diff --git a/.github/workflows/publish-companion.yml b/.github/workflows/publish-companion.yml
new file mode 100644
index 0000000..0d43ce8
--- /dev/null
+++ b/.github/workflows/publish-companion.yml
@@ -0,0 +1,77 @@
+name: Publish companion release
+
+on:
+  workflow_dispatch:
+    inputs:
+      component:
+        description: Released companion module
+        required: true
+        type: choice
+        options: [session, dataflow]
+      tag:
+        description: Existing GitHub release tag (vX.Y.Z)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-companion-${{ inputs.component }}-${{ inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Validate released source
+        id: source
+        env:
+          GH_TOKEN: ${{ github.token }}
+          COMPONENT: ${{ inputs.component }}
+          RELEASE_TAG: ${{ inputs.tag }}
+        run: |
+          set -euo pipefail
+          case "$COMPONENT" in session|dataflow) ;; *) exit 1 ;; esac
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          gh release view "$RELEASE_TAG" --repo "wippyai/$COMPONENT" --json tagName,isDraft,isPrerelease \
+            --jq 'select(.isDraft == false and .isPrerelease == false) | .tagName' > release-tag.txt
+          test "$(cat release-tag.txt)" = "$RELEASE_TAG"
+          echo "version=${RELEASE_TAG#v}" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          path: framework
+          persist-credentials: false
+      - uses: ./framework/.github/actions/setup-wippy
+        id: wippy
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          repository: wippyai/${{ inputs.component }}
+          ref: ${{ inputs.tag }}
+          path: module
+          persist-credentials: false
+
+      - name: Validate module and build notes
+        env:
+          COMPONENT: ${{ inputs.component }}
+          RELEASE_VERSION: ${{ steps.source.outputs.version }}
+        run: |
+          set -euo pipefail
+          test "$(awk '/^module:/ {print $2; exit}' module/wippy.yaml)" = "$COMPONENT"
+          if [ "$COMPONENT" = session ]; then version_file=module/src/_index.yaml; else version_file=module/wippy.yaml; fi
+          test "$(awk '/^version:/ {gsub(/"/, "", $2); print $2; exit}' "$version_file")" = "$RELEASE_VERSION"
+          python3 framework/scripts/release_notes.py --line module/CHANGELOG.md "$RELEASE_VERSION" > release-notes.txt
+          test -s release-notes.txt
+
+      - name: Pack and publish the released module
+        env:
+          WIPPY: ${{ steps.wippy.outputs.path }}
+          WIPPY_TOKEN: ${{ secrets.WIPPY_TOKEN }}
+          RELEASE_VERSION: ${{ steps.source.outputs.version }}
+        run: |
+          set -euo pipefail
+          test -n "${WIPPY_TOKEN:-}"
+          "$WIPPY" publish --config module --version "$RELEASE_VERSION" --dry-run
+          "$WIPPY" publish --config module --version "$RELEASE_VERSION" --release-notes "$(cat release-notes.txt)"
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 12b75f7..45148a8 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,16 +1,16 @@
 {
-  "src/actor": "0.4.4",
-  "src/agent": "0.5.3",
+  "src/actor": "0.4.5",
+  "src/agent": "0.5.4",
   "src/bootloader": "0.3.18",
   "src/docs": "0.3.11",
   "src/embeddings": "0.3.17",
   "src/facade": "0.6.43",
-  "src/llm": "0.5.6",
-  "src/migration": "0.3.22",
-  "src/relay": "0.3.16",
+  "src/llm": "0.5.7",
+  "src/migration": "0.3.23",
+  "src/relay": "0.3.17",
   "src/security": "0.4.3",
   "src/terminal": "0.4.6",
-  "src/test": "0.4.21",
+  "src/test": "0.4.22",
   "src/usage": "0.3.26",
   "src/views": "0.5.12"
 }
diff --git a/src/actor/CHANGELOG.md b/src/actor/CHANGELOG.md
index 9691057..c5216da 100644
--- a/src/actor/CHANGELOG.md
+++ b/src/actor/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.4.5](https://github.com/wippyai/framework/compare/actor-v0.4.4...actor-v0.4.5) (2026-10-14)
+
+
+### Bug Fixes
+
+* harden Lua actor, relay, tool-round and runner behavior ([#165](https://github.com/wippyai/framework/issues/165)) ([d4607bb](https://github.com/wippyai/framework/commit/d4607bb274e09a1d0cc6bef533f45546846fb79b))
+
 ## [0.4.4](https://github.com/wippyai/framework/compare/actor-v0.4.3...actor-v0.4.4) (2026-10-09)
 
 
diff --git a/src/agent/CHANGELOG.md b/src/agent/CHANGELOG.md
index 9ded802..0debe69 100644
--- a/src/agent/CHANGELOG.md
+++ b/src/agent/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.5.4](https://github.com/wippyai/framework/compare/agent-v0.5.3...agent-v0.5.4) (2026-10-14)
+
+
+### Bug Fixes
+
+* Permission refresh is opt-in: bind the execution identity resolver and set refresh_perms to true. Parallel tools share one refresh per batch; sequential tools refresh at each call boundary. Stop is checked again after prompt construction and before provider generation.
+* **agent:** opt in to authority refresh at tool boundaries ([#173](https://github.com/wippyai/framework/issues/173)) ([3b92e76](https://github.com/wippyai/framework/commit/3b92e76d8f8d51343d3a1b5d94483ddf5d8285c9))
+* harden Lua actor, relay, tool-round and runner behavior ([#165](https://github.com/wippyai/framework/issues/165)) ([d4607bb](https://github.com/wippyai/framework/commit/d4607bb274e09a1d0cc6bef533f45546846fb79b))
+
 ## [0.5.3] (2026-10-07)
 
