reference: the release the site documents and the board's counts, generated

The site named no release but the one its install pages had hard-coded, three weeks old, and the
landing page said nothing of how much of Spin is built. `task reference` now writes
src/data/reference.json: the newest spin release the documented commit reaches, the spin and
spin-terraform-aws commits the reference was generated from, and the feature board's counts.
The landing page and its Markdown twin show the counts and the release in one sentence.

Every release a hand-written page names is pinned to that release: `task reference` rewrites it,
and `task reference:check` fails on any other. The reference is regenerated against spin
6b07d27d0 and spin-terraform-aws 3c0100d (`spin open` gets its page).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: aledbf

README.md

@@ -14,6 +14,10 @@ task check        # the reference against the sources, the build, and every link
 - **Reference pages** under `src/content/docs/reference/` are generated by `task reference` from
   checkouts of spin and spin-terraform-aws beside this one (`SPIN=`, `TERRAFORM=` to point
   elsewhere). Edit the source they name, not the page.
+- **What the site documents** is `src/data/reference.json`, written by `task reference`: the spin
+  release an installation runs, the commits the reference was generated from, and the feature
+  board's counts, which the landing page shows. Every release a hand-written page names is pinned
+  to that release: `task reference` rewrites it, and `task reference:check` fails on another.
 - **The status page** `reference/status/` is written from `spin features`, the feature board a
   test in spin holds to the tree. The bullets of `overview/limitations.md` are its limit rows,
   and `task reference:check` fails on a bullet that is not one, or a row no bullet leads with.

src/components/StatusCounts.astro

@@ -0,0 +1,13 @@
+---
+// The feature board's counts and the release the site documents, from src/data/reference.json.
+// The same sentence is the component's text in the page's Markdown twin (src/lib/pages.ts).
+import { statusLine } from '../lib/reference';
+
+const base = import.meta.env.BASE_URL.replace(/\/$/, '');
+const html = statusLine
+	.replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>')
+	.replace(/`([^`]+)`/g, '<code>$1</code>')
+	.replace(/\[([^\]]+)\]\((\/[^)]*)\)/g, (_, text, href) => `<a href="${base}${href}">${text}</a>`);
+---
+
+<p class="status-counts" set:html={html} />

src/content/docs/aws/overview.mdx

@@ -11,7 +11,7 @@ module, [spin-terraform-aws](https://github.com/spin-stack/spin-terraform-aws):
 ```hcl
 module "spin" {
   source       = "github.com/spin-stack/spin-terraform-aws?ref=<tag>"
-  spin_version = "v20260927.03"
+  spin_version = "v20261019.02"
   domain       = "spin.example.com"
 }
 ```

src/content/docs/aws/prerequisites.md

@@ -68,7 +68,7 @@ and region, tagged `spin:version`:
 
 ```bash
 git clone https://github.com/spin-stack/ami && cd ami
-SPIN_VERSION=v20260927.03 task build publish
+SPIN_VERSION=v20261019.02 task build publish
 ```
 
 The build fetches the release, checks every file against its signature, and lays it into a
@@ -80,5 +80,5 @@ tag.
 
 ## Pick a release
 
-Releases are named by date: `v<YYYYMMDD>.<N>`, such as `v20260927.03`, the third release of 27
-September 2026. See [github.com/spin-stack/spin/releases](https://github.com/spin-stack/spin/releases).
+Releases are named by date: `v<YYYYMMDD>.<N>`, the Nth release of that day. This site documents
+`v20261019.02`. See [github.com/spin-stack/spin/releases](https://github.com/spin-stack/spin/releases).

