Changelog

​

The credit balance shows on every page

• Precision — the chip rounds to cents. A balance under one cent keeps four decimals, and a smaller one reads <$0.0001. A live balance never shows as $0.00.
• Freshness — the figure is rendered with the page rather than polled. A tab left open overnight shows last night’s figure; Settings → Billing holds the live one.
• Billing outage — the chip renders nothing rather than a wrong number, and the rest of the dashboard still loads.
• Narrow screens — the chip is hidden below 640px, where the header has no room for it.

​

What’s new

• Fleet and runner consoles — each console renders one section strip at every width. The 224px navigation rail that appeared on wide screens read as a second sidebar and took that width from the transcript.
• Status line — the metric cards under each strip are now one monospace line. On a fleet it sits under the composer; on a runner it sticks to the foot of the canvas. It carries the same figures the cards did.
• Runner checks — the checks card is now a verdict on the runner’s identity line. It reads checks passed, N checks failed, checks stale, checks pending, or checks never run. A failure is the one state painted red, and the verdict opens the full report in a dialog named after the host.
• Tabs — the fleet and runner section strips use the underlined tab style that Billing and the settings sections already use.
• Fleet transcript — a fleet’s replies read at 18px instead of 15px, the reading size rather than the interface size.
• Core capabilities — the landing section shows one divided list at every width. It stacked a three-across card grid on a four-across card grid, rendering the same seven items twice.
• Landing hero — the kicker above the headline is gone. It rearranged the words of the headline beneath it.

​

Bug fixes

• Fleet library import — importing a bundle from GitHub now has 30 seconds instead of 10. A repository that GitHub served slowly failed in the dialog while agentsfleetd was still fetching it. The two pages that host the action declare a 60 second server ceiling, so the dialog’s message arrives instead of a gateway 504.
• Balance card caption — the billing balance card drops its spent $X · N events caption. It summed only the charge rows the page had loaded, so page two reported a different figure for the same account.
• Landing page headings — five sections opened with a 12px eyebrow marked as a heading, above their real heading. A screen reader heard ten headings where there are five sections.
• Approvals link — the link in the fleet status line underlines on keyboard focus, not only on hover. Its target is a finger’s height rather than 12px.
• Admin lease filter — the filter fits a phone screen. It carried a 720px minimum width that the fixed shell clipped.
• Header edge — the brand and the avatar sit the same distance from the window edge. The header’s trailing side followed the canvas gutter plus whatever scrollbar the platform reserved. At 1920px the avatar sat 48px in from the right, the brand 22px in from the left.

​

Every live frame carries the fleet’s counters

• Frames — event_received, event_complete, gate_opened and gate_resolved all carry the pair. A frame the daemon could not fill omits both fields rather than sending zeros; a client leaves the figures it has standing.
• hello — {"kind":"hello","fleet_ids":[…],"counters":{"<fleet_id>":{"events_processed":n,"budget_used_nanos":n}}}. A fleet that has never run answers with zeros; a fleet the read could not answer for is omitted.
• Wall — the tile footer no longer derives its figures from the streamed rows, and the wall no longer re-reads the fleet list when a row arrives without a price. A run that parks behind an approval shows the event it counted.

​

Dashboard

• Navigation — items are symmetric pills with no accent rail; the four groups share one 16px eyebrow rhythm.
• Tables — a paginated table lets the page scroll rather than opening a second scroll region; cells sit on the 4px scale and the page controls align with the body’s right edge.
• Buttons — one primary action per surface renders the default variant; every other non-destructive action is ghost.
• Runs strip — a processed run whose list row carries no body reads Completed.; only the event detail, which holds the body, says when no reply was recorded.
• Admin leases — the Fleet column names the agent by callsign, as every other agent column does, and keeps the fleet id on hover.

​

Connecting GitHub completes again

​

Bug fixes

• Sidebar toggle — the collapse control sits in the sidebar column, aligned to the navigation beneath it, and centres in the rail when collapsed.

​

Four benchmark lanes measure what steer, lease and delivery sustain

• Profiles — PROFILE=rig is unbounded against the compose stack; dev and prod carry caps and refuse a parameter above them before opening a connection. prod also refuses without BENCH_LOAD_PRODUCTION=i-accept-the-blast-radius.
• Attribution — every result carries Redis commands and Postgres round trips separately, read from the servers’ own counters, so a saturation is attributed rather than guessed.
• Idle lease poll — 1 Redis command and 0 Postgres round trips, so idle cost scales with runners and not with fleets. A contended lease costs about 37 round trips.
• Delivery head-of-line — with one destination in sixteen answering in 250 ms, the other fifteen’s p95 rose to 3.8 s: one stream, one worker, one queue position at a time.
• Honest zeros — a lane refuses a knob it cannot parse, writes no tail for an empty distribution, and records a window that ran out as an abort; bench-compare names differing parameters before any delta.
• Cardinality — about 4.6 KB of Redis per idle fleet, flat from 10 to 10 000 fleets; a million idle fleets is roughly 4.6 GB.
• Sweep — a run creates only under its own prefix and removes everything it created on every exit path, reporting created against swept in the result.

​

Session verification bounds stale signing keys

​

Upgrading

• Fleet versions — use stable MAJOR.MINOR.PATCH values. Import now refuses prerelease and build suffixes that installation cannot accept.

​

Bug fixes

• Signing-key restrictions — session verification refuses incompatible key usage or algorithm metadata and ambiguous signing-key identifiers.
• Capability outages — repeated requests retain the documented stale capability fallback without extending its age.
• Malformed URL escapes — memory paths reject escapes such as %+a instead of decoding them as bytes.
• Extreme dates — timestamps beyond the supported calendar range display their original millisecond value as text.

​

Dashboard reads stop retrying at a deadline, and a write is never sent twice

​

Bug fixes

• Retry deadline — a read stops retrying 20 seconds after its first attempt, whatever the attempt ceiling says.
• Retry-After cap — a 429 asking the dashboard to wait more than 10 seconds fails at once with the 429; a shorter wait is obeyed exactly.
• Writes sent once — a POST is sent again only when the connection was refused or the server declined to run it. A reset after sending, a timeout, or a gateway 502, 503 or 504 surfaces the error instead, so a steer never becomes two events.
• Spread retries — retries after a shared blip spread across the full backoff window instead of landing together.
• Failure classes — a 408 or 425 is reported as its own class, no longer as a server error, and a socket failure is read from Node’s error cause rather than its message.

​

CLI

• Writes sent once — agentsfleet no longer replays a POST after its own 15 second timeout or after a socket reset. A POST refused at connect is still sent again.
• Retry-After cap — agentsfleet waits at most 10 seconds for a Retry-After; a longer ask fails at once with the answer.

​

Website access links open the waitlist

• Installation instructions — the website hides the unavailable shell installer command and its copy button. The agents page retains the npm instructions.

​

Incident response examples and clearer dashboard navigation

​

What’s new

• Documentation theme — headings, reading text, and code use distinct fonts; the docs share the website’s brighter backgrounds and mint accents.
• Website navigation — mobile and desktop links expose the dashboard, workflow examples, and agent resources at /agents.
• Account settings — profile and sign-in security open on a dedicated page at /settings/account.
• Workspace names — leave the name blank to use a generated name.

​

Bug fixes

• CLI login — browser approval reaches the terminal correctly, and a sign-in redirect no longer displays an unapproved verification code.
• Keyboard navigation — dialogs return focus to their opening control, focused fleet tabs stay visible, and document previews support keyboard scrolling.
• Header controls — the workspace switcher and avatar align vertically, and runner refresh matches the other action buttons.
• Failed initial reads — approvals, events, integrations, secrets, and billing show recovery when their list or balance request fails.

