Release by release, newest first. The full history lives on GitHub.
v0.9.0 Jul 11, 2026
latest
+−
Added Memory writes topic chapters that keep their identity
Facts that cluster around one topic are now written up as a chapter — and the chapter survives its own growth. When new facts join, the grown cluster supersedes its old chapter instead of minting a parallel copy, and a chapter can never be absorbed into a cluster built from its own members. Topics only relate on two independent signals — embedding similarity plus a shared salient token, never similarity alone. One caveat carried from the changelog: the eval's passing verdict holds under its standard grounding rule and flips under a stricter one — disclosed as such, not hidden.
Added Unused evidence gets re-mined, not dropped
Transcript records that a mining pass read but did not use are no longer lost — they queue in a residue ledger, and later idle passes re-mine them under a bounded attempt cap, so nothing loops forever. Every pass now reports its own coverage: what it saw, what it cited, what it queued, rescued, or retired.
Added A re-learned fact folds into the one already stored
Extraction could mint near-duplicates of a fact it already held. A novelty gate now checks every candidate against the existing record — only genuinely new information earns a new entry; everything else folds into the fact it repeats. The gate is deliberately conservative, so distinct facts never merge.
Added The model cannot vouch for itself
Only user-authored evidence can advance a fact's confidence. The model restating its own earlier claim no longer counts — an agent cannot talk itself into certainty. Limit, stated in the changelog: a numeric claim grounded in a tool result and one the model merely asserted still earn equal trust today; a source-reliability gate is planned.
Fixed Corrections retire the stale fact, every time
Two correction bugs closed: correcting a fact now retires the stale value even when the corrected value was already on file, and the supersede directive is recognized wherever it appears in the extractor's output, not only in the one spot the parser used to look.
Changed Tool calls read as one line in the terminal
The terminal now renders each tool call as a compact one-line summary with its markup escaped — bracketed text inside a call no longer corrupts the line it prints on.
v0.8.1 Jul 9, 2026+−
Fixed The benchmark can no longer pass on nothing
Three test-suite holes shared one disease: point the live benchmark at a misconfigured server and it could still come up green — every run erroring, nothing measured. A success check that matched on empty text is now rejected when scenarios load; the budget-cap test demands the capped behavior itself — one action taken, the follow-up absent — instead of accepting any failure as proof; and the endpoint health check and the tests it guards now resolve the same pinned model and server from one place, refusing loudly to run unpinned. Verified against a live endpoint: green only when correctly pinned, loud on everything else.
v0.8.0 Jul 5, 2026+−
Added Surprise decides what gets remembered
Alongside the existing capture floor — a tool error that later resolved, a stuck loop that recovered — every tool outcome is now scored against that tool's own track record, computed inside the database with no model call and no token cost. A normally-reliable tool erroring is a surprise, and becomes a memory; a tool failing the way it always fails stops being news — the junk the old floor had no way to suppress. A tool with too little history to predict from is scored as a cold start rather than guessed at, and the capture floor still covers it from the first turn.
Added Corrections become quarantined, reversible facts
When you correct the agent — "no", "I meant…", "actually…" — the harness now records it. A direct correction supersedes the most recent fact it was likely about, with the original text preserved behind a dispute marker, never erased; anything less clear-cut is filed as its own quarantined fact in your own words. Everything is reversible through fact history, and repeating a correction confirms the existing record instead of duplicating it. The trigger is a plain word list, not a model — a correction that uses none of the words is missed, and a false trigger costs one stored record.
Added Capture first, behavior later
Every new write in this release lands below the injected memory's visibility line: stored and searchable, but kept out of the prompt — so it cannot change what the agent does — until an idle consolidation pass confirms it. Corrections and disputed facts are held back further, for a deeper reconciliation pass. A single config lever reverts the whole live path to the old capture floor while the scorer keeps logging — a kill switch committed in advance, not improvised after. The injected block still does not steer the agent's first move; this release is capture, and says so.
Added Proven by replaying a real session
The gate comparison ran offline: one real session trace, replayed through the old gate and the new one, measured against the full set of surprising failures rather than a hand-labeled proxy. The new gate captured every one; the old floor missed a few. The junk-write comparison depends on how strictly junk is graded — under the strictest grading it inverts — so both gradings ship in the repo's report tooling rather than as one headline number. The trace carried no expected failures and no recovered stalls, so those paths are proven by unit tests, not a live occurrence — disclosed, not declared won.
v0.7.0 Jul 4, 2026+−
Added The next sitting remembers the last
Every run of the harness is now a session with its own record. When one ends, the harness distills a one-line, payload-first summary of what actually happened — the error you resolved, the stuck loop it recovered from — and files it to the agent's memory; a sitting with nothing of substance writes nothing rather than padding with filler. A fresh session then answers "what did we do last time?" straight from its injected memory block, without a tool call. Summaries written when context is compacted persist the same way, so what got compacted away isn't lost to the next sitting.
Added A Recent Session History shelf
The injected memory now carries a Recent Session History block — each past sitting on its own line, tagged with a relative day and clock time, newest first, capped to a short window; older sittings stay in the store and remain searchable. When a sitting has no error-lesson to lead with, its summary leads instead with a trimmed slice of what you asked — so a pure conversation is no longer invisible to memory. Rendering reads the session records directly and stays byte-stable within a day; the whole path runs without a model call.
Added A live thinking indicator in the REPL
While the model is generating, the terminal shows an animated "thinking…" spinner that clears the instant real output arrives — a tool-call line, the answer panel, or the next prompt. It replaces the occasional static "Working…" line, so a long generation no longer looks like the box has hung.
