release: v1.37.0

[Desperado]

Summary

Ship v1.37.0 rolling up the model-picker and transcript-verbosity work from the last day.

• Opus 5.5 becomes the default (⭐) Claude Code entry on shortcut `3`, and is now also offered in the Direct API picker. Sonnet 5 stays selectable but is no longer the default. (feat(orch): surface Opus 5.5 in Claude Code + Direct API pickers #209)
• New `narrate_tool_calls` config knob (`off` / `brief` (default) / `full`) controls how much the CLI agent (cc/codex/agy/opencode) prefaces each tool call in the transcript. Set via `qmax-code config set narrate_tool_calls `. (feat(config): narrate_tool_calls knob for CLI agent transcript #210)
• `narrationDirective` now carries a mandatory redaction clause in every mode — API keys, bearer/session tokens, `Authorization:` / `Cookie:` header values, connection strings, `--token=` / `--api-key=` flags, `AWS_` / `GITHUB_TOKEN` / `ANTHROPIC_API_KEY` and other `_KEY` / `_TOKEN` / `_SECRET` env-var values, and webhook signing secrets must be replaced with `` before being echoed. Raw `env` / `printenv` / `.env*` contents must not be quoted in narration. Guarded by `TestNarrationDirectiveCarriesRedactionClause`. (fix(agent): harden narrationDirective against secret leakage #211)

Full details in CHANGELOG.md.

Test plan

• `go build ./...` on the underlying commits (feat(orch): surface Opus 5.5 in Claude Code + Direct API pickers #209, feat(config): narrate_tool_calls knob for CLI agent transcript #210, fix(agent): harden narrationDirective against secret leakage #211)
• `go test ./...` — 18 packages green
• Tag `v1.37.0` on merge → `.github/workflows/release.yml` builds six-platform archives (darwin amd64/arm64, linux amd64/arm64, windows amd64/arm64) and publishes them to the public releases repo.

Post-merge

```bash
git checkout main && git pull --ff-only
git tag v1.37.0 && git push origin v1.37.0
gh run watch # release workflow builds & publishes
```

Note on branch protection

Discovered while merging #211 that `main` branch protection was already disabled (likely left off after a prior release's admin-lift step). Not touching it in this PR — flagging so it can be re-armed with the correct settings post-release.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: unavailable — no completed model review

Re-review: Open the QualityMax check and select Re-review after it completes.

Files eligible: 1 · Files reviewed: 1 · Files with findings: 0 · Findings: 0 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	skipped · eligible 0, reviewed 0 · LLM · All changed files were excluded as non-code, generated, or binary content.
SAST	completed · eligible 1, reviewed 1 · hybrid
Overall review evidence	unavailable — insufficient model review evidence
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: VERIFIED independently judged patch · REPRODUCED verified finding · GROUNDED deterministic evidence · MODEL-ONLY model judgment.

QualityMax project results are available in the configured project.

_{Receipt · commit 44557b4cbcdedd227e0db4b2d610f58a9eddf88a · run 2026-09-26T22:02:22+00:00 · model served not applicable · model requested not applicable · model review unavailable — no completed model review · model source not recorded · re-review 2 · proof counts {}}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	⏭️ Skipped — All changed files were excluded as non-code, generated, or binary content. · skipped · 0 eligible / 0 reviewed · All changed files were excluded as non-code, generated, or binary content.
🔍 SAST	completed · 1 eligible / 1 reviewed
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5327636822 and overview #5850260629 confirmed
🧪 Repo Tests	✅ 844/844 passed (go)

_{Powered by QualityMax — AI-Powered Test Automation}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.