​

A fleet chat follows its runs from the live tail, and the dashboard changes the screen at the click

​

What’s new

• The daemon brackets every run on the live tail — event_received when a run’s row is written, including the run an approval continues, and event_complete when a report or a refusal closes it. The completion carries the row as the events list serves it (status, outcome, tokens, duration, spend) without fleet_id and workspace_id, which the stream names, plus fleet_status and pending_approvals. A gate opening, a decision, and a sweep publish gate_opened and gate_resolved with the count; gate_resolved.event_id is null for a gate raised outside a run. The API reference for both event streams now lists every frame kind. The CLI’s steer tail, which always waited for event_complete, now receives it.
• The chat summary is a view over the stream — the strip’s figures and its pending count come from the frames, not from a request. A run that pauses or kills the fleet re-renders the page once so the Stop, Resume, and Kill controls follow; nothing else does.
• The fleet detail carries pending_approvals — GET /v1/workspaces/{workspace_id}/fleets/{fleet_id} counts the gates waiting on a human, so a console opens on the fleet and its thread alone instead of paging the approvals inbox to render a number.
• Secrets, runner state, and approvals paint at the click — the row leaves or the badge changes when you confirm, before the server answers. The confirm dialog stays disabled until the write settles. A refusal restores the row and shows the error next to the control. A secret delete re-reads the list only when the outcome is unknown: a timeout, a network fault, or a server error.
• Dashboard reads retry transient failures — a read answered with 408, 425, 429, 502, 503, or 504, or failed by the network, is retried up to 3 attempts. The wait starts at 250 ms, doubles each time, is capped at 2 s, and honours a Retry-After header. Writes are sent once: a write that timed out is never replayed, because the server may have processed it.
• Every dashboard request times out — a request with no answer after 10 seconds fails and, for a read, is retried like any other transient failure. A hung approval resolve times out instead of pending forever. A stalled backend no longer holds a page open.
• Runner detail and the platform model library load one round-trip sooner — each page starts its two reads together instead of one after the other.
• The approvals inbox stops polling while its tab is hidden — and reads once when you look at it again.

​

The daemon exports traces, metrics, and logs over OTLP

​

What’s new

• OTEL_EXPORTER_OTLP_ENDPOINT names the collector — traces post to /v1/traces, metrics to /v1/metrics, and logs to /v1/logs under it. No default. Unset means no export.
• OTEL_EXPORTER_OTLP_HEADERS adds request headers — comma-separated key=value pairs. A pair without = stops the daemon from starting. No default.
• OTEL_EXPORTER_OTLP_PROTOCOL picks the encoding — http/protobuf (default) or http/json. Any other value, grpc included, stops the daemon from starting.
• OTEL_EXPORTER_OTLP_TIMEOUT bounds one export — whole milliseconds, default 10000. Zero or an unreadable value stops the daemon from starting.
• GRAFANA_OTLP_ENDPOINT, GRAFANA_OTLP_INSTANCE_ID, and GRAFANA_OTLP_API_KEY still work — the endpoint is read when the standard variable is unset, and the pair becomes a basic Authorization header. A standard header of the same name replaces it. These names retire with the previous daemon.
• Metrics are collected every 5 seconds — the interval the previous daemon used, so a series keeps its rate across the switch.
• Lost telemetry is counted, never retried — spans, log records, and metric collection cycles that failed to send are counted in the process. A resent window would double-count delta families.
• The log signal counts without logging — a warning about a failed log export would become a log record handed back to the exporter that just failed it. For logs the count is the whole report.
• A family this build does not produce is named at start-up — each is logged once, at debug level, with the reason, rather than exported as zeros.
• The start-up line names where the endpoint came from, never its value — startup_otel_enabled carries source=OTEL_EXPORTER_OTLP_ENDPOINT or source=GRAFANA_OTLP_ENDPOINT, because the header beside the endpoint carries a credential.

​

An unreadable PostgreSQL certificate file names itself at startup

​

Bug fixes

• Certificate file errors identify the setting — sslrootcert, sslcert, and sslkey failures name DATABASE_URL_MIGRATOR, the canonical parameter, and the unreadable path under UZ-INTERNAL-001.
• Malformed inline certificate data stays out of errors — PEM-like values are redacted instead of being printed as file paths.

​

Every command answers a mistyped invocation the same way

​

What’s new

• A rejection names the fix, not just the fault. agentsfleet events answers ✕ error: missing required argument 'fleet_id' followed by Suggestion: usage: agentsfleet events [options] <fleet_id>.
• An unknown command still suggests the nearest match and points at the command list it belongs to.
• --json rejections are parseable. A rejected invocation emits {"error":{"code","message"}} on standard error with a stable code — MISSING_ARGUMENT, MISSING_OPTION_VALUE, MISSING_REQUIRED_OPTION, UNKNOWN_COMMAND, UNKNOWN_OPTION, INVALID_ARGUMENT, or EXCESS_ARGUMENTS. It printed human text before.
• A command group run bare prints help on standard output, so agentsfleet workspace | less is no longer empty. It went to standard error while exiting 0.
• agentsfleet logs stops repeating itself. Its suggestion line said the same sentence as the error above it; it now carries the runnable usage line, as grant list now does too.
• The published exit-code table is what the client does. The command reference listed 2 as covering invalid input as well as network failure; that row is now network failure alone.

​

A hardened runner completes credentialed work again

​

What’s new

• Run checks can catch this class of fault. The runner’s check panel gains a fourth line: the scratch dir accepts a write inside the sandbox. It runs under the same restrictions your work runs under, so a sandbox that would fail your fleets fails the check first.
• The runner page reads plainer. The lease filter is labeled Filter with an Apply button, the filter accepts workspace:<id> and fleet:<name or id> written exactly as its hint shows, and the lease and activity tables use the same Time and Duration column names as the events list.
• Every runner action carries an icon, and Cordon and Drain show as disabled with the reason “Not active yet” until they are ready to use.
• A refresh button re-reads the runner page on your click — after you request checks, the verdict appears without a full page reload.
• Runner states are explained where they show. The state chip links to the states a runner shows, and that section now defines every admin state and liveness value on the page.

​

Bug fixes

• The check panel’s relative timestamp shows the absolute time on hover, matching the lease table’s time column.

​

Installing a fleet is one step

​

What’s new

• A renamed install tells you its new name. The response carries the name that was stored, and the dashboard shows that name rather than the one it started from.
• The platform fleet library takes a bundle from your computer. Admin → Fleet library → Create fleet library now offers the same GitHub and upload sources the workspace dialog already had. An uploaded entry records no repository and still lands as a draft, so publishing stays a separate act.
• A runner policy dialog shows what is already mounted. The paths agentsfleetd mounts on its own are listed as read-only rows, so you can see the baseline before adding to it. The screen says “mounts” throughout; the wire field is unchanged.
• Model prices read as Input, Cached, and Output, in United States dollars per 1 million tokens.
• Runners have a page. Runners covers enrolment, every policy field with its default and range, and what makes a runner stop taking work.

​

Bug fixes

• A development runner no longer fails every lease with runner_crash/HostResolutionFailed. The sandbox’s readable-path set is derived from the same bind list the child is handed, so the files needed to resolve a host name are inside the sandbox. Operator mounts also reach the child at the mode they were assigned, read-only or read-write.
• Dialog buttons say Create. The button that opens the dialog keeps its noun, such as Create fleet library, so the two are no longer the same words in two places.

​

A revoked integration grant stays revoked

​

Security

• A stale gate can no longer resurrect a revoked grant. Gate resolution now leaves an already-revoked grant alone, whatever decision the gate carries. Re-authorizing a service goes back through the install flow, which raises a fresh gate.

​

--provider is checked against the model catalogue your server serves

​

Breaking changes

• A provider your catalogue does not price is refused. The message names what your server does price and points at the custom-endpoint form for anything it does not. Free-form --data bodies stay unvalidated.
• The typed form requires --provider. --api-key with --model and no provider used to store a credential whose provider was the empty string — a provider key that could never dial.
• claude-cli, codex-cli, gemini-cli, openai-codex, and claude-code are refused by name. Each names a local coding tool that carries no API key. The refusal says so and does not offer the custom-endpoint form — these tools have no endpoint to point at.