src/content/docs/aws/setup.md

@@ -35,7 +35,7 @@ $(tofu -chdir=../../bootstrap output -raw init)
 That runs `tofu init` against the state bucket. Then write `terraform.tfvars`:
 
 ```hcl
-spin_version = "v20260927.03"
+spin_version = "v20261019.02"
 domain       = "spin.example.com"
 # name   = "spin"        # a prefix for every resource; one installation per name
 # region = "us-west-2"   # the region bootstrap was applied in

src/content/docs/index.mdx

@@ -15,6 +15,7 @@ hero:
 ---
 
 import { CardGrid, LinkCard } from '@astrojs/starlight/components';
+import StatusCounts from '../../components/StatusCounts.astro';
 
 ## What it looks like
 
@@ -43,6 +44,8 @@ A restore from a memory snapshot puts the processes back as they were.
 Each answer is a limit row of the [status page](/reference/status/), held to the code by a test.
 The rest are on [Limitations](/overview/limitations/).
 
+<StatusCounts />
+
 ## Where to go
 
 <CardGrid>

src/content/docs/reference/api/adminservice.md

@@ -260,6 +260,7 @@ No fields: `{}`.
 | `images` | list of [PlatformImage](/reference/api/types/#platformimage) | Empty until the object store is configured: there is nowhere to publish to. |
 | `baseImages` | list of [BaseImage](/reference/api/types/#baseimage) | Every base image published, one per machine release, newest first. |
 | `supervisorReleases` | list of [ExtensionRelease](/reference/api/types/#extensionrelease) | Every release of the supervisor, newest first. |
+| `agentReleases` | list of [ExtensionRelease](/reference/api/types/#extensionrelease) | Every release of the agent CLIs (Claude Code and Codex, one extension), newest first. |
 
 ## GetRegistrationMode
 

src/content/docs/reference/api/index.md

@@ -25,7 +25,7 @@ curl -s https://app.example.com/spin.v1.WorkspaceService/ListWorkspaces \
 - [RunnerTokenService](/reference/api/runnertokenservice/): 4 procedures
 - [SettingsService](/reference/api/settingsservice/): 3 procedures
 - [SetupService](/reference/api/setupservice/): SetupService handles initial platform setup and admin bootstrap. Most endpoints require admin authentication, except GetSetupStatus and PasswordLogin.
-- [WorkspaceService](/reference/api/workspaceservice/): 47 procedures
+- [WorkspaceService](/reference/api/workspaceservice/): 49 procedures
 - [ShareService](/reference/api/shareservice/): ShareService manages snapshot sharing Snapshots can be shared with specific users or made public Users can create new workspaces from shared snapshots
 - [SignatureService](/reference/api/signatureservice/): SignatureService is what only people sign of themselves: who a user's keys are and who a team's members are. A host holds every workspace's access to these (internal/roster), so a control plane that is taken can say neither which keys are somebody's nor who is in a team. A workspace's access is signed through WorkspaceService.SetOwnerWord. The control plane proposes each document from what it holds - a key registered, a member added - and keeps what was signed; it signs nothing. A client shows a person what they are signing and signs it with a key of theirs: `spin sign`, with the keys ssh-agent holds, or the terminal's page, with a passkey.
 - [SSHKeyService](/reference/api/sshkeyservice/): SSHKeyService is the user's own keys, as a registry: the ones a client offers when the owner signs a workspace's word (OwnerWord), and the anchor a create may name. A key here logs in to nothing on its own - only a key the owner's word for a workspace lists does, there.

src/content/docs/reference/api/teamservice.md

@@ -422,7 +422,7 @@ A team's secrets: what a brokered network rule has the host's egress proxy add t
 | `name` | string | Lower-case letters, digits and dashes, starting with a letter; what a rule names it by. |
 | `value` | string | At most 8 KiB of visible ASCII. Replaces what the name held. |
 | `hosts` | list of string | The exact names the secret may be sent to, 1 to 16: a brokered rule that injects it and names any other host is refused it. |
-| `ref` | string | In place of value: the ARN of a Secrets Manager secret the team keeps it in, read as the team (InstallationSettings.team_secrets_role) now and whenever a host asks for it. |
+| `ref` | string | In place of value: the ARN of a Secrets Manager secret or a Parameter Store parameter the team keeps it in, read as the team (InstallationSettings.team_secrets_role) now and whenever a host asks for it. |
 
 **Response**
 

src/content/docs/reference/api/types.md

@@ -86,6 +86,22 @@ BaseImage is the base image of one machine release, as published.
 | `day` | `Timestamp` | The day's first instant, UTC. |
 | `services` | list of [ServiceCost](/reference/api/types/#servicecost) | Costliest first. |
 
+## BrokeredRequest
+
+BrokeredRequest is one request the egress proxy read from the workspace's machine to a brokered name. No header and no body: what the proxy set is the team's secret, and what the machine sent is its own.
+
+| Field | Type | What it is |
+|---|---|---|
+| `name` | string |  |
+| `method` | string |  |
+| `path` | string | As the machine sent it, without the query. |
+| `status` | integer (int32) | What the real host answered; what the proxy answered for a refusal. |
+| `bytesSent` | string (int64) |  |
+| `bytesReceived` | string (int64) |  |
+| `at` | `Timestamp` |  |
+| `refused` | string | Empty for a request passed on. Otherwise why the proxy refused it: credentials (a secret or token the team does not hold), host (a request for another name), upgrade, method (TRACE or TRACK), scope (a method or path the injecting rule does not allow), authority (the cloud principal refused to sign it). |
