release: v0.9.8 (#1304)

* fix(memory): enforce visibility:private ACL on delete in unified-bank mode

In unified-bank mode (the default) every agent's visibility:private docs
live in the single `shared` bank, isolated only by a read-time agent:<id>
tag filter. delete() swept by document_id with no owner check, so any
caller who knew/guessed another agent's (guessable) document_id could
delete that agent's private memory — read/search/list enforce visibility,
delete did not.

delete() now resolves each target id's owner via _deletable_ids() and
withholds any doc the caller can't see (fail-closed), mirroring the read
paths. Legacy multi-bank mode is unchanged: _allowed_namespaces never
yields a foreign private bank, so bank isolation already protects it.

Residual surface hardening (no /api/memory auth, ungated /mcp/memory bulk
delete) tracked in #1302.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(services): register turnstone as a companion service

Turnstone shipped as a bundled agent but was never wired into the services
surface the way hermes is, so it was absent from /api/services, the Services
pane, the Overview health card, and the sidebar footer status strip.

- Add a ServiceDef (unit hal0-agent@turnstone.service, systemd probe,
  loopback :9129, full lifecycle) → surfaces in /api/services with real
  status + start/stop/restart controls (generic systemd probe, like
  hindsight).
- Add a _probe_turnstone systemd probe + block to /api/services/health so
  the Overview card and the footer status pip resolve turnstone (now 5
  curated services).
- Footer indicator (chrome.jsx) + dashboard-redesign SERVICE_ORDER slot
  turnstone next to hermes.
- Update service page/health id-set + count tests; stub _probe_turnstone
  everywhere hermes is stubbed to keep the health tests hermetic.

Turnstone runs as the shared `hal0` user (User=hal0 in the templated unit;
no dedicated account), same as hermes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* release: v0.9.8

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: thinmintdev

CHANGELOG.md

@@ -21,6 +21,34 @@ applying. Add those subsections to a version's section to surface them; see
 
 ## [Unreleased]
 
+## [0.9.8] — 2026-07-13
+
+Turnstone lands as a second heavyweight bundled agent alongside Hermes and
+becomes a first-class companion service; the unified **hal0-rocmfpx** runner
+becomes the default image for AMD GPUs (with an automatic slot migration on
+update); and a memory security fix stops one agent deleting another's private
+memories.
+
+### Highlights
+- **Turnstone — a second heavyweight bundled agent** joins Hermes: a native `turnstone-server` on loopback :9129, installed into its own managed PyPI venv, coexisting with Hermes via relaxed single-pick (#1299).
+- **Turnstone is a first-class companion service** — it shows in the Services pane and the Overview health card with start/stop/restart controls, next to Hermes/Hindsight/OpenWebUI.
+- **hal0-rocmfpx is now the universal default runner for AMD GPUs** — one unified image (Vulkan/RADV + HIP) replaces the per-lane toolboxes; CUDA and CPU-only lanes keep their lean images (#1297).
+- **Memory: private-visibility is now enforced on delete** — in unified-bank mode one agent could delete another agent's `visibility:private` memory by id; `delete` now applies the same fail-closed ACL as read/search/list.
+
+### Migrations
+- `hal0 update` automatically re-pins existing AMD-GPU slots from the old `amd-strix-halo-toolboxes` images to the unified `hal0-rocmfpx` runner (no-op on CUDA/CPU lanes) (#1297).
+
+### Added
+- **Turnstone bundled agent** — provisioning pipeline (managed PyPI venv, JWT-secret generation, model automap) plus hal0 provider/memory wiring, coexisting with Hermes (#1299).
+- **Turnstone companion-service registration** — a `ServiceDef` + systemd health probe, so turnstone appears in `/api/services` (Services pane, full lifecycle actions) and `/api/services/health` (Overview card + sidebar status).
+
+### Changed
+- **hal0-rocmfpx as the default AMD-GPU image** — basic seed profiles defer to a manifest-driven resolver that returns the unified runner for AMD lanes, the CUDA image for NVIDIA, and the lean toolbox for CPU-only (#1297).
+- PyPI distribution is published under the name **`hal0ai`** (the import package and `hal0`/`hal0-agent` console scripts are unchanged) (#1298).
+
+### Fixed
+- **Memory delete ACL** — `delete` enforces the `visibility:private` owner check in unified-bank mode, so an agent can no longer delete another agent's private memory by (guessable) document id; unresolved ids are withheld fail-closed (#1302).
+
 ## [0.9.7.3] — 2026-07-12
 
 A robustness release. Fresh installs now adapt to the host — provisioning their

pyproject.toml

@@ -10,7 +10,7 @@ build-backend = "hatchling.build"
 # that resolves this project by distribution name must use "hal0ai".
 [project]
 name = "hal0ai"
-version = "0.9.7.3"
+version = "0.9.8"
 description = "Open-source home AI inference platform"
 readme = "README.md"
 requires-python = ">=3.12"

src/hal0/api/routes/services_health.py

@@ -1,12 +1,12 @@
 """GET /api/services/health — dashboard services health aggregator.
 
