docs: v0.13.0 release notes (readable public prose)

.gitignore

@@ -52,6 +52,13 @@ docs/product-pilot-judge-results-*.md
 docs/product-pilot-*.md
 docs/vscode-plugin.md
 
+# ── internal ADRs / embed hook (living developer docs — not public tip) ──
+docs/ADR-*.md
+docs/CE-EMBED-HOOK.md
+
+# ── local skill-shell umbrella workspace (never ship) ──
+skill-shell-rationalization/
+
 # ── machine-level admin policy drop-in (never commit a live copy) ──
 /admin.json
 /admin.baked.json

CHANGELOG.md

@@ -3,6 +3,62 @@
 Human-curated release notes. Earlier 0.9.x notes also live on the
 [GitHub releases](https://github.com/benjsmith/switchbay/releases) page.
 
+## 2026-09-29 — v0.13.0
+
+**Migration:** none. **Breaking:** none for wiki/vault format. After pull,
+run `make refresh BUILD=1` and hard-reload the PWA. No new VSIX.
+
+Switchbay **0.13.0** same-origin reverse-proxies curiosity-engine and
+okstratr (no iframes), mounts skill UIs in the same document, dual-mounts
+CE sidebar + Graph canvas, auto-starts core skills, and is a thin client
+over okstratr’s harness registry. Built-in Graph, Agents, and filebrowser
+remain; proxied embeds are opt-in in Settings.
+
+Skill versions:
+
+| Skill | Version | Notes |
+|---|---|---|
+| curiosity-engine | **1.9.0** | Dual-mount Pages + atlas; IndexedDB cache |
+| okstratr | **0.2.0** | Hosted proxy; registry SSOT; observer desk UX |
+| curiosity-merge | **0.8.4** | Installer / UI-boundary contract |
+
+See [release notes](docs/releases/v0.13.0.md) and [architecture](docs/architecture.md).
+
+### Added
+
+- **Same-origin embed reverse-proxy** — `/embed/ce/*` → `:8766`,
+  `/embed/okstratr/*` → `:8767`; loopback-only upstreams; inject
+  `X-CE-Host` / `X-Okstratr-Host: switchbay`. Feature flag
+  `proxied_skill_embeds` (Settings) switches Graph → CE / Agents → okstratr;
+  daemon proxy is always on. Built-ins **not** deleted.
+- **Same-document skill mount** — fetch proxied HTML when core-skills
+  healthy; rewrite assets; execute scripts in-panel; wait chrome via
+  `GET /api/core-skills/status` (`starting` / `unhealthy` / `building_wiki` /
+  `live`). Soft-reload on `sy:files-changed`.
+- **Dual-mount CE Graph** — shell-left `CeSidebarSlot` (Pages|Files persists
+  across Graph/Agents/Editor) + Graph-pane `CeAtlasEmbed` canvas; shared
+  `ceEmbedSession`; prefers `window.CEEmbed.create` when present; keeps
+  atlas warm across tab switches; loads `atlas-cache.js` for cold Graph cache.
+- **Core-skills auto-start** — always start CE + okstratr with the shell;
+  rail `host_notify`; `OKSTRATR_HOSTED=switchbay` on supervised serve.
+- **Settings → okstratr harness registry** — thin client (`/api/okstratr/harness*`);
+  no second Switchbay allowlist.
+- **Pack / ingest queues** — process CE `.workbench/pack-runs/` via rail LLM;
+  process ingest-runs via `local_ingest` / prefer CE drop-ingest endpoint.
+- **Sandbox roots** — allow `/workspace` (+ env roots) in home-gate.
+
+### Fixed / polish
+
+- Keep CE atlas warm across Graph tab switches; dual-mount sidebar bugs after
+  Graph mount; gzip large JSON + guard soft-remount during CE load; retarget
+  viewer on workspace switch; serve `data.json` fast / enrich off hot path;
+  vault missing-extract UX from `vault.db`.
+
+### Unchanged
+
+- v0.12.19 Curate / desks / Web / Comms / watch-folder / Zen behavior remains
+  the product baseline. Graph and Agents chrome stay; proxied mode is opt-in.
+
 ## 2026-09-20 — v0.12.19
 
 No wiki/vault format migration. Review Web, Comms, and watch-folder behavior changes below. After updating, run `make refresh BUILD=1` and hard-reload the PWA. No new VSIX.

README.md

@@ -15,8 +15,10 @@ curate captured material into linked wiki pages, run Auto orchestration
 It runs **entirely on your machine**, against whatever models you choose,
 and nothing leaves unless you send it.
 
-- **Local & private** — two processes and your files. No cloud, no
-  accounts; your data and API keys stay on your machine.
+- **Local & private** — a Switchbay daemon on your machine (auto-starts
+  curiosity-engine + okstratr) and your files. No cloud, no accounts; your
+  data and API keys stay on your machine. See
+  [`docs/architecture.md`](docs/architecture.md).
 - **Bring your own models** — hosted APIs (Anthropic, xAI Grok, OpenAI,
   Gemini, Meta Muse Spark), subscription coding CLIs (Claude Code, Grok
   Build, Muse Code, Codex, Copilot), or fully-local models (llama.cpp /
@@ -39,7 +41,8 @@ and nothing leaves unless you send it.
 New here? Read **[`docs/concepts-and-data-flow.md`](docs/concepts-and-data-flow.md)**
 — how Switch Bay is put together in one read: the core vocabulary
 (**Workspace → Thread → Run → Turn**), the runtime shape, and the data
-flows behind the things you do most. Provider coverage (what's
+flows behind the things you do most. Hosting / embed architecture:
+**[`docs/architecture.md`](docs/architecture.md)**. Provider coverage (what's
 first-class vs preview, including Muse Code) is
 **[`docs/providers.md`](docs/providers.md)**. The default **open**
 profile is today's consumer product. An optional **enterprise** profile
@@ -99,7 +102,9 @@ make sync           # uv sync (base Python deps; add `make sync-semantic` for em
 make sync-frontend  # pnpm install in frontend/
 ```
 
-Two processes. In one terminal:
+Dev needs the daemon and Vite. The daemon **auto-starts** curiosity-engine
+(`:8766`) + okstratr (`:8767`); Vite is only for hot frontend reload. In
+one terminal:
 
 ```sh
 WORKSPACE=/path/to/workspace make dev-daemon
@@ -112,7 +117,8 @@ make dev-frontend
 ```
 
 Then open the URL vite prints (default `http://localhost:5173`). Vite
-proxies `/api` and `/ws` to the daemon on `:8765`.
+proxies `/api`, `/ws`, and `/embed` to the daemon on `:8765`. Architecture:
+[`docs/architecture.md`](docs/architecture.md).
 
 ## Test
 
@@ -182,6 +188,7 @@ don’t need to quit and reopen the PWA after each restart.
 
 ## More
 
+- **[`docs/architecture.md`](docs/architecture.md)** — how Switchbay hosts CE and okstratr (embed proxy, core-skills, pack/ingest queues).
 - **[`docs/concepts-and-data-flow.md`](docs/concepts-and-data-flow.md)** — the map: concepts + data flows.
 - **[`docs/known-issues.md`](docs/known-issues.md)** — rough edges + deliberate deferrals in this release.
 - **[`docs/THIRD-PARTY-NOTICES.md`](docs/THIRD-PARTY-NOTICES.md)** — third-party attributions.