2026.7.16

Highlights

Your devices now watch out for each other. This release turns the same-owner device mesh from a design into a working, end-to-end-verified system (Windows host ↔ Linux VM over a real public relay):

• Cross-device liveness — each console keeps a dedicated mesh room on the relay (no contention with the away page), exchanges capability adverts so rosters enroll both ways after a single sync, and a 60s ticker keeps presence honest: if a device goes dark, its lamp goes out on every other device within ~90s.
• Decentralized task board — running tasks are published to the shared mesh log (offer + claim + lease + heartbeat). If a device dies mid-task, the lease expires and a surviving device raises a decision card: "A task on your linux device was interrupted — pick it up here?" Nothing runs without your explicit accept. Accepting claims the task, reruns it locally, and writes the honest terminal state back to the board.
• One-step mutual pairing — pairing with a device's one-time code now also lets that device dial you back, behind three gates (explicit code, fingerprint pin, full scope proven by the sync round itself). No more second code.
• Mesh log compaction — old heartbeats of finished tasks are pruned safely (frontier and materialized state provably unchanged), so the board stays lean.

Quality-of-life:

• Lite mode 🪶 — one click (or your OS's reduced-transparency preference) turns off the expensive frosted-glass, large shadows and idle animations for older PCs and virtual machines. Normal mode is pixel-identical.
• Filter your pending calls — when decisions pile up, a chip bar appears above the list so you can view one kind at a time.
• Proposal copy fully bilingual — 22 server-side card templates now render in your UI language (109 new strings, en + zh), with a contract test that keeps it that way.
• Share codes can carry a role — a read-only share bound to a role now releases exactly that role's generalizable experience to the visitor, nothing more.
• Refreshed README screenshots and tour GIF.

Full test suite green (3,979 tests) and five-leg CI (Linux / macOS / Windows, py3.11/3.12) passing on every commit in this release.

2026.7.13

A big one: your KarvyLoop is no longer tied to one machine or one desk. Your
devices become one mesh, your phone reaches home from anywhere, your memory is
yours to lock and rewrite, and a decision card is now something you can question
before you decide.

Added

• Your devices are one KarvyLoop (same-owner device mesh). Register your machines
  into a roster (karvyloop devices), each advertising a capability fingerprint, and
  what you learn on one flows to the others over one shared, causally-ordered log (HLC,
  not vector clocks): crystallized skills and memory beliefs sync between devices
  (outbox on the write choke + idempotent replay — never resurrects a belief you
  invalidated), and a decentralized task board (lease/claim + reclaim-on-death) means
  losing a device loses the machine a job runs on, never the job. A My Devices panel
  surfaces the roster with capability chips, an online light, and informed-consent removal
  (it warns before you delete a device that provides a capability no other device has).
• Reach your home console from anywhere (away-from-home). Your phone on cellular, a
  café network — a phone and a home machine both behind NATs meet at your own public
  relay (karvyloop relay-serve; blind-forwarding, sees only ciphertext). Pair a device
  once, from the /m phone page, and it gets its own key — end-to-end encrypted (X25519 +
  ChaCha20-Poly1305), the browser tunneling the app home over the relay. Pairing is a
  one-time code, never a raw token in a URL or QR; management (issue/list/revoke) is
  local-only — a stolen phone can use the surface but can never mint access or revoke
  another device. The relay is bring-your-own-server: its address is config
  (relay: in config.yaml), never hardcoded, with a one-command setup script and a
  self-host guide.
• A phone page that does one thing well (/m). Open it on your phone: the decisions
  waiting on you, three thumb buttons, and a chat strip to start work — a fluid layout
  that reflows from phone to foldable to tablet, no coined jargon on the first screen.
• Ask about a decision before you decide. A decision card now has an opt-in "💬 Ask
  about this" — question Karvy about this card ("why now?", "what if I decline?") and it
  answers grounded only in that card's own evidence, staying neutral (it won't argue you
  toward accept). The two-button fast path is untouched; asking never touches the decision.
• Your memory is yours to lock and rewrite. In the knowledge library you can now pin
  a belief (never auto-archived) and edit it as a ledger-style supersede — the new
  version becomes active, the old one moves to the history layer with an auditable "edited
  by you" trail. Nothing is silently rewritten.

