Changelog

A curated, user-facing summary of what landed recently. The authoritative per-batch journal — every commit + every link — lives on STATUS.md (the agent-curated status board); the immutable per-commit journal-of-record is git log. This page is the friendlier surface: what’s new, what changed, what to know.

2026-08-09 — Bounded reasoning for Qwen routes (0.3.10)

Named Qwen routes can now opt into explicit llama.cpp thinking budgets on both Chat and Responses without changing DS4 or unrelated providers. The Model Hub, kin connect, resume journals, and route fingerprints share the same closed qwen-llamacpp contract, including Utility title headroom and fail-closed output validation. The pinned Kinra gateway uses reasoning_budget_tokens; Kin sends no alternate field speculatively.

Route clones now keep their request metadata independent, and resumed conversations restore the persisted reasoning effort on the provider wire as well as in the interface.

2026-08-08 — DS4 and Qwen become the live fleet (0.3.9)

Kin’s executable live-model contract now matches production inference: the main route is DeepSeek V4 Flash over OpenAI Responses with its advertised 131K context, 32K output ceiling, and exact input counting; single-image vision and utility calls use the independently qualified Qwen route. The current gates exercise both routes directly, while historical vLLM, Laguna, and llama.cpp probes now require an intentional endpoint instead of silently falling back to the retired fleet.

Outpost carries that identity all the way through unattended work. Jobs and recipes snapshot the selected provider profile as well as endpoint and model, so a kin connect configuration keeps its Responses wire and credential route. Authenticated model-drift checks resolve the current credential without putting it in the jobs database, refuse to send it across origins, and disable redirects. Existing job snapshots remain untouched until an operator re-pins or recreates them.

Container recovery now seeds settings.toml and the 0600 credentials.toml independently, without overwriting a live named volume. The background governor also tells the truth about DS4: portable running, queue, and token caps remain active, while vLLM request priority and pressure metrics are explicitly configured compatibility features rather than assumed production capabilities.

2026-08-08 — Clean resumes and resilient launches (0.3.8)

Kin’s memory reflection is internal housekeeping: it distills durable memories between turns, but it is not part of the conversation. Those reflection turns were correctly hidden while a session was live, then could reappear after a resume — in the terminal or Outpost transcript, prompt history, a forked agent’s labels, compaction input, or rewind state. Replay now recognizes the whole bounded reflection span everywhere it consumes a journal, so the conversation you resume is the conversation you had. The journal still keeps the internal work for recovery, and ordinary user text that merely resembles a reflection marker is not hidden.

Launching Kin from a terminal whose current directory was deleted or moved into a protected Trash location no longer crashes before even --help can run. With no explicit project path, Kin re-anchors to your home directory and falls back to / if home itself cannot be entered, while reporting what happened. An explicit relative --workdir still fails closed when its original base directory is gone rather than quietly targeting somewhere else. kin doctor also re-anchors before invoking repair installers, so diagnosis and repair follow the same recovery contract.

The release dependency set was refreshed through the pre-release vulnerability gate as well, including patched aiohttp, cryptography, PDF parsing, and documentation/build dependencies. The published Outpost image and wheel are built from that audited lock.

2026-08-07 — Pseudo-terminals just work, and “run it unconfined” is one click (0.3.7)

A sandbox-friction release. Commands that allocate a real pseudo-terminal — the kind a full terminal UI, an interactive REPL, or the verify-pty gate needs — used to hit a wall in auto mode: the OS sandbox denied the allocation, the failure hid behind a misleading “out of pty devices” message, and the peer had to manufacture throwaway probes just to surface something it could ask you to approve. The sandbox now allows pseudo-terminal allocation natively, so those commands run contained with no approval at all.

And when the peer genuinely needs the sandbox lifted for a specific command, it can now ask you before running it — one prompt that shows you the exact command — instead of provoking a failure to earn the right to ask. That prospective request is always shown, never silently granted, is scoped to the one command, and can’t be widened into a standing “run anything unconfined” pass.

