# Changelog > A curated, user-facing summary of what landed recently. The authoritative per-batch journal — every commit + every link — lives on STATUS.md (the agent-curated status board); the immutable per-commit journal-of-record… A curated, user-facing summary of what landed recently. The authoritative per-batch journal — every commit + every link — lives on [STATUS.md](https://github.com/kinra-ai/kin/blob/dev/STATUS.md) (the agent-curated status board); the immutable per-commit journal-of-record is `git log`. This page is the friendlier surface: what’s new, what changed, what to know. ## 2026-08-09 — Bounded reasoning for Qwen routes (0.3.10) Named Qwen routes can now opt into explicit llama.cpp thinking budgets on both Chat and Responses without changing DS4 or unrelated providers. The Model Hub, `kin connect`, resume journals, and route fingerprints share the same closed `qwen-llamacpp` contract, including Utility title headroom and fail-closed output validation. The pinned Kinra gateway uses `reasoning_budget_tokens`; Kin sends no alternate field speculatively. Route clones now keep their request metadata independent, and resumed conversations restore the persisted reasoning effort on the provider wire as well as in the interface. ## 2026-08-08 — DS4 and Qwen become the live fleet (0.3.9) Kin's executable live-model contract now matches production inference: the main route is DeepSeek V4 Flash over OpenAI Responses with its advertised 131K context, 32K output ceiling, and exact input counting; single-image vision and utility calls use the independently qualified Qwen route. The current gates exercise both routes directly, while historical vLLM, Laguna, and llama.cpp probes now require an intentional endpoint instead of silently falling back to the retired fleet. Outpost carries that identity all the way through unattended work. Jobs and recipes snapshot the selected provider profile as well as endpoint and model, so a `kin connect` configuration keeps its Responses wire and credential route. Authenticated model-drift checks resolve the current credential without putting it in the jobs database, refuse to send it across origins, and disable redirects. Existing job snapshots remain untouched until an operator re-pins or recreates them. Container recovery now seeds `settings.toml` and the 0600 `credentials.toml` independently, without overwriting a live named volume. The background governor also tells the truth about DS4: portable running, queue, and token caps remain active, while vLLM request priority and pressure metrics are explicitly configured compatibility features rather than assumed production capabilities. ## 2026-08-08 — Clean resumes and resilient launches (0.3.8) Kin's memory reflection is internal housekeeping: it distills durable memories between turns, but it is not part of the conversation. Those reflection turns were correctly hidden while a session was live, then could reappear after a resume — in the terminal or Outpost transcript, prompt history, a forked agent's labels, compaction input, or rewind state. Replay now recognizes the whole bounded reflection span everywhere it consumes a journal, so the conversation you resume is the conversation you had. The journal still keeps the internal work for recovery, and ordinary user text that merely resembles a reflection marker is not hidden. Launching Kin from a terminal whose current directory was deleted or moved into a protected Trash location no longer crashes before even `--help` can run. With no explicit project path, Kin re-anchors to your home directory and falls back to `/` if home itself cannot be entered, while reporting what happened. An explicit relative `--workdir` still fails closed when its original base directory is gone rather than quietly targeting somewhere else. `kin doctor` also re-anchors before invoking repair installers, so diagnosis and repair follow the same recovery contract. The release dependency set was refreshed through the pre-release vulnerability gate as well, including patched `aiohttp`, `cryptography`, PDF parsing, and documentation/build dependencies. The published Outpost image and wheel are built from that audited lock. ## 2026-08-07 — Pseudo-terminals just work, and "run it unconfined" is one click (0.3.7) A sandbox-friction release. Commands that allocate a real pseudo-terminal — the kind a full terminal UI, an interactive REPL, or the `verify-pty` gate needs — used to hit a wall in auto mode: the OS sandbox denied the allocation, the failure hid