Changelog

Neutron's user-visible changes. Versioning follows the b-scheme (adopted from proxima) — merges make builds, tags close versions:

merge #1 → v0.2.4-b1   merge #2 → v0.2.4-b2   …   tag v0.2.4 closes the version
                                                    └→ next merge mints v0.2.5-b1

• Target version = latest clean vX.Y.Z tag on the line + 1 (CI computes it; the VERSION file holds just the line major.minor — nobody edits numbers day-to-day). -bN = every merge to main, deployed as the next build of the target; the badge bottom-left shows it. Closing a version = pushing the clean tag at a deploy milestone — the target rolls, b resets.
• Minor bumps (feature epochs): edit VERSION; the next merge comes out as vX.Y.0-b1.
• Changelog: every MR that touches app code adds a bullet under ## [Unreleased] (enforced by the changelog CI job; genuine non-user-facing changes opt out with [skip changelog] in a commit message). [Unreleased] is always exactly "in builds since the last closed version"; closing a version sweeps those bullets under a ## [vX.Y.Z] heading. The deployed copy renders in-app from the badge's "What's new" panel.

[Unreleased]

• Slack channel (#97, plan 011) — pair a Slack DM/channel to an agent via Socket Mode (no public webhook): DM the bot pair <code>, messages run as you with in-chat approvals. Admins add an app-level token (xapp-) and a bot token (xoxb-) in Settings → Channels. Rounds out the messaging set (Telegram, Discord, Slack) on the shared linked-channel core; Teams stays out (Azure Bot infra), WhatsApp is a separate gateway.

• Agent computer auto-provisioning (#98, plan 012) — spin up a desktop from Settings → Computers (or ask an agent: "provision_computer"). neutron creates a webtop pod (Firefox + noVNC) in its own namespace and streams the live screen back through its own proxy — no per-computer ingress, inherits neutron's auth. Governed: the agent tool is approval-gateable; delete tears the pod down. Requires the instance's provisioning RBAC flag; external VNC URLs still work.

• Discord channel (#97, plan 011) — pair a Discord chat to an agent, same per-user principal model as Telegram: DM the instance bot pair <code>, and messages run as you with in-chat yes/no approvals. Admins add one bot token (Discord Developer Portal, Message Content intent) in Settings → Channels; raw Gateway v10, no public webhook. The shared linked-channel core now backs both Telegram and Discord (Slack next; Teams needs Azure Bot infra, deferred).

• Self-test admin identity — an operator can grant a Cloudflare Access service token admin self-test access (env NEUTRON_SELFTEST_ADMIN + NEUTRON_SELFTEST_TOKENS): a request bearing that token's CF-issued JWT resolves to the configured admin, so automated checks can drive the admin surface through the ingress without a human SSO login. SSO users are unaffected (their JWT has no service-token common_name).

• Agent computers (#98, plan 012) — register a desktop by its noVNC URL in Settings → Computers, bind it to an agent, and watch the live screen from the dashboard. The agent drives it through a granted computer-use capability. Engine-agnostic; the first in-house step toward the "agent with its own computer" pattern (self-hosted, no Orgo dependency).

• Constellation — the neutron multi-core network is now called a Constellation (docs + connector label); a control core manages peer nodes, each with its own agents and computers.

• Skill learning loop (#99, plan 013) — agents now propose reusable skills after hard-won successes (propose_skill, with Hermes-style trigger heuristics). Proposals land as PENDING capabilities: a 💡 card hits the bell, the full SKILL.md is reviewed in Settings → Capabilities, and approval grants the skill to the proposing agent. Nothing agent-authored ever loads unreviewed — the governed answer to marketplace skill supply-chain risk.

• Per-agent memory (#99, plan 013) — agents remember across conversations, DB-backed and multi-user: an agent's own working knowledge plus what it knows about each specific user, injected into that user's turns only. Agents save facts with a save_memory tool; you can read, edit, or clear what any agent remembers about you in Settings → Messaging. User B's memory never leaks into user A's turns — something single-operator harnesses can't represent.

• Telegram links (#97, plan 011) — pair your own Telegram chats to an agent from Settings → Messaging (deep-link or /pair code, 1h expiry). Messages on a paired chat run as YOU: your history, your grants — and gated actions ask inline, answered with a yes/no reply. Admins wire one instance bot (BotFather token) in Settings → Channels; per-user links are the multi-user edge single-operator harnesses can't match.