Both changes went through an adversarial security review before shipping, which is worth knowing about: the review caught that the pseudo-terminal rule, as first written, would have let a sandboxed command paint text onto your actual terminal (where the approval prompts are drawn), and that a long command in the approval prompt could scroll a payload out of view. Both were fixed — the terminal grant is now scoped to the pseudo-terminals a command allocates for itself, and the approval prompt shows the whole command — and the review’s other findings hardened the new escape hatch so it can’t become a durable bypass. See decision record 0158.

2026-08-02 — The shell door gets the same rules as everything else (0.3.3)

A security-and-workflow release. The theme: things Kin already refused to do through its structured tools could still be done through the shell, and things the shell learned from the network were trusted more than they deserved. Both doors now follow the same rules.

The shell-door audit (four decision records) closed the gaps one class at a time. Reading a credential store through cat/grep used to auto-run because those commands are “provably read-only”; any shell command that names a secret path now asks first, and that approval deliberately can’t be remembered. Rewriting hook-manager configs (.envrc, .pre-commit-config.yaml, kin’s own trust files) through a sandboxed sed -i used to succeed where the same edit through the edit tools asks; the sandbox now denies those writes at the kernel. run_code approvals never join the “always allow” tier. And when the model runs its own curl/wget — or Python networking through run_code — the output now arrives wrapped in the same untrusted frame a fetched web page gets, so instructions planted in remote content read as data, not as your voice.

GitHub got friendlier without getting looser. A recognized GitHub remote with gh installed but not signed in now parks the exact Git call on one plain-language web-login handoff and resumes it, instead of failing with credential-helper archaeology — and if you’d already trusted your SSH route, that keeps working untouched. Project MCP config moved to kin-owned .kin/mcp.json (a root .mcp.json — other harnesses’ convention, and older kin’s — is adoption material in /mcp, never auto-executed). Picking a model whose provider has no stored key now asks for the key right there. And the nested AGENTS.md guidance that file tools always surfaced now also triggers when a shell command touches a guided subtree, bounded so a wide ls can’t flood a turn.

A ten-finding adversarial review of all of the above landed with it: quoted pipes in rg/sed/awk no longer trip endless un-rememberable prompts, git sync names the real reason it stops after upstream squash-merges instead of “unexpected state”, a checkout the sandbox half-blocked reports the stale files instead of claiming success, and a parked login modal no longer blocks sibling sessions’ syncs.

2026-07-25 — Clearer refusals and a correct key map (0.3.2)

A polish release for the terminal UI, and most of it is Kin telling you the truth about itself.

When Kin refuses something you just asked for, it now names what is actually in the way. Twenty-one surfaces used to answer with one of two stock lines: “while a turn is running” — which was simply wrong if a /compact was what held the session — or “while kin is busy”, which named nothing at all. That second one was the worse of the two: pressing ++ctrl+l++ while an approval dialog waited for an answer read as an unexplained refusal instead of “answer the dialog first”.

The ++f1++ key map was describing an app that no longer existed. It listed the old provider picker with a key that surface has not had since 0.3.0, and never mentioned the /models hub that replaced it. The overlay hints and the map are now one declaration read from two places rather than two copies that drifted, which immediately surfaced three more gaps: the sandbox-access dialog binds a w “grant for this workspace” key its hint never named, /grants never named the n that backs out of an armed revoke, and the /models and /mcp hint lines were long enough to render cut off mid-word.

Peeking a file with v or /view showed its size and line count where the esc / q closes hint belongs, so the only way out of that view was undocumented on screen. Both are shown now.

Every overlay hint reads in one voice — each key followed by what it does (enter picks, esc closes) — and a hint no longer repeats what the dialog’s own buttons already say. See Keybindings & cursor mode.

Two places where text Kin did not author reached a notification without being treated as literal — another session’s folder name and conversation summary, and an error line from tmux — could render as markup or be dropped. Both are fixed.

