@@ -34,3 +34,5 @@ ui/playwright-report/
 src/shadow_agent/_assets/
 /target
 /src-tauri/gen/
+/tools/llama.cpp/
+/packaging/llama.cpp/bin/
@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.27.0 — Managed local inference
+
+- Local GGUF rows load through a ShadowCode-managed llama.cpp runtime
+  (`~/.local/lib/shadowcode/llama-server`). The engine prefers that binary over
+  PATH. It does not start Ollama or LM Studio. Removing a catalog entry still
+  never deletes weights. One GGUF is loaded at a time.
+- Codex, Claude Code, and Cursor now receive real image bytes on their official
+  interfaces (Codex `localImage`, Claude image source blocks, ACP `image`).
+  Antigravity still rejects attachments because its stream-json input does not
+  document image blocks. Local GGUF vision is enabled only when an mmproj
+  companion file is present.
+- CPU llama.cpp is compiled from a pinned upstream commit and installed with
+  the AppImage. Models are never auto-downloaded.
+
 ## 0.26.0 — Desktop coding agent
 
 - One searchable composer picker with **Subscriptions** and **On this computer**.
 
@@ -4,7 +4,7 @@ default-members = ["native/core"]
 resolver = "2"
 
 [workspace.package]
-version = "0.26.0"
+version = "0.27.0"
 edition = "2021"
 rust-version = "1.95"
 license = "MIT"
 
@@ -1,6 +1,6 @@
 # ShadowCode
 
-![version](https://img.shields.io/badge/version-0.26.0-386c51) ![Rust](https://img.shields.io/badge/runtime-Rust%201.95-orange) ![license](https://img.shields.io/badge/license-MIT-green)
+![version](https://img.shields.io/badge/version-0.27.0-386c51) ![Rust](https://img.shields.io/badge/runtime-Rust%201.95-orange) ![license](https://img.shields.io/badge/license-MIT-green)
 
 **Your ideas. Your models. Your machine.**
 
@@ -10,8 +10,9 @@ context, tools, permissions, checkpoints, plans, and verification.
 
 ![ShadowCode workspace](docs/images/workspace-light.png)
 
-**Native 0.26 release:** one unified model picker (Codex, Claude Code, Cursor,
-Antigravity, and local models). The `main` branch builds a Rust/Tauri desktop window
+**Native 0.27 release:** one unified model picker (Codex, Claude Code, Cursor,
+Antigravity, and local models). Local GGUF rows run through a managed llama.cpp
+runtime installed with the app. They do not start Ollama or LM Studio. The `main` branch builds a Rust/Tauri desktop window
 with the interface embedded in the executable. It needs no Python runtime or
 browser launcher. See the [native desktop guide](docs/NATIVE_DESKTOP.md)
 and the [goals](docs/NATIVE_GOALS.md) and [model routing](docs/NATIVE_ROUTING.md)
@@ -37,16 +38,16 @@ Integrations and release checks are tracked under the [release gates](docs/NATIV
 
 ## Native AppImage
 
-Download the `v0.26.0` **x86_64 AppImage**
+Download the `v0.27.0` **x86_64 AppImage**
 and its `SHA256SUMS` file from [GitHub releases](https://github.com/Shadowfetchapps/ShadowCode/releases/latest).
 The native application embeds its interface; Python, Node.js and a browser
 launcher are not runtime dependencies. The release targets **Ubuntu 24.04 or
 newer / glibc 2.39+**. Git and a model provider such as Ollama remain external.
 
 ```bash
 sha256sum --ignore-missing -c SHA256SUMS
-chmod +x ShadowCode_0.26.0_amd64.AppImage
-./ShadowCode_0.26.0_amd64.AppImage --appimage-extract-and-run
+chmod +x ShadowCode_0.27.0_amd64.AppImage
+./ShadowCode_0.27.0_amd64.AppImage --appimage-extract-and-run
 ```
 
 Extraction mode works without FUSE. To install into `~/Applications`, add a
@@ -55,7 +56,7 @@ stable `shadow` and `shadowcode` commands, and replace the desktop launcher:
 ```bash
 git clone https://github.com/Shadowfetchapps/ShadowCode.git
 cd ShadowCode
-./scripts/install-appimage.sh /path/to/ShadowCode_0.26.0_amd64.AppImage
+./scripts/install-appimage.sh /path/to/ShadowCode_0.27.0_amd64.AppImage
 ```
 
 Keep `SHA256SUMS` beside the download and the installer verifies its matching
 
@@ -96,13 +96,22 @@ coordination sidecars. Directory capabilities confine database/sidecar paths;
 query work, concurrent readers and output are bounded. Cancellation interrupts
 SQLite and releases its connection; an OS filesystem stall may delay return.
 