behind a misleading "out of pty devices" message, and the peer had to manufacture throwaway probes just to surface something it could ask you to approve. The sandbox now allows pseudo-terminal allocation natively, so those commands run contained with no approval at all. And when the peer genuinely needs the sandbox lifted for a specific command, it can now ask you *before* running it — one prompt that shows you the exact command — instead of provoking a failure to earn the right to ask. That prospective request is always shown, never silently granted, is scoped to the one command, and can't be widened into a standing "run anything unconfined" pass. Both changes went through an adversarial security review before shipping, which is worth knowing about: the review caught that the pseudo-terminal rule, as first written, would have let a sandboxed command paint text onto your actual terminal (where the approval prompts are drawn), and that a long command in the approval prompt could scroll a payload out of view. Both were fixed — the terminal grant is now scoped to the pseudo-terminals a command allocates for itself, and the approval prompt shows the whole command — and the review's other findings hardened the new escape hatch so it can't become a durable bypass. See decision record 0158. ## 2026-08-02 — The shell door gets the same rules as everything else (0.3.3) A security-and-workflow release. The theme: things Kin already refused to do through its structured tools could still be done through the shell, and things the shell learned from the network were trusted more than they deserved. Both doors now follow the same rules. The shell-door audit (four decision records) closed the gaps one class at a time. Reading a credential store through `cat`/`grep` used to auto-run because those commands are "provably read-only"; any shell command that names a secret path now asks first, and that approval deliberately can't be remembered. Rewriting hook-manager configs (`.envrc`, `.pre-commit-config.yaml`, kin's own trust files) through a sandboxed `sed -i` used to succeed where the same edit through the edit tools asks; the sandbox now denies those writes at the kernel. `run_code` approvals never join the "always allow" tier. And when the model runs its own `curl`/`wget` — or Python networking through `run_code` — the output now arrives wrapped in the same untrusted frame a fetched web page gets, so instructions planted in remote content read as data, not as your voice. GitHub got friendlier without getting looser. A recognized GitHub remote with `gh` installed but not signed in now parks the exact Git call on one plain-language web-login handoff and resumes it, instead of failing with credential-helper archaeology — and if you'd already trusted your SSH route, that keeps working untouched. Project MCP config moved to kin-owned `.kin/mcp.json` (a root `.mcp.json` — other harnesses' convention, and older kin's — is adoption material in `/mcp`, never auto-executed). Picking a model whose provider has no stored key now asks for the key right there. And the nested AGENTS.md guidance that file tools always surfaced now also triggers when a shell command touches a guided subtree, bounded so a wide `ls` can't flood a turn. A ten-finding adversarial review of all of the above landed with it: quoted pipes in `rg`/`sed`/`awk` no longer trip endless un-rememberable prompts, `git sync` names the real reason it stops after upstream squash-merges instead of "unexpected state", a checkout the sandbox half-blocked reports the stale files instead of claiming success, and a parked login modal no longer blocks sibling sessions' syncs. ## 2026-07-25 — Clearer refusals and a correct key map (0.3.2) A polish release for the terminal UI, and most of it is Kin telling you the truth about itself. When Kin refuses something you just asked for, it now names what is actually in the way. Twenty-one surfaces used to answer with one of two stock lines: "while a turn is running" — which was simply wrong if a `/compact` was what held the session — or "while kin is busy", which named nothing at all. That second one was the worse of the two: pressing ++ctrl+l++ while an approval dialog waited for an answer read as an unexplained refusal instead of "answer the dialog first". The ++f1++ key map was describing an app that no longer existed. It listed the old provider picker with a key that surface has not had since 0.3.0, and never mentioned the `/models` hub that replaced it. The overlay hints and the map are now