2026-07-24 — Streaming, transcript, and launch fixes (0.3.1)

A maintenance release. The headline is a quiet one: long assistant replies could stop rendering partway through. When a streaming reply arrived before its message body existed, Kin built the stream around nothing, the write failed once in the background, and everything after that point was dropped with no error shown — the reply simply looked shorter than it was. Nothing was lost from the journal, so /resume always showed the full text; only the live view was truncated.

Two more fixes you may have hit. Starting Kin in a workspace where another launch already held the lock could fail with an internal error instead of falling back to a plain session. And the Outpost run-page transcript rendered the internal environment block that the terminal UI hides, so remote transcripts carried noise the local ones did not.

/model on a provider with no key now opens the /models hub directly rather than the retired provider modal, finishing the 0.3.0 move to one configuration surface. /brave-key (alias /search-key) is unchanged and remains where search credentials live. See Providers.

The rest is internal: the Textual client joined the type gate, every rendered inline script is now parsed by the test suite rather than only the landing page, and the Outpost transcript shares the harness’s journal decoder instead of a drifted copy of it.

2026-07-22 — Model hub and local Responses (0.3.0)

Kin 0.3.0 makes model configuration job-first. The /models hub now separates Jobs, Connections, and Routes so the plain-language jobs — main conversation, images, computer screenshots, tasks, and workflows — can each use a stable named assignment without exposing provider credentials or endpoint details to the model. Connection editing, secret updates, model discovery, and route assignment share one staged, conflict-aware apply flow. /providers [id] and /routes are now deep links into that hub rather than modals of their own, so the Brave Search key lives on /brave-key (alias /search-key) instead of a section inside the old provider modal. Bare /model is unchanged — it is still the cross-provider model picker. See Providers.

The release also adds an explicit OpenAI Responses wire with Kin-owned typed item replay, journal resume, strict parallel tools, structured output, usage reporting, and endpoint-safe reasoning persistence. vLLM 0.25.1 and Paddock-managed llama.cpp with Laguna S 2.1 have reproducible live qualification gates. Laguna’s long-context profile gains conservative first turn admission and completed-history compaction while preserving tool continuations intact; because Laguna S 2.1 is text-only, that profile now predeclares nested tool-result images unsupported rather than probing for them, so screenshots reach the serve as stable text references while the canonical bytes stay available to a separate vision route. See Models & providers.

Two of those changes are not profile-scoped, and are worth a look before you upgrade. Output-aware prompt admission now runs before every model round on any backend that reports a response cap: if the reserved output budget plus the prompt Kin may not summarize still cannot fit the context window, no model call is made. Interactively that is an admission error; in headless it is the new done_reason: context_limit with exit 1, so a scheduler that branches on done_reason needs the new value. And tool arguments are now validated against each tool’s JSON Schema on every wire — malformed, non-object, or schema-invalid arguments return an error to the model before any permission prompt or tool execution. If you ship a custom or MCP tool whose declared schema is stricter than its implementation, re-check that schema. See Headless.

The final review hardened secret writes, concurrent settings edits, endpoint switches, headless context-limit exits, Responses content filtering, and TUI shutdown so background git refreshes cannot fail after the chrome detaches.

2026-07-21 — Named model routes (0.2.5)

Kin 0.2.5 introduces operator-defined named model routes (DR 0139): global [model_routes.<id>] tables bind a provider preset + model behind a stable handle, and [model_assignments] steer the main agent, subagents, workflows, and vision work onto them — including semantic media dispatch, so a text-only main model can hand images to a vision-capable route via inspect_media. The model sees only the handles it may choose, never provider identity or endpoints. See Models & providers. The release also carries a verified review pass over the feature: route telemetry now attributes child rounds correctly, a custom [[providers]] row without a base_url keeps its ambient endpoint, and bare --resume again reuses the saved backend even with KIN_* exported in the shell.