Changed

• The README leads with the story, not the category. First screen is now the 40th-run
  value curve and three contrarian bets, not "another agent runtime."
• Honest egress + honest away-from-home labels. Domain-level network egress is positioned
  as an opt-in enhancement — the default binary fail-closed floor is the honest, universal
  guarantee; nothing bypassable is ever labeled "enforced."

Fixed

• LAN boot no longer hangs on a busy instance. Decision cards load lazily — an instance
  with dozens of backed-up cards opens fast instead of firing every card's LLM at once.
• The keyword gate no longer locks out orchestration. Karvy can decompose and route a
  no-keyword task instead of falling through to a literal reply.
• Preference crystallization has a deterministic floor. "You keep deciding X the same
  way" is counted from the evidence, not gated solely on an LLM flag that can wobble.

Added

• Bring your own AI runtime into the driver's seat (M1). You can now attach an external
  headless-CLI AI runtime as a channel citizen, @-dispatch a task to it, and get its real reply
  back — while it stays an opaque external executor whose output is always untrusted data that
  never auto-enters your memory. Federate capability, not trust, not memory: the external runtime's
  token spend is metered under its own independent ext:<name> ledger source (never mixed into your
  main gateway buckets), its stdout/stderr are treated as possibly-carrying-secrets and scrubbed
  before touching any log/Trace, and credentials are never placed in the subprocess environment (a
  hard first line of defense, not a redaction afterthought). The global assistant orchestrates this
  (attach / dispatch / list) through capability-gated tools; failures are fail-loud (nonzero exit,
  timeout, empty-success, or an approval request all surface instead of hanging). Adding another
  runtime is a recipe file, not new code.
• Manage your external runtimes from the console — and connect one on demand. A new
  External Runtimes panel (🔌 in the left nav) lists every connected external citizen with a
  distinct, off-colored external badge (so an opaque, untrusted external executor is never
  mistaken for a native role), a live online/offline/unreachable status light you can refresh per
  citizen, a remove (detach) button, and a direct-chat button — external citizens get their own
  l0 conversation line, addressed as (domain, external, citizen_id) so they never blend into the
  native role space. New management endpoints (GET /api/external/citizens,
  GET /api/external/liveness, POST /api/external/detach) live in their own routes_external.py
  and go through the same local-first origin gate as one-click install (writes only from
  loopback/LAN). On-demand onboarding: Diagnose and the panel deterministically detect whether a
  compatible headless CLI runtime is installed and, if not, walk you through connecting one from
  its own official source — the same degradation-guidance pattern as the [asr]/[ocr] unlocks
  and the MCP registry links. The hard boundary is spelled out in the UI and the README: an external
  runtime is third-party software you bring yourself — KarvyLoop does not bundle, host, download,
  or git clone it. We ship the bridge, adapters, and management UI; you bring the runtime.

Fixed

• The one-click update now tells you what happened instead of leaving you guessing. A failed
  upgrade (e.g. git pull couldn't reach GitHub) used to silently restart the old version and
  re-show the same ambiguous "a newer version is available" banner — the user was stranded on "did
  it update or not?" (the exact 怎么样了? status-anxiety anti-pattern this product exists to
  kill). Three fixes: (1) the upgrade outcome survives a normal reopen — the result window went
  from 10 minutes to 24 hours, so closing the tab and coming back still shows why it didn't take;
  (2) any failed upgrade now surfaces a fail-loud red banner with the reason and a Retry
  button — previously only an auto-rollback did, a plain git pull failure showed nothing; the
  banner is suppressed once you're actually on the target version (no stale false alarms); and
  (3) the current running version is now always visible in the top bar next to the logo, so
  "what am I on?" is answerable at a glance without reverse-engineering the banner.