​

What’s new

• agentsfleet models lists the catalogue — provider, model id, context window, and per-million-token rates, with --provider <id> scoping it to one provider. Rates are charged under platform-managed posture only; a self-managed credential is billed by your own provider account, so an unpriced row shows a dash.
• --model is checked too, against that provider’s models only. It used to be validated nowhere, so a typo stored a credential that failed at the first event.
• Provider ids match without case. --provider Anthropic stores anthropic, the catalogue’s spelling and what the runtime compares against. Model ids are matched exactly — they belong to the provider, and several are case-sensitive.
• An empty or unreachable catalogue accepts the value. A newly deployed server has no catalogue until an administrator primes it, and an outage is not a reason to refuse a credential. The server validates either way.
• The credential store reads the caller’s environment. AGENTSFLEET_STATE_DIR handed to the process now reaches every read and write, not only the ones that consulted the process environment directly.
• An unreadable credentials.json warns instead of impersonating logged-out. A permission or disk error prints warning: could not read credentials.json with the cause, then continues as logged out. A missing file stays silent, as before.

​

Sign-in events record the caller’s address, not the proxy’s

​

Security

• A forged X-Forwarded-For is caught again. When the forwarded chain and Fly-Client-IP disagree, the Fly value wins and the request is marked divergent. Two unreadable headers meant that comparison ran on two empty values, so client_ip_divergent was false on every event ever emitted.
• A replayed session is refused when it arrives from another address. The consume path keys idempotency on sha256(address || user-agent || session id) — a matching fingerprint within 60 seconds returns the cached payload, any other fingerprint is terminal. With the address pinned to the proxy it separated nobody, so a session presented from elsewhere behind the same proxy, under a matching user agent, fingerprinted identically and was handed the cached payload instead of being refused.

​

Bug fixes

• client_ip and client_ip_source name the caller and the header it came from. The seven session audit events — created, approved, verified, verify-failed, consumed, consumed-replay, aborted — carry the derived address. client_ip_source read tcp_peer on all of them whatever the request actually carried.
• created_from_address records where a credential was minted. The core.cli_credentials column holds the address the operator signed in from rather than the proxy’s, so it can identify a machine.

​

Login saves a credential that outlives the browser session

​

Breaking changes

• agentsfleet login --token is gone. The flag is refused as an unknown option rather than ignored. Piped input goes with it: a login with no terminal attached and no AGENTSFLEET_API_KEY fails and names that variable. Unattended callers set AGENTSFLEET_API_KEY to a tenant API key, which authenticates every request and writes nothing to disk.
• agentsfleet logout no longer ends your dashboard session. It revokes this computer’s credential, aborts any unfinished sign-in, and clears local state. A browser session is a different credential class refreshed through the identity provider, so signing out of a terminal leaves the dashboard signed in. A revoke that cannot reach the server still clears local state, warning that the credential stays live until you revoke it from the dashboard.
• A deployment that sets OIDC_PROVIDER=custom is refused at boot. The value selected a second ladder that read capability and workspace claims from custom_claims, app_metadata, and namespaced keys, none of which anything writes. OIDC_PROVIDER=clerk is unchanged, so no deployment that runs today needs editing.

​

What’s new

• One live credential per computer. A second login from the same computer revokes what it left behind, and core.cli_credentials carries a partial unique index, so two live credentials for one person and computer cannot be recorded at all. Only a hash is stored, so the credential cannot be read back from anywhere. agentsfleet logout is how a computer ends its own.
• A credential records the server that issued it. Later commands reach that server with no flag and no environment variable, resolving --api, then AGENTSFLEET_API_URL, then the recorded server, then the built-in URL. A saved credential recording no server, dialed at a server nobody named, is refused before anything is sent with DEPLOYMENT_UNKNOWN and exit code 1. logout and doctor still run — one ends a credential, the other explains the refusal.
• Three error codes name what went wrong. UZ-AUTH-023 says the credential was revoked, UZ-AUTH-024 says no live credential of yours has that identifier, and UZ-AUTH-025 says login recovered a session but could not exchange it, so nothing was saved. A 401 or 403 from the client now names the API URL the credential was presented to.

​

Security

• Minting a credential takes a browser sign-in. A credential still authenticates listing and revoking, so a terminal can end its own access without opening a browser, but it cannot mint a replacement. Minting used to accept an existing credential, which turned one stolen credential into an unbounded supply under machine names of the caller’s choosing.
• A stored value is checked against its whole shape. The load path and the mint response both require afc_ followed by exactly 64 lower-case hexadecimal characters. A prefix check passed values carrying trailing bytes.
• A tenant API key carries its creator’s capabilities. An agt_t key resolves its capability set from the identity provider, keyed on the created_by subject it already stored, replacing a nine-entry set compiled into the binary that no operator could narrow. Narrowing that person narrows every key they minted, on the next request past the cache window. A creator the provider no longer knows resolves to no capability; an unreachable provider past the staleness ceiling reports unavailable rather than an empty grant.
• Each claim is read from exactly one key. The capability claim is scopes and nothing else. The reader used to try OAuth2’s scope first, so a token carrying both would have supplied a capability set we never granted, on the authorisation path. The scp spelling and the workspaceId alias are unread.

​

Metered runs are priced from the model catalogue

​

Breaking changes

• GET /v1/tenants/me/billing no longer returns free_trial. The response carries balance_nanos, updated_at, is_exhausted, and exhausted_at, which is the whole billing state a client needs. The member is gone from the published schema and from its required list, so a client that reads it must stop.

​

Bug fixes

• A metered platform stage is charged the catalogue rate. Run time and all three token tiers — input, cached, and output — accrue against the credit pool at the rates the catalogue carries, instead of resolving to zero. A self_managed stage is unchanged: the run fee only, with token counts recorded and not charged.
• A model the catalogue does not price is refused rather than run for nothing. The window answered ahead of the catalogue lookup, so a provider-and-model pair with no rate row priced at zero instead of failing. Renewal and settlement now fail closed on an unpriced pair; the lease estimate still admits the run, so it surfaces as a billing error rather than a silent free run.
• The budget gates can refuse a fleet. A fleet budget is spent against real rates, so credit_deducted_nanos accrues from the first metered slice. While every charge was zero no budget was ever consumed and neither gate could stop anyone.
• The free trial is named early access. The pricing card reads “Early access”, and the answer to “What am I actually paying for?” no longer describes an ending — it used to say metering began “after the trial”. Free usage is the starter grant, which ends when the balance does rather than on a date. The rates themselves are unchanged.
• Deleting a fleet erases its memory. Rows in memory.memory_entries go with the fleet they belong to. They used to survive it, and because every sweep is scoped by an enumerable fleet, memory whose fleet was already gone was unreachable by all of them — an erased account kept it indefinitely. The isolation boundary is unchanged: the memory role holds no grant on core and cannot name core.fleets.

​

A fleet with write access always parks for a human

​

What’s new

• incident-repairer joins the fleet library. It wakes on a failed deploy workflow run, reads the incident timeline and the repository at the exact verified head, authors a forward fix, then pushes one branch and opens one draft pull request over the GitHub API — no checkout, no git tooling. A human approves the write before any of it, and a human reviews the bytes on the pull-request diff before any merge.
• A write-scoped GitHub token spends a recorded approval, never a live setting. The mint checks the durable gate row for the run’s own event — its status, its kind, and the repository binding stated on the card a human actually saw. No recorded approval → 403 UZ-REPAIR-010. The binding drifted since the card was approved → 403 UZ-REPAIR-011. Tokens never carry the workflows permission, so an approved fix cannot rewrite the pipelines that gate it.
• A repair pull request is linked to its incident, then to its deploy result. When the repair branch’s pull request opens, the platform records the link in core.repair_pr_links; when the next deploy on that branch completes, the row is stamped with the outcome. The stamp matches the repository as well as the branch, so a run finishing on a same-named branch somewhere else cannot claim it. Rows are insert-only — a replayed webhook answers duplicate_repair_link (UZ-REPAIR-012) rather than overwriting history.
• A fleet no longer wakes on its own repair. Pull requests and workflow runs on a repair branch are the crew hearing itself, and a failed one used to look exactly like a fresh incident — so the fleet would set out to fix what it had just written, asking for another approval each time round. That traffic is now recognised and dropped on both webhook routes.