one declaration read from two places rather than two copies that drifted, which immediately surfaced three more gaps: the sandbox-access dialog binds a `w` "grant for this workspace" key its hint never named, `/grants` never named the `n` that backs out of an armed revoke, and the `/models` and `/mcp` hint lines were long enough to render cut off mid-word. Peeking a file with `v` or `/view` showed its size and line count where the `esc / q closes` hint belongs, so the only way out of that view was undocumented on screen. Both are shown now. Every overlay hint reads in one voice — each key followed by what it does (`enter picks`, `esc closes`) — and a hint no longer repeats what the dialog's own buttons already say. See [Keybindings & cursor mode](/docs/kin/guide/keybindings/). Two places where text Kin did not author reached a notification without being treated as literal — another session's folder name and conversation summary, and an error line from tmux — could render as markup or be dropped. Both are fixed. ## 2026-07-24 — Streaming, transcript, and launch fixes (0.3.1) A maintenance release. The headline is a quiet one: long assistant replies could stop rendering partway through. When a streaming reply arrived before its message body existed, Kin built the stream around nothing, the write failed once in the background, and everything after that point was dropped with no error shown — the reply simply looked shorter than it was. Nothing was lost from the journal, so `/resume` always showed the full text; only the live view was truncated. Two more fixes you may have hit. Starting Kin in a workspace where another launch already held the lock could fail with an internal error instead of falling back to a plain session. And the Outpost run-page transcript rendered the internal environment block that the terminal UI hides, so remote transcripts carried noise the local ones did not. `/model` on a provider with no key now opens the `/models` hub directly rather than the retired provider modal, finishing the 0.3.0 move to one configuration surface. `/brave-key` (alias `/search-key`) is unchanged and remains where search credentials live. See [Providers](/docs/kin/guide/providers/). The rest is internal: the Textual client joined the type gate, every rendered inline script is now parsed by the test suite rather than only the landing page, and the Outpost transcript shares the harness's journal decoder instead of a drifted copy of it. ## 2026-07-22 — Model hub and local Responses (0.3.0) Kin 0.3.0 makes model configuration job-first. The `/models` hub now separates Jobs, Connections, and Routes so the plain-language jobs — main conversation, images, computer screenshots, tasks, and workflows — can each use a stable named assignment without exposing provider credentials or endpoint details to the model. Connection editing, secret updates, model discovery, and route assignment share one staged, conflict-aware apply flow. `/providers [id]` and `/routes` are now deep links into that hub rather than modals of their own, so the Brave Search key lives on `/brave-key` (alias `/search-key`) instead of a section inside the old provider modal. Bare `/model` is unchanged — it is still the cross-provider model picker. See [Providers](/docs/kin/guide/providers/). The release also adds an explicit OpenAI Responses wire with Kin-owned typed item replay, journal resume, strict parallel tools, structured output, usage reporting, and endpoint-safe reasoning persistence. vLLM 0.25.1 and Paddock-managed llama.cpp with Laguna S 2.1 have reproducible live qualification gates. Laguna's long-context profile gains conservative first turn admission and completed-history compaction while preserving tool continuations intact; because Laguna S 2.1 is text-only, that profile now predeclares nested tool-result images unsupported rather than probing for them, so screenshots reach the serve as stable text references while the canonical bytes stay available to a separate vision route. See [Models & providers](/docs/kin/guide/models-and-providers/). Two of those changes are **not** profile-scoped, and are worth a look before you upgrade. Output-aware prompt admission now runs before every model round on any backend that reports a response cap: if the reserved output budget plus the prompt Kin may not summarize still cannot fit the context window, no model call is made. Interactively that is an admission error; in headless it is the new `done_reason: context_limit` with exit `1`, so a scheduler that