• Schedules: create from the dashboard + run history (#100) — Settings → Schedules gains a New-schedule form (name, cron, timezone, agent, prompt) and an expandable recent-runs panel per schedule showing engine run status and errors. Prompting an agent still works; it's no longer the only way.

• OpenCode turns unwedged — the engine's event subscription now carries the per-agent project directory; without it, /event is project-scoped and every OpenCode turn bound to an agent directory received no events and hung. This was the real wedge behind #96; the idle guard remains as the belt.

• OpenCode turns fail loud instead of hanging (#96) — a provider error the engine retries forever (e.g. a model the connected subscription doesn't serve, like GPT-5.6 Luna without an API key) now aborts the turn with a visible error after a 10-minute silent window, instead of spinning forever and wedging scheduled runs.

• GPT-5.6 family (#93) — Sol / Terra / Luna in the model picker on the OpenCode engine, with correct pricing including the whole-request long-context surcharge past 272K input (2× in / 1.5× out). Explicit model ids are pinned; the instance default is unchanged (opt-in per turn/agent).

• Reasoning-effort knob (#93) — a per-message Effort menu (Low → Max) next to the model picker: OpenAI backends get reasoning.effort (Max clamps to X-High on pre-5.6 models), Claude backends map it to a thinking-token budget. Gated by the instance's model-switch policy. "Ultra" multi-agent mode is tracked separately (#95) pending engine support.

• Schedules in Settings — a new admin Settings → Schedules tab finally makes recurring agent turns visible: list (cron, timezone, agent, paused, prompt), idempotent delete with confirm, and the quiet-hours governor editor — no more API-only schedules.

• Interrupt governor (#78) — proactive output now lands as typed inbox cards under the bell (admins), and a policy layer decides whether a card actively interrupts (toast) or waits silently: configurable quiet hours (timezone-aware, midnight-crossing) with priority break-through for urgent cards. First producer: fired schedules (result + failure cards). Policy via PUT /api/admin/settings/governor.

• Durable scheduled turns — a fired schedule's turn now runs as a heartbeated engine activity: if the pod dies mid-turn, the engine retries it on the restarted pod (at-least-once, max 2 attempts) instead of losing the fire. Engine workflow history shows the turn's true duration. Requires the bundled assay-engine ≥ 0.5.5 (heartbeat-timeout reaper fix).

• Proactive schedules (#77) — agents can now run on a clock. New opt-in schedule connector (create_schedule/list_schedules/delete_schedule) stores durable cron schedules in the bundled assay-engine; a new poll-worker turns each fire into a headless agent turn saved to a per-schedule thread (morning briefings, recurring reports). 5-field cron is accepted and padded to the engine's 6-field form. Mutations gate like other connectors.

• Fix: the fleet connector now parses a peer's plain-JSON /mcp reply, not only SSE — ask_peer/admin_peer no longer return "empty response" when the peer answers with application/json.

• Secrets — NEUTRON_SECRETS_BACKEND=assay-vault stores operational secrets in the bundled assay-engine's encrypted KV instead of plaintext Postgres. src/db/migrate-secrets.ts copies existing db-backed secrets into the vault.

• Fleet — a fleet connector lets a hub instance drive sibling neutron nodes over the token-authed /mcp each node serves (plan 008). Opt-in per instance via connectors: + a fleet.peers registry (name, url, token: secret://…, scope: chat|admin|both). Tools: list_peers (read-only health/scope), ask_peer (delegate a chat turn), admin_peer (call a peer's admin API). ask_peer/admin_peer are powerful — gate via tool_policy/approval_required (mcp__fleet__ask_peer, mcp__fleet__admin_peer). Peer tokens resolve per-agent at call time and are never logged.

• Fix: OAuth MCP servers now get a canonical Bearer auth scheme — a provider that stored a lowercase token_type no longer 401s (its tools were silently absent).

• Vault — a vault connector gives agents a first-class, governed key/value secret store (store/get/list/delete) backed by the bundled assay-engine, replacing raw assay_run Lua. Opt-in per instance; store/ delete are mutating and gate via tool_policy/approval_required. Works on both engines.

• Web search — a web-search connector lets agents query the org's self-hosted SearXNG (read-only, opt-in per instance). Works on both engines.

