release: promote frozen 0.6.5 beta candidate to stable

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -50,7 +50,7 @@ body:
     id: node
     attributes:
       label: Node version
-      description: Output of `node --version`. The supported minimum is 22.13.
+      description: Output of `node --version`. The supported minimum is 24.0.0.
     validations:
       required: true
   - type: dropdown
@@ -93,5 +93,5 @@ body:
           required: true
         - label: This is not a security vulnerability.
           required: true
-        - label: I am running a supported Node version (>= 22.13) on Linux (systemd + rootless Podman).
+        - label: I am running a supported Node version (>= 24.0.0) on Linux (systemd + rootless Podman).
           required: true

.github/workflows/ci.yml

@@ -15,9 +15,8 @@ jobs:
       matrix:
         # Linux only: ChannelGate runs under systemd with rootless Podman, so there is no macOS leg.
         os: [ubuntu-latest]
-        # 22.13 is the exact supported minimum (node:sqlite is stable from 22.13 — see
-        # package.json engines); 24 is the current LTS line. Node 20 cannot run the app at all.
-        node: ["22.13", "24"]
+        # Exercise the exact supported floor and the current Node 24 LTS patch.
+        node: ["24.0.0", "24"]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

.github/workflows/release.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: "22.13"
+          node-version: "24"
           cache: npm
       - run: node scripts/check-release-candidate.mjs
       - run: npm ci

.nvmrc

@@ -0,0 +1 @@
+24

AGENTS.md

@@ -64,7 +64,7 @@ post/edit the reply in the thread (degraded to the surface's capabilities) → u
 ## Where things live
 
 - `src/start.js` + `src/platform-gate.js` + `src/server.js` — entry and boot. `start.js` checks the
-  Node floor (≥ 22.13, `node:sqlite`) with NO static imports, the gate refuses every non-Linux
+  Node floor (≥ 24.0.0, `node:sqlite`) with NO static imports, the gate refuses every non-Linux
   host with one plain line, then `server.js` boots in this order: `.env`, the legacy-layout
   migration FIRST, the runtime root + database + singleton lock, settings over env, the skills
   catalog, hardening, the container CLI probe (FATAL without one), the MCP socket, Express,
@@ -249,7 +249,7 @@ post/edit the reply in the thread (degraded to the surface's capabilities) → u
   idle reaper), exec (session-leader helpers so a later exec can signal the whole tree),
   credentials, the per-channel HOME volume and the mounts, the operator's VS Code lease
   (`npm run vscode -- <channel>`).
-- `containers/` — the runtime image: `Containerfile` (`node:22-bookworm-slim`, the `agent` user
+- `containers/` — the runtime image: `Containerfile` (`node:24-bookworm-slim`, the `agent` user
   at the daemon's real uid/gid, tini, a root-owned toolchain under `/opt/channelgate`),
   `versions.json` (`imageSpecVersion` + every pin: Claude Code, Codex, `mcp-remote`, `vercel`,
   `supabase`, Playwright + `agent-browser` with Chromium, Python with OpenCV and faster-whisper;

CONTRIBUTING.md

@@ -11,8 +11,8 @@ trailer on each commit *is* that acceptance (CLA Section 7). Participation is go
 
 ## Set up
 
-Requirements: Node **>= 22.13** (the floor is exact — `node:sqlite` is stable from 22.13 and the
-daemon refuses to boot below it), Git, and Linux — the daemon refuses to boot anywhere else.
+Requirements: Node **>= 24.0.0** (use the current Node 24 LTS release; `nvm use` reads
+the repository's `.nvmrc`), Git, Linux, and the container runtime described in [INSTALL.md](./INSTALL.md).
 
 ```bash
 git clone <your fork> && cd <checkout>
@@ -26,6 +26,27 @@ database) lives outside the repository under the gateway runtime root, not in th
 `INSTALL.md` covers a full working install; the tests below need neither Slack credentials nor a
 running daemon.
 
+## TypeScript for new code
+
+TypeScript is the default for new backend and browser modules, Node scripts, and tests. Use strict
+type checking and explicit types at module boundaries. Validate external inputs at runtime; types
+do not replace the existing authorization checks, schemas, or adapter validation. Do not suppress
+type errors with blanket `any` annotations or disabled checking.
+
+Adopt TypeScript incrementally. Existing JavaScript files can receive focused maintenance fixes;
+when substantially extending a module, migrate it or extract the new implementation into a typed
+module. A feature does not require a rewrite of unrelated JavaScript. Shell and Python helpers
+keep their appropriate language.
+
+The current daemon and tooling execute JavaScript directly. Before adding the first executable
+TypeScript module, include the mixed JavaScript/TypeScript build and execution support in that
+change, with reproducible checks on the supported Node versions. Cover test discovery, browser
+assets, container helper staging, installation/update/release paths, and the existing static and
+security checks wherever affected. Type checking must run in CI. Do not introduce a `.ts` file
+that these paths cannot execute, ship, or check; do not raise the Node minimum implicitly. This
+policy establishes the language choice; it does not claim that runtime TypeScript support has
+already shipped.
+
 ## Run the checks
 
 ```bash
@@ -45,7 +66,7 @@ Tests must leave no scratch directories behind. Create temp directories with `te
 exit-handler cleanup, and `npm test` also runs `scripts/test-scratch-sweep.mjs` first to sweep
 anything a crashed run left in the system temp dir.
 
-Every one of these must pass before you open a pull request. CI runs the suite on Node 22.13 and 24
+Every one of these must pass before you open a pull request. CI runs the suite on the exact Node 24.0.0 minimum and current Node 24
 on ubuntu-latest.
 
 ## Branches and review