branches on `done_reason` needs the new value. And tool arguments are now validated against each tool's JSON Schema on every wire — malformed, non-object, or schema-invalid arguments return an error to the model before any permission prompt or tool execution. If you ship a custom or MCP tool whose declared schema is stricter than its implementation, re-check that schema. See [Headless](/docs/kin/guide/headless/). The final review hardened secret writes, concurrent settings edits, endpoint switches, headless context-limit exits, Responses content filtering, and TUI shutdown so background git refreshes cannot fail after the chrome detaches. ## 2026-07-21 — Named model routes (0.2.5) Kin 0.2.5 introduces operator-defined named model routes (DR 0139): global `[model_routes.]` tables bind a provider preset + model behind a stable handle, and `[model_assignments]` steer the main agent, subagents, workflows, and vision work onto them — including semantic media dispatch, so a text-only main model can hand images to a vision-capable route via `inspect_media`. The model sees only the handles it may choose, never provider identity or endpoints. See [Models & providers](/docs/kin/guide/models-and-providers/). The release also carries a verified review pass over the feature: route telemetry now attributes child rounds correctly, a custom `[[providers]]` row without a `base_url` keeps its ambient endpoint, and bare `--resume` again reuses the saved backend even with `KIN_*` exported in the shell. ## 2026-07-18 — Code reads like code Fenced code blocks now follow conventional editor cues instead of repainting the brand palette (DR 0134): strings render in a muted content-only green, functions and builtins in bold bone, with cyan confined to keywords and amber confined to numbers. Inline code drops its amber and renders in body text on the code band — amber in a transcript once again means *attention*, nothing else. See the [identity page](/docs/kin/concepts/identity/) for the reasoning. ## 2026-07-18 — get.kinra.ai becomes the Kinra product front door [get.kinra.ai](https://get.kinra.ai) now introduces two independent products: Kin, the native AI peer for the terminal, and Paddock, the Linux x86-64 alpha for operating local llama.cpp models. Each has a complete product page and installer; one quiet integration note explains that Kin can use Paddock's loopback OpenAI-compatible endpoint without making either product depend on the other. Outpost remains an optional Kin deployment. - The site is three static pages with shared CSS and JavaScript, system fonts, no analytics, keyboard-operable OS tabs, accessible copy feedback, reduced-motion support, and screenshots sourced from each owning product. - Kin's same one-liner is now universal on a fresh machine. It keeps every existing checkout on the editable path, but automatically uses a manifest-selected, SHA-256-pinned public wheel when Git or authorized GitHub SSH is unavailable. PyPI supplies public dependencies without becoming a candidate source for Kin itself. `--check` remains non-mutating and never probes SSH. - Kin 0.2.4 repairs the wheel resolver boundary caught by the production fresh-install drive: making Kinra the only package index also hid Kin's third-party dependencies. The installer and `kin update` now make Kin a checksum-pinned direct requirement and expose PyPI only as the dependency index. - Paddock owns an independent manifest-last publication channel under `/paddock/`, including immutable archives, checksum sets, SPDX SBOMs, build metadata, compatibility evidence, and its bootstrap installer. Both source repositories remain private. - Public support and private-security inquiries use `support@kinra.ai`, a stable role address rather than an individual operator's account. - get.kinra.ai now serves from a durable host docroot. Kin and Paddock publish disjoint allowlists, so a Kin deploy cannot delete a retained Paddock release. The old worktree docroot remains an explicit emergency rollback mount. ## 2026-07-17 — Subagents run until completion Bundled subagent profiles no longer carry arbitrary model-round caps. A registered child runs until it finishes or the main coding agent pauses, interrupts, restarts, or kills it. Omitted or `max-turns: 0` now means unlimited for custom profiles too; a positive value remains available as an explicit operator leash. The supervision runtime, shared root token budget, doom-loop guard, depth and parallelism limits remain the real runaway controls. This removes the old failure mode where productive work hit a profile cap, parked, and required the main agent to spend another round resuming it with a freshly reset window. ## 2026-07-16 — kin tells you when there's an update, and one command applies it kin 0.2.0 opens the update channel ([DR 0121](https://github.com/kinra-ai/kin/blob/dev/docs/decisions/0121-update-channel-and-kin-update.md)): - **You get told.