​

A runner you assign now runs the work

​

Bug fixes

• Every lease died at initialization when the service had no HOME. systemd gives a service with no User= no home of its own, and the sandbox forwards HOME only when the daemon holds it, so the engine could not resolve a configuration directory. The unit now sets it to its own RuntimeDirectory, which ProtectHome=yes and ProtectSystem=strict leave reachable where /root would not be.
• Resource controllers are enabled at daemon startup, not on the first assignment. Delegate= makes cpu memory pids available to the unit, but writing cgroup.subtree_control is the delegatee’s job and systemd never does it. Doing it at startup means a runner with no assignment yet still enables them, and the post-deploy check no longer races the first heartbeat.
• A failed configuration load names its cause. The error was discarded before it reached the log, leaving UZ-EXEC-012 with nothing to act on; the record now carries the underlying failure.
• Execution cgroups are removed when a lease ends. Teardown used a recursive delete, which the kernel refuses because the control files inside a cgroup cannot be unlinked — so every reclaim failed and the directories accumulated on the host for the life of the runner.
• An unrecognised runner failure is no longer blamed on the fleet. A cause the chat surface could not classify fell back to “this fleet needs instructions” and appended the internal error name. A cause that is not operator-facing prose now reads as a runner failure, and the identifier is not shown. A fleet that genuinely has no instructions still says so.
• A host that cannot enforce limits is refused before deployment. The readiness check ran only after the runner was installed, and stopped at the first missing controller — so a host missing all three reported one. It now names every missing controller in a single run and verifies the kernel and system.slice before the deploy proceeds.

​

Assigning a policy

• The policy dialog scrolls. Its actions sat below the fold on a short viewport with no way to reach them, so assigning a policy required maximising the window.
• The three isolation tiers sit on one row. Two columns wrapped the third onto a row of its own.

​

The free trial ends per account, not on a calendar date

• free_trial.ends_at_ms on GET /v1/tenants/me/billing is now nullable. Null means the account’s trial has no end date set — it is not a missing value. Render it as “no end date”, never as an expiry at the epoch.
• The pricing pages no longer print an end date. The banner and hero pill read “Free during early access”, and the Terms point at the Dashboard for an account’s own boundary instead of naming a date that can go stale.

​

Every runner lease says whose workspace it belongs to

​

Upgrading

• Runner lease history is pruned 30 days after settlement. A sweep deletes a settled lease 30 days from when it settled — not from when it started — with the two per-lease activity records describing it. A lease still running or renewing is untouched, and the runner’s lifecycle activity (the Activity feed) is kept at any age, so a long-lived host never shows an empty feed. A lease whose runner died without reporting is marked expired at the same window, then keeps its own. Lifetime counts on the runner page are unaffected — they count transitions, not surviving rows — but export raw lease history older than 30 days from GET /v1/fleets/runners/{id}/leases before upgrading.
• Four migrations apply on startup. They add a per-runner counter table, an index for the activity feed’s filtered reads, the delete grants the sweep needs, and two indexes that keep the sweep itself off whole-table scans. The counter table backfills itself from existing history inside the migration, so no step is manual and no existing row is rewritten.

​

What’s new

• The lease table has a Workspace column. Each row links to that workspace’s fleet wall and carries the full identifier in its tooltip; a funnel beside it narrows the table to that workspace alone.
• The workspace filter lives in the address bar. ?workspace=<id> is deep-linkable, survives a reload, and Back steps out of it — so a narrowed view is something you can send to someone.

​

API reference

• GET /v1/fleets/runners/{id}/leases?workspace_id=<uuid> — new optional filter, still requiring runner:read. The response shape is unchanged and total narrows with the page. A malformed value answers 400 UZ-REQ-001; a well-formed identifier that owns nothing answers an empty page rather than an error, so a stale link reads as “no leases” instead of failing. starting_after composes with the filter: the cursor must name a lease on the filtered page, and one taken under a different workspace_id answers the same 400 UZ-REQ-001 instead of silently skipping rows.

​

Bug fixes

• A runner that refused a run no longer reads as a fleet missing instructions. Both conditions reported the same startup class, so a sandbox, egress, or resource-control refusal on the host was blamed on the fleet’s own configuration. The chat row now names the runner’s reason.
• Deleting an account unregisters its scheduled runs. The purge removed the schedule rows but never told the upstream scheduler, so an erased tenant’s cron kept firing at runners indefinitely. Teardown now unregisters upstream while those rows still exist, and counts a provider failure on agentsfleet_account_teardown_unregister_failures_total rather than swallowing it — erasure still completes either way.
• One failed schedule no longer strands the rest. The unregister pass stopped at the first provider error, leaving every schedule behind it firing forever. Each schedule is now attempted; a failure is logged with the identifiers needed to retire the survivor by hand, and missing provider credentials count on the same failure counter instead of passing silently.
• Simultaneous account deletions no longer skip the scheduler. Concurrent deletions could exhaust the database connection pool, time out every unregister, and still complete the purge. The unregister pass now runs without holding a connection, so deletions queue instead of starving each other.
• A stale lease link offers a way back. A bookmarked lease page whose workspace filter or page cursor the server no longer accepts showed “try refreshing”, which replayed the same address every time — and the control that could clear the filter sits inside the table that a failed read does not draw. That page now links to the newest leases instead.
• The runner page no longer re-counts a host’s whole history to show four numbers. Acquired, succeeded, failed, and expired are maintained as each lease settles, so the page cost stays flat however long the host has been running.

​

The isolation you assign is the isolation the runner applies

​

Upgrading

• POST /v1/runners takes the assignment envelope — the body is {host_id, assigned_policy: {sandbox_tier, network_policy, registry_allowlist[], worker_count}, labels[]}; the old top-level sandbox_tier answers 400 UZ-REQ-001. The response echoes the assignment as stored (worker_count clamped into [1, 64]).
• The runner environment collapses to the bootstrap pair — AGENTSFLEET_API_URL and AGENTSFLEET_RUNNER_TOKEN, plus the optional host-local RUNNER_STORAGE_HOME (renamed from RUNNER_WORKSPACE_BASE). RUNNER_HOST_ID, RUNNER_SANDBOX_TIER, RUNNER_NETWORK_POLICY, RUNNER_REGISTRY_ALLOWLIST, RUNNER_WORKER_COUNT, and the RUNNER_CP_*_MS deadlines are removed, not deprecated — the daemon no longer reads them, so a stale env file cannot fork the truth again.
• macos_seatbelt leaves the tier vocabulary — it never had enforcement code, and a tier that cannot be applied must not be assignable. A stray stored value parses fail-closed and the runner refuses to lease. The assignable tiers are landlock_full, container_nested, and dev_none (dev builds only).
• Existing runners read degraded once repaired — pre-upgrade rows carry no assignment. A live, upgraded host marks its own row degraded — no assigned policy on its first heartbeat; a host that is down, or still on the pre-upgrade daemon, keeps a healthy-looking row until the manual statement below runs. The fix is the same either way: open the runner, use Edit policy, and the host applies it on its next heartbeat.
• One migration applies on startup, one statement runs by hand — the migration adds the policy, capability, and verdict columns to fleet.runners and rewrites no rows. Right after deploying, mark the pre-upgrade rows degraded yourself (idempotent; it only matches rows without an assignment): UPDATE fleet.runners SET degraded = TRUE, degraded_reason = 'no assigned policy' WHERE network_policy IS NULL;

​

What’s new

• Add Runner assigns all four policy fields — isolation, network policy (defaults allow_all until allowlist enforcement ships), registry allowlist, and worker count — with copy that says the host must satisfy the selection.
• Edit policy on the runner page — PATCH /v1/fleets/runners/{id} with {assigned_policy: {…}} re-assigns a live runner; the change reaches the host within one heartbeat, and the verdict is re-checked in the same request. Growing the worker count past what the daemon started with takes effect after a runner restart.
• The runner row shows assigned against achievable — the fleet list and detail reads carry assigned_policy, the host’s reported achievable mechanisms, and degraded with its reason; a degraded row wears a badge and states what is missing.
• A runner that recovers, recovers by itself — a later heartbeat whose report satisfies the assignment clears the verdict and leasing resumes; UZ-EXEC-017 names the refusal while it stands.