2026-07-18 — Code reads like code

Fenced code blocks now follow conventional editor cues instead of repainting the brand palette (DR 0134): strings render in a muted content-only green, functions and builtins in bold bone, with cyan confined to keywords and amber confined to numbers. Inline code drops its amber and renders in body text on the code band — amber in a transcript once again means attention, nothing else. See the identity page for the reasoning.

2026-07-18 — get.kinra.ai becomes the Kinra product front door

get.kinra.ai now introduces two independent products: Kin, the native AI peer for the terminal, and Paddock, the Linux x86-64 alpha for operating local llama.cpp models. Each has a complete product page and installer; one quiet integration note explains that Kin can use Paddock’s loopback OpenAI-compatible endpoint without making either product depend on the other. Outpost remains an optional Kin deployment.

• The site is three static pages with shared CSS and JavaScript, system fonts, no analytics, keyboard-operable OS tabs, accessible copy feedback, reduced-motion support, and screenshots sourced from each owning product.
• Kin’s same one-liner is now universal on a fresh machine. It keeps every existing checkout on the editable path, but automatically uses a manifest-selected, SHA-256-pinned public wheel when Git or authorized GitHub SSH is unavailable. PyPI supplies public dependencies without becoming a candidate source for Kin itself. --check remains non-mutating and never probes SSH.
• Kin 0.2.4 repairs the wheel resolver boundary caught by the production fresh-install drive: making Kinra the only package index also hid Kin’s third-party dependencies. The installer and kin update now make Kin a checksum-pinned direct requirement and expose PyPI only as the dependency index.
• Paddock owns an independent manifest-last publication channel under /paddock/, including immutable archives, checksum sets, SPDX SBOMs, build metadata, compatibility evidence, and its bootstrap installer. Both source repositories remain private.
• Public support and private-security inquiries use support@kinra.ai, a stable role address rather than an individual operator’s account.
• get.kinra.ai now serves from a durable host docroot. Kin and Paddock publish disjoint allowlists, so a Kin deploy cannot delete a retained Paddock release. The old worktree docroot remains an explicit emergency rollback mount.

2026-07-17 — Subagents run until completion

Bundled subagent profiles no longer carry arbitrary model-round caps. A registered child runs until it finishes or the main coding agent pauses, interrupts, restarts, or kills it. Omitted or max-turns: 0 now means unlimited for custom profiles too; a positive value remains available as an explicit operator leash.

The supervision runtime, shared root token budget, doom-loop guard, depth and parallelism limits remain the real runaway controls. This removes the old failure mode where productive work hit a profile cap, parked, and required the main agent to spend another round resuming it with a freshly reset window.

2026-07-16 — kin tells you when there’s an update, and one command applies it

kin 0.2.0 opens the update channel (DR 0121):

• You get told. At session start kin makes one best-effort, 24h-cached check of the get.kinra.ai release manifest and shows a one-line note when a newer release is out. Version-only, fixed endpoint; opt out with update_check = false / KIN_UPDATE_CHECK=0.
• kin update does the rest — it detects how kin was installed (checkout vs wheel) and applies the right update, including the tool-venv dependency refresh that a bare git pull used to silently skip. kin update --check and a new kin doctor line report without applying.
• Releases are verified by construction. get.kinra.ai and docs.kinra.ai now publish only from task ship-gated builds of main, and the wheel only from a tagged release — with older wheels retained, so each immutable versioned wheel URL remains a working rollback.
• Re-running the install one-liner fully heals an existing install. Kin 0.2.4 supersedes the original index-only resolver shape with the checksum-pinned direct-wheel boundary described above.