• Capability registry — Settings → Capabilities: register MCP servers, CLI tools, and skills once, then equip any agent with them from the Agent editor's checkbox list. Sensitive header/env values route straight to the secret store (secret:// refs only — raw keys never sit in a capability row), and a newly granted server's tools start approval-gated until an admin explicitly allows them. Works on both engines — the claude SDK and opencode — from one registry: MCP servers, tools, and skills reach an agent identically whichever engine runs its turn. OAuth-protected MCP servers connect with a Connect button (browser sign-in, e.g. Higgsfield) and refresh automatically; .mcpb bundles import into a reviewable draft. Fully API-drivable: the same /api/admin/capabilities endpoints serve the UI, the admin MCP, and agents managing their own fleet (token-origin auto-approves; chat requests still raise an approval card).

• Every Settings option now explains itself — hover the ⓘ next to any field across Providers, Secrets, Roles, Channels, API tokens, Resources, tool policy, and the Agent editor for a one-line description of what it does.

• The build badge now leads with a real version — v0.2.4-b2 · <sha> · <time> instead of a bare commit SHA. Builds are version-stamped from birth: every merge mints the next -bN of the upcoming version, and closing a version is just pushing its clean tag.

• Build badge now stamps the product, not the instance. The bottom-left badge reads neutron-core · v0.2.4-bN · … instead of the instance brand (Eda) — the brand is one agent of neutron-core, so the header keeps it and the badge names the product. The built-in agent is now tagged (core) in the agent switcher (e.g. Eda (core)) so it's distinct from named agents.

• One unified "Add provider" door. The button now opens a single searchable picker with brand icons: subscriptions (tagged login) at the top, the ~12 most-used providers under Popular, a ▸ More (N) expander for the full ~150-provider catalog, and Custom endpoint pinned at the bottom — no more giant unsearchable, iconless dropdown. Picking a subscription runs its OAuth login; picking a catalog provider lets you choose a model and paste that provider's API key right there (stored in the OpenCode auth store, so it actually reaches the engine); Custom endpoint keeps the full Claude-SDK/OpenCode form. You can also now edit a credential's agent scope after creating it (not just at add time), and the grandfathered key reads as "default key" instead of a raw zai_api_key.

• Providers panel redesigned as a tight one-line table. Each provider is now a single dense row — brand icon (tooltip carries the full name), credential chips with a masked key preview (sk-a…8f), a ✓/✗ connection symbol, and a + to add — no more two-line cards or truncated labels beside empty space. A provider connected by a pre-existing key now shows that key as a "shared" chip instead of an empty box; click any chip to reveal/copy the value (admins only, same policy as Secrets) or manage its agent scope. Provider keys also appear in the Secrets tab's ring, badged "provider" — they live in the same secret store (OpenBao when configured) as everything else.

• Multiple accounts per provider + add your own providers. The Providers panel now holds many named credentials per provider, each scoped to specific agents — so agent A can use one GLM/Kimi key and agent B another. When an agent has 2+ keys for a provider, requests round-robin across them. You can also add providers: pick one OpenCode already supports, or define a custom model (name, engine, base URL + key). Existing keys keep working unchanged — a provider with no named credentials falls back to its old single key. (Multiple subscription accounts — e.g. two ChatGPT logins — are the next phase.)

• Connect your model providers from Settings → Providers. A new admin panel lists your providers and lets you add/rotate an API key (GLM, Kimi) or connect a subscription (OpenAI/ChatGPT-Codex, xAI/Grok) by clicking — the subscription flow starts an OAuth device-code login, hands you a URL + short code to approve once in your browser, then stores the credential and applies it live (no redeploy). The same actions are available headlessly over the admin REST API (and therefore MCP + assay), audited by caller — so a provider can be provisioned by a human clicking or by an agent/script, whichever you prefer.

• Turns no longer abort when you leave the page. A chat turn now keeps running server-side and saves its answer even if you navigate away mid-turn — so when you come back to the thread, the finished reply is waiting. Previously a disconnect broke the event stream, which skipped the save and lost the whole turn.

• Rich, friendly output on every engine. GPT-5.5 (and any OpenCode model) now runs as the same warm assistant with the same presentation as Claude — tables, Mermaid diagrams, tasteful emoji, and clickable links — instead of OpenCode's terse default coding voice. The OpenCode driver bakes the instance identity + persona + a shared presentation guide into a custom agent (OpenCode's agent prompt, not the weak per-message system field, is what actually steers the model); the same presentation guide is added to the Claude engine too, so every model presents consistently.