​

Steer never misses the reply’s opening words

​

Bug fixes

• Subscribe before send — the steer turn opens its Server-Sent Events tail first and waits (up to 2 seconds) for the server to confirm the subscription; frames that arrive before the server names the event are buffered and replayed in order, and a tail that cannot open falls back to the previous post-then-poll behavior.
• Cancel before send — Ctrl-C that lands before the message goes out now interrupts the turn without sending; the fleet no longer executes a message you cancelled.
• No stray connections — every steer turn now provably closes its stream on success, failure, and interrupt alike.

​

Security

• Dashboard toolchain refresh — Next.js 16.2.12 clears three high-severity advisories (Server-Side Request Forgery in Server Actions, a middleware bypass, and a request-driven denial of service), and the dashboard now type-checks and builds on TypeScript 7’s Go-native compiler.

​

Follow-up — chat replies start streaming immediately

​

A runner has a page of its own, and every list pages by cursor

​

Upgrading

• page and page_size are removed from three reads — GET /v1/fleets/runners, GET /v1/fleets/runners/{id}/events, and GET /v1/api-keys. All three take ?starting_after=&limit= and answer {"items": [...], "total": N, "next_cursor": "..."}; follow next_cursor until it is null. A request still sending either parameter answers 400 UZ-REQ-001 rather than being silently ignored, so client and server upgrade together.
• sort is removed from GET /v1/fleets/runners — newest-first is the only order. Its non-default values existed to serve a sortable column on the table this release replaces, so the capability left with the control that used it. Sending sort answers 400 UZ-REQ-001.
• The fleets list renames its cursor on both sides — the request parameter cursor becomes starting_after and the response field cursor becomes next_cursor on GET /v1/workspaces/{workspace_id}/fleets. Both old spellings are refused, not translated.
• The memory list envelope drops request_id — it is now exactly {"items": [...], "total": N, "next_cursor": "..."}. Read the request identifier from the response header if you were consuming it from the body.
• agentsfleet api-key list no longer takes --page or --page-size, and agentsfleet list no longer takes --cursor. The paging flags are gone rather than deprecated: an invocation carrying one fails as an unknown option and makes no request. Use --starting-after on agentsfleet list; api-key list needs no flag, since it now returns every key.
• Two index migrations apply on startup — both add an index and touch no column, so no row is rewritten and no step is manual.

​

What’s new

• /admin/runners is a card wall, and each card is a link. A card states what its host is working on in one line, or that it is idle, and shows administrative state before liveness so a cordoned host never reads as healthy.
• /admin/runners/{runner_id} opens on Leases — a metrics strip over the standard table, live leases first, each row carrying its outcome. A failed row reads the same plain-English sentence the fleet console uses, never the machine tag, with the daemon’s detail line beneath it. Activating a row opens Review lease: fencing token, kind, provider, model, posture, token meters, and expiry.
• Activity carries lifecycle records only. Lease acquire and release are excluded because the lease table already states each of them once, with its outcome — which is what removes the doubled count.
• An expired lease is never credited with someone else’s success. Outcome is computed from the lease’s own status first, so a lease this host stopped renewing reads expired even after another host finished the same work. A lease whose fleet event is missing reads as not recorded rather than as a success.
• agentsfleet api-key list returns every key you hold. The list follows the cursor to the end instead of showing a first page, and the dashboard’s key list drops its pagination footer while keeping column sorting.
• agentsfleet memory list takes --starting-after <KEY>, and the dashboard’s memory panel now shows every entry a fleet has learned rather than the first page of them.

​

API reference

• GET /v1/fleets/runners/{id} — requires runner:read. Returns the runner with derived liveness, active_lease_count, active_fleet_count, and lifetime leases_acquired / leases_succeeded / leases_failed / leases_expired, all computed from durable lease and event rows. Never returns token_hash. An unknown id answers 404 UZ-RUN-014.
• GET /v1/fleets/runners/{id}/leases?starting_after=&limit= — requires runner:read. limit defaults to 50 and is refused above 100. Each item carries outcome (running, succeeded, failed, expired, or unknown), failure_label and failure_detail when it failed, fencing_token, kind, provider, model, posture, the three token meters, and the fleet and workspace identifiers plus the fleet name so a link needs no second read. Never returns request_json. An unparseable starting_after, or a limit outside the range, answers 400 UZ-REQ-001.
• GET /v1/fleets/runners/{id}/events?event_type=<tag>[,<tag>…]&starting_after=&limit= — event_type now accepts a comma-separated set and returns the union. An unrecognised tag anywhere in the set answers 400 UZ-REQ-001 and no partial result, so a typo can never read as “no such events”. Follow next_cursor until it is null to read a runner’s whole history.
• GET /v1/workspaces/{workspace_id}/fleets/{fleet_id}/memories?starting_after=&limit= — all three query shapes (recent, category, and text search) page by cursor over creation order, so a filtered or searched list can no longer be silently truncated at the first page.

​

Bug fixes

• The memory list’s next-page hint is runnable. It printed a command without --fleet, which memory list requires, so copying it produced a usage error instead of the next page. It now carries the fleet you asked about.
• Paging a runner’s leases no longer costs its whole history. The lease table accumulates a row per claim and is never pruned, so reading one page had been sorting everything that host had ever done. Both of the read’s access paths are indexed now, and page cost stays flat as the history grows.

​

CLI

• agentsfleet list [--starting-after <ID>] [--limit <N>]
• agentsfleet memory list --fleet <ID> [--starting-after <KEY>] [--limit <N>] [--category <NAME>]
• agentsfleet api-key list [--sort <FIELD>] — no paging flags

​

Replacing a secret means sending the secret you want stored

​

Upgrading

• PATCH /v1/workspaces/{workspace_id}/secrets/{secret_name} is removed — replaced by PUT on the same route. PUT takes {"data": {...}}, the same shape create takes, and replaces the stored body whole; a field you omit is absent afterwards. There is no compatibility spelling, and a PATCH now answers method-not-allowed. Client and server upgrade together.

​

What’s new

• agentsfleet secret update <name> replaces a stored secret in one call. The name stays claimed for the whole call, so fleets that require it keep resolving — no delete-and-recreate gap. It takes the same --data object (or --data=@- on stdin) and the same typed custom-endpoint flags as create.
• The dashboard’s Edit dialog is the Create form, prefilled — provider, base URL, and model come from the row you opened; you supply the key. A custom endpoint’s base URL is editable after creation for the first time.
• Edit writes the model entry before the credential — a credential is shared by every entry referencing it and can never be read back to restore, so it is written last. If the credential write is the one that fails, the model change that already committed is re-read into the table rather than left off screen.

​

API reference

• PUT /v1/workspaces/{workspace_id}/secrets/{secret_name} — request {"data": {...}} (non-empty object, at most 4 KiB stringified); 200 {"name": "..."}. A name the workspace does not hold answers 404 UZ-VAULT-003 and creates nothing — a replace racing a delete cannot resurrect the deleted secret.
• The write is one statement. Two concurrent replaces resolve to the later body whole; no merge of the two can be stored.

