metrics — time to first token, total response time, session percentiles
• feature: metrics view in the abctl TUI #953 Metrics view in the abctl TUI
• 🐛 No token showing for requests in abctl #900 No token showing for requests in abctl

Persistence & configuration

• feature: persist sessions #901 Persist sessions — sqlite backend
• feature: persistent user configuration for abctl #954 Persistent user configuration for abctl

Unattended operation

• feature: support unattended agent workloads — headless agent runs with no human present #955 Support unattended agent workloads — headless agent runs with no human present

TUI stabilization

• feature: abctl: better user help for disappearing events #870 Better user help for disappearing events
• feature: abctl: sort events other than chronologically #865 Sort events other than chronologically

Bugs

• authbridge-proxy: early flush of leading thinking block turns a slow tool call into a client stream-idle timeout #926 Early flush of leading thinking block → client stream-idle timeout
• TLS bridge auto-skip turns a CA trust error into 10-minute intermittent failures #912 TLS bridge auto-skip → 10-minute intermittent CA failures

Release testing

• test: release smoke test on macOS CI runners #956 Release smoke test on macOS CI runners
• test: release smoke test on Linux CI runners #957 Release smoke test on Linux CI runners

Docs

• docs: first-run path — install to first useful reading #959 First-run path — install to first useful reading
• docs: troubleshooting guide for the laptop install #960 Troubleshooting guide for the laptop install
• docs: explain what Cortex shows and why it is worth running — interpreting the metrics and the value case #963 Explain what Cortex shows and why it is worth running — interpreting the metrics
  and the value case

Stretch — P1 (13)

• Refactor: Separate proxy data-planes from a shared proxy shim layer #682 Refactor: separate proxy data-planes — merge cutoff 2026-09-19 (tracked here by
  reference only: Refactor: Separate proxy data-planes from a shared proxy shim layer #682 is a native sub-issue of #2244 epic: Cortex Phase 1, and GitHub
  allows one parent)
• feature: Codex support — detection, settings, parsed events, token and cost accounting #942 Codex support
• feature: attribute tool-pruning savings — tokens and cost saved #952 Attribute tool-pruning savings — tokens and cost saved
• docs: separate laptop docs from Kubernetes and platform docs #961 Separate laptop docs from Kubernetes and platform docs
• test: CI coverage gate for abctl and authbridge-proxy #958 CI coverage gate for abctl and authbridge-proxy
• feature: Report statistics to a central collector #898 Report statistics to a central collector
• feature: Better information for non-LLM/A2A/MCP traffic #906 Better information for non-LLM/A2A/MCP traffic
• feature: Surfacing outbound pipeline denials #724 Surfacing outbound pipeline denials
• feature: make targets for building abctl and authbridge-proxy #914 make targets for building abctl and authbridge-proxy
• feature: abctl: explanation of / (filter) function #867 Explanation of / (filter) function
• feature: abctl: slow down y (yank) screen clearing, simplify accessing yanked files #868 Slow down y (yank) screen clearing
• feature: Help Context Guru end users understand what Context Guru does for them #844 Help Context Guru end users understand what it does
• feature: abctl exec subcommand #913 abctl exec — verify and close, appears already implemented

Critical paths

Two dependency chains, both spanning more than one owner. Neither parallelizes.

#939 agent contract  ──┬── #940 Claude Code (reimplemented on it)
                       ├── #941 OpenCode
                       ├── #943 Bob
                       └── #942 Codex (P1)

#949 session identity ──┬── #950 token/cost aggregation ── #953 TUI metrics view
                        └── #955 unattended workloads

#949 is owned by @galmasi, #950 by @huang195, #953 and #955 by @esnible. The
session-identity schema needs agreeing in week one, not discovering in week three.

Risks

• 27 P0 items, three weeks, five people. Every P0 has an owner. Several are small, but
  feature: agent integration contract — reusable detection, settings patching, and revert #939/feature: OpenCode support — detection, settings, parsed events, token and cost accounting #941/feature: Bob support — detection, settings, parsed events, token and cost accounting #943, feature: per-session and per-model token and cost aggregation #950/feature: latency metrics — time to first token, total response time, session percentiles #951/feature: metrics view in the abctl TUI #953, feature: verified macOS install and launchd service lifecycle #944/feature: verified Linux install and systemd service lifecycle #945 and feature: differentiate concurrent coding-agent sessions in abctl #949 are not.
• Exit criterion 5 lands last by construction. docs: explain what Cortex shows and why it is worth running — interpreting the metrics and the value case #963 explains what the metrics mean, so it
  cannot be finished before feature: per-session and per-model token and cost aggregation #950/feature: latency metrics — time to first token, total response time, session percentiles #951/feature: attribute tool-pruning savings — tokens and cost saved #952 do, and the outside-reader verification cannot start
  before docs: explain what Cortex shows and why it is worth running — interpreting the metrics and the value case #963. Whoever is going to read the docs cold should be lined up in advance, or the
  criterion becomes a rubber stamp in the final days.
• @esnible holds 10 of the 24 P0 items, spanning agent integrations and TUI stabilization —
  two workstreams that do not interleave. The heaviest load in the plan.
• Refactor: Separate proxy data-planes from a shared proxy shim layer #682 landing late. A proxy data-plane refactor merged in the final week is the single
  biggest threat to the exit bar. Hard cutoff 2026-09-19; if it has not merged by then it
  leaves the release. Its title is also stale — the shim-layer approach was rejected in favour
  of in-process policy plus a thin interception front, so it needs rescoping either way.
• All 7 remaining unowned issues are P1, so nothing unowned gates the release.

Open questions

• Owners for feature: Report statistics to a central collector #898, feature: Better information for non-LLM/A2A/MCP traffic #906, feature: Surfacing outbound pipeline denials #724, feature: make targets for building abctl and authbridge-proxy #914, feature: abctl: explanation of / (filter) function #867, feature: abctl: slow down y (yank) screen clearing, simplify accessing yanked files #868, feature: Help Context Guru end users understand what Context Guru does for them #844 (all P1)
• Confirm v0.9.0 publishes as non-prerelease so install.sh defaults to it
• feature: Bob support — detection, settings, parsed events, token and cost accounting #943: Bob's wire format and settings location need capturing before implementation