feat: complete RAG runbook workflow and release docs

CHANGELOG.md

@@ -10,27 +10,37 @@ ______________________________________________________________________
 
 ### Added
 
-- `README.md` — project overview, description, example workflow, supported distributions, and suggested tooling
-- `ROADMAP.md` — phased development plan covering decisions, data collection, AI integration, CLI design, and hardening
-- `CHANGELOG.md` — this file; established changelog tracking for the project
-- `.gitea/workflows/ci.yml` — Gitea Actions CI workflow for push and pull request events
-- Gitea CI now uses native `git` checkout and system Python setup to avoid host-executor JavaScript action path issues
-- Gitea native checkout now uses `CI_GIT_TOKEN` repository secret for authenticated fetch from private repos
-- Gitea CI now installs dependencies in a local `.venv` to avoid Debian/PEP 668 externally-managed pip errors
-- Python package scaffold with `src` layout and project metadata in `pyproject.toml`
-- Initial CLI entrypoint with agreed SSH flags: `--identity-file`, `--jump-host`, and `--ignore-ssh-config`
-- Input parsing/validation module and core request model
-- SSH configuration scaffold module for upcoming connection/read-only execution work
-- Implemented SSH module with real key-based command execution via system `ssh`
-- Added explicit SSH port support across CLI, input parsing, request model, and SSH client (`--port`, e.g. 5566)
-- Added live SSH connectivity probe (`uname -a`) enabled by default, with `--no-probe` opt-out and non-zero exit on failure
-- Added baseline diagnostics collection via `--collect`, including service, journal, disk, and network checks
-- Read-only command policy enforcement (allowlist + blocked shell operators)
-- Added byte-limited SSH output capture with truncation markers for large command output
-- Test scaffold (`pytest`) with initial parser and CLI coverage
-- SSH test coverage for policy checks, SSH argument construction, and config summary behavior
-- CI workflow for lint (`ruff`), type-check (`mypy`), and tests (`pytest`)
-- CI coverage expanded with Markdown formatting checks (`mdformat --check`) and YAML linting (`yamllint`)
+- Nothing yet.
+
+______________________________________________________________________
+
+## [0.4.0] - 2026-05-06
+
+### Added
+
+- `runbooks/` corpus with service troubleshooting guides: `ssh`, `nginx`, `postgres`, `disk`, `kernel`, `docker`, `sssd`, `xorg`, `wayland`, `x2go`, `selinux`, `apparmor`
+- Runbook knowledge store module `src/tai/runbook_store.py` (persistent ChromaDB-backed index and query)
+- Chroma telemetry no-op client `src/tai/chroma_telemetry.py` to suppress noisy local telemetry errors
+- `tai runbooks` command group with:
+	- `sync` for indexing all Markdown runbooks
+	- `list` for listing indexed metadata
+	- `add` for indexing a single runbook file
+- `--runbooks` option on `tai run` to enable Tier 2 runbook retrieval
+- Initial analysis RAG path using retrieved diagnostic chunks (`build_analysis_message_with_chunks`)
+- Follow-up RAG path updates with tighter `top_k` and runbook context injection
+- AI runtime controls:
+	- `--ai-timeout-seconds`
+	- `--ai-max-tokens`
+- Non-streaming AI completion path for improved local backend reliability
+- Service/subsystem presence probes in collection plans:
+	- unit-file checks
+	- expected binary path checks
+	- status/journal/config probes for recognized services including `sssd`
+- Prompt instruction for "component absent or not installed" interpretation when presence signals are missing
+- Runbook store unit tests in `tests/test_runbook_store.py`
+- CLI tests updated for `tai run` subcommand and non-streaming completion mocks
+- README refreshed with current CLI, architecture layout, RAG/runbook workflow, and usage examples
+- `docs/ARCHITECTURE.md` with end-to-end flow, module responsibilities, safety boundaries, and fallback behavior
 
 ### Removed
 
@@ -44,3 +54,5 @@ ______________________________________________________________________
 - SSH bastion support: `--jump-host` flag using SSH native ProxyJump
 - SSH config behavior: use `~/.ssh/config` by default; allow override via `--ignore-ssh-config`
 - Interface: **interactive REPL** for v0.1; `textual`-based TUI (split-pane) for v0.2+
+- RAG Tier 1 strategy: semantic diagnostic chunk retrieval with local embeddings
+- RAG Tier 2 strategy: Markdown runbooks persisted in embedded ChromaDB