• GPT-5.5 usage now shows a cost instead of $0. Like the Claude backends (which also run on a subscription), GPT-5.5 is priced at its API list rate ($5/$30 per 1M) so the usage tab reports API-equivalent value; it was mistakenly set to $0.

• Engine badges in the model pickers: each model in the chat picker and the agent editor now shows which engine runs it — OpenCode (e.g. GPT-5.5 on the ChatGPT subscription) vs Claude SDK (Claude, and the Anthropic-compatible GLM/Kimi backends) — so the engine behind a model is visible at a glance.

• Second engine: OpenCode. Neutron can now run a backend on a headless opencode serve process (driven via @opencode-ai/sdk) instead of the Claude Agent SDK — selected per backend by a new driver: "opencode" field, behind the same AgentEvent seam so the chat UI is identical either way. This unlocks providers that don't speak the Anthropic wire format, including OpenAI (ChatGPT subscription) — shipped as a selectable GPT-5.5 model. OpenCode auth is the operator's existing OpenCode credential (via OPENCODE_AUTH_CONTENT); Claude and the Anthropic-format backends are unchanged. AgentEvent also gains file_change so live file edits can surface on either engine. The opencode 1.17.15 binary is baked into the image.

• Kimi K2.7 Code as a selectable model: the picker now offers Moonshot's Kimi K2.7 Code alongside Claude and GLM, running on the same engine via Moonshot's Anthropic-compatible endpoint — paste a MOONSHOT_API_KEY in Settings → Secrets to enable. Adding it surfaced a general capability: backends can now authenticate with an Authorization: Bearer token, not just an x-api-key, so any bearer-gated Anthropic-compatible gateway drops in as a single registry line. Keyed third-party backends now also strip the host's Claude credential from the model's spawn, so it can never leak to another provider's endpoint.

• Remote chat over MCP with audited auto-approval: a new chat tool on /mcp runs turns against the core agent (or any named agent) from any MCP client, returning the reply and a thread_id for continuity. On token-authenticated turns, gated tool calls auto-approve — no human is watching a card, and the token is the standing authorization — with every decision persisted to the approvals audit trail as token:<name>. The one exception: an agent's self-initiated request_change stays human-only. Interactive web chat keeps its approval cards exactly as before.

• Bundled assay 0.17.5 → 0.17.6, which adds the assay.neutron module: the full neutron admin API from Lua, so any assay-equipped agent — including an instance's own core agent — can configure agents, secrets, connections, resources, and tokens on this or sibling instances. Bake it into an agent via the Assay modules checklist to make that agent a fleet operator.

• API tokens open two doors: the same bearer token now drives the admin REST API directly (curl, scripts, assay) as well as /mcp — one credential, audited as token:<name> either way. And fresh deployments can seed NEUTRON_BOOTSTRAP_TOKEN: a first-boot key that verifies only while no minted tokens exist, so a provisioner can take over a newborn instance, mint a real token, and the bootstrap dies automatically.

• MCP endpoint — manage an instance from any MCP client: POST /mcp (streamable-HTTP, stateless) with two tools: admin_reference (the route catalog) and admin_request (the full admin API over one tool). Auth is a bearer token minted in the new Settings → API tab — a token is standing admin authorization (no approval gates on the admin surface), shown once at creation, only its hash stored, revocable anytime. Token callers act as the auditable principal token:<name>. Plug an instance into Claude Code with the URL https://<instance>/mcp and an Authorization: Bearer header.

• Agents can be restricted to admins: a "Restrict to admins" switch in the Agent editor (Permissions tab). An admin-only agent disappears from the picker for non-admins and refuses their turns — meant for a core agent that manages the instance itself.

• Resources UI: the list button says "Add resource" and the create form picks the type with two clear buttons (Workspace / Guide) instead of a dropdown.

• The whole config surface is now agent-drivable: new agent-admin tools close the remaining gaps — delete_secret, list_resources / delete_resource, roles (list_roles, create_role, delete_role, set_role_member), list_users, instance settings (get_settings / update_settings for theme + approval default), and channels (get_channels / update_channels, secrets stay write-only). Mutations ride the usual approval gate; secret value read-back remains human-only.

• Connections are fully agent-manageable: new gated list_connections, set_connection, and delete_connection tools (agent-admin), so a trusted admin agent can provision git-host identities — including agent scoping — by code, with the usual approval flow. Scope pickers now show the core agent as core (not its internal slug), and core is accepted as an alias wherever agent scopes are written.

