chore(release): v0.7.18 — bump version

.github/workflows/build.yml

@@ -444,7 +444,7 @@ jobs:
           build-args: |
             VOGT_SOURCE_REF=main
             VOGT_SOURCE_SHA=${{ github.sha }}
-            VOGT_PRODUCT_VERSION=0.7.17
+            VOGT_PRODUCT_VERSION=0.7.18
           cache-from: |
             type=registry,ref=${{ env.CACHE_IMAGE }}:stack-main
             type=registry,ref=${{ env.CACHE_IMAGE }}:demo-main
@@ -560,7 +560,7 @@ jobs:
           build-args: |
             VOGT_SOURCE_REF=main
             VOGT_SOURCE_SHA=${{ github.sha }}
-            VOGT_PRODUCT_VERSION=0.7.17
+            VOGT_PRODUCT_VERSION=0.7.18
           provenance: true
           sbom: true
           cache-from: |
@@ -715,7 +715,7 @@ jobs:
             --set "*.args.CORE_IMAGE=${CORE_IMAGE}"
             --set "*.args.VOGT_SOURCE_REF=${VOGT_SOURCE_REF}"
             --set "*.args.VOGT_SOURCE_SHA=${VOGT_SOURCE_SHA}"
-            --set "*.args.VOGT_PRODUCT_VERSION=0.7.17"
+            --set "*.args.VOGT_PRODUCT_VERSION=0.7.18"
           )
           # One label per line. A value is a url, a revision or a timestamp.
           while IFS= read -r pair || [ -n "$pair" ]; do
@@ -899,7 +899,7 @@ jobs:
             --set "*.args.CORE_IMAGE=${CORE_IMAGE}"
             --set "*.args.VOGT_SOURCE_REF=${VOGT_SOURCE_REF}"
             --set "*.args.VOGT_SOURCE_SHA=${VOGT_SOURCE_SHA}"
-            --set "*.args.VOGT_PRODUCT_VERSION=0.7.17"
+            --set "*.args.VOGT_PRODUCT_VERSION=0.7.18"
           )
           # metadata-action's labels are newline-separated key=value.
           while IFS= read -r pair || [ -n "$pair" ]; do

.github/workflows/ci.yml

@@ -194,7 +194,7 @@ jobs:
       - run: uv sync --locked
 
       - name: canonical product version is aligned
-        run: uv run --no-sync python scripts/check_product_version.py 0.7.17
+        run: uv run --no-sync python scripts/check_product_version.py 0.7.18
 
       - name: ruff (lint)
         run: uv run --no-sync ruff check .

deploy/.env.example

@@ -22,7 +22,7 @@ VOGT_BIND_IP=127.0.0.1
 
 # The image to run. Pin a digest in anything you would call a deployment.
 # Ignored when you add deploy/vogt.build.yml, which builds from the checkout.
-# VOGT_IMAGE=ghcr.io/thedancingdeveloper-org/vogt:0.7.17
+# VOGT_IMAGE=ghcr.io/thedancingdeveloper-org/vogt:0.7.18
 
 # The uid the container runs as. The gid is always 0 — that is what makes the
 # data directory writable at any uid. Set this to whoever owns the files this

deploy/engine.overlay.yml

@@ -61,7 +61,7 @@ services:
         # container carries both halves. Defaults to the same public image the
         # base would run, so the embedded core matches it; pin a digest for a
         # real deployment. The Dockerfile already carries a public default too.
-        CORE_IMAGE: "${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.7.17}"
+        CORE_IMAGE: "${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.7.18}"
         # Optional image-managed agent CLIs. When enabled, versions come from
         # engine/agent-versions.env unless an operator deliberately overrides
         # one with a reproducible build arg.

deploy/stack.compose.yml

@@ -43,7 +43,7 @@ services:
     # `prod-<sha>` tags in the same repository are the maintainer's own pods:
     # same CLIs, plus estate integrations that address one estate's
     # infrastructure and mean nothing outside it. See DEPLOYMENT.md.
-    image: ${VOGT_STACK_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt-stack:0.7.17}
+    image: ${VOGT_STACK_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt-stack:0.7.18}
     restart: unless-stopped
 
     # tini as PID 1 reaps the processes agent sessions leave behind. The
@@ -263,7 +263,7 @@ services:
     # Digest-pin this for a real deployment, exactly as the stack
     # image above. Pin the release family (`X.Y.Z`, `latest`); the default is a
     # tag so the file is runnable as-is.
-    image: ${VOGT_VOICE_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt-voice:0.7.17}
+    image: ${VOGT_VOICE_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt-voice:0.7.18}
     restart: unless-stopped
     # It only reads its baked models and writes audio to tmpfs, so it can run
     # locked down even though the pod beside it cannot.

deploy/vogt.compose.yml

@@ -29,7 +29,7 @@ services:
     # digest — publishing an image and moving a deployment are separate acts,
     # and a digest is the only form of "which image is this" a
     # rebuild cannot silently change.
-    image: ${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.7.17}
+    image: ${VOGT_IMAGE:-ghcr.io/thedancingdeveloper-org/vogt:0.7.18}
     restart: unless-stopped
 
     # The image runs as any uid so long as the gid is 0: `/var/lib/vogt` is

docs/CUSTOMISATION.md

@@ -385,7 +385,7 @@ pattern: a Dockerfile a few lines long that starts `FROM` the published
 `vogt-stack` digest and adds what your sessions need. Keep it in your fork,
 build it in your CI, deploy it by digest.
 