Added

• 🧾 Receipt Reader (票据员) — the fourth resident: receipt/invoice recognition → one checked
  structured line. Hand it a receipt or invoice — pasted text or a photo — and it returns a clean
  structured record (merchant, date, currency, total, tax id, itemised amounts) with the items
  actually summed and checked against the stated total, the usual OCR mess (O↔0, l↔1, misplaced
  decimals) calibrated from context, and any unsure field left null rather than guessed.
  Recognition and structuring only: it suggests a category as a hint from your human-owned
  company category sheet (the growth soul, like the scribe's glossary), never rules on
  reimbursability and never files anything. Image input rides the same file_extract path as
  audio: photos are OCR'd on-device via the optional [ocr] extra (PaddleOCR), and without it
  (and no vision model) it asks for the pasted text instead of faking it — no bespoke pipeline, no
  special UI, it's just a resident you drop a receipt on. Real-model verified including the hard
  case: given a receipt whose items don't add up, it flagged sum_mismatch with both numbers and
  refused to fudge the figures to balance.
• 📚 study-buddy and 🎙️ meeting-notes promoted from skills to full residents. Both now ship as
  complete 7-file paradigm images (identity / soul / user / commitment / verify / memory +
  composition), read-only, each carrying a growth soul — study-buddy's concept map & weak
  spots, the scribe's team glossary — the reason each is a role you can watch learn, not a static
  skill. The empty house now offers four tenants (file-butler, study-buddy, meeting-notes,
  expense).
• Internal agents use our own paradigm (知行合一). A new AgentSpec declares an internal
  agent's engineering core — identity, principles, contract, verify, tools — with the persona
  layer deliberately omitted for stateless internals; converge is the first adopter. This
  dogfoods the paradigm on our own code, for developers reading the source; it is not surfaced
  in the user UI (that would clutter and create a see-but-can't-use asymmetry).
• Knowledge chat「追问」(converge flow A). On the sediment card you can now settle the rest
  while keeping the questioned point open for discussion, instead of an all-or-nothing accept.
• Onboarding intake: 4 questions whose answers immediately change behavior. At the start of
  the first-10-minutes journey (after the key is configured, before the first demo chip), the
  journey bar asks 4 quick questions — conclusion-first vs process-first outp...

2026.7.11

KarvyLoop 2026.7.11

The bring-your-own-runtime release: pull an external AI runtime into your driver's seat as a channel citizen — while you stay the one who decides.

🔌 Cross-runtime collaboration (headline)

Bring any external headless-CLI AI runtime into KarvyLoop as a channel citizen — federate capability, not trust, not memory.

• Attach via claim-code handshake — click Add → a pending shell + one-time secret + a copy-paste command; run it in your runtime, it connects back and claims the shell (GitHub-runner-style reverse attach). Pick the runtime type + agent so multiple installed runtimes are disambiguated.
• Recipe-driven — connect a new runtime by writing a recipe (config, not code); three built-in output shapes.
• Roundtable & workflow guest seat (M2) — an external citizen joins a domain roundtable as a contributor, never a decision seat; its output is always untrusted data that never auto-enters memory — it crosses your provenance boundary only through an H2A adoption card.
• Graded-trust membership — T0 guest / T1 scoped member (deny-by-default, reads domain-public only, reversible supply), rug-pull use-time hash re-verify, and graceful scoped detach.
• Security is the floor — per-domain egress allowlist (fail-closed on all three sandbox backends), credentials never enter the subprocess env, stdout treated as possibly-secret and scrubbed, external spend metered under its own ext: ledger source.
• Management panel — 🔌-badged citizen list, liveness, delete, direct-chat, and on-demand onboarding (install from the runtime's own official source — we never bundle it).

💬 Direct-chat any role

Click a role in the roster to chat with it directly — no need to first add it to a business domain (l0/personal scope, no domain governance).

🏷️ Tag system for roles / atoms / skills

Roles, atoms, and skills now carry tags (bilingual, no vectors — keyword + overlap + LLM-tag matching). Each panel has a tag filter, so wiring an atom into a new role no longer means scrolling a wall.

🏢 Business-domain onboarding

The domains panel now splits empty vs. non-empty states: with no domains you're guided to create your first (templates as the creation path); with domains, you see the list and templates tuck into "New" — no more misleading "open" framing.

🧾 Expense / receipt handling

A resident expense clerk that recognizes receipts via OCR and reconciles them with a deterministic arithmetic solver (the receipt's own math redundancy catches model slips) — wired as role → skill → tool, plus deterministic pre-OCR image preprocessing (upscale / deskew / contrast) to rescue low-res, skewed, or faded photos.

⌨️ Karvy slash commands + CLI management

/status /doctor /url /reboot /version /help — deterministic ops with zero LLM (0 requests), intercepted only on an exact command with no trailing text or attachments. Plus a noun-verb karvyloop management surface (roles / domains / schedules / skills / tokens: list, show, create, remove).