** At session start kin makes one best-effort, 24h-cached check of the get.kinra.ai release manifest and shows a one-line note when a newer release is out. Version-only, fixed endpoint; opt out with `update_check = false` / `KIN_UPDATE_CHECK=0`. - **`kin update` does the rest** — it detects how kin was installed (checkout vs wheel) and applies the right update, including the tool-venv dependency refresh that a bare `git pull` used to silently skip. `kin update --check` and a new `kin doctor` line report without applying. - **Releases are verified by construction.** get.kinra.ai and docs.kinra.ai now publish only from `task ship`-gated builds of `main`, and the wheel only from a tagged release — with older wheels retained, so each immutable versioned wheel URL remains a working rollback. - Re-running the install one-liner fully heals an existing install. Kin 0.2.4 supersedes the original index-only resolver shape with the checksum-pinned direct-wheel boundary described above. ## 2026-07-16 — Supervision branch hardened by a full multi-agent review A high-effort multi-agent review of the model-owned-supervision branch surfaced 13 confirmed correctness defects and 10 cleanups; all are fixed. What you'll notice: - **Headless runs report honestly and always finish.** A failed `kin -p` main turn can no longer be flipped to exit `0` by a later clean supervisor continuation, and a hung background agent now ends the run with a clear `agent quiescence stalled` error (~5 minutes of true silence) instead of hanging a cron job forever. - **Sandboxed git-over-SSH actually works on Linux.** A stock `ssh-agent` socket under `/tmp` is now bound back through bubblewrap's private `/tmp`, and a *successful* command that merely quotes "Permission denied (publickey)" (a grep over logs) is no longer misread as a sandbox denial. With `sandbox_network = false`, `uv run`/`task` work again offline (`UV_NO_SYNC=1` is restored for that posture). - **Agent control is safer.** Pausing a foreground child (a guaranteed deadlock) is refused; an interrupted agent can't be double-run; pressing ++escape++ during an interrupt/restart wait actually interrupts; resuming a turn-capped agent gets fresh rounds; stale-health detection covers resumed and foreground agents; and `agent_wait`'s `any_change` wakes on real activity instead of sleeping to its timeout. ## 2026-07-15 — Model-owned subagent supervision Registered `task` agents are now first-class supervised resources. The MCA can inspect, wait for, steer, cooperatively pause/resume, promptly interrupt, restart, and close them; lifecycle events automatically regain its attention without a human sending another message. Child prose and diagnostics stay behind explicitly untrusted-framed tools. Headless runs wait for agent quiescence, the TUI renders hidden-input autonomous continuations without a fake user bubble, and stale activity is advisory after a configurable bounded timeout. The old completion-reminder off switch is retired because lifecycle delivery is now correctness, not presentation. ## 2026-07-10 — get.kinra.ai installer + `kin doctor` + this site goes public One pasted command now takes a fresh Linux/macOS machine to a running `kin`: ```bash bash <(curl -fsSL https://get.kinra.ai/install.sh) ``` - **[get.kinra.ai](https://get.kinra.ai)** is a single static page (no framework) with per-OS prereq notes (Fedora / Ubuntu·Debian / macOS / Windows-via-WSL2) and the one-liner above. `install.sh` installs `uv` if missing, clones `kinra-ai/kin` to `~/kin` (`~/kin-textual` is reused for existing pre-rename installs), `uv sync`s, installs `kin` via `uv tool install --editable`, and writes a starter `~/.kin/settings.toml` — idempotent, no sudo, never edits shell rc files. Needs an SSH key with repo access (private repo). - **No SSH key?