chore(main): release 1.213.0

[coreplane-infra]

🤖 I have created a release beep boop

1.213.0 (2026-09-14)

Features

• agents: pi 0.85.1 in both execution images, a preset's harness field with its config knob, and an exec's caller environment — the ground the pi harness lands on (#1042) (8179e7a)
• dispatcher: the router is on by default — a fresh installation routes a plain message from its first day, help says "describe what you want", and the card says how to override a route (#1038) (41a734a)
• harness: the coding preset can run on pi — pi in the container with the run's bearer as its only key, every RPC event bridged into the run's own events and spans, our tools and tool rules as its extension, dark behind harness: pi (#1043) (8c95dd5)
• runs: a run's files move by reference — the artifact event names the store key, the run page serves each file through its own authorized route, and the Files block lists them with images inline (#1045) (0146e37)
• tools: the artifact store seam — a run's files can move by reference through one private R2 bucket the bot signs URLs for, with the config section, three bot secrets and the /healthz fact; absent the section, nothing changes (#1040) (d35050e)

Bug fixes

• dispatcher: the router reads a terse "fix it" as a coding ask — imperative fixtures join the replay, and the compound rule meets its bar at the live model (#1051) (f99535d)
• harness: a fresh pi run is prompted with the request, not the thread's oldest turn — the earlier turns become the session pi starts from, and a single-turn thread is unchanged (#1048) (ea57f04)
• keep error-code diagnoses out of the secret redactor and make the onboard not-in-installation refusal actionable (#1041) (33d4e2b)
• resident: a container whose runtime never answers heals itself — the unreachable probe is named, counted and escalated (short re-arm, stop, destroy and restore from snapshot, then down), with an admin recreate-container op (#1046) (78f5409)

Documentation

• docs: record 0033 proposes the artifact store — run files move by reference through one private R2 bucket in both directions, and the run record keeps the key (#1033) (80e3664)
• docs: the execution ledger for record 0033 — eight units that move run artifacts through R2 in both directions, outbound first, each inert until the store is configured (#1036) (3192767)
• the front door is the first thing a newcomer meets — every intro says describe what you want, commands wait for whoever digs, and the pictures show a routed run (#1037) (0318334)
• the front door, the runner and the budgets read as built — every page says a plain message routes itself, no pause exists, turns are a guard, and the plan's graph matches its text (#1031) (bdf2504)

---

This PR was generated with Release Please. See documentation.

[github-actions]

What merging this release deploys

Deploy targets for 929b46b: 4 of 4 Workers — memory, bot, resident, sandbox

Worker	Decision	Judged against	Why
memory	deploy	live c3e94f9	src/agents/registry.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/redact.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/runEvents.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/runFriction.ts (imported by deploy/cloudflare-memory/worker.ts) src/core/trace/workerTrace.ts (imported by deploy/cloudflare-memory/worker.ts)
bot	deploy	live c3e94f9	deploy/cloudflare/worker.ts package-lock.json: dependencies of the root package changed — + aws4fetch 1.0.20 package.json src/agents/registry.ts src/artifacts/buildStore.ts src/artifacts/config.ts src/artifacts/contentType.ts src/artifacts/keys.ts … +52 more
resident	deploy	live c3e94f9	deploy/cloudflare-resident/Dockerfile deploy/cloudflare-resident/worker.ts deploy/cloudflare-resident/wrangler.template.jsonc src/core/redact.ts (imported by deploy/cloudflare-resident/worker.ts) src/core/trace/workerTrace.ts (imported by deploy/cloudflare-resident/worker.ts) src/execution/residentRefresh.ts (imported by deploy/cloudflare-resident/worker.ts)
sandbox	deploy	live c3e94f9	deploy/cloudflare-sandbox/Dockerfile src/core/redact.ts (imported by deploy/cloudflare-sandbox/worker.ts) src/core/trace/workerTrace.ts (imported by deploy/cloudflare-sandbox/worker.ts)

Unclassified paths: none.

Judged per Worker against the commit it is serving right now. Re-rendered by the release-please workflow on every merge to main; merging this PR runs deploy all --affected and deploys exactly the Workers marked deploy.

[justinhelmer]

CI red on ci / bot / test 3 of 4 at d90c391 is the McpService OAuth concurrent-refresh race, filed as #1050: untouched by this release, passes 5/5 locally. Re-ran the failed Depot jobs.

[coreplane-infra]

🤖 Created releases:

• v1.213.0

🌻