---

Local-first · MIT · cross-platform (Linux / macOS / Windows). The moat is your data and crystallized skills, not the code.

2026.7.9

Local-first, loop-native personal agent runtime. CalVer release.

Highlights

🧾 Receipt Reader (票据员) — a fourth resident. Drop it a receipt or invoice (pasted text or a photo) and get one clean structured line: merchant, date, total, tax id, itemised amounts — with the items actually summed and checked against the stated total, OCR mess (O↔0, l↔1) calibrated from context, unsure fields left null not guessed. Recognition and structuring only — it suggests a category from your own company sheet as a hint you confirm, never rules on reimbursability or files anything. Photos OCR on-device via the optional [ocr] extra; no extra and no vision model → it asks for the text rather than fake it. Real-model verified on the hard case: a receipt that doesn't add up gets a sum_mismatch flag with both numbers, not fudged figures.

📚 study-buddy & 🎙️ meeting-notes are now full residents (7-file paradigm images, read-only), each with a growth soul (concept map / team glossary). The empty house now offers four tenants.

Internal agents use our own paradigm (知行合一). A new AgentSpec gives internal agents the engineering core (identity/principles/contract/verify/tools); converge is the first adopter. For developers reading the source — not surfaced in the UI.

Knowledge chat「追问」 — settle the rest while keeping a questioned point open for discussion.

Fixed

• Knowledge chat: real back-and-forth turns, no same-module self-contradiction (one referent, one source of truth), and paste-a-link actually fetches — real browser headers + the fake-ip proxy range (198.18/15) so it works behind Clash/Surge.
• Management modals scroll when content runs past one screen.
• Capability-grant card covers the delegated execution path; decision-card popup no longer overlaps the role-edit modal.

Full detail: CHANGELOG.md

Update: pip install --upgrade karvyloop (or karvyloop update).

2026.7.4

The see-it release. "More like you with every use" stopped being a promise you take on faith:
you can now watch it happen in your first ten minutes, read it as a growth curve, and trust it
behind statistical gates that refuse to bluff.

Added

• The first ten minutes. A fresh install now opens with a guided journey: run one real demo
  task (a bundled sample CSV, executed by your configured model — nothing pre-recorded), run a
  second one, and watch the ♻ method-reuse receipt appear as the runtime recalls how it solved the
  first. The finale lights up only when your growth curve has real points. Skippable, replayable
  (🎬 in the top bar), and it never pops for existing instances upgrading in.
• Growth you can see. GET /api/skills/curve replays your Trace (read-only, same scoring code
  as production) into per-skill score sparklines and a library-wide growth chart at the top of the
  skills panel — usage, success rate, promotion progress over calendar days.
• Webhook push channel. Decision cards can now reach you wherever you actually are: a generic
  outbound webhook with presets for ntfy / Bark / Slack-compatible endpoints (plus a body template
  for anything else). Same dispatch point and card-selection semantics as the email channel;
  secrets never logged — including a redaction filter for the HTTP client's own request logs.
  Outbound-only in v1 (decide via the console link).
• Attachments, really parsed. PDF / docx / xlsx now flow down the same lane CSV always had —
  preview, truncation labels, one-click "have them analyze it" — via the optional [files] extra
  (pypdf, python-docx, openpyxl). Parse-empty-not-poison: corrupt or mislabeled files yield
  an empty result and a clear error, never binary garbage in your context.
• Earned silence, fully gated. All six statistical gates behind auto-handled decisions are now
  real code: irreversible actions never enter the pool; Wilson 95% lower-bound ≥ 0.90 with
  pre-registered evaluation windows; accept- and reject-direction accuracy each gated separately
  (with an honest correction: a 0.90 reject-side bar is mathematically unreachable at a ~93%
  approval base rate — the gate that can't be passed is decoration, so it's now a
  better-than-chance bound); 15% unannounced audits; renewals require reviewing evidence, not
  rubber-stamping; a rolling blast-radius cap. And the silenced path itself now runs the same
  violation checks as human-facing cards — fail-closed when the checker can't run.
• Windows joins CI. A windows-latest gate runs the full suite (the sandbox's AppContainer /
  RestrictedToken code is real Windows code — the cross-platform claim needed a non-Linux leg).
  The last shell-grep subprocess tests migrated to an OS-portable scanner.
• Public docs, layer one. docs/QUICKSTART.md, docs/ARCHITECTURE.md, docs/CONCEPTS.md
  (English + 中文) — the ten-minute journey in text, the two-loops architecture with real
  thresholds verified against the code, and a concepts dictionary.