2026-07-16 — Supervision branch hardened by a full multi-agent review

A high-effort multi-agent review of the model-owned-supervision branch surfaced 13 confirmed correctness defects and 10 cleanups; all are fixed. What you’ll notice:

• Headless runs report honestly and always finish. A failed kin -p main turn can no longer be flipped to exit 0 by a later clean supervisor continuation, and a hung background agent now ends the run with a clear agent quiescence stalled error (~5 minutes of true silence) instead of hanging a cron job forever.
• Sandboxed git-over-SSH actually works on Linux. A stock ssh-agent socket under /tmp is now bound back through bubblewrap’s private /tmp, and a successful command that merely quotes “Permission denied (publickey)” (a grep over logs) is no longer misread as a sandbox denial. With sandbox_network = false, uv run/task work again offline (UV_NO_SYNC=1 is restored for that posture).
• Agent control is safer. Pausing a foreground child (a guaranteed deadlock) is refused; an interrupted agent can’t be double-run; pressing ++escape++ during an interrupt/restart wait actually interrupts; resuming a turn-capped agent gets fresh rounds; stale-health detection covers resumed and foreground agents; and agent_wait’s any_change wakes on real activity instead of sleeping to its timeout.

2026-07-15 — Model-owned subagent supervision

Registered task agents are now first-class supervised resources. The MCA can inspect, wait for, steer, cooperatively pause/resume, promptly interrupt, restart, and close them; lifecycle events automatically regain its attention without a human sending another message. Child prose and diagnostics stay behind explicitly untrusted-framed tools. Headless runs wait for agent quiescence, the TUI renders hidden-input autonomous continuations without a fake user bubble, and stale activity is advisory after a configurable bounded timeout. The old completion-reminder off switch is retired because lifecycle delivery is now correctness, not presentation.

2026-07-10 — get.kinra.ai installer + kin doctor + this site goes public

One pasted command now takes a fresh Linux/macOS machine to a running kin:

bash <(curl -fsSL https://get.kinra.ai/install.sh)

• get.kinra.ai is a single static page (no framework) with per-OS prereq notes (Fedora / Ubuntu·Debian / macOS / Windows-via-WSL2) and the one-liner above. install.sh installs uv if missing, clones kinra-ai/kin to ~/kin (~/kin-textual is reused for existing pre-rename installs), uv syncs, installs kin via uv tool install --editable, and writes a starter ~/.kin/settings.toml — idempotent, no sudo, never edits shell rc files. Needs an SSH key with repo access (private repo).
• No SSH key? uv tool install kin --index https://get.kinra.ai/simple/ installs the latest built wheel from a static index instead — read-only, no checkout, no dev loop.
• kin doctor — a new subcommand that verifies any install: tools on PATH, a resolvable model provider (and which source supplies it), and the endpoint’s reachability (--offline skips the last check). Exit 0/1. See Install § Verify the install.
• kin --version — prints kin <version> and exits before any TUI import; the installer’s success gate.
• This site is now public at docs.kinra.ai, overriding the earlier “docs hosting LOCAL-ONLY” decision. A companion outpost-install.sh (also from get.kinra.ai) brings up the Outpost on a fresh server the same way.

2026-07-10 — Composer drag-drop + paste attach files by reference

Dropping files onto the composer, or pasting a Finder multi-file selection or an absolute path, now attaches them as @-mentions instead of dumping raw path text into the prompt — the same untrusted-content framing and secret-file guard an @-mention typed by hand already gets.

• Whole-paste file detection — when the entire paste is one or more absolute, existing file paths (Finder’s newline-joined drop, Ghostty’s backslash-escaped spaced path, iTerm’s newline join), each becomes an @-mention at the caret in one toast; a prose paste that merely mentions a path is left untouched.
• Oversize images (over 5MB) auto-downscale via macOS’s sips before attaching, to fit the vision-model edge budget.
• ctrl+v captures a clipboard image directly — no intermediate file needed.
• More than 10 files in one drop warns and inserts the paste verbatim instead of silently attaching a partial set.
• Opt out with KIN_PASTE_MENTIONS=0 (or paste_file_mentions = false in settings.toml) to get the old verbatim-paste behavior back.

2026-07-10 — read_file learns Word + Excel (.docx/.xlsx)

read_file classified files by extension — image / PDF / SVG / text — and everything else fell through to the text reader, which opens a file with errors="replace". A .docx or .xlsx (zip containers of XML, not UTF-8 text) therefore came back as silent mojibake — a wall of replacement characters the model would hallucinate against. That fallthrough is now dead.