​

Bug fixes

• Reconfiguring an existing custom endpoint from the Add dialog works again — it still sent a create, which stopped overwriting on Jul 28, 2026, so reusing the name answered UZ-VAULT-005 and saved nothing. It now replaces the endpoint’s stored body.
• A failed save in Edit no longer strands the shared credential — a save changing both the model and the key could commit the new key, then report failure, leaving every entry sharing that secret on a credential the dashboard said was not saved. The credential is now the last write, so a failure ahead of it touches nothing.

​

CLI

• agentsfleet secret create on a name that already exists still reports skipped and exits 0; the message now points at agentsfleet secret update instead of delete-and-recreate.

​

The dashboard loads the page you asked for, and a failed read says so

​

Upgrading

• Creating a secret no longer overwrites one that exists — POST /v1/workspaces/{workspace_id}/secrets answers 409 UZ-VAULT-005 when the name is already held, and writes nothing. Rotate with PATCH /v1/workspaces/{workspace_id}/secrets/{secret_name} instead. The database decides, so two concurrent creates on one name resolve to one 201 and one 409. Reconnecting a provider and refreshing its token are unaffected — those are rotations, not creations.
• agentsfleet secret create --force is gone — it relied on the endpoint upserting, so it could only have failed. Passing it exits non-zero before anything is sent; creating an existing name reports skipped and exits 0. Rotate in place with PATCH /v1/workspaces/{workspace_id}/secrets/{secret_name}, which holds the name for the whole call. The client has no rotate command yet, and delete-then-create leaves the name absent between the two calls — any fleet requiring it fails in that gap.
• ?q= is gone from GET /v1/models and GET /v1/workspaces/{workspace_id}/fleet-libraries — the substring filter published on Jul 27, 2026 had no caller on any plane. A request that still sends it is answered as though it were absent, so you get a page rather than an error. Page with next_cursor and filter client-side.
• support_files has left every API response — the admin catalog was the last surface carrying it. The manifest is still written and stored on import, and the content-addressed bundle tar remains the authoritative file list, so no install behaviour changes.

​

What’s new

• The Fleet library gallery and Models registry load more instead of everything — each states how many entries it is holding and that more remain, so a bounded page never reads as a complete list.
• Your place in the gallery survives a reload — the cursor of the page you are on is written into the address bar. A reload, a shared link, or a Back out of a fleet lands where you were rather than at the first page.
• The model catalogue loads when you reach for it — hovering, focusing, or opening the model picker fetches it, and an ordinary visit to Models does not. Hover is skipped on touch pointers and under Save-Data, where a hover is not a guess about intent.
• A deep link to a library entry that is not on the loaded page says so — it neither errors the page nor quietly shows you something else.
• The Add-model dialog will not save against a secret list that never loaded — it used to submit anyway, skipping the name-ownership check. Save now waits for the list, says what it is waiting for, and offers a retry when the read fails.

​

API reference

• New error code: UZ-VAULT-005 (409) — a secret with this name already exists in the workspace.
• UZ-LIBRARY-003 narrows to a limit outside 1 to 100. Its search-length cause left with ?q=; the code and its registry row are unchanged.
• GET /v1/workspaces/{workspace_id}/fleet-libraries cursors are bound to the workspace and page size, no longer to a filter.

​

Bug fixes

• Fleet chat replies render as they arrive — a reply stayed invisible until you switched tabs or reloaded, while the typing indicator ran and the Live badge stayed green. Every streamed frame is named by its kind, and a named frame reaches only a listener registered for that name; the per-fleet stream listened for unnamed frames alone and dropped all of them.
• The Events tab scrolls again — expanding a grouped run set left the page frozen in a non-maximized window. The table’s scroll region contained the wheel on both axes while having nothing of its own to scroll vertically, so the page never received it.
• Sortable column headers read evenly — the unsorted indicator was drawn heavier and taller than the sorted one, on every sortable column at once.
• Runner rows lost a copy button that copied nothing useful, and now lead with administrative state before liveness.

​

CLI

• agentsfleet secret create costs one request — it no longer reads the secret list first to decide whether the name is free. The endpoint decides, which also closes the window where two creates of one name could both believe they were first.

​

Model and Fleet library reads are bounded pages

​

Upgrading

• GET /v1/models returns at most 50 models per request — follow next_cursor until it is null. A client that reads only the first response now sees a truncated catalogue. version and models keep their names and shapes; total (always null) and next_cursor are added beside them.
• GET /v1/workspaces/{workspace_id}/fleet-libraries is a page too — ordered created_at DESC, then platform entries before tenant entries, then id. Follow next_cursor.
• The gallery summary no longer carries support_files — the manifest is not served on the workspace plane; the admin catalog (GET /v1/admin/fleet-libraries/{id}) remains its only reader. Nothing else moved off the card.
• Upgrade the agentsfleet CLI together with the server — agentsfleet install --library <id> resolves an id against the gallery, and a pre-upgrade CLI reads only the first page, so it reports a valid entry past that page as missing.
• Bundle imports and catalog edits now enforce requirement ceilings — at most 32 required credentials, 64 required tools, and 64 network hosts, with names up to 200 bytes and hosts up to 253. An import past a ceiling returns 413; a catalog edit whose install-gate copy is over 32 entries, or longer than 500 bytes for one credential, returns 400. Stored entries are not re-validated, so nothing already saved becomes unreadable.

​

What’s new

• Filter the catalogue — ?q= matches a case- and accent-insensitive substring across a model’s id and provider, ?provider= matches a provider exactly. % and _ match literally.
• Conditional catalogue reads — every answer carries an ETag, Cache-Control: private, no-cache, and Vary: Authorization. Send the tag back as If-None-Match and an unchanged catalogue answers 304 with no body.

​

API reference

• GET /v1/models?limit=&starting_after=&q=&provider= → {version, models, total, next_cursor}, plus ETag / Cache-Control / Vary on both 200 and 304.
• New error codes: UZ-LIBRARY-001 (cursor this endpoint never issued), UZ-LIBRARY-002 (cursor for different filters or page size), UZ-LIBRARY-003 (limit outside 1..100, or q over 128 bytes), UZ-LIBRARY-004 (catalogue revision unreadable), UZ-LIBRARY-005 (a compliant response would exceed its body ceiling), UZ-LIBRARY-006 (pool or query failure), UZ-LIBRARY-008 (a secret-reference write lost a race to a concurrent delete).
• A stale-but-valid cursor is not an error: it resumes from its boundary and may return an empty page with next_cursor: null.

​

Bug fixes

• The dashboard Models page lists every model entry again — the page sent no limit and ignored next_cursor, so a tenant with more entries than one page silently saw only the first.

​

CLI

• agentsfleet install --library <id> reads the whole gallery — it follows next_cursor until the id is found, so an entry past the first page installs instead of reporting itself absent.

​

Adding runners no longer slows the control plane

​

What’s new

• Idle polls skip the database entirely — a poll consults a readiness index that ingress writes when a fleet actually receives work, so a fleet holding nothing is never examined. Previously every poll walked every active fleet on the platform.
• Scheduled fires enter the fast path too — the cron producer records readiness when it appends, so a scheduled run is picked up on the next poll instead of waiting for the background sweep to reach its fleet.
• Per-poll work is capped — the candidate scan is bounded by MAX_READY_CANDIDATES_PER_POLL, alongside NO_WORK_RETRY_AFTER_MS so both knobs are visible together.
• Runner authentication is memoized for one heartbeat interval — repeat calls from the same runner no longer re-read fleet.runners. A cordon, drain, revoke, or delete drops the entry on the machine that served it, and any other machine’s entry expires within one heartbeat.
• New /metrics families for poll cost and readiness depth — candidate-scan depth and per-poll database round-trips, unlabelled and rendered without touching a datastore.

