chore(release): 0.18.0 (#523)

* chore(release): bump version to 0.18.0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* docs(roadmap): remove Phase 4 and completed foundation items

Remove "Parallel Execution — Advanced Patterns" phase (no longer
planned), strip already-completed "Foundation in place" items from
remaining phases, and renumber phases 5-13 → 4-12.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore(release): fix changelog reference links for v0.17.0 and v0.18.0

[Unreleased] was still comparing from v0.16.0 and the 0.17.0/0.18.0
comparison links were missing entirely.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: anderskev

CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.0] - 2026-03-07
+
+### Added
+
+- **sandbox:** Add Daytona cloud sandbox provider for remote code execution ([#509](https://github.com/existential-birds/amelia/pull/509))
+- **dashboard:** Auto-populate task title from plan/design document H1 heading ([#515](https://github.com/existential-birds/amelia/pull/515))
+- **server:** Bridge EventBus events to server console via loguru for unified observability ([#504](https://github.com/existential-birds/amelia/pull/504))
+- **drivers:** Add token usage tracking to Codex CLI driver ([#503](https://github.com/existential-birds/amelia/pull/503))
+
+### Changed
+
+- **plan-extraction:** Consolidate plan extraction to regex-only, removing LLM dependency for faster and more predictable parsing ([#516](https://github.com/existential-birds/amelia/pull/516))
+- **dashboard:** Remove Roundtable/Capacity placeholders and move Costs to Agent Ops section ([#510](https://github.com/existential-birds/amelia/pull/510))
+
+### Fixed
+
+- **dashboard:** Fix bulk model dropdown for OpenRouter and agent card layout overflow ([#519](https://github.com/existential-birds/amelia/pull/519))
+- **dashboard:** Restore profile settings modal save and clean up error handling ([#517](https://github.com/existential-birds/amelia/pull/517))
+- **dashboard:** Shrink workflow canvas nodes to fit within viewport ([#519](https://github.com/existential-birds/amelia/pull/519))
+- **external_plan:** Resolve Quick Shot timeout and duplicate plan file creation ([#514](https://github.com/existential-birds/amelia/pull/514))
+- **types:** Audit and resolve `type: ignore` comments across codebase ([#501](https://github.com/existential-birds/amelia/pull/501))
+
+### Security
+
+- **deps:** Bump dompurify to 3.3.2 to address XSS vulnerability ([#521](https://github.com/existential-birds/amelia/pull/521))
+- **deps:** Bump minimatch to fix ReDoS vulnerability ([#502](https://github.com/existential-birds/amelia/pull/502))
+
 ## [0.17.0] - 2026-02-22
 
 ### Added
@@ -442,7 +469,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - FastAPI server with WebSocket support
 - React dashboard for workflow visualization
 
-[Unreleased]: https://github.com/existential-birds/amelia/compare/v0.16.0...HEAD
+[Unreleased]: https://github.com/existential-birds/amelia/compare/v0.18.0...HEAD
+[0.18.0]: https://github.com/existential-birds/amelia/compare/v0.17.0...v0.18.0
+[0.17.0]: https://github.com/existential-birds/amelia/compare/v0.16.0...v0.17.0
 [0.16.0]: https://github.com/existential-birds/amelia/compare/v0.15.0...v0.16.0
 [0.15.0]: https://github.com/existential-birds/amelia/compare/v0.14.0...v0.15.0
 [0.14.0]: https://github.com/existential-birds/amelia/compare/v0.13.0...v0.14.0

amelia/__init__.py

@@ -8,7 +8,7 @@
     __version__: Package version string.
 """
 
-__version__ = "0.17.0"
+__version__ = "0.18.0"
 
 __all__ = [
     "__version__",

dashboard/package.json

@@ -1,7 +1,7 @@
 {
   "name": "amelia-dashboard",
   "private": true,
-  "version": "0.17.0",
+  "version": "0.18.0",
   "license": "Apache-2.0",
   "type": "module",
   "scripts": {

docs/site/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amelia/design-system-docs",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Amelia Design System documentation site built with VitePress by hey-amelia bot",
   "private": true,
   "type": "module",

docs/site/reference/roadmap.md

@@ -160,12 +160,6 @@ Recursive Language Model (RLM) processing for documents exceeding context limits
 
 Automated verification before code reaches human reviewers.
 