-The core image (`ghcr.io/thedancingdeveloper-org/vogt:0.7.17`) is a build
+The core image (`ghcr.io/thedancingdeveloper-org/vogt:0.7.18`) is a build
 input to the stack image rather than something to deploy on its own. It is
 also built to be a base — `USER root`, install, `USER 1000:0`, keeping
 `ENTRYPOINT ["vogt"]` and the `root:0`-owned data directory — so extend it

docs/DEPLOYMENT.md

@@ -42,7 +42,7 @@ sidecar, released as a pair and run by one Compose file,
   on by default (`COMPOSE_PROFILES=voice`).
 
 The engine is not optional: it is the only way in. The core image,
-`ghcr.io/thedancingdeveloper-org/vogt:0.7.17`, is also published at every
+`ghcr.io/thedancingdeveloper-org/vogt:0.7.18`, is also published at every
 release because the stack image is built from it by digest and the release
 manifest records both — it is a build input, not a deployment target.
 `deploy/vogt.compose.yml` and `deploy/engine.overlay.yml` run a core and an
@@ -136,8 +136,8 @@ Everything an operator chooses lives in `deploy/.env`, read by
 | `ENGINE_BIND` | no | `127.0.0.1` | Host interface the port is published on. Loopback until you mean to expose it. |
 | `ENGINE_PORT` | no | `8910` | Host port the container's 8910 is published on. |
 | `ENGINE_PUBLIC_URL` | no | — | The URL clients reach the stack at. Set it once there is a stable one (§4). |
-| `VOGT_STACK_IMAGE` | no | `ghcr.io/thedancingdeveloper-org/vogt-stack:0.7.17` | The image to run. Pin a digest (§6). |
-| `VOGT_VOICE_IMAGE` | no | `ghcr.io/thedancingdeveloper-org/vogt-voice:0.7.17` | The sidecar. Pin the same release as the stack. |
+| `VOGT_STACK_IMAGE` | no | `ghcr.io/thedancingdeveloper-org/vogt-stack:0.7.18` | The image to run. Pin a digest (§6). |
+| `VOGT_VOICE_IMAGE` | no | `ghcr.io/thedancingdeveloper-org/vogt-voice:0.7.18` | The sidecar. Pin the same release as the stack. |
 | `COMPOSE_PROFILES` | no | `voice` | Clear it to run without the sidecar; the voice controls stay present but inert. |
 | `VOGT_BOOTSTRAP_CORE_TOKEN_ACTOR` | no | `agent:engine` | Who the adopted stack secret acts as — and therefore whom a break-glass token's Vogt calls are attributed to. |
 | `VOGT_BOOTSTRAP_CORE_TOKEN_SCOPES` | no | `read,work.write,project.write` | What it may do. Everything in the pod can read the file, so this is the blast radius. |
@@ -596,9 +596,9 @@ a deployment are separate acts, and the digest line is what moves one.
 Resolve the digests of a release:
 
 ```console
-docker buildx imagetools inspect ghcr.io/thedancingdeveloper-org/vogt-stack:0.7.17 \
+docker buildx imagetools inspect ghcr.io/thedancingdeveloper-org/vogt-stack:0.7.18 \
   | grep -m 1 Digest
-docker buildx imagetools inspect ghcr.io/thedancingdeveloper-org/vogt-voice:0.7.17 \
+docker buildx imagetools inspect ghcr.io/thedancingdeveloper-org/vogt-voice:0.7.18 \
   | grep -m 1 Digest
 ```
 

mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vogt-mobile",
-  "version": "0.7.17",
+  "version": "0.7.18",
   "license": "AGPL-3.0-only",
   "private": true,
   "type": "module",

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vogt"
-version = "0.7.17"
+version = "0.7.18"
 description = "A product development environment for the AI era"
 readme = "README.md"
 requires-python = ">=3.11"

src/vogt/__init__.py

@@ -2,6 +2,6 @@
 
 from __future__ import annotations
 
-__version__ = "0.7.17"
+__version__ = "0.7.18"
 
 __all__ = ["__version__"]

tests/test_product_version.py

@@ -16,7 +16,7 @@
 
 def test_product_version_contract_is_in_sync() -> None:
     result = subprocess.run(
-        [sys.executable, "scripts/check_product_version.py", "0.7.17"],
+        [sys.executable, "scripts/check_product_version.py", "0.7.18"],
         cwd=ROOT,
         capture_output=True,
         text=True,
@@ -28,6 +28,6 @@ def test_product_version_contract_is_in_sync() -> None:
 def test_android_version_name_is_derived_from_the_canonical_mobile_manifest() -> None:
     package = (ROOT / "mobile/package.json").read_text(encoding="utf-8")
     gradle = (ROOT / "mobile/android/app/build.gradle").read_text(encoding="utf-8")
-    assert '"version": "0.7.17"' in package
+    assert '"version": "0.7.18"' in package
     assert "new JsonSlurper().parse(file('../../package.json'))" in gradle
     assert "versionName androidVersionName" in gradle

web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vogt-web",
-  "version": "0.7.17",
+  "version": "0.7.18",
   "license": "AGPL-3.0-only",
   "private": true,
   "type": "module",