​

Bug fixes

• A message posted to a non-canonical fleet id is now rejected — an uppercase, brace-wrapped, or dash-free fleet_id on POST /v1/workspaces/{workspace_id}/fleets/{fleet_id}/messages matched the fleet and returned 202, then queued the event onto a stream nothing reads, so the message was never delivered.
• Stopping, deleting, or auto-pausing a fleet clears its readiness entry — a fleet that left active kept an unreachable entry that held a slot of the bounded sample permanently; the approval gate’s automatic pause now clears it the same way the stop and delete paths do. A stop keeps the fleet’s stream, so a resume still finds its undelivered event.
• A stranded event no longer waits on unrelated traffic — the background sweep re-derives readiness from the streams themselves, including entries appended but never delivered to any consumer, which the previous reclaim path could not see.

​

Metrics move to one namespace and standard names

​

Upgrading

• /metrics families that started fleet_ now start agentsfleet_ — fleet_triggered_total becomes agentsfleet_fleet_triggered_total.
• Four metrics renamed — agentsfleet.credit.drained_nanos → agentsfleet.billing.credit.consumed ({nanocredit}); agentsfleet.run.duration_ms → gen_ai.invoke_agent.duration (seconds); agentsfleet.tokens.processed → agentsfleet.invoke_agent.token.usage ({token}, split by gen_ai.token.type), with cached input separate as agentsfleet.invoke_agent.cache_read.token.usage — a subset of input, not a third total.
• Workspace and tenant identity no longer appear on metrics — per-workspace cost stays a Postgres query against the execution-telemetry rows.

​

What’s new

• Bounded model attribution — gen_ai.provider.name and gen_ai.request.model are attached while a series budget allows; past it the attribute is dropped, never truncated, and agentsfleet_otel_attribute_omitted_total counts the omission.
• Standard HTTP span keys — http.request.method, http.route, and numeric http.response.status_code. The route is the matched template, so the concrete path, query string, and Authorization header stay out.

​

Bug fixes

• Successful lease renewals now reach the credit metric — renewals committed money but emitted no sample, understating consumption for any run that renewed.

​

Idle load tracks your work, not your history

​

What’s new

• Idle database load stays flat as accounts grow — stored runners and events no longer make background work more expensive over time.
• Long lists stay responsive — runner, credential, and API key lists limit their work to the requested page.

​

Bug fixes

• A backslash in an actor filter no longer returns 500 — an actor value containing \ now matches the literal backslash and returns a normal page.

​

A hung peer cannot hold a call open

​

What’s new

• Telemetry export finishes predictably — each request obeys a deadline, so a stalled endpoint cannot hold delivery open indefinitely.
• Exporter health is on /metrics — queue depth and dropped-telemetry totals make an exporter outage visible.
• High-volume traces stay bounded — routine success traffic is limited; runner rejections, server errors, and drops stay visible in metrics.

​

An identifier has exactly one spelling

​

Upgrading

• Lowercase any identifier your code stores or builds itself. Ids returned by the API and CLI are already lowercase; act only where your code uppercases an id or hard-codes one in a fixture or webhook URL. Those requests fail with UZ-UUIDV7-009, or UZ-REQ-001 on inline-validating routes.

​

API reference

• Uppercase and mixed-case ids return 400 — UZ-UUIDV7-009, or UZ-REQ-001 on inline-validating routes. Handle both.
• The CLI rejects the same shape — checked before the request leaves your machine.

​

Bug fixes

• A clock outside the representable range fails loudly — minting an id on a host set before 1970 returns an error instead of an id that sorts wrong.

​

A struggling fleet explains itself

​

What’s new

• Failures name their cause — Failed a startup safety check — no instructions configured appears in Chat, the events table, and the live completion frame. A run from an older runner that records no cause still shows the plain-language sentence, never a guess.
• A repeating failure is one banner — what failed, why, how many times, when it last happened, and what to do. It clears when the fleet recovers.
• Repeats collapse — consecutive identical deliveries fold into one expandable row with a ×N count and time range.
• Compact integration events — one line with the full payload one click away; a recognized change proposal links to its source.
• Guidance where you can act on it — a startup failure links to the fleet’s Skill tab.
• One pagination control everywhere — every console table pages the same way, and a page is shareable by link.

​

API reference

• core.fleet_events gains failure_detail — an additive nullable text column carrying the human-readable cause. The events endpoint returns it beside failure_label; both are null on a clean run.

​

Bug fixes

• Zero metrics on a failed run dim — 0 tokens, $0.00 cost, and 0ms no longer read as a real measurement.
• A long-open Chat tab stays bounded — the live view keeps a recent window; full history stays in Events.

​

Tables stay sortable and contained

​

What’s new

• Sortable columns — click a supported heading to cycle ascending, descending, original order.
• Contained event history — long lists scroll below a sticky heading.
• Consistent pagination — client, cursor, and page-backed lists share one control and keep recovery navigation on an empty later page.
• Exact dashboard frame — the header aligns edge to edge and page content owns viewport scrolling.

​

Fleet detail is now a focused workspace

​

What’s new

• The composer is always on screen — only the conversation scrolls.
• Every message says who sent it — a sender chip, a readable name, and the time. Yours read Operator; the fleet’s read its own name.
• Events describe themselves — an incoming event shows what arrived, such as opened · owner/repo#539 — add retry with backoff, with its payload one click away.
• Failures read as sentences — in Chat, the summary, and the events table, instead of the runner’s internal tag.
• Fleet-local views — Events is fleet-scoped; Memory, Skill, Trigger, and Settings each get one destination.
• Approvals stay in context — a waiting count opens workspace Approvals filtered to the current fleet.
• Trigger drops setup clutter — source, filters, schedule, and latest delivery only.

​

Bug fixes

• Messages send while the live feed is down — a refused message shows as failed with a retry instead of sitting queued.
• Your own messages survive a reload — they rendered as empty rows because Chat used the fleet’s reply field for every entry.
• Incoming events no longer render as blank rows.
• A lost connection recovers on its own — Chat reconnects when the tab returns to the foreground or the network comes back.
• The API accepts a real request’s headers — the 4 KiB request-header limit answered 431 on any authenticated request crossing a proxy. The limit is now 16 KiB.

​

The console puts steering first

​

What’s new

• Steer-first console — the SKILL.md/TRIGGER.md source card is collapsed to its header until you open it; Edit keeps it open while a draft exists.
• A way back to the wall — the console header gains a ← Fleets link.
• Plain-words wall tiles — footers read $1.20 spent · 7 events; a stale feed reads not live.
• Events in the standard table — Time, Status, Fleet, Actor, Type, Summary, Tokens, and Duration, with cursor paging.
• The wall search box is gone — it only filtered fleets already loaded in the page.

​

Bug fixes

• Console columns no longer overlap — long unbroken lines scroll inside their own block.
• The run-metrics strip says Time — Wall collided with the Live Wall page name.

​

Delete revoked runners, and a seeded model catalogue

​

What’s new

• Delete a revoked runner — revoke is the destructive step, delete retires the record. The trash action appears only on revoked runners.
• A pre-seeded model catalogue — Anthropic, OpenAI, Gemini, DeepSeek, Kimi, GLM, MiniMax, Qwen, xAI, Groq, and Mistral direct, plus the same models via Pioneer, Fireworks, Together, Novita, and OpenRouter. Each host carries its own pricing.
• Custom endpoints learn their context window — an OpenAI-compatible endpoint naming a known model enforces that model’s real context cap.
• Loading screens speak — route loaders rotate wording; screen readers hear the plain wording.

​

API reference

// 204 No Content on success
// 404 UZ-RUN-014 — no runner with this id
// 409 UZ-RUN-016 — active runner must be revoked before deletion

​

Bug fixes

• No fake platform default — a fresh tenant sees “No default is configured” instead of a green Active badge.
• Self-managed models say “Billed by provider” instead of “Rates unavailable”.
• The platform-default row is hidden for tenants running their own model with no default configured.