** `uv tool install kin --index https://get.kinra.ai/simple/` installs the latest built wheel from a static index instead — read-only, no checkout, no dev loop. - **[`kin doctor`](/docs/kin/reference/cli/#kin-doctor)** — a new subcommand that verifies any install: tools on `PATH`, a resolvable model provider (and which source supplies it), and the endpoint's reachability (`--offline` skips the last check). Exit `0`/`1`. See [Install § Verify the install](/docs/kin/getting-started/install/#verify-the-install). - **`kin --version`** — prints `kin ` and exits before any TUI import; the installer's success gate. - **This site is now public at `docs.kinra.ai`**, overriding the earlier "docs hosting LOCAL-ONLY" decision. A companion `outpost-install.sh` (also from get.kinra.ai) brings up the Outpost on a fresh server the same way. ## 2026-07-10 — Composer drag-drop + paste attach files by reference Dropping files onto the composer, or pasting a Finder multi-file selection or an absolute path, now attaches them as `@`-mentions instead of dumping raw path text into the prompt — the same untrusted-content framing and secret-file guard an `@`-mention typed by hand already gets. - **Whole-paste file detection** — when the *entire* paste is one or more absolute, existing file paths (Finder's newline-joined drop, Ghostty's backslash-escaped spaced path, iTerm's newline join), each becomes an `@`-mention at the caret in one toast; a prose paste that merely mentions a path is left untouched. - **Oversize images (over 5MB) auto-downscale** via macOS's `sips` before attaching, to fit the vision-model edge budget. - **`ctrl+v` captures a clipboard image** directly — no intermediate file needed. - **More than 10 files in one drop** warns and inserts the paste verbatim instead of silently attaching a partial set. - Opt out with `KIN_PASTE_MENTIONS=0` (or `paste_file_mentions = false` in `settings.toml`) to get the old verbatim-paste behavior back. ## 2026-07-10 — read_file learns Word + Excel (.docx/.xlsx) `read_file` classified files by extension — image / PDF / SVG / text — and everything else fell through to the text reader, which opens a file with `errors="replace"`. A `.docx` or `.xlsx` (zip containers of XML, not UTF-8 text) therefore came back as **silent mojibake** — a wall of replacement characters the model would hallucinate against. That fallthrough is now dead. - **Word (`.docx`, `.docm`)** → clean text: paragraphs plus tables rendered as Markdown rows, in document order. - **Excel (`.xlsx`, `.xlsm`)** → each sheet as a `## title` heading + a Markdown table (cached values, not formulas), capped at 10 sheets × 100 rows × 30 columns with a truncation footer, then the same 50 KB char cap as PDF. `@`-mentioning an Office file works too. - **Macros are never read.** The `.docm`/`.xlsm` variants are handled, but the VBA blob is not a paragraph or a worksheet — it's structurally unreachable. - **Two security guards, verified engaged (not just installed):** a zip-bomb cap that rejects an archive whose *declared* decompressed size exceeds 50 MB (checked before any parse), and the XML entity-expansion guard (`defusedxml`, openpyxl's billion-laughs defense). A four-pin test battery proves both fire. - **No silent garbage, ever:** a corrupt or non-Office file with one of these extensions returns an explicit `error:` — never a mojibake decode. ## 2026-07-04 — Unlimited main-session turns (`KIN_MAX_TURNS`) The main session's per-turn round cap was hardcoded at 40 model↔tool round-trips — fine for typical interactive turns, but it cut short the long agentic runs a large model can sustain for hours. The cap is now **unlimited by default**, configurable end-to-end, and the subagent caps are raised to match. - **`KIN_MAX_TURNS`** env / **`max_turns`** settings key / **`--max-turns`** headless flag — `0` = unlimited (the default). A non-zero value caps the model↔tool round-trips in one user turn (done reason `turn_cap`, headless exit `1`). Mirrors the existing `token_budget` resolution chain. - **Subagent caps raised:** default `max-turns` 20 → 100, hard cap 100 → 1000 (a subagent profile's frontmatter). - The **doom-loop guard** (3× identical call+result) remains the real no-progress backstop, so an unbounded cap is safe — a stuck loop still trips it. `max_turns` is an operator leash (deliberately not model-writable), just like the per-run `token_budget`. ## 2026-07-04 — TUI polish pass + docs audit A 10-commit TUI polish pass (POLISH r1-r10) landed on `dev` (the 746535b fix commit followed), then a separate docs-audit pass cleaned up drift in the user-facing docs. **POLISH r1-r10 + 746535b (the visual identity series):** - **r1** — every functional glyph consolidated into `theme.py` constants (POLISH-r1 audit-fail for any drift site; zero diffs). - **r2** — `#transcript { margin-bottom: 1 }` always-on transcript↔StatusBar gap; the old `.