-**Foundation in place:**
-
-- Configurable iteration limits (`max_retries`, `max_iterations`) with auto-halt
-- Pre-push hook running lint, typecheck, test, and dashboard build
-- Retry with exponential backoff for transient failures (`RetryConfig`, `_run_workflow_with_retry`)
-
 - Error compaction/summarization before LLM re-invocation (review feedback currently fed verbatim)
 - Pre-review gates integrated into agent workflow (not just git hooks)
 - Evaluation CI/CD integration ([#230](https://github.com/existential-birds/amelia/issues/230))
@@ -178,19 +172,7 @@ Automated verification before code reaches human reviewers.
 
 ---
 
-## Phase 4: Parallel Execution — Advanced Patterns [Planned]
-
-Advanced concurrency patterns building on the parallel execution foundation.
-
-- DAG-aware task scheduling within workflows
-- Resource management (LLM rate limiting, compute allocation)
-- **Sectioning pattern**: Parallel independent subtasks
-- **Voting pattern**: Run high-stakes tasks multiple times for consensus
-- Fire-and-forget completion notifications (currently WebSocket/dashboard only)
-
----
-
-## Phase 5: Bidirectional Tracker Sync [Planned]
+## Phase 4: Bidirectional Tracker Sync [Planned]
 
 Full issue lifecycle management from CLI ([#64](https://github.com/existential-birds/amelia/issues/64)).
 
@@ -200,7 +182,7 @@ Full issue lifecycle management from CLI ([#64](https://github.com/existential-b
 
 ---
 
-## Phase 6: Pull Request Lifecycle [Planned]
+## Phase 5: Pull Request Lifecycle [Planned]
 
 PR management from creation through merge ([#66](https://github.com/existential-birds/amelia/issues/66)).
 
@@ -211,7 +193,7 @@ PR management from creation through merge ([#66](https://github.com/existential-
 
 ---
 
-## Phase 7: Chat Integration & Notifications [Planned]
+## Phase 6: Chat Integration & Notifications [Planned]
 
 Slack/Discord interface for async workflow management ([#61](https://github.com/existential-birds/amelia/issues/61)).
 
@@ -223,7 +205,7 @@ Slack/Discord interface for async workflow management ([#61](https://github.com/
 
 ---
 
-## Phase 8: Observability & Tooling [Planned]
+## Phase 7: Observability & Tooling [Planned]
 
 Infrastructure for monitoring, debugging, and extending agent capabilities.
 
@@ -234,25 +216,18 @@ Infrastructure for monitoring, debugging, and extending agent capabilities.
 
 ---
 
-## Phase 9: Continuous Improvement [Planned]
+## Phase 8: Continuous Improvement [Planned]
 
 Metrics and feedback for agent quality improvement ([#63](https://github.com/existential-birds/amelia/issues/63)).
 
-**Foundation in place:**
-
-- Success/failure tracking with `success_rate` in usage summaries
-- Token usage and cost tracking per agent, model, and workflow (15+ models supported)
-- Costs dashboard with trend charts, success rate badges, and model breakdown
-- Reviewer structured output with severity classification (Critical/Major/Minor)
-
 - Project-specific knowledge base (idioms, pitfalls, decisions)
 - Prompt A/B testing with benchmark suite
 - Pre-merge evaluation CI for agent quality
 - LLM-as-Judge for nuanced quality assessment
 
 ---
 
-## Phase 10: Debate Mode [Planned]
+## Phase 9: Debate Mode [Planned]
 
 Multi-agent deliberation for design decisions ([#202](https://github.com/existential-birds/amelia/issues/202)).
 
@@ -263,15 +238,10 @@ Multi-agent deliberation for design decisions ([#202](https://github.com/existen
 
 ---
 
-## Phase 11: Security & Authorization [Planned]
+## Phase 10: Security & Authorization [Planned]
 
 Defense-in-depth security with per-agent permissions ([#228](https://github.com/existential-birds/amelia/issues/228), [#231](https://github.com/existential-birds/amelia/issues/231)).
 