-Returns a stable list of four well-known services (comfyui, hermes,
-openwebui, n8n) with honest up/down state.  Every source degrades
+Returns a stable list of five well-known services (comfyui, hermes,
+turnstone, openwebui, n8n) with honest up/down state.  Every source degrades
 gracefully — a probe failure yields up=false, never a 500.
 
-Real probes: comfyui (in-process /system_stats+/queue), hermes (systemd
-unit state), openwebui (loopback GET /health — SpikeB §5.4).  n8n has no
-reachable probe from the API process (not deployed on this host) and
+Real probes: comfyui (in-process /system_stats+/queue), hermes + turnstone
+(systemd unit state), openwebui (loopback GET /health — SpikeB §5.4).  n8n
+has no reachable probe from the API process (not deployed on this host) and
 reports up=false, detail="unmonitored".
 
 HARD RULE: up=true requires a real signal.  Services with no wired probe
@@ -38,6 +38,11 @@
 
 router = APIRouter()
 
+# Turnstone's systemd unit (bundled agent, loopback :9129) — probed the same
+# way as hermes. _HERMES_UNIT is imported from comfyui; turnstone has no such
+# shared constant, so name it locally.
+_TURNSTONE_UNIT = "hal0-agent@turnstone.service"
+
 # OpenWebUI binds 0.0.0.0:3001 in hal0-openwebui.service (the port is fixed
 # in the unit — see config.py _OPENWEBUI_PORT). We probe it over loopback,
 # independent of the browser-facing public URL (_openwebui_url). The probe
@@ -113,6 +118,18 @@ async def _probe_hermes() -> tuple[bool, str]:
     return False, "systemd unit inactive or absent"
 
 
+async def _probe_turnstone() -> tuple[bool, str]:
+    """Probe Turnstone via systemd unit state — same mechanism as hermes.
+
+    Turnstone is a bundled agent running ``hal0-agent@turnstone.service``
+    (loopback :9129). Real signal: the unit's active state.
+    """
+    active = await _systemd_active(_TURNSTONE_UNIT)
+    if active:
+        return True, "systemd unit active"
+    return False, "systemd unit inactive or absent"
+
+
 async def _probe_openwebui() -> tuple[bool, str]:
     """Real reachability probe — GET <loopback>/health on OpenWebUI.
 
@@ -141,14 +158,14 @@ async def _probe_n8n() -> tuple[bool, str]:
 
 @router.get("/health")
 async def services_health() -> dict[str, Any]:
-    """Aggregate health of the four known hal0 companion services.
+    """Aggregate health of the five known hal0 companion services.
 
     Response shape::
 
         {
           "services": [
             {
-              "id":     "comfyui"|"hermes"|"openwebui"|"n8n",
+              "id":     "comfyui"|"hermes"|"turnstone"|"openwebui"|"n8n",
               "name":   str,
               "up":     bool,
               "detail": str,
@@ -199,6 +216,24 @@ async def services_health() -> dict[str, Any]:
         }
     )
 
+    # ── turnstone ────────────────────────────────────────────────────────────
+    try:
+        t_up, t_detail = await _probe_turnstone()
+    except Exception as exc:
+        log.warning("services_health.turnstone_probe_error", exc=repr(exc))
+        t_up, t_detail = False, type(exc).__name__
+
+    services.append(
+        {
+            "id": "turnstone",
+            "name": "Turnstone",
+            "up": t_up,
+            "detail": t_detail,
+            "url": None,  # loopback-only, no browser-reachable URL
+            "stat": None,
+        }
+    )
+
     # ── openwebui ─────────────────────────────────────────────────────────────
     try:
         ow_up, ow_detail = await _probe_openwebui()

src/hal0/memory/hindsight_provider.py

@@ -45,6 +45,11 @@
 _ANONYMOUS = "anonymous"
 _UNKNOWN_AGENT = "unknown"
 