Changed

• Console IA converges to one home + one mode. The top-bar view switch is now two options —
  💬 Chat (the home: talk + decide, always one click back) ⇄ 🖥 Desk (watch your team at work).
  The former Board view stepped down from a top-level "home" to a rail gesture: a ⛶ button on the
  decision column temporarily expands the four quadrants into the familiar 2×2 full-screen
  (every panel kept, nothing removed); Esc or ✕ returns to chat. The zoom is a transient state —
  never remembered as a startup view — and a stored "board" startup preference migrates smoothly
  back to chat. The first-10-minutes journey always lands in the chat view and introduces the Desk
  as a reward moment at the finale instead of a cold-start three-way choice.
• The desk mascot is the official capybara. Hand-drawn pixel frames retired; the real artwork
  now renders at native resolution with CSS state animations (breathing, typing, card-carry,
  sleeping, a happy hop). Role accents became chest badges. The no-fake-idle red line stands:
  states change only on real events.

Fixed

• Slow-brain total outage on main. A prompt-cache contract change had evolved the gateway's
  to_blocks(cache=...) signature without its duck-typed twin in the coding executor — every model
  call raised TypeError, was misdiagnosed as "model/network unreachable", and 2,900 green unit
  tests couldn't see it (their mock never calls the real body builder). Caught by the real-model
  end-to-end journey; fixed with a signature-parity contract test and a test that exercises the
  real request-body path, both verified to go red on drift.
• The journey's model-readiness poll no longer yanks you back to the chat view (or steals focus)
  every 15 seconds while you're exploring unconfigured; the forced view replay happens once, on
  first mount.
• Wheel builds from a dirty tree can no longer package stray files from the sample-data directory;
  the release test-bench writes to a temp workspace instead of the source tree.

Security

• web_fetch egress guard (SSRF). Outbound fetches now resolve the target and refuse private,
  loopback, link-local, and cloud-metadata ranges, plus file:// and credentialed URLs — with
  every redirect hop re-validated. Closes a credential-theft vector (a page could previously point
  the fetcher at 169.254.169.254 or your own loopback console).
• Skill-library poisoning via corrections closed. Reviewer feedback written back into a skill's
  SKILL.md is now sanitized — no header/frontmatter injection can hijack a skill's method.
• Adversarial tests are a first-class suite: pytest -m security runs 25 attack-vector classes
  (SSRF, poisoning, traversal, injection provenance, sandbox escape probes …) with an OWASP
  LLM Top-10 cross-reference in tests/security/README.md.
• Deeper sandbox floors: the Windows network gate is now OS-enforced (AppContainer/LowBox WFP
  deny — no admin required), and Linux gained a Landlock kernel layer under bubblewrap (older
  kernels degrade gracefully).

2026.7.3

The trust release. One theme: prove it, don't claim it — the taste hit-rate score, measured cost before you spend, evidence drill-downs, governed out-of-workspace access with a hard floor for secrets, upgrades that verify themselves and roll back, and Windows joining as a supported (degraded) platform.

Security

• Same-origin gate on the console: cross-origin browser requests are rejected on both HTTP and the
  WebSocket handshake (closes cross-site WebSocket hijacking and file-endpoint CSRF; non-browser clients
  and the console's own frontend are unaffected). Applies even on loopback.
• Skill integrity lock enforced on the production paths: a tampered trust: untrusted skill is refused
  at the recall index, at every disk-scan fallback, and again before sandbox execution.
• Deterministic context ceiling at the LLM gateway choke-point: a request whose assembled context
  (messages + system + tools schema, CJK-aware estimate) exceeds the model's window is refused fail-loud
  instead of being sent to fail.

