Add v2026.410.0 release notes

releases/v2026.410.0.md

@@ -0,0 +1,35 @@
+# v2026.410.0
+
+> Released: 2026-04-10
+
+## Highlights
+
+- **Issue workflow and review gates** — Refined the issue detail experience, added explicit review-start controls, tightened execution-policy handoffs, and improved live issue updates across review and approval stages. ([#3000](https://github.com/paperclipai/paperclip/pull/3000), [#3039](https://github.com/paperclipai/paperclip/pull/3039), [#3204](https://github.com/paperclipai/paperclip/pull/3204), [#3222](https://github.com/paperclipai/paperclip/pull/3222), @cryppadotta)
+- **Routines and approvals** — Added draft routine defaults, run-time overrides, generic issue-linked board approvals, and related inbox/activity plumbing so routine-driven work can stay governed without custom workflows. ([#3220](https://github.com/paperclipai/paperclip/pull/3220), [#3204](https://github.com/paperclipai/paperclip/pull/3204), @cryppadotta)
+- **Issue chat, inbox, and navigation UX** — Improved issue chat stability and performance, added nested inbox views and keyboard shortcuts, and polished attachments, image viewing, and issue-detail navigation. ([#3079](https://github.com/paperclipai/paperclip/pull/3079), [#3163](https://github.com/paperclipai/paperclip/pull/3163), [#3205](https://github.com/paperclipai/paperclip/pull/3205), @cryppadotta, @devinfoley)
+- **MCP server and workspace hardening** — Added a standalone Paperclip MCP server package, project-level environment variables, worktree reseeding, and tighter runtime/workspace setup checks. ([#2999](https://github.com/paperclipai/paperclip/pull/2999), [#3001](https://github.com/paperclipai/paperclip/pull/3001), [#3203](https://github.com/paperclipai/paperclip/pull/3203), @cryppadotta)
+
+## Improvements
+
+- **Auth and adapter resilience** — Removed the hardcoded auth JWT secret fallback, improved agent-auth secret fallback behavior, added Bedrock model-selection support for `claude-local`, and hardened resumed Claude/Codex session handling. ([#3124](https://github.com/paperclipai/paperclip/pull/3124), [#3033](https://github.com/paperclipai/paperclip/pull/3033), [#2866](https://github.com/paperclipai/paperclip/pull/2866), [#3299](https://github.com/paperclipai/paperclip/pull/3299), @aronprins, @cleanunicorn, @ergonaworks, @kimnamu)
+- **Execution reliability** — Tightened non-participant stage mutation checks, stabilized comment wake batching, persisted heartbeat child PIDs earlier, and reduced route-test cross-talk in the local test harness. ([#3206](https://github.com/paperclipai/paperclip/pull/3206), [#3222](https://github.com/paperclipai/paperclip/pull/3222), @cryppadotta)
+- **Developer workflow cleanup** — Scoped workspace-link preflight checks to linked worktrees, refreshed worktree/repo-plan docs, and kept generated lockfile refresh flows aligned with CI ownership. ([#3203](https://github.com/paperclipai/paperclip/pull/3203), @cryppadotta)
+
+## Fixes
+
+- **Security authorization hardening** — Company portability import preview/apply, approval decisions, activity creation, heartbeat-run issue listing, and heartbeat cancellation now enforce company-scoped access correctly. ([#3315](https://github.com/paperclipai/paperclip/pull/3315), @cryppadotta)
+- **Security dependency updates** — Upgraded `multer` to `2.1.1` and `rollup` to `4.59.0` to address known CVEs in the shipped dependency graph. ([#2819](https://github.com/paperclipai/paperclip/pull/2819), @mvanhorn)
+- **Server and auth edge cases** — Fixed Express 5 auth wildcard routing, removed the remaining hardcoded JWT fallback in auth init, improved reverse-proxy keepalive behavior, and preserved timezone-aware log timestamps. ([#3124](https://github.com/paperclipai/paperclip/pull/3124), [#3009](https://github.com/paperclipai/paperclip/pull/3009), [#2936](https://github.com/paperclipai/paperclip/pull/2936), [#2937](https://github.com/paperclipai/paperclip/pull/2937), @KhairulA, @Lempkey, @cleanunicorn)
+- **Issue and runtime stability** — Fixed long-thread typing lag, signoff follow-up handling, workspace link/runtime regressions, identifier collisions in issue creation, and stale session recovery in Codex resume flows. ([#3163](https://github.com/paperclipai/paperclip/pull/3163), [#2818](https://github.com/paperclipai/paperclip/pull/2818), [#2909](https://github.com/paperclipai/paperclip/pull/2909), @devinfoley, @marysomething99-prog, @mvanhorn)
+
+## Upgrade Guide
+
+Database migrations `0049` through `0054` will run automatically on startup. These add issue-relation and execution-decision data, inbox dismissal state, project environment support, and draft-routine storage. The migrations are additive, but operators should still take a backup before upgrading production data.
+
+If you are upgrading for the security advisory, make sure every deployed package is at least `2026.410.0`. Versions earlier than `2026.410.0` should be treated as vulnerable for the published GHSA.
+
+## Contributors
+
+Thank you to everyone who contributed to this release!
+
+@AllenHyang, @aronprins, @cleanunicorn, @cryppadotta, @DanielSousa, @davison, @devinfoley, @ergonaworks, @HearthCore, @HenkDz, @KhairulA, @kimnamu, @Lempkey, @marysomething99-prog, @mvanhorn, @plind-dm, @shoaib050326, @sparkeros, @wbelt