+| `principal` | string | Who asked: "user" or "agent", by the listener the proxy read it on. |
+
 ## BurstMode
 
 BurstMode is how a workspace of a preset may grow past what it starts with.
@@ -371,6 +387,18 @@ Image is one name a workspace can be created from: a publication in this install
 | `name` | string | What a person choosing a disk is shown: its name ("base image") and what it is ready for. An empty name is a publication made before one was asked for; show the ref. |
 | `description` | string |  |
 
+## InjectionStatus
+
+InjectionStatus is one header the egress proxy sets on the workspace's requests to a brokered name, and whether the workspace's team holds what it is set from.
+
+| Field | Type | What it is |
+|---|---|---|
+| `policy` | string | The policy, by name, and the names its rule brokers. |
+| `names` | list of string |  |
+| `header` | string |  |
+| `from` | string | What the header is set from: a team secret by name, "<forge> app", or "identity for <audience>". |
+| `held` | boolean | Whether the team holds it: the secret is set, the forge app is set, an identity is always held. False is a request refused with credentials. |
+
 ## InstallationSettings
 
 InstallationSettings contains global settings for the Spin installation
@@ -394,7 +422,8 @@ InstallationSettings contains global settings for the Spin installation
 | `workspaceIdleSuspendMinutes` | integer (int32) | How many minutes a running workspace may go unused - nobody working over its ssh, editor or forwarded ports, and its cores all but still - before it is suspended with its processes, which its next start resumes. 0 suspends none; 60 is what an installation that says nothing keeps, and a week is the most. |
 | `workspaceMaxRunningMinutes` | integer (int32) | How many minutes a workspace may run at a stretch, used or not, before it is suspended the same way: a process that keeps its cores busy is use to the rule above, and this is what ends it. Counted from its machine's start, which a resume is too. 0 caps none; 720 is what an installation that says nothing keeps, and a week is the most. |
 | `workspaceLeaseMaxMinutes` | integer (int32) | How many minutes a process may keep its workspace awake at a stretch (a lease: `spin-supervisor keep -- <cmd>`, a .spin.yaml task with keep_awake). While a lease is held and within this of its start, nobody is asked, nothing idle is suspended, and the running cap waits for the lease's end. 0 honours no lease; 480 is what an installation that says nothing keeps, and a week is the most. |
-| `teamSecretsRole` | string | The IAM role a team's secret kept in Secrets Manager is read under, in a session tagged spin-team-id with the team: its policy lets that session read only what carries the same tag. Empty, no secret is kept as a reference. |
+| `teamSecretsRole` | string | The IAM role a team's secret kept in Secrets Manager or Parameter Store is read under, in a session tagged spin-team-id with the team: its policy lets that session read only what carries the same tag. Empty, no secret is kept as a reference. |
+| `agentsFetch` | boolean | Whether the control plane fetches the agent CLIs - Claude Code and Codex - from their publishers on its own: the newest release of each, looked for daily. False, it fetches none, and a workspace is given the pair the control plane's image carries or one an administrator published. |
 
 ## Job
 
@@ -515,6 +544,7 @@ NetworkRule is one thing a network policy allows: these destinations on these po
 | `inject` | list of [HeaderInjection](/reference/api/types/#headerinjection) | Headers the proxy sets on a brokered rule's requests, each from a secret of the workspace's team (or the nearest team above it with one by that name). Brokered rules only. |
 | `cloud` | [CloudAccess](/reference/api/types/#cloudaccess) | The principal the proxy authorizes a brokered rule's requests as, on its cloud: the host takes its credentials as the workspace, with a token of its identity. Brokered rules naming that cloud's endpoints only, and not with inject. |
 | `verifySni` | boolean | The host's egress proxy reads the TLS server name of each connection to these names and passes on, untouched, only one this rule names: an address shared with other names opens only these to a client that says which it wants. A connection with no name, or one hiding it (ECH), goes nowhere. Names only, on TCP, never with broker; it does not stop a client that lies. |
+| `principal` | string | Whose connections a brokered rule stands in for: "agent" (the workspace's agent, whose packets its guest marks), "user" (everything else the workspace sends), or "any" (empty: both). Two rules for one name, one per principal, each with its own injections and methods, say what the person may do and what the agent may. Brokered rules only: an agent reaches nothing outside the proxy, so a rule that is not brokered is the person's already. |
 
 ## ObservedDestination
 
@@ -736,6 +766,7 @@ The repository a workspace opened, as its guest clones it: the project's URL, th
 | `fromCommit` | string | from_commit is the commit the disk's checkout already is, for a disk cloned from a prebuild: the guest holds the tree to it (git fsck, no tracked file changed) before it fetches. |
 | `prebuildId` | string | The prebuild the disk is a clone of, and the SHA-256 of the claim its host signed of it (PrebuildClaim): what the owner approves when the open was from one. |
 | `prebuildClaimDigest` | string |  |
+| `pullRef` | string | pull_ref is a pull request's ref as its forge serves it (refs/pull/<n>/head, GitLab's refs/merge-requests/<n>/head), fetched once ref is cloned and checked out as pr-<n> or mr-<n>; empty for a workspace that opens at ref itself. |
 
 ## ResolverLookup