• Word (.docx, .docm) → clean text: paragraphs plus tables rendered as Markdown rows, in document order.
• Excel (.xlsx, .xlsm) → each sheet as a ## title heading + a Markdown table (cached values, not formulas), capped at 10 sheets × 100 rows × 30 columns with a truncation footer, then the same 50 KB char cap as PDF. @-mentioning an Office file works too.
• Macros are never read. The .docm/.xlsm variants are handled, but the VBA blob is not a paragraph or a worksheet — it’s structurally unreachable.
• Two security guards, verified engaged (not just installed): a zip-bomb cap that rejects an archive whose declared decompressed size exceeds 50 MB (checked before any parse), and the XML entity-expansion guard (defusedxml, openpyxl’s billion-laughs defense). A four-pin test battery proves both fire.
• No silent garbage, ever: a corrupt or non-Office file with one of these extensions returns an explicit error: — never a mojibake decode.

2026-07-04 — Unlimited main-session turns (KIN_MAX_TURNS)

The main session’s per-turn round cap was hardcoded at 40 model↔tool round-trips — fine for typical interactive turns, but it cut short the long agentic runs a large model can sustain for hours. The cap is now unlimited by default, configurable end-to-end, and the subagent caps are raised to match.

• KIN_MAX_TURNS env / max_turns settings key / --max-turns headless flag — 0 = unlimited (the default). A non-zero value caps the model↔tool round-trips in one user turn (done reason turn_cap, headless exit 1). Mirrors the existing token_budget resolution chain.
• Subagent caps raised: default max-turns 20 → 100, hard cap 100 → 1000 (a subagent profile’s frontmatter).
• The doom-loop guard (3× identical call+result) remains the real no-progress backstop, so an unbounded cap is safe — a stuck loop still trips it. max_turns is an operator leash (deliberately not model-writable), just like the per-run token_budget.

2026-07-04 — TUI polish pass + docs audit

A 10-commit TUI polish pass (POLISH r1-r10) landed on dev (the 746535b fix commit followed), then a separate docs-audit pass cleaned up drift in the user-facing docs.

POLISH r1-r10 + 746535b (the visual identity series):

• r1 — every functional glyph consolidated into theme.py constants (POLISH-r1 audit-fail for any drift site; zero diffs).
• r2 — #transcript { margin-bottom: 1 } always-on transcript↔StatusBar gap; the old .-turn-end re-tagging machinery deleted; the docked Footer replaced with the placeholder’s F1 help hint.
• r3 — UserMessage is a rounded titled box with a you border-title (auto-width hugs short prompts, wraps long ones).
• r4 — connector vocabulary: G_RUNNING flipped to •, carets on Collapsible, ╰ tail elbow for the live tail of a running tool, border-left rails on Contents.
• r5 — Reasoning title two-tone (thinking… → thought · 4s), body italic dim, left rail $accent 35%.
• r6 — new shimmer.py primitive (cosine-swept raised-cosine sweep, 2.0s period, 5.0-char band) + StatusBar phase-word state machine (thinking / mulling / tracing / sifting / weaving / kindling / distilling rotation).
• r7 — subagent dedup (single set_activity(f"agent working ({profile})…") on the bg path) + task · <profile> agent-mode title.
• r8 — tool_call_draft end-to-end (new Chunk("tool_draft", …) on both wires — name + chars only, NO argument content; loop-side ≤250ms throttle; ForwardingEmit drops it from subagent children; StatusBar shows drafting <name>… N chars with char-count tiers).
• r9 — WorkflowCard shimmer + tooltips + HelpModal audit (cursor-mode + expand-all + ctrl+p added; scrollable body fixed-height+1fr-scroll).
• r10 — snapshot baselines regen + docs sync (docs/reference/events.md got tool_call_draft; docs/getting-started/first-run.md mentions the shimmer + phase-word state machine + TEXTUAL_ANIMATIONS=none fallback; REFERENCE.md § UI widgets & theme got the four invariants).
• 746535b — fix pass for the adversarial-review findings from the polish series.