-**Foundation in place:**
-
-- Path traversal prevention in worktree and file operations
-- `allowed_tools` parameter on `execute_agentic()` for per-agent tool restriction ([#356](https://github.com/existential-birds/amelia/issues/356))
-
 - Deterministic guardrails blocking high-risk operations
 - Per-agent tool allowlists (Architect: read-only, Developer: write, Reviewer: read+comment)
 - Configurable risk levels per profile (Prototype/Demo/Production) ([#219](https://github.com/existential-birds/amelia/issues/219))
@@ -281,21 +251,17 @@ Defense-in-depth security with per-agent permissions ([#228](https://github.com/
 
 ---
 
-## Phase 12: Cloud Deployment [Partially Complete]
+## Phase 11: Cloud Deployment [Planned]
 
 Parallel execution on cloud infrastructure.
 
-**Foundation in place:**
-
-- Cloud sandbox execution via Daytona provider — ephemeral cloud-based sandboxes for agent workloads ([#509](https://github.com/existential-birds/amelia/pull/509))
-
 - Multiple workflows running in parallel on cloud infrastructure (AWS or equivalent)
 - Thin CLI client for submitting and monitoring
 - OAuth-based authentication with GitHub
 
 ---
 
-## Phase 13: Capitalization Tracking [Planned]
+## Phase 12: Capitalization Tracking [Planned]
 
 Engineering work attribution for financial reporting (OPEX vs CAPEX) ([#70](https://github.com/existential-birds/amelia/issues/70)).
 
@@ -313,14 +279,14 @@ Engineering work attribution for financial reporting (OPEX vs CAPEX) ([#70](http
 | F1: Natural Language → Tool Calls | 🟡 Partial | Core Orchestration | Evaluator/Knowledge use Pydantic schemas; core agents (Architect/Developer/Reviewer) use free-form agentic mode |
 | F2: Own Your Prompts | ✅ Complete | Core Orchestration | Full versioning system with DB persistence, `PromptResolver`, workflow audit linking |
 | F3: Own Your Context Window | 🚧 In Progress | Phases 1, 2 | Task sectioning exists; no token counting or context budgeting |
-| F4: Tools = Structured Outputs | 🟡 Partial | Core Orchestration, Phase 8 | Canonical `ToolName` registry; tool schemas owned by driver frameworks, not Amelia |
+| F4: Tools = Structured Outputs | 🟡 Partial | Core Orchestration, Phase 7 | Canonical `ToolName` registry; tool schemas owned by driver frameworks, not Amelia |
 | F5: Unified State | ✅ Complete | Web Dashboard | Frozen `BasePipelineState` → `ImplementationState` hierarchy with LangGraph reducers |
 | F6: Launch/Pause/Resume | ✅ Complete | Web Dashboard | 8 REST endpoints, LangGraph `interrupt_before`, PostgreSQL checkpointing |
-| F7: Contact Humans with Tools | 🟡 Partial | Phases 7, 10, 11 | `human_approval_node` exists; agents cannot initiate contact mid-execution; no outbound notifications |
+| F7: Contact Humans with Tools | 🟡 Partial | Phases 6, 9, 10 | `human_approval_node` exists; agents cannot initiate contact mid-execution; no outbound notifications |
 | F8: Own Your Control Flow | ✅ Complete | Core Orchestration | Custom routing functions with business logic, two pipeline graphs |
-| F9: Compact Errors | 🟡 Partial | Phases 3, 8 | Exponential backoff retry exists; no error compaction for LLM context |
+| F9: Compact Errors | 🟡 Partial | Phases 3, 7 | Exponential backoff retry exists; no error compaction for LLM context |
 | F10: Small Focused Agents | ✅ Complete | Core Orchestration | 6 narrow agents (Architect, Developer, Reviewer, Evaluator, Oracle, Brainstorm), step limits, per-task fresh sessions, sandbox isolation |
-| F11: Trigger from Anywhere | 🟡 Partial | Web Dashboard, Phase 7 | CLI + REST + Dashboard; no inbound webhooks or event-driven triggers |
+| F11: Trigger from Anywhere | 🟡 Partial | Web Dashboard, Phase 6 | CLI + REST + Dashboard; no inbound webhooks or event-driven triggers |
 | F12: Stateless Reducer | ✅ Complete | Core Orchestration | Frozen Pydantic state, `operator.add` reducers, pure node functions |
 | F13: Pre-fetch Context | 🟡 Partial | Phase 1 | Issue/commit/design/prompts pre-fetched; codebase context via runtime exploration |
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "amelia"
-version = "0.17.0"
+version = "0.18.0"
 description = "A local agentic coding system with configurable profiles."
 readme = "README.md"
 requires-python = ">=3.12"