Fixed

• H2A decision cards: every proposal kind now lands in the decision column (reject button + payload intact);
  multiple pending cards no longer overwrite each other; pending cards (incl. deferred) survive restart.
• Domain deontic rules (forbid/oblige/permit) now reach the runtime guardrail (previously only
  value.md did — and it was dropped entirely when value.md was blank); no double-injection with compiled
  per-role prompts.
• Decisions made over REST now feed the preference flywheel and the decision log exactly like WebSocket ones.
• Task terminal states (done/error) are recorded into Trace, so the async evaluators see task-level outcomes.
• Backend Chinese reason/detail strings are translated in the English UI (contract-tested: a new backend
  reason without a translation fails the suite).

Added

• Taste hit-rate — "more you", proven: before you decide a card, the system quietly predicts your
  call from your crystallized preferences; after you decide, it settles the bet. The decision-prefs
  panel now shows "it predicts your calls N% of the time (last 20; previous period M%)". Honesty
  built in: only bets placed before your decision count, failed predictions aren't counted, and
  below 10 samples it says "still learning you" instead of a fake percentage.

• Cost before you spend: execution-type decision cards (delegate / rerun / roundtable) show what
  recent similar tasks actually cost ("~12.4k tokens each, range 8k–18k, last 10") — measured from
  per-task token attribution, never guessed; hidden until there are at least 3 real samples.

• One-click MCP channel presets — the Coding capability card now has a "Connect a channel" section:
  pick a well-known MCP server (filesystem scoped to a folder — defaults to the workspace, web fetch,
  GitHub, memory, time, SQLite), fill in a folder/token where needed, and it's written into
  config.yaml's mcp.servers (secrets stay in config.yaml, never echoed back). The UI states honestly
  that MCP servers connect at startup, so a restart is required to load the new tools.

• The decision flow is now phone-friendly — open the LAN token link (karvyloop url) on your phone
  and approve/reject/edit decision cards comfortably: on small screens the cockpit stacks into a single
  column with the decision column first, ACCEPT/DEFER/REJECT become thumb-sized full-width targets, the
  edit-then-accept textarea no longer triggers focus-zoom, and chat opens as a full-screen sheet. Purely
  additive CSS (one media query) — the desktop layout is untouched by construction.

• Out-of-workspace access, governed: roles are confined to the workspace by default; when one needs
  a path outside it, the denial surfaces as a decision card ("grant this folder?") — approve once and
  the grants ledger opens exactly that path (tool boundary + capability chain + sandbox mounts all honor
  it; revocable in the Capability overview). Sensitive paths (API keys, ssh, credential stores) are a
  hard floor: never grantable, immune even to bypass mode.

• Open a company (starter templates): five staffed, working domains — personal research, finance
  research, job hunt, content studio, home ops — each with values, hard deontic rules, and roles with
  souls; one click in the Domains panel, yours from the first use.

• Upgrades now snapshot state, verify the install, and auto-roll back on failure (one click back on
  the console): before switching versions the updater records the current commit
  (~/.karvyloop/update_rollback.json) and backs up your instance state files
  (~/.karvyloop/backups/, last 3 kept, honest scope in each manifest.json); after install it
  smoke-checks that the new code actually imports, and a broken build is rolled back to the previous
  known-good commit automatically — with the reason stated out loud, never a silent broken restart.
  POST /api/update/rollback + rollback_available/prev_version in the update status payload.

• karvyloop export — your instance is a folder, now with a button: packs ~/.karvyloop
  (skills, knowledge, preferences, history) into one portable archive with a self-explaining
  MANIFEST.txt; secrets (config.yaml with your API keys, console.runtime.json, *.lock)
  are deliberately left behind. Unpack on the new machine, add your key, karvyloop console — home.

• Idle = 0 LLM calls is now a tested contract (tests/test_idle_zero_llm.py): when nothing
  changed, the daily slow side burns nothing — knowledge consolidation and skill tagging hit their
  watermarks without touching the gateway, and the daily loop's idle path provably exits before any
  LLM work. No overnight heartbeat bills.

• Windows is now a supported (degraded) platform: the runtime, console and your own crystallized
  (knowledge-only) skills run fully on Windows; only third-party skill scripts are refused — fail-closed,
  with a clear message explaining the degraded mode (no sandbox on Windows yet; Linux/macOS keep the full
  sandbox). Ships a one-line PowerShell installer mirroring install.sh
  (irm https://raw.githubusercontent.com/Caprista/KarvyLoop/main/scripts/install.ps1 | iex): dedicated
  venv under %LOCALAPPDATA%\karvyloop, a karvyloop.cmd shim on the user PATH, Python 3.11+ guard with
  py -3.11 fallback.