Docs audit (this pass):

• vLLM example model id refreshed across README.md + the vLLM recipe in docs/guide/models-and-providers.md + the banner mock-ups in docs/BANNER_SPEC.md + the example in research/README.md — fleet is now Qwen3.6-35B-A3B on vLLM 0.23.0 (was 27B-FP8).
• src/kin/tui/CLAUDE.md synced with POLISH r1-r10 — new shimmer.py row in the UI map, new “POLISH r1-r10 invariants” subsection under Theme & visual identity.
• TRACKER line 16 (the former TRACKER backlog) stale wording fixed (“NOT yet pushed, NOT on main” → “PROMOTED to main 2026-07-03, clean FF to 6e32d6b”); the §23-31 STRATEGY closure block collapsed to a 5-line recap pointing at research/2026-07-02-strategy.md and the 2026-07-03 review (now docs/decisions/0009 + 0010).
• Verify-suite count reconciled: task verify runs eleven wired-in suites (was “ten”); verify-memory and verify-workflow added to README’s verify command list.
• MCP servers added to CLAUDE.md’s operator-tour block.
• New docs/internals/extending-tools.md — the user-facing mirror of src/kin/harness/CLAUDE.md’s tool-author guide, plus walkthroughs for adding a permission kind and a subagent profile.
• docs/concepts/architecture.md extended — “Compared to other agent harnesses” table (kin in-process vs Claude Code / Gemini / Codex subprocess vs Aider/Continue LSP vs OpenHands/Devin remote), Mermaid turn-flow diagram.
• New docs/getting-started/first-session.md — 10-exercise TUI tutorial (welcome banner, slash history, cursor mode, planning freeze, sessions).
• KIN_BASE_URL heuristic anchor made explicit (#the-kin_base_url-heuristic) on docs/guide/models-and-providers.md; docs/getting-started/first-run.md uses the explicit anchor.
• The former HARNESS_PLAN planning doc’s “Dynamic workflows DESIGN” section collapsed (~279 lines → ~62 lines pointer + recap).
• docs/kin-console.md deleted (76-line placeholder predating the Outpost; superseded by docs/guide/outpost.md).
• Duplicate trailing line removed from docs/guide/sessions.md.
• docs/404.md (this 404 page) + docs/changelog.md (this page) added.

2026-07-03 — STRATEGY build PROMOTED to main

All 11 rocks landed (Tier 0 + Tier 1 + Tier 2 + ALL of Tier 3: 3a/3b/3c/3d/3e), verified, and PROMOTED to main (clean FF to 6e32d6b, 2026-07-03 ~21:00). Outpost was redeployed with all three riders (2a scheduler / 3b chromium / 3c Memory card). Verify baseline: 2500/0 across 11 suites.

Tier 3 (the maturation tier):

• 3a MCP maturation — hardening + elicitation + resources + OAuth (auth-code+PKCE, NOT device flow: research overturned the hunch).
• 3b Computer-use Tier-1 — browser tool (Playwright chromium, text-only, action-enum, scheme allowlist, two-layer SSRF guard).
• 3c Agent-memory floor — memory tool (Anthropic’s memory_20250818 command set 1:1) + FTS5 recall index + session-end consolidation side-call + Outpost Memory card.
• 3d Multi-agent artifact store — publish/ref verbs + agent() opt-in {ref, summary} handle + ride-alongs /revise + /research.
• 3e Code-interpreter — run_code stateful per-Session kernel under the OS sandbox (kind=perm.SHELL reuses the shell decision path; zero permission-plumbing edits).

Half-rock gap (still open): Tier 2b “GPU governor” landed a per-run token leash, NOT the cross-run GPU-fairness gate STRATEGY asked for. Live session + scheduled job still race one GPU. See the 2026-07-03 review (now docs/decisions/0009 + 0010) Tier-2b section.