• Connections can be scoped to agents — the same dropdown as secret scoping. A scoped connection is that agent's bot identity: its worktrees fetch, push, and commit as that account (per-worktree remote + committer), while other agents never touch its token. Two bots on the same host can now serve different agents; unscoped connections stay shared. The Secrets tab's connection rows show each token's scope.

• Deleting a secret or connection now asks for confirmation — a danger dialog spelling out what stops working (secret:// refs, model keys, host auth). Confirm-before-delete is now the standard for every destructive action in Settings (agents, roles, resources already had it).

• The instance persona now belongs to the core agent: named agents no longer inherit the plugin persona/brand base by default — they run purely on their own identity and opt in with the "Inherit the instance persona" switch. Turning it off now really strips the persona (the plugin no longer mounts at all for persona-less agents), and the read-only plugin-persona preview only shows when it actually applies.

• Agent editor is tabbed: Persona / Permissions / Tools / Model / Guardrails / Workspaces as switchable tabs instead of one long scroll.

• Assay modules checklist is denser: one line per module (hover for the full description) and a taller list, so the catalog is scannable.

• The built-in agent is now called the "core agent" everywhere users and agents see it (Agents list badge, scope pickers, agent-admin tool text) — it is the core of the instance and always exists, whatever display name you brand it with. Its internal slug stays default so existing scopes and configs keep working.

• Secrets tab overhaul: agent scoping is now a checkbox dropdown of your real agents (no more comma textbox); values show a masked preview ("fa62…80") with copy and pencil/tick/cross inline editing — the edit box prefills the current value. Policy change: admins can now read a value back (one explicit endpoint); agents still never can. Connection tokens appear in the same list as read-only rows badged "connection", so the whole key ring is visible from one tab.

• Assay modules are now first-class agent config: a new "Assay modules" checklist in the Agent editor (Tools group) lists every module the bundled assay binary ships; checked modules get their full API docs baked into that agent's system prompt, so it scripts against them with no lookups. Every agent also gets a standing discovery hint — it knows the wider catalog exists, searches it with assay_context, and can request additions to its own baked set through the usual config-change approval flow. The bundled assay binary moves 0.17.2 → 0.17.5.

• Base persona is now per-agent: a new "Inherit the instance persona" switch in the Agent editor — off means the agent runs purely on its own identity text (no plugin persona, no brand default underneath), so a utility agent like tom no longer carries the instance's profile. The GLM picker entry also now reads "GLM 5.2".

• Model keys from Secrets: backend API keys now resolve from a secret named after the key env when the env is unset — paste your GLM key as zai_api_key in Settings → Secrets and the GLM model works with no redeploy. Env still wins. The landing page also drops its redundant subtitle (the capability cards carry it).

• Agent-scoped secrets: each secret can name the agents allowed to see and consume it (blank = all). Out-of-scope agents don't see it in their listing and its secret:// references refuse to resolve on their turns.

• Time filter, take two: the range picker is now a compact segmented button row (∞ / 24h / 7d / 30d / calendar) in both the chat history and the Usage table — the calendar reveals from/to pickers, and each surface remembers its selection across reloads.

• Audience toggle: the multi-user icon is orange to mean "admin only" — the separate lock badge next to it is gone (the single-user view never needed admin).

• Secrets: a new Settings tab for named write-only secrets (API keys, tokens) in the secret store — values are never displayed again. Reference them as secret://name in MCP endpoint env/headers (resolved at spawn, out of the model's context); agents can list names and add values through an approval but can never read them back.

• One time filter everywhere: the history's range picker (presets + custom from/to) is now a shared component and appears on the Usage table too, with server-side date filtering. Mixed-owner lists show each person as a compact color-coded first name instead of a badge — same person, same color, less space.

• Agent editor clarity: the per-tool policy grid moved into its own folded "Tools" group; the safety-mode section shows one clear hint instead of two; the two approval-timeout fields are now clearly distinct ("Instance default approval timeout" vs the per-agent field, which also saves on Enter); and resource badges lead with the type ("workspace · rw", "guide").

• No more vanishing turns: the chat stream now sends a heartbeat, so long approval waits can't get the connection silently killed by the network edge (this ate a follow-up approval card). If a stream still drops, the UI says so and auto-refreshes the conversation when the agent finishes.