+## Local GGUF inference
+
+ShadowCode can spawn a managed `llama-server` on 127.0.0.1 with one user-owned
+GGUF at a time. It does not start Ollama or LM Studio and does not download
+weights. Removing a catalog row deletes only the pointer, never the file. The
+managed binary lives under `~/.local/lib/shadowcode/` after install.
+
 ## Vendor subscription CLIs
 
 Codex, Claude Code, Cursor, and Antigravity run as official local CLIs.
 ShadowCode does not scrape cookies, extract OAuth tokens, or treat a Gemini API
 key as Antigravity subscription access. Disconnecting ShadowCode does not always
 log out a shared native CLI — use that vendor's own logout when you want the
-CLI session gone.
+CLI session gone. Image attachments are forwarded only on official vendor fields
+(Codex `localImage`, Claude image source blocks, Cursor ACP `image`). Antigravity
+rejects images.
 
 ## Secrets and transcript content
 
 
@@ -140,8 +140,8 @@ From the repository root, build both package formats with:
 ```sh
 node scripts/build-native.mjs
 node scripts/check-native-package.mjs \
-  target/release/bundle/appimage/ShadowCode_0.26.0_amd64.AppImage \
-  target/release/bundle/deb/ShadowCode_0.26.0_amd64.deb
+  target/release/bundle/appimage/ShadowCode_0.27.0_amd64.AppImage \
+  target/release/bundle/deb/ShadowCode_0.27.0_amd64.deb
 node scripts/test-native-runtime.mjs
 node --test scripts/test-native-source-fetch.mjs
 node scripts/test-native-runtime-sources.mjs
 
@@ -1,3 +1,12 @@
+ShadowCode 0.27.0 keeps the desktop coding-agent picker and adds a real
+managed local runtime. Local GGUF files you already have load through
+`~/.local/lib/shadowcode/llama-server`. ShadowCode does not start Ollama or
+LM Studio. Weights are never auto-downloaded or deleted when a catalog row is
+removed. Codex, Claude Code, and Cursor receive official image bytes; Antigravity
+still rejects attachments.
+
+Downloads: `ShadowCode_0.27.0_amd64.AppImage`, `ShadowCode_0.27.0_amd64.deb`.
+
 ShadowCode 0.26.0 is a desktop coding agent: open a project, pick one
 execution target, describe the task, watch it work. The composer has a single
 searchable picker for Codex, Claude Code, Cursor, Antigravity, and local
@@ -25,84 +34,3 @@ to simplify the onboarding flow and elevate workspace feel.
 Downloads: `ShadowCode_0.25.0_amd64.AppImage`, `ShadowCode_0.25.0_amd64.deb`,
 the AppImage runtime source archive, and `SHA256SUMS`. Binaries target x86_64,
 Ubuntu 24.04+ / glibc 2.39+.
-
----
-
-ShadowCode 0.24.0 adds vendor CLI agent backends. You can run Claude, Codex, or
-Grok subscriptions by spawning the official CLI. ShadowCode never reads or
-stores those OAuth tokens.
-
-- **Codex:** `codex app-server` JSON-RPC, falling back to `codex exec --json`
-  only when app-server is unavailable.
-- **Grok:** `grok agent stdio` (Agent Client Protocol).
-- **Claude:** headless stream-json. Anthropic forbids third-party use of
-  Pro/Max OAuth tokens directly (enforced 2026); the official binary with the
-  user's own login is currently tolerated but not guaranteed.
-- Doctor, picker, and Settings → Advanced knobs. Rewind does not apply to
-  vendor-agent tasks.
-
-Downloads: `ShadowCode_0.24.0_amd64.AppImage`, `ShadowCode_0.24.0_amd64.deb`,
-the AppImage runtime source archive, and `SHA256SUMS`. Binaries target x86_64,
-Ubuntu 24.04+ / glibc 2.39+. Git and model providers such as Ollama remain
-external. Vendor CLIs are optional and are never bundled.
-
----
-
-ShadowCode 0.23.0 hardens the verification gate, live steering and parallel
-workspace recovery. The Rust/Tauri app embeds its interface and needs no Python
-or Node runtime.
-
-- **Honest verification:** a task is verified only when its last test, build,
-  lint or type-check command succeeded and nothing failed afterwards. The
-  failing-test-first flow requested for bug fixes now completes as verified;
-  model prose never does. Bug-fix wording is matched as whole words.
-- **Steering:** a rejected pause on a queued task can no longer park it at its
-  first boundary. One Steer action pauses and records the instruction; the task
-  stays paused until Resume.
-- **Parallel workspaces:** a checkout deleted outside ShadowCode is reported by
-  name and pruned during cleanup while its branch is retained.
-- **Secrets:** `.env.example`-style templates are readable; `.env`, `secrets.env`,
-  credential JSON and private keys remain refused, and tool output is redacted
-  before reaching the model.
-
-Downloads: `ShadowCode_0.23.0_amd64.AppImage`, `ShadowCode_0.23.0_amd64.deb`,
-the AppImage runtime source archive, and `SHA256SUMS`. Binaries target x86_64,
-Ubuntu 24.04+ / glibc 2.39+. Git and model providers such as Ollama remain external.
-
----
-
-ShadowCode 0.22.3 improved native Linux coding workflows, project isolation and recovery.
-
-- **Conversation control:** fork from a response with completed tool context;
-  later turns stay out of the fork and the original remains intact.
-- **Safe recovery:** pause, steer and resume tasks; checkpoint rewind waits for