+# Page size for the pre-delete visibility scan (unified mode). delete() lists
+# the caller's banks to resolve each target doc's owner before removing it; a
+# page big enough that a normal delete resolves in one round-trip.
+_DELETE_SCAN_PAGE = 500
+
 
 def _agent_of(tags: list[str] | tuple[str, ...] | None) -> str | None:
     """Return the ``<id>`` of the first ``agent:<id>`` tag, else None."""
@@ -383,6 +388,47 @@ def _list_fact_to_item(fact: dict[str, Any], bank: str) -> dict[str, Any]:
             "type": fact.get("fact_type"),
         }
 
+    async def _deletable_ids(
+        self, ids: set[str], banks: list[str], client_id: str | None
+    ) -> set[str]:
+        """Return the subset of ``ids`` the caller is allowed to delete under
+        unified-bank visibility.
+
+        In unified mode the single ``shared`` bank holds every agent's
+        ``visibility:private`` docs, so a blind delete-by-id would let any
+        caller remove another agent's private memory (read/search/list all
+        enforce visibility; delete must too). A doc is deletable when it is
+        non-private, or private and owned by the caller — the exact predicate
+        the read paths use (:meth:`_is_visible_to`). An id we cannot resolve to
+        a doc in the caller's banks is **withheld** (fail-closed), matching the
+        fail-closed posture of the read filter.
+        """
+        if not ids:
+            return set()
+        caller = self._caller_agent(client_id)
+        wanted = set(ids)
+        out: set[str] = set()
+        for bank in banks:
+            if not wanted - out:
+                break
+            offset = 0
+            while wanted - out:
+                try:
+                    resp = await self._client.list_memories(
+                        bank_id=bank, limit=_DELETE_SCAN_PAGE, offset=offset
+                    )
+                except Exception:
+                    break  # fail-soft per bank; unresolved ids stay withheld
+                items = resp.get("items", [])
+                for fact in items:
+                    fid = fact.get("id") or fact.get("document_id")
+                    if fid in wanted and fid not in out and self._is_visible_to(fact, caller):
+                        out.add(fid)
+                if len(items) < _DELETE_SCAN_PAGE:
+                    break  # last page
+                offset += _DELETE_SCAN_PAGE
+        return out
+
     async def delete(
         self,
         ids: list[str],
@@ -400,7 +446,16 @@ async def delete(
         banks = [
             namespace_to_bank(ns) for ns in self._allowed_namespaces(dataset or _SHARED, client_id)
         ]
+        # Unified mode: gate deletes on the same visibility:private ACL the read
+        # paths enforce, so one agent can't delete another's private doc by id.
+        # Legacy multi-bank mode needs no gate — _allowed_namespaces never
+        # yields a foreign private bank, so bank isolation already protects it.
+        deletable = (
+            await self._deletable_ids(set(ids), banks, client_id) if self._unified_bank else None
+        )
         for document_id in ids:
+            if deletable is not None and document_id not in deletable:
+                continue  # withheld: not visible to this caller (fail-closed)
             for bank in banks:
                 try:
                     res = await self._client.delete_document(bank_id=bank, document_id=document_id)

src/hal0/services/registry.py

@@ -101,6 +101,16 @@ class ServiceDef:
         actions=_FULL,
         loopback_port=9119,
     ),
+    ServiceDef(
+        id="turnstone",
+        name="Turnstone",
+        description="Bundled agent (turnstone-server, loopback :9129).",
+        unit="hal0-agent@turnstone.service",
+        public_url_env="HAL0_TURNSTONE_PUBLIC_URL",
+        probe="systemd",
+        actions=_FULL,
+        loopback_port=9129,
+    ),
     ServiceDef(
         id="hindsight",
         name="Hindsight",

tests/api/test_services_health.py

@@ -6,7 +6,7 @@
 so the endpoint is reachable without touching the real app factory.
 
 Covers:
-  1. Endpoint returns 200 with all 4 service ids present.
+  1. Endpoint returns 200 with all 5 service ids present.
   2. n8n is up=false, detail="unmonitored" (no real probe).
   3. With comfyui probe mocked reachable -> up=true, stat populated.
   4. comfyui probe raising -> comfyui up=false, endpoint still 200.
@@ -27,7 +27,7 @@
 from hal0.api.routes.services_health import router as services_router
 
 _BASE = "hal0.api.routes.services_health"
-_EXPECTED_IDS = {"comfyui", "hermes", "openwebui", "n8n"}
+_EXPECTED_IDS = {"comfyui", "hermes", "turnstone", "openwebui", "n8n"}
 