• Approval card polish: long justifications wrap instead of forcing horizontal scrolling, and grant changes now say plainly that they replace the agent's full grant list (agents are told to include existing grants).

• Natural "remember this": agents now treat guide resources as their long-term domain memory — asking one to "learn the assay modules and remember them" makes it distill a guide and request the grant itself, no tool-speak needed.

• Connections: a new Settings tab for named git-host accounts (GitLab/ GitHub, self-hosted bases included) with write-only tokens — they power workspace cloning and the repo dropdown, so multiple sources work at once. Tokens live behind a pluggable secret store (database by default; an OpenBao backend is available per deployment). Deploy-managed env tokens still win.

• Roomier settings: the Settings overlay is larger, and the Agent editor is reorganized into collapsible groups (Persona & cards, Permissions & approvals, Model, Guardrails, Workspaces & guides) — far less scrolling.

• Guide resources: a new resource type — a pure-markdown domain brief (e.g. which platform modules exist and when to use them) granted per agent like a workspace. The one-line summary is always in the agent's prompt (so it knows the domain exists), the body injects whole when short; agents can create and maintain guides via the new create_guide/update_guide tools.

• Custom date range in history: the chat list's time filter gains a "Custom range" option with from/to date pickers; the rolled-up spend follows the filter.

• delete_agent joins the configurable tier: gated by default, an admin can grant allow like the other management tools. The default agent remains hard-undeletable — the instance cannot run without it.

• Per-agent approval timeout: each agent can carry its own approval window (Agent editor, blank = the instance-wide default) — admin agents can tune it for other agents too.

• Complete agent management for agents: delete_agent (always requires human approval — no policy can bypass it), create_workspace/update_workspace (admin agents can provision repos end-to-end), and config_reference — the authoritative schema + examples agents read before composing config changes.

• Readable tool names: trace chips and approval cards now show friendly names ("agent-admin · list agents", "Eda wants to change its own configuration") instead of raw mcp__… ids, and agents describe these actions in plain words in chat.

• Agents can manage agents: new built-in agent-admin tools let an agent list, inspect, tune, and create other agents — every mutation pauses for human approval by default, and granting an agent allow on those tools (in the Agent editor) makes it a trusted admin agent that can build and tune agents autonomously. All API-driven; part of neutron core.

• Approval cards can no longer freeze: cards show a live countdown and flip to "expired" at the deadline; pressing a stale card's buttons now reports the request's real fate instead of silently doing nothing; replayed threads reconcile card status against the database; and the approval timeout is now configurable (Settings → Agents, 1–120 minutes).

• Step and turn timings: every tool chip in the activity trace now shows how long that step took, and the reply footer shows the whole turn's time next to cost and tokens.

• Themed repo picker: the workspace repo URL field is now a proper themed type-to-filter combobox (keyboard navigation included), and the host selector matches the app's styling — no more native browser dropdowns.

• Readable approval cards: config-change requests now show plain-English lines ("pkg-police: turn OFF" + the agent's justification) instead of raw JSON.

• Agents know their own setup: every agent's system prompt now states which guardrail police are armed or disabled for it and how to request config changes — no more searching the workspace to learn about itself.

• Agent self-config requests: agents get a built-in self-config tool to request changes to their own configuration (police toggles, workspace grants, tool policy) with a justification. Every request pauses as an approval card — hard-gated, so no tool policy can let an agent change itself silently.

• Repo picker: the Resources editor's repo URL field now suggests every repo the connected GitLab/GitHub workspace account can reach (auto-filling host and default branch); pasting any public https URL still works.

• Workspace jump-link: the Agent editor's Workspaces section links straight to Settings → Resources to create or manage workspaces without hunting for the tab.

• Per-agent police toggles: the Agent editor's Agentkit section now shows a switch per police (git/kubectl/pkg/mr/format/coding) — each agent can turn an individual guardrail on or off over the instance defaults.

• Per-agent workspace isolation: every agent now works in its own checkout (agents/<agent>/… git worktrees off one shared fetch cache) instead of a single shared clone — two agents on the same repo can no longer clobber each other's branches, and an agent's in-flight work survives across turns. Checkouts start detached at the remote default branch, so committing always begins with a feature branch.

• Resources — per-agent workspaces: a new admin Resources tab creates instance-level workspaces (repos + a markdown guide) with ro/rw access; grant them per agent in the Agent editor. A granted workspace clones its repos and injects its guide into that agent's system prompt, with the push/MR autonomy gate intact (ro grants keep pushes gated).