-turn-end` re-tagging machinery deleted; the docked Footer replaced with the placeholder's `F1 help` hint. - **r3** — `UserMessage` is a rounded titled box with a `you` border-title (auto-width hugs short prompts, wraps long ones). - **r4** — connector vocabulary: `G_RUNNING` flipped to `•`, carets on `Collapsible`, `╰ tail` elbow for the live tail of a running tool, `border-left` rails on Contents. - **r5** — `Reasoning` title two-tone (`thinking…` → `thought · 4s`), body italic dim, left rail `$accent 35%`. - **r6** — new `shimmer.py` primitive (cosine-swept raised-cosine sweep, 2.0s period, 5.0-char band) + StatusBar phase-word state machine (`thinking` / `mulling` / `tracing` / `sifting` / `weaving` / `kindling` / `distilling` rotation). - **r7** — subagent dedup (single `set_activity(f"agent working ({profile})…")` on the bg path) + `task · ` agent-mode title. - **r8** — `tool_call_draft` end-to-end (new `Chunk("tool_draft", …)` on both wires — name + chars only, NO argument content; loop-side ≤250ms throttle; `ForwardingEmit` drops it from subagent children; StatusBar shows `drafting … N chars` with char-count tiers). - **r9** — WorkflowCard shimmer + tooltips + HelpModal audit (cursor-mode + expand-all + `ctrl+p` added; scrollable body fixed-height+1fr-scroll). - **r10** — snapshot baselines regen + docs sync (`docs/reference/events.md` got `tool_call_draft`; `docs/getting-started/first-run.md` mentions the shimmer + phase-word state machine + `TEXTUAL_ANIMATIONS=none` fallback; `REFERENCE.md § UI widgets & theme` got the four invariants). - **746535b** — fix pass for the adversarial-review findings from the polish series. **Docs audit (this pass):** - vLLM example model id refreshed across `README.md` + the vLLM recipe in `docs/guide/models-and-providers.md` + the banner mock-ups in `docs/BANNER_SPEC.md` + the example in `research/README.md` — fleet is now Qwen3.6-35B-A3B on vLLM 0.23.0 (was 27B-FP8). - `src/kin/tui/CLAUDE.md` synced with POLISH r1-r10 — new `shimmer.py` row in the UI map, new "POLISH r1-r10 invariants" subsection under Theme & visual identity. - `TRACKER` line 16 (the former TRACKER backlog) stale wording fixed ("NOT yet pushed, NOT on main" → "PROMOTED to `main` 2026-07-03, clean FF to `6e32d6b`"); the §23-31 STRATEGY closure block collapsed to a 5-line recap pointing at `research/2026-07-02-strategy.md` and the 2026-07-03 review (now `docs/decisions/0009` + `0010`). - Verify-suite count reconciled: `task verify` runs **eleven** wired-in suites (was "ten"); `verify-memory` and `verify-workflow` added to README's verify command list. - MCP servers added to CLAUDE.md's operator-tour block. - New `docs/internals/extending-tools.md` — the user-facing mirror of `src/kin/harness/CLAUDE.md`'s tool-author guide, plus walkthroughs for adding a permission kind and a subagent profile. - `docs/concepts/architecture.md` extended — "Compared to other agent harnesses" table (kin in-process vs Claude Code / Gemini / Codex subprocess vs Aider/Continue LSP vs OpenHands/Devin remote), Mermaid turn-flow diagram. - New `docs/getting-started/first-session.md` — 10-exercise TUI tutorial (welcome banner, slash history, cursor mode, planning freeze, sessions). - `KIN_BASE_URL` heuristic anchor made explicit (`#the-kin_base_url-heuristic`) on `docs/guide/models-and-providers.md`; `docs/getting-started/first-run.md` uses the explicit anchor. - The former `HARNESS_PLAN` planning doc's "Dynamic workflows DESIGN" section collapsed (~279 lines → ~62 lines pointer + recap). - `docs/kin-console.md` deleted (76-line placeholder predating the Outpost; superseded by `docs/guide/outpost.md`). - Duplicate trailing line removed from `docs/guide/sessions.md`. - `docs/404.md` (this 404 page) + `docs/changelog.md` (this page) added. ## 2026-07-03 — STRATEGY build PROMOTED to `main` All 11 rocks landed (Tier 0 + Tier 1 + Tier 2 + ALL of Tier 3: 3a/3b/3c/3d/3e), verified, and PROMOTED to `main` (clean FF to `6e32d6b`, 2026-07-03 ~21:00). Outpost was redeployed with all three riders (2a scheduler / 3b chromium / 3c Memory card). Verify baseline: 2500/0 across 11 suites. **Tier 3 (the maturation tier):** - **3a MCP maturation** — hardening + elicitation + resources + OAuth (auth-code+PKCE, NOT device flow: research overturned the hunch). - **3b Computer-use Tier-1** — `browser` tool (Playwright chromium, text-only, action-enum, scheme allowlist, two-layer SSRF guard). - **3c Agent-memory floor** — `memory` tool (Anthropic's `memory_20250818` command set 