 
 @pytest.fixture
@@ -43,7 +43,7 @@ def _services_by_id(body: dict) -> dict:
 
 
 def _stub_other_probes() -> list:
-    """Patch comfyui/hermes/openwebui to neutral down states so a test can
+    """Patch comfyui/hermes/turnstone/openwebui to neutral down states so a test can
     isolate ONE service without real network/systemd calls. Returns a list
     of started patchers the caller closes via an ExitStack, OR use as a
     context-manager group. Default: everything down/unmonitored.
@@ -59,6 +59,11 @@ def _stub_other_probes() -> list:
             new_callable=AsyncMock,
             return_value=(False, "systemd unit inactive or absent"),
         ),
+        patch(
+            f"{_BASE}._probe_turnstone",
+            new_callable=AsyncMock,
+            return_value=(False, "systemd unit inactive or absent"),
+        ),
         patch(
             f"{_BASE}._probe_openwebui",
             new_callable=AsyncMock,
@@ -67,7 +72,7 @@ def _stub_other_probes() -> list:
     ]
 
 
-# ── 1. shape: 200 + all 4 ids ─────────────────────────────────────────────────
+# ── 1. shape: 200 + all 5 ids ─────────────────────────────────────────────────
 
 
 def test_services_health_200_all_ids(svc_client: TestClient) -> None:
@@ -79,7 +84,7 @@ def test_services_health_200_all_ids(svc_client: TestClient) -> None:
     assert r.status_code == 200, r.text
     body = r.json()
     assert "services" in body
-    assert len(body["services"]) == 4
+    assert len(body["services"]) == 5
     ids = {s["id"] for s in body["services"]}
     assert ids == _EXPECTED_IDS
 
@@ -116,6 +121,11 @@ def test_comfyui_reachable_up_true_stat_populated(svc_client: TestClient) -> Non
             new_callable=AsyncMock,
             return_value=(False, "systemd unit inactive or absent"),
         ),
+        patch(
+            f"{_BASE}._probe_turnstone",
+            new_callable=AsyncMock,
+            return_value=(False, "systemd unit inactive or absent"),
+        ),
         patch(
             f"{_BASE}._probe_openwebui",
             new_callable=AsyncMock,
@@ -148,6 +158,11 @@ def test_comfyui_probe_raises_degrades_gracefully(svc_client: TestClient) -> Non
             new_callable=AsyncMock,
             return_value=(False, "systemd unit inactive or absent"),
         ),
+        patch(
+            f"{_BASE}._probe_turnstone",
+            new_callable=AsyncMock,
+            return_value=(False, "systemd unit inactive or absent"),
+        ),
         patch(
             f"{_BASE}._probe_openwebui",
             new_callable=AsyncMock,
@@ -182,6 +197,11 @@ def test_openwebui_health_2xx_up_true(svc_client: TestClient) -> None:
             new_callable=AsyncMock,
             return_value=(False, "systemd unit inactive or absent"),
         ),
+        patch(
+            f"{_BASE}._probe_turnstone",
+            new_callable=AsyncMock,
+            return_value=(False, "systemd unit inactive or absent"),
+        ),
         patch("httpx.AsyncClient.get", new_callable=AsyncMock, return_value=ok_resp),
     ):
         r = svc_client.get("/api/services/health")
@@ -205,6 +225,11 @@ def test_openwebui_unreachable_up_false(svc_client: TestClient) -> None:
             new_callable=AsyncMock,
             return_value=(False, "systemd unit inactive or absent"),
         ),
+        patch(
+            f"{_BASE}._probe_turnstone",
+            new_callable=AsyncMock,
+            return_value=(False, "systemd unit inactive or absent"),
+        ),
         patch("httpx.AsyncClient.get", new_callable=AsyncMock, side_effect=conn_err),
     ):
         r = svc_client.get("/api/services/health")
@@ -228,6 +253,11 @@ def test_openwebui_non_2xx_up_false(svc_client: TestClient) -> None:
             new_callable=AsyncMock,
             return_value=(False, "systemd unit inactive or absent"),
         ),
+        patch(
+            f"{_BASE}._probe_turnstone",
+            new_callable=AsyncMock,
+            return_value=(False, "systemd unit inactive or absent"),
+        ),
         patch("httpx.AsyncClient.get", new_callable=AsyncMock, return_value=bad_resp),
     ):
         r = svc_client.get("/api/services/health")

tests/api/test_services_page.py

@@ -30,7 +30,7 @@
 from hal0.services.registry import SERVICES, service_by_id
 
 _ROUTE = "hal0.api.routes.services"
-_EXPECTED_IDS = {"openwebui", "comfyui", "hermes", "hindsight", "honcho", "n8n"}
+_EXPECTED_IDS = {"openwebui", "comfyui", "hermes", "turnstone", "hindsight", "honcho", "n8n"}
 
 _DOWN_STATE = {
     "active_state": "inactive",