-  a safe boundary and refuses competing workspace activity.
-  Attached windows retain events after engine replacement and can close during
-  reconnection without waiting for a new engine.
-- **Local model tuning:** visible context and Ollama residency controls, with
-  validated settings preserved when selecting saved models.
-- **Parallel workspaces:** prepare up to two branches, open explicit tasks,
-  check the combined merge result and remove clean checkouts while retaining
-  commits. No automatic worker dispatch or integration is implied.
-- **Code intelligence:** private bounded AST cache, confined file access,
-  Unicode-safe signatures, stale-entry removal and syntactic call-site queries.
-- **Execution hardening:** owned scratch directories, correct project mount
-  order, early bubblewrap probing and no replay of failed shell executions.
-- **Guardian:** optional diagnostics and properly scoped proposal approval.
-  Diagnostics identify test commands but do not run tests or generate patches.
-- **Linux launch reliability:** preserve the caller directory and relative project
-  paths; keep external Python tools usable and both installed CLI names in sync.
-- **Reproducible release checks:** clean hosts build the real application before
-  process tests, and packaging retains Rustup while excluding unsafe PATH entries.
-
-Downloads: `ShadowCode_0.22.3_amd64.AppImage`,
-`ShadowCode_0.22.3_amd64.deb`, the AppImage runtime source archive, and `SHA256SUMS`.
-Binaries target x86_64, Ubuntu 24.04+ / glibc 2.39+. Git and model providers such
-as Ollama remain external.
-
-Keep SHA256SUMS beside the AppImage and run
-`scripts/install-appimage.sh /path/to/ShadowCode_0.22.3_amd64.AppImage` to verify
-and install it in `~/Applications`. Existing settings, keys and task history
-are preserved. Extraction mode works without FUSE.
-
-See `docs/SHADOWCODE_022_QUALIFICATION_REPORT.md` for tested scope and limitations.
@@ -1,13 +1,13 @@
 # Native release procedure
 
-This procedure publishes the Rust/Tauri 0.26 application. The tag workflow is
+This procedure publishes the Rust/Tauri 0.27 application. The tag workflow is
 the release authority: it does not build, upload, or mention the legacy Python
 wheel, source distribution, portable archive, or browser launcher.
 
 ## Prepare the release
 
 1. Update the shared version in `Cargo.toml` and `src-tauri/tauri.conf.json`.
-   They must match the tag exactly, for example `v0.26.0`.
+   They must match the tag exactly, for example `v0.27.0`.
 2. Update `CHANGELOG.md`, `docs/RELEASE_NOTES.md`, README download commands and
    native migration/verification records with only evidence that is current for
    the tagged commit.
 
@@ -1,25 +1,26 @@
-# ShadowCode 0.26 product simplification
+# ShadowCode 0.27 product simplification
 
 Visual target: the two six-panel desktop boards (home, unified picker, accounts, activity, review, local models). Names, percents, and pass counts in those boards are layout examples only.
 
 ## Status
 
-- [x] Inspect origin/main (0.25.0 already shipped) and keep reliable vendor CLI code
+- [x] Inspect origin/main (0.26.0 already shipped) and keep reliable vendor CLI code
 - [x] One searchable composer picker: Subscriptions + On this computer
 - [x] Cursor ACP adapter (`cursor-agent acp`) and Antigravity `agy` stream-json adapter
 - [x] Keep Grok adapter; do not feature it in the primary picker
 - [x] Truthful usage snapshots (unknown/stale/shared; never invent percents)
-- [x] Built-in GGUF catalog + optional llama.cpp spawn (no auto-download)
-- [x] Image attach only when the selected route actually supports vision
+- [x] Built-in GGUF catalog + managed llama.cpp runtime (no auto-download)
+- [x] Image attach only when the selected route actually forwards vision bytes
 - [x] Compact activity timeline; Mode tabs / chip stack off the default composer
 - [x] Accounts + Local models settings (official login commands, no password forms)
-- [x] Deterministic tests for picker, usage, image rejection, cancel, new protocols
-- [x] Version 0.26.0, docs, AppImage install, push origin/main
+- [x] Deterministic tests for picker, usage, image forwarding, cancel, new protocols
+- [x] Version 0.27.0, docs, AppImage install, push origin/main
 
 ## Honest limits
 
 - Antigravity 1.2.8 has no `usage` command; quota stays "Usage unavailable"
 - Cursor `about` reports plan tier, not remaining allowance — do not render a percent
-- llama.cpp is not bundled; Ready only after the user points at a verified binary and a GGUF they already have
+- llama.cpp is bundled as a managed CPU binary; Ready after that binary is installed and a user-owned GGUF is cataloged
 - Ollama tags stay optional compatibility rows, never treated as GGUF
-- Vendor CLIs own their tool loops; images on those routes are rejected until the adapter passes real image bytes
+- Vendor CLIs own their tool loops. Codex/Claude/Cursor receive official image bytes. Antigravity rejects images.
+- No chat GGUF existed on this machine; live generation against user weights was not proven