• Agentkit discipline is per-agent: the git/format/coding police are now a per-agent toggle (default on) in the agent editor, so agents can be tuned separately instead of sharing one instance-wide switch.

• Approver editor polish: the approver chooser (per-tool and Default permissions) confirms with a tick / cancels with ✕ (reverting) instead of a "done" link; and the history/usage audience filter shows an amber admin lock so it reads as an admin-only control.

• Approvals survive restarts cleanly: a gated request is persisted before it's shown (no inbox race), and any approval left pending by a previous process is expired on boot — so a restart never leaves a stale, undecidable card behind.

• Approvers rework: the tool-policy grid is one tool per line; setting a tool to gate expands an inline chooser at the bottom of its row with three entry points — self, user, role — where user/role reveal a dropdown (people come from the registered-login list, no free-text emails). A new Default permissions control sets the approver for every gated tool that doesn't set its own; unset, gated calls fall back to self (the requester confirms their own), so a solo operator never deadlocks. Set a role for real two-person approval. The bell reads "No notifications" when empty.

• Header & popover polish: the header approvals control is now a bell (notification) icon; the usage page's people filter opens inside the window instead of spilling off the right edge; and the redundant theme toggle is gone from the header (it still lives in Settings → Appearance).

• Approver picker: one line + self-approval: a gated tool's approvers (role, people, and the new self) now sit on a single row, and the gated card spans full width so nothing wraps. Adding self lets the requester approve their own gated call — a confirm-your-own-action gate — composable with a role or named people (still no admin break-glass).

• Rich identity editor: the Identity field gains a formatting toolbar (bold/italic/heading/list/link) and an Edit/Preview toggle that renders with the chat's markdown renderer — what's stored is still the raw markdown.

• Structured capability cards: cards are now Label / Description / icon rows with add and remove (and an icon picker), instead of one label | desc | icon line each.

• Audience filter: history and usage share a single/multi-human toggle — the multi-human icon opens a per-person checklist (All/None) to filter specific people out of the "everyone" view; the choice sticks per surface and a dot marks an active filter.

• Editor & inbox polish: the approvals bell shows a red count badge; MCP tools group under their server with a violet accent; admin is selectable as an approver; and clearer copy explains the safety mode is each tool's default.

• Approve by specific users: a gated tool's approver can be a role and/or named users — the request routes to any role holder or listed user (never the requester).

• Roles: admins can now define named roles and assign users to them from a new Settings → Roles tab (the admin role is derived from the instance admin list). The approvals inbox comes next.

• Approvals inbox: role approvers get a header bell listing role-gated requests routed to them from other people's chats, with Approve/Deny and an open-the-thread link — so a request reaches its approver even outside the requester's conversation.

• Gate-by-role: a gated tool can now require approval from a specific role — set it per tool in the agent's tool-policy grid. A role-gated request is decided only by a holder of that role who is not the requester (separation of duties; no admin break-glass); tools without a role keep the owner/admin rule.

• Cleanup: dropped the pre-1.0 legacy safety shims (approval-needed spelling and the read_only boolean) now that all configs use mode.

• Agents editor: named agents now confirm a safety-mode change (like the default agent); plugin-backed instances show the plugin persona as a read-only, collapsible preview under Identity.

• Friendlier greeting: the landing page greets you by first name, and asks for your name when the email can't yield a real one (saved for next time).

• Tidier tool policy: built-in, MCP, and custom tools share one list — icons mark the type and the full id is a tooltip; verbose subheadings dropped.

• Tool policy grid: stdio MCP endpoints (e.g. assay mcp-serve) are now probed during discovery, so their tools appear in the grid alongside HTTP ones — each tool row gains a type icon and a cleaner bordered-row alignment.

• Agent templates: the Add-agent view now offers curated starter agents (Sales Strategist, Marketing Strategist, Real-Estate Analyst) — pick one to create an editable agent pre-loaded with a persona and capability cards, or start from a blank agent as before.

• Per-tool policy: each tool can be set to allow, gate (ask for approval), or deny — with the agent's safety mode as the default for anything left unset. The old approval checklist becomes a per-tool allow/gate/deny control.

• Assay toolbox: the assay binary ships in the image; instances can mount it as an MCP endpoint (assay mcp-serve) — ~55 gated infra/SaaS modules behind one approval-gated run tool.