• Edit, then accept on decision cards: kinds with an actionable text field let you fix the proposal
  in place and approve your version — the original→edited contrast feeds decision-preference
  crystallization (the richest taste signal there is), and an edit counts as real judgment for the
  high-stakes gate.

• Under-the-hood drill-down on task details: expand any task to see the real actions beneath the
  narration (tool calls and outcomes, projected from the Trace).

• Kinder first-run: model-connection failures now say what's actually wrong (bad key / wrong
  endpoint / unreachable) before the raw error, and a local Ollama install is auto-detected and
  offered as a one-click, no-API-key path.

• Semantic tag layer for skill recall (tags: in SKILL.md, matched alongside token overlap — no vectors),
  with a daily slow-side backfill that tags untagged own skills once (untrusted skills untouched).

• Capability overview (/api/capability/overview + a card in the Skills panel): one table for
  tools × mode floors and skills × trust/network/integrity-lock.

Changed

• Internal restructuring, no behavior change: the workflow / distill / roundtable engines moved out of
  console/routes.py into their own console modules, and the core loop moved from cli/main_loop.py
  to the new karvyloop/runtime/ package (karvyloop.cli.main_loop remains as a compatibility shim).

Removed

• Six unreachable packages from an earlier architecture cycle (ethos, syntonos, instance,
  onboarding, l0, bus, ~2.6k lines): superseded by the current design (verify gate + evaluators,
  per-role paradigm compiler, H2A decision cards, a2a/ transport) or parked concepts whose designs
  live in the design docs. No live code imported them; recoverable from git history.

2026.7.1

First release. A local-first, loop-native AI agent runtime you can clone → install → point at a model →
drive in ~15 minutes: run one full execution loop (intent → run → verify → crystallize a skill → the fast
brain reuses it) and one full decision loop (proposal → decision card → you decide → the preference
crystallizes → it pre-aligns the next proposal). Everything below is what's in this first cut.

Runtime & safety

• Local web console (FastAPI REST + /ws WebSocket + static SPA) and a terminal TUI, on a fast/slow-brain
  MainLoop; a Forge coding executor; a multi-provider LLM gateway that meters every token at one
  choke-point (any path that talks to a model is counted).
• Entity model L0–L4 (tool/skill · atom · role · domain), mirrored field-for-field in schemas/.
• Safety is foundational — every task carries a capability token (zero-permission start); all
  file/network/process access is checked against it; third-party skills run in a bubblewrap (Linux) /
  Seatbelt (macOS) sandbox, below the agent's trust boundary. macOS adversarially verified on Apple Silicon.
• Deterministic self-check — doctor / status run without a model (config / key / port / deps /
  version / data integrity) and tell you the exact fix in your terms; doctor --fix auto-heals the reversible
  cases (e.g. corrupt persisted JSON → backup + reset so it boots). An LLM ops agent (/api/ops/diagnose)
  reasons on top of doctor's real findings but never executes — only the deterministic repair auto-applies.

Roles, domains & collaboration

• Roles (a 7-file soul: identity / character / user / commitment / verify / …), business domains (like
  companies) with sub-domain inheritance, and value.md + deontic governance — hard guardrails (top-down,
  un-overridable) + soft defaults (most-specific-wins) — injected into every route / workflow / scheduled /
  roundtable, no opt-out.
• Domain membership is a dynamic member_query (weak reference resolved at access). A domain member role
  has a read-only merged view: its native paradigm plus the value.md / deontic it inherits from the domain.
• Every role is born a "resourceful subordinate" — a default, editable collaboration contract in its
  COMMITMENT layer: pursue feasible goals, exhaust your own resourcefulness before coming back, and bring
  evidence, not "what do I do?". The hard safety floor (budget ceiling / infra-dead stop / fail-loud / verify
  gate) is enforced by the runtime and can't be edited away.
• Karvy 🦫, the global assistant, turns plain language into a single hand-off, a roundtable (roles think
  in parallel → converge), a workflow (multi-step DAG), or an ops check — always surfaced as an H2A
  decision card, never auto-run. Vague instructions are LLM-decomposed over real domain members (never
  fabricated). Up to 50+ participants per roundtable / workflow.
• Durable workflows survive a console restart (steps checkpointed; completed steps replay instantly); a
  full-screen Drawflow canvas for human orchestration. Scheduled tasks in plain language (NL→cron),
  Karvy-only (one audit surface), with a ⏰ dashboard.