2026-07-02 — Headless run mode

kin -p <prompt> (the Tier 0 keystone from the STRATEGY research) — one turn, no UI, real Backend, collecting emit sink, exit 0/1/2 contract. The Outpost scheduled-jobs centerpiece (2a) consumes this via kin -p SUBPROCESSES. Closes the gate for scheduling / evals / cron work. See the Headless guide for the full surface.

2026-07-01 — Live reasoning-effort controls

/effort slash command + per-serve picker (low / medium / high / xhigh / max for Anthropic; low / medium / high for OpenAI-compat; auto / on / off for Qwen). The KIN_REASONING_EFFORT env var overrides per session.

2026-06-30 — Git network tools

git-push / git-pull / git-fetch modeled on ssh.py (structured args only, argv assembled element-by-element, runs OUTSIDE the OS sandbox). push / pull reuse kind=perm.MCP (ASK both modes); fetch gets the new kind=perm.NETWORK (ALLOW auto / ASK strict / freeze-DENY). force only ever emits --force-with-lease (no raw --force).

2026-06-28 — v3 §4-7 batch

• §4 ssh egress — ssh tool (kind=MCP, outside the sandbox, honors ~/.ssh/config, opt-in global ssh_hosts, host-scoped approvals).
• §5 bundled exemplar skills — 9 SKILL.md exemplars (deep-research / brainstorm / code-review / simplify / debug / commit-message / plan / skill-creator / pr-description).
• §6 search_workspace Tier 1 — stdlib FTS5 build/search, secret
  • gitignore exclusion, off by default (KIN_SEARCH=1). Tier 2 (vector / embed / rerank) DEFERRED.
• §7 settings tool — read_settings READ + propose_settings META with an explicit MODEL_WRITABLE_KEYS allowlist.

2026-06-27 — auto-first two-mode collapse + plan lifecycle

The two-mode core (auto + strict, the CYCLE for shift+tab) plus the planning freeze (a transient read-only overlay, not a mode). default → strict, accept-edits → auto, plan → strict legacy aliases. /plan enters the freeze; present_plan presents the tracked plan file (3-option modal: keep / clear & re-inject / hand to critic).

2026-06-26 — Dynamic workflows (“ultracode”) MVP

The seven primitives (agent / parallel / pipeline / phase / log / publish / ref) + the workflow tool + the TUI WorkflowCard + the /workflows modal. Closed namespace (capability by absence, NOT a sandbox) + AST filter + SIGALRM busy-loop watchdog. See the Workflows guide for the user-facing walkthrough.

2026-06-26 — Background subagents + Ctrl+O panel

The task tool spawns a bg subagent and returns an agent id immediately; the model sees a metadata-only <system-reminder> on the next depth-0 turn (never subagent prose). MAX_BG_SUBAGENTS = 3 is the runaway guard. Ctrl+O opens the panel (shells / agents / tasks panes, Tab cycles).

2026-06-26 — Tasks DAG + --agent CLI

The tasks tool with action enum (add / update / complete / remove / list / blocked), cycle-checked, auto-unblock on complete. Sidecar at <KIN_SESSION_DIR>/<session_id>.tasks.json. kin --agent <name> runs the main session as a profile (TTY-only).

2026-06-25 — kin CLI packaging

The installable kin uv CLI (src layout, hatchling). macOS Ghostty “Open in kin” Finder Quick Action in extras/macos/.

2026-06-24 — File-extraction refactor + security fixes

The read_file tool gained PDF (via pypdf) + image (PNG / JPEG / GIF / WebP as image blocks; SVG as text) support, with a 50k char cap and a coerce_int discipline for numeric args.

2026-06-23 — Spine landed, verified, live-tested + hardened

The kin-textual → native Python harness pivot. In-process harness (src/kin/harness/) + Textual UI (src/kin/tui/) + the event vocabulary seam (src/kin/harness/events.py). No subprocess, no NDJSON, no wire between the two. The Go ../kin/ repo became the design reference only.