 ### Features
diff --git a/src/llm/CHANGELOG.md b/src/llm/CHANGELOG.md
index f0aac50..8344d25 100644
--- a/src/llm/CHANGELOG.md
+++ b/src/llm/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.5.7](https://github.com/wippyai/framework/compare/llm-v0.5.6...llm-v0.5.7) (2026-10-14)
+
+
+### Features
+
+* **llm:** support OpenAI Decisions evaluation ([#166](https://github.com/wippyai/framework/issues/166)) ([a7baba6](https://github.com/wippyai/framework/commit/a7baba6b5f7e718aec42c1a66783791868d477c6))
+
+
+### Bug Fixes
+
+* harden Lua actor, relay, tool-round and runner behavior ([#165](https://github.com/wippyai/framework/issues/165)) ([d4607bb](https://github.com/wippyai/framework/commit/d4607bb274e09a1d0cc6bef533f45546846fb79b))
+* **llm:** preserve positional messages through prompt mapping ([#177](https://github.com/wippyai/framework/issues/177)) ([199516b](https://github.com/wippyai/framework/commit/199516b9fe963541c1cad46ae5db728b948a7b0b))
+
 ## [0.5.6](https://github.com/wippyai/framework/compare/llm-v0.5.5...llm-v0.5.6) (2026-10-09)
 
 
diff --git a/src/migration/CHANGELOG.md b/src/migration/CHANGELOG.md
index 7d62912..6564607 100644
--- a/src/migration/CHANGELOG.md
+++ b/src/migration/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.3.23](https://github.com/wippyai/framework/compare/migration-v0.3.22...migration-v0.3.23) (2026-10-14)
+
+
+### Features
+
+* **migration:** preserve history across migration renames ([#94](https://github.com/wippyai/framework/issues/94)) ([7a485e9](https://github.com/wippyai/framework/commit/7a485e9b59fc4d59720104bf55157adb3a01a386))
+
 ## [0.3.22](https://github.com/wippyai/framework/compare/migration-v0.3.21...migration-v0.3.22) (2026-10-09)
 
 
diff --git a/src/relay/CHANGELOG.md b/src/relay/CHANGELOG.md
index 244ebd8..36dce72 100644
--- a/src/relay/CHANGELOG.md
+++ b/src/relay/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Changelog
 
+## [0.3.17](https://github.com/wippyai/framework/compare/relay-v0.3.16...relay-v0.3.17) (2026-10-14)
+
+
+### Bug Fixes
+
+* Browser disconnects now start a reconnect grace period, and reconnecting cancels pending retirement. Pair Relay 0.3.17 with Session 0.6.8 or newer so accepted model, tool, and handoff work drains before session exit.
+* harden Lua actor, relay, tool-round and runner behavior ([#165](https://github.com/wippyai/framework/issues/165)) ([d4607bb](https://github.com/wippyai/framework/commit/d4607bb274e09a1d0cc6bef533f45546846fb79b))
+* **relay:** drain sessions before idle hub cleanup ([#179](https://github.com/wippyai/framework/issues/179)) ([c6c8734](https://github.com/wippyai/framework/commit/c6c873448d73e3c8d16c943262b4461002e8f33f))
+* **relay:** enforce connected-client ownership before command dispatch ([#176](https://github.com/wippyai/framework/issues/176)) ([b2f1e92](https://github.com/wippyai/framework/commit/b2f1e924980722694856a70d2b46165b3dd71ec7))
+* **relay:** preserve sessions through disconnect grace ([#180](https://github.com/wippyai/framework/issues/180)) ([5208546](https://github.com/wippyai/framework/commit/520854662a4a32e52100c14013f338acf3b1bd86))
+
 ## [0.3.16] (2026-10-07)
 
 ### Bug fixes
diff --git a/src/test/CHANGELOG.md b/src/test/CHANGELOG.md
index 2639e00..1936c29 100644
--- a/src/test/CHANGELOG.md
+++ b/src/test/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.4.22](https://github.com/wippyai/framework/compare/test-v0.4.21...test-v0.4.22) (2026-10-14)
+
+
+### Bug Fixes
+
+* harden Lua actor, relay, tool-round and runner behavior ([#165](https://github.com/wippyai/framework/issues/165)) ([d4607bb](https://github.com/wippyai/framework/commit/d4607bb274e09a1d0cc6bef533f45546846fb79b))
+
 ## [0.4.21](https://github.com/wippyai/framework/compare/test-v0.4.20...test-v0.4.21) (2026-10-12)