The wedge — crystallization (the moat)

• Skill crystallization stores the method, not the answer — a recall hit re-executes the learned method
  on the current inputs (CBR-style Revise), never replays a stale answer; only semantically-stable results are
  cached. The payoff is fewer tokens (the slow brain is guided), not a cached reply.
• Decision-interface crystallization — the decision card translates a proposal into your terms, keeps a
  verified region (✓/✗, traceable to a gate) visibly separate from Karvy's narration, pre-aligns the standards
  you've crystallized, and forces judgment before a high-stakes commit. ACCEPTing a dispatch runs the independent
  checker and its real verdict becomes a grounded report card (inconclusive is shown honestly, never a fake ✓).
• Two layers, judged along the accountability chain — a role answers to you, so your decisions evaluate it
  (decision-preference crystallization, RLHF-shaped); an atom answers to its role, so the role's objective
  measures (achievement × efficiency, past its verify gate) evaluate it (RLVR-shaped). Evaluation is off the
  hot path: a drive only executes and writes facts to the Trace (run/eval split); a patient, idempotent
  evaluator reads the Trace to score and writes back — learning never competes with the live task.

Cognition & knowledge

• Personal knowledge base — feed a link or notes; a distill flow (fetch → analyze → refine with Karvy →
  you decide → compile to Belief) sinks it. It never silently writes 0 (a thin/failed fetch says so and
  keeps the todo), folds the key points you add in chat into the material, and re-feeding the same source
  supersedes the old version. Every knowledge point shows its real source (the link or file).
• Cognition graph — an Obsidian / map-style mesh: laid out by connected component (compact clusters
  packed together, unconnected notes in a tidy grid), drawing only real links (semantic + each node's
  strongest) so it branches instead of hairballing, with map-style zoom-level labels (LOD), hover tooltip, big
  hit targets, and a click-to-select detail card (title, full content, source, clickable related nodes).
• No vector DB — recall is grep + CJK-bigram + LLM semantic tags + spreading activation over the mesh;
  near-duplicate knowledge is tidied via an H2A consolidate (suggest → you confirm), off the hot path.

Execution & models

• Fast brain (crystallized-skill hit → re-run with the method) vs slow brain (explore from zero);
  atoms (task/daemon) are the one reused ReAct loop; create_atom lets a role mint a new sub-agent when
  nothing fits — it searches the shared pool first, is born on trial, is merged if a near-duplicate exists, and
  can never silently poison the pool (strict-JSON synthesis, duplicate gate, earn-by-reuse lifecycle).
• A delegated role pursues its goal within a budget — re-plans on a failed attempt, fixes-and-retries a
  rejected result, stops immediately and says so when the model/network/sandbox is down (infra-dead vs
  replannable, classified end-to-end), and returns an evidence-carrying infeasibility card, never a silent stall.
• Providers — Anthropic, OpenAI-compatible, DeepSeek, Kimi/Moonshot (Global + For-Coding) — config-driven
  (extra_headers onboards a header-gated endpoint with no code). Multimodal input — attach images or
  text/Markdown files, threaded as content blocks.

Updates, quality & housekeeping

• By-version releases (CalVer) with a detect-and-notify update path: a dismissible console banner +
  karvyloop update; a one-click upgrade that runs stop → install → restart for you and reconnects the page
  (localhost-only, CSRF-guarded, single-flight) — it never auto-upgrades. Your data in ~/.karvyloop/
  survives upgrades (config, beliefs, skills, roles/atoms, decision log).
• Concurrency-safe — role-registry and memory writes are lock-guarded, so parallel roles/atoms can't lose a
  write. Bilingual (en/zh) throughout, with a parity test. Static assets are served Cache-Control: no-cache
  so a deployed frontend change shows on a normal refresh. A wiring test fails CI on any orphan endpoint / dead
  call. MIT-licensed; the test suite is self-contained (~1880 passed, optional infra skipped cleanly).