Changed The root agent is the orchestrator, by name
The root agent is now created and selected as "orchestrator" rather than "default", matching the architecture's own vocabulary. Existing installs migrate on first start and keep every memory — the agent file and the whole memory store are adopted under the new name, one-time and crash-safe. If you already run your own agent named orchestrator, the migration refuses rather than merge or overwrite anything, the root keeps its old name, and a console note explains how to resolve. The old name still redirects to it, and orchestrator is now reserved for the root.
Fixed A conversational reply arrives once, not twice
The act-guard — the nudge that turns a stated intent to go look something up into an actual tool call — used to ask the model to restate its final answer when no tools were needed, which could surface a narrated duplicate of the reply you had already been given. It now requests a marker the harness swallows, and the original reply is delivered unchanged. This retires a leak that had been live since an earlier release.
v0.6.0 Jul 3, 2026+−
Added Persistent memory that learns from experience
Agents now write, rank, consolidate, and retrieve long-term memory on their own — no memory prompt-engineering. There are two write paths: a deliberate save, and an automatic gate that captures lessons from the harness's own prediction-error signals — a tool call that failed then later succeeded, a stuck loop that recovered — at no extra model cost. Nothing is ever overwritten: a conflicting fact supersedes the old one, which stays retrievable on request, and every fact carries provenance back to the episode it came from.
Added Ranking and consolidation at no token cost
Which facts earn prompt space is decided by activation scoring — used-often plus used-recently — computed inside the database at query time, so ranking costs nothing. When you go idle, a background "sleep" pass promotes lessons seen across more than one episode, decays unused facts out of the visible index without deleting them from the store, and trims a soft cap by demotion rather than silent deletion. Your next message cancels an in-flight pass at once.
Added A byte-stable memory index
The in-prompt memory is an index — fact names with one-line, payload-first descriptions — not the full bodies, which are pulled on demand. Reads and retrieval no longer perturb its bytes; they accumulate in a staging ledger instead of reordering anything. The bytes move only at genuine writes, consolidation folds, and day boundaries, keeping the inference server's prefix cache intact between those points — stability that is load-bearing on a long prompt, not cosmetic.
Added Structure-aware memory search
An over-window document read now persists its gist-and-schema tree, so a later search routes through that structure — the gists steer the search, the leaf records anchor the answer. The number-provenance net from the over-window work extends here too: a figure promoted into a gist that traces back to no source leaf is flagged, never silently kept.
Fixed Promoted lessons survive every render layer
A promoted lesson's payload now survives every render layer — the line budget for the index no longer truncates the discriminating detail out of a lesson before it reaches the prompt.
v0.5.3 Jul 2, 2026+−
Changed Built-in subagents: quarantined or read-only, no exceptions
Two shell-holding specialist roles left the default roster after a live quality pass — one hung on an undeclared dependency on its first run, the other worked but had no business holding a shell by default. Both remain as documented opt-in examples. What ships now is exactly the set whose fences the security model can vouch for. (Released ahead of the in-progress memory milestone, which keeps the number below.)
Fixed Memory search survives real-world queries
Hyphenated terms, tickers, and slashes used to leak into the search syntax and error out. Query text is now quoted term-by-term, so punctuation is content, never an operator.
Fixed Instant answers end as answers
A question the model could answer without tools sometimes ended on a self-referential note instead of the answer. The loop now tells the model only its last reply is shown, and unchanged answers are confirmed with a sentinel the summary resolves back to the real text.
v0.5.2 Jul 2, 2026+−
Added Serial-by-default inference gate
Overlapping local runs used to stack prefills toward one shared GPU — the freeze-the-box failure mode. Inference toward a local endpoint is now serialized by default, in-process and across processes. Decode is engine-serialized anyway, so serial costs roughly nothing in wall-clock.
Added A download cap on web_fetch
Fetches stream to a hard body cap instead of buffering unbounded responses — one pathological URL can no longer eat the box. When the cap engages it is surfaced in the retained page, never silent.
Changed Cruncher chunks sized at the measured knee
Over-window chunks got bigger, to where recall peaks before lost-in-the-middle sets in: better recall and fewer leaves to reduce, at neutral wall-clock. A recall-and-cost win, not a speedup — scope stated honestly.
v0.5.1 Jun 26, 2026+−
Added Number provenance for big-document answers
When a document bigger than the context window is combined in stages, every figure in the final answer is checked back against the verbatim section notes. Anything untraceable is surfaced as a warning — never silently rewritten.
Added Security model in plain English
The threat model now lives in SECURITY.md: trust boundaries, the structural injection defense, and — plainly — what is not built yet.
v0.5.0 Jun 25, 2026+−
Added Lossless reading past the context window
A cruncher subagent splits oversize documents structure-aware and reads every section — nothing truncated. Content handles move results between agents without re-inlining the bytes.
Added The capability floor
Untrusted-ingested web or tool content can never co-reside with host-mutating tools in the same agent — defense-in-depth above model refusal.
earlier Jun 2026+−
Fixed Hermetic test suite
The test suite runs without a configured home directory — a clean checkout is green from the first command.
Added Start opens to the default agent
The start command drops you straight into the default agent; the subagent picker moved behind a flag.
Added Web search in the box
Web search ships as a core dependency — no extra install to give an agent the web.
Fixed Markdown in the terminal
Agent responses render as Markdown instead of raw text.
Fixed Steadier context counting
The context counter handles literal special-token text instead of failing the turn.