1:1) + FTS5 recall index + session-end consolidation side-call + Outpost Memory card. - **3d Multi-agent artifact store** — `publish`/`ref` verbs + `agent()` opt-in `{ref, summary}` handle + ride-alongs `/revise` + `/research`. - **3e Code-interpreter** — `run_code` stateful per-Session kernel under the OS sandbox (`kind=perm.SHELL` reuses the shell decision path; zero permission-plumbing edits). **Half-rock gap (still open):** Tier 2b "GPU governor" landed a per-run token leash, NOT the cross-run GPU-fairness gate STRATEGY asked for. Live session + scheduled job still race one GPU. See the 2026-07-03 review (now `docs/decisions/0009` + `0010`) Tier-2b section. ## 2026-07-02 — Headless run mode `kin -p ` (the Tier 0 keystone from the STRATEGY research) — one turn, no UI, real Backend, collecting emit sink, exit 0/1/2 contract. The Outpost scheduled-jobs centerpiece (2a) consumes this via `kin -p` SUBPROCESSES. Closes the gate for scheduling / evals / cron work. See the [Headless guide](/docs/kin/guide/headless/) for the full surface. ## 2026-07-01 — Live reasoning-effort controls `/effort` slash command + per-serve picker (`low` / `medium` / `high` / `xhigh` / `max` for Anthropic; `low` / `medium` / `high` for OpenAI-compat; `auto` / `on` / `off` for Qwen). The [KIN_REASONING_EFFORT](/docs/kin/reference/environment-variables/) env var overrides per session. ## 2026-06-30 — Git network tools `git-push` / `git-pull` / `git-fetch` modeled on `ssh.py` (structured args only, argv assembled element-by-element, runs OUTSIDE the OS sandbox). `push` / `pull` reuse `kind=perm.MCP` (ASK both modes); `fetch` gets the new `kind=perm.NETWORK` (ALLOW auto / ASK strict / freeze-DENY). `force` only ever emits `--force-with-lease` (no raw `--force`). ## 2026-06-28 — v3 §4-7 batch - **§4 ssh egress** — `ssh` tool (`kind=MCP`, outside the sandbox, honors `~/.ssh/config`, opt-in global `ssh_hosts`, host-scoped approvals). - **§5 bundled exemplar skills** — 9 SKILL.md exemplars (deep-research / brainstorm / code-review / simplify / debug / commit-message / plan / skill-creator / pr-description). - **§6 search_workspace Tier 1** — stdlib FTS5 build/search, secret + gitignore exclusion, off by default (`KIN_SEARCH=1`). Tier 2 (vector / embed / rerank) DEFERRED. - **§7 settings tool** — `read_settings` READ + `propose_settings` META with an explicit `MODEL_WRITABLE_KEYS` allowlist. ## 2026-06-27 — auto-first two-mode collapse + plan lifecycle The two-mode core (`auto` + `strict`, the `CYCLE` for `shift+tab`) plus the planning freeze (a transient read-only overlay, not a mode). `default` → `strict`, `accept-edits` → `auto`, `plan` → `strict` legacy aliases. `/plan` enters the freeze; `present_plan` presents the tracked plan file (3-option modal: keep / clear & re-inject / hand to critic). ## 2026-06-26 — Dynamic workflows ("ultracode") MVP The seven primitives (`agent` / `parallel` / `pipeline` / `phase` / `log` / `publish` / `ref`) + the `workflow` tool + the TUI WorkflowCard + the `/workflows` modal. Closed namespace (capability by absence, NOT a sandbox) + AST filter + SIGALRM busy-loop watchdog. See the [Workflows guide](/docs/kin/guide/workflows/) for the user-facing walkthrough. ## 2026-06-26 — Background subagents + Ctrl+O panel The `task` tool spawns a bg subagent and returns an agent id immediately; the model sees a metadata-only `` on the next depth-0 turn (never subagent prose). `MAX_BG_SUBAGENTS = 3` is the runaway guard. Ctrl+O opens the panel (shells / agents / tasks panes, Tab cycles). ## 2026-06-26 — Tasks DAG + `--agent` CLI The `tasks` tool with action enum (add / update / complete / remove / list / blocked), cycle-checked, auto-unblock on complete. Sidecar at `/.tasks.json`. `kin --agent ` runs the main session as a profile (TTY-only). ## 2026-06-25 — kin CLI packaging The installable `kin` uv CLI (src layout, hatchling). macOS Ghostty "Open in kin" Finder Quick Action in `extras/macos/`. ## 2026-06-24 — File-extraction refactor + security fixes The `read_file` tool gained PDF (via `pypdf`) + image (PNG / JPEG / GIF / WebP as image blocks; SVG as text) support, with a 50k char cap and a `coerce_int` discipline for numeric args. ## 2026-06-23 — Spine landed, verified, live-tested + hardened The `kin-textual` → native Python harness pivot. In-process harness (`src/kin/harness/`) + Textual UI (`src/kin/tui/`) + the event vocabulary seam (`src/kin/harness/events.py`). No subprocess, no NDJSON, no wire between the two. The Go `../kin/` repo became the design reference only.