• Private chats: your conversations are now visible only to you; admins can switch the history sidebar to "Everyone" to see every user's chats.

• Identity is never blank: the editor now shows the effective persona — yaml text, or the brand-derived default the engine actually injects.

• Per-chat agent picker: pick a named agent for a new chat from the composer; the conversation pins that agent for life, and the header + history show which agent it's talking to.

• Editor polish: text boxes are click-to-edit with the pencil inside; the mode confirm names the target ("Change to Read-only?") with a red button; agents delete straight from the list (core agent protected).

• Styled confirmations: native browser confirm dialogs replaced with a theme-aware modal (Esc / backdrop to cancel).

• Per-field agent saves: each agent field saves the moment you change it — no bottom Save button — with a green tick confirming and an inline error on failure.

• Expanding identity editor: the identity field grows as you edit it and settles back when you're done.

• Settings overlay: Settings now opens as an overlay over the chat instead of taking over the whole screen; Esc closes it.

• Tool discovery: the gated-tools checklist lists the instance's connector and MCP-endpoint tools, and the custom field autocompletes against them.

• approval-gated: safety mode renamed from approval-needed (old spelling still reads); the default agent now shows the instance brand.

• Multi-agent management: Settings → Agents lists the default agent plus named agents — add, edit, delete; unset fields inherit the instance defaults. Chats use the default agent until the per-chat picker lands.

• Gated-tools checklist: pick tools to gate from a checklist (plus custom MCP ids); a hint explains what the current mode already gates.

• Settings polish: tab icons; GitLab / GitHub card titles; compact safety-mode picker with a confirm before live changes; editors prefill live values (no more wiped capability cards); plugin-owned personas say so.

• Editable agent config: identity, safety mode, gated tools, capability cards, and model policy editable in Settings — stored in the DB over instance.yaml, live from the next turn.

• Profile & usage polish: inline-edit display name (pencil → tick/✕) with aligned values; usage shows display names and is visible to everyone (admins get a mine/everyone toggle); clearer switches; real brand logos; amber locks mark admin-only surfaces.

• Three safety modes: readonly | approval-gated | readwrite replace read_only; approval-gated pauses writes and mutating commands on an approval card.

• Settings surface: an always-visible ⚙ gear opens tabbed Settings — Appearance, Profile, Usage for everyone; Agents and Channels admin-only.

• agentkit discipline hooks: workspace agents run under the police portfolio (git/kubectl/pkg/mr/format/coding), armed automatically.

• CLI toolbox: instances declare allowed CLIs (catalog pins or url+sha256); a Bash allowlist enforces available ≠ permitted.

• Repo workspace (phase 1): agents work across declared repos; gated autonomy pauses pushes/MRs; default-branch pushes always refused.

• GitHub mentions channel: @mention the bot on allowlisted issues/PRs; one conversation per target; GitHub Enterprise supported.

• Channels settings page: GitLab/GitHub mentions fully configurable from Settings (secrets write-only; env overrides); live on the next webhook.

• AWS Bedrock models: Bedrock-hosted Claude via backend: bedrock entries; clear failure without AWS credentials.

• GitLab mentions channel: @mention the bot on allowlisted MRs/issues; replies as comments, one conversation per target; off by default.

• Embedded mode: ?embed/iframe drops the brand header; controls move to the meta bar.

• Per-origin usage: turns attribute to their surface (web/embed/?origin=); per-origin cost columns appear when a second surface shows up.

• Interactive approvals: gated tools pause the turn on an approval card (Approve & run / Deny, owner or admin, 5-minute timeout, refresh-safe).

• Theme system: semantic tokens, pre-paint dark/light/system, instance-wide templates + code themes + markdown accents.

• Activity trace: read/search runs collapse into "Gathered context"; live shimmer; hover-to-copy answers.

• Landing page: configurable capability cards with generic defaults.

• Mermaid & tables: theme-colored diagrams that scroll; tables wrap long values.

• Version badge: one-click copy; changelog opens in-app.

• Instance identity: identity: (or a brand default) sets the system prompt; a plugin persona still extends/overrides it.

0.1 — first deployed line (2026-07-03 → 2026-07-04)

• One core, N instances: chat with live activity trace, token-streamed answers, markdown, per-turn + per-thread cost, history with rename/range/cost·model, admin usage, per-instance branding + accent, and a build badge — deployed via GitOps to chat.agenteda.com and neutroncore.agenteda.com.