​

No missing-page flash, and a Platform sidebar group

​

Bug fixes

• No not-found flash on the workspace home — the dashboard entry, workspace switcher, and workspace creation open the fleet wall directly.
• The refetch dialog reads as a refetch — Fetch update opens its own dialog with the repository locked to the entry’s source. Repointing a source stays under Edit.
• A finished onboarding step shows a check.

​

What’s new

• A Platform sidebar group — Runners, Model library, and Fleet library move out of Configuration. It shows only to an operator holding the matching scope.

​

Fleet detail becomes the operating console

​

What’s new

• Source editing — read and edit SKILL.md or TRIGGER.md from the dashboard. A save takes effect on the next wake and keeps the fleet’s memory; a concurrent save reloads the other change instead of overwriting it.
• Memory correction — inspect learned entries and forget one. Deleting the fleet still deletes all its memory; editing its source does not.
• Run cost — each event can show tokens, wall time, and settled cost. The recent rollup covers the latest 200 events within seven days and labels that bound; lifetime spend stays separate.
• Faster fleet lists — lifetime event and spend counters are maintained on write.

​

API reference

• Fleet detail — GET /v1/workspaces/{workspace_id}/fleets/{fleet_id} returns source, triggers, lifecycle state, lifetime counters, and an ETag header.
• Event cost — fleet event rows include nullable cost_nanos, sourced from settled billing telemetry.
• Memory forget — DELETE /v1/workspaces/{workspace_id}/fleets/{fleet_id}/memories/{key} requires fleet:write, returns 204 when deleted and UZ-MEM-004 when the key is absent.
• Stale-write protection — fleet source and platform library PATCH may send If-Match. A stale fleet edit returns UZ-AGT-014, a stale catalog edit UZ-CATALOG-005; both are 412 and include the current ETag.

​

The fleet catalog stops overstating itself

​

What’s new

• Draft-first onboarding — creating or refetching a platform entry returns it to draft. Publish after review.
• Edit a catalog entry’s identity — name, repository, and ref are editable. Changing the repository or ref discards the stored bundle and returns the entry to draft; workspaces already running the fleet keep the bundle they installed. Fetch update fetches at the ref the entry names, not the default branch.
• An honest status column — an entry published with no bundle shows as Broken, not Published.
• Consistent naming — Create fleet library replaces “Add fleet”; the page reads Fleet library.
• Copy buttons where a value wants copying — bundle hashes (the full hash), identifiers, secret names, cron schedules, webhook URLs, and one-time credentials. A failed write is reported on the button instead of showing “Copied” and costing you a one-time token.
• The dashboard counts every fleet — installing and killed fleets appear in the summary tiles.
• The live thread shows tool calls and cost — each response lists the tools it called with durations.

​

API reference

​

Platform operators onboard fleets from the dashboard

​

What’s new

• Onboarding without a hand-built API request — onboarding the same repository twice updates the existing entry rather than creating a second one.
• Four prebuilt fleets — github-pr-reviewer, platform-ops, zoho-sprint-daily-summarizer, and zoho-recruiter-daily-summarizer. Each is a public repository under agentsfleet.
• A fleet’s library identifier comes from its bundle — read from the name in SKILL.md, not the repository path you type. Keep the repository name, the SKILL.md name, and the TRIGGER.md name identical.

​

API reference

• security-reviewer removed from the prebuilt catalog — it named a repository that was never published.

​

Removed CLI commands stop appearing in hints

​

Upgrading

• agentsfleet workspace delete JSON output field renamed — {"deleted": "<id>"} is now {"removed_from_local_state": "<id>"}. Update any script parsing it. The workspace and its remote data are unaffected by this command.

​

Bug fixes

• Stale command hints removed — error text no longer points at agentsfleet install --from, agentsfleet secret add, agentsfleet workspace add, or agentsfleet tenant provider add. agentsfleet list with no fleets points to agentsfleet library and agentsfleet install --library <library_id>; vault hints say agentsfleet secret create <NAME>.
• Clean --help output — agentsfleet --help no longer prints a telemetry-shutdown timeout after valid help output.
• GitHub Pull Request events — the signed per-fleet webhook accepts the full set of supported Pull Request actions.

​

GitHub App events route to repository-bound fleets

​

What’s new

• Repository-bound triggers — add repositories: [owner/repository] beside source: github and events in TRIGGER.md; omission receives no managed App traffic.
• Scoped fan-out — one delivery may wake several matching fleets in its workspace; wrong-repository, wrong-event, inactive, and unapproved fleets receive nothing.
• Verified installation ownership — the callback verifies access to the claimed installation and refuses to move one already connected to another workspace.
• Replay recovery — replay protection uses the signed payload body per fleet, so changing the unsigned delivery header cannot bypass it.

​

API reference

• POST /v1/ingress/github verifies the platform GitHub App signature, acknowledges signed ping checks, maps installation.id to a workspace, and normalizes supported events. Returns 202 after routing and 404 with UZ-WH-022 when no fleet subscription matches.
• pull_request events are accepted. workflow_run is accepted only for completed failed runs.

​

CLI

• agentsfleet connector list [--workspace <id>] [--json] — reports connected, not_connected, reconnect_required, or unconfigured per provider.
• agentsfleet connector status <provider> [--workspace <id>] [--json] — one provider’s state, without treating a valid disconnected state as an error.

​

The model library is now an authenticated read

​

Upgrading

• GET /_um/<key>/cap.json is retired — the path returns 404, no alias. Switch to GET /v1/models with a Bearer token. The models[] rows are unchanged: id, provider, context_cap_tokens, input_nanos_per_mtok, cached_input_nanos_per_mtok, output_nanos_per_mtok. The ?model= filter is not ported — filter client-side. Dashboard and CLI users need do nothing.
• The global rates/billing block is gone with the document — GET /v1/models carries the catalogue only. Current rates stay at agentsfleet.net/#pricing.

​

API reference

• GET /v1/models — Bearer-authed, any tenant, no capability scope. Returns { "version": "YYYY-MM-DD", "models": [...] }; an empty catalogue is 200 with models: []; a missing or invalid token is 401.
• UZ-PROVIDER-004 — the “Model not in library” guidance points at GET /v1/models.

​

Reconnecting an integration takes effect immediately, and Jira stays connected

​

Bug fixes

• Stale token after reconnect — the credential cache spots a changed identity, such as a different GitHub installation or a rotated personal access token, and mints a fresh token. It used to serve the cached one for up to an hour.
• Jira hourly reconnect loop — the platform stores the rotated refresh token returned during renewal. Applies to any provider that rotates them (Atlassian’s Jira OAuth does by default); Zoho Desk is unaffected. A failed store still lets the in-flight request succeed, at the cost of at most one reconnect prompt.

​

Per-fleet spend ceilings are enforced

​

What changed

• daily_dollars and monthly_dollars now stop a fleet — a fleet that has spent its allowance is refused before its next run opens, recording gate_blocked with a budget_breach label. The refused event is not charged. A fleet crossing its ceiling mid-run stops at its next lease renewal (UZ-RUN-015) and records fleet_error with the same label.
• budget_breach is a distinct label — previously every mid-run stop reported renewal_terminate.
• Spend windows — daily_dollars is a rolling 24 hours, monthly_dollars the UTC calendar month; spend counts what you were charged. monthly_dollars stays optional.
• Lowering a ceiling takes effect immediately, including on a run in flight.
• /v1/admin/models is documented — the platform-admin catalogue routes were served without appearing in the API reference. A continuous-integration gate now fails whenever a served route is missing from the specification.

​

Documentation corrections

• Continuation chains never existed. The context-lifecycle page described a continuation chain capping at 10 and an 11th attempt labelled chunk_chain_escalate_human. None of it was built: a fleet that runs out of context wraps up, the run ends processed, and nothing re-queues it.
• actor=continuation:<original_actor> is not a value the runtime writes — removed from the activity-stream and --actor filter documentation.
• budget_breach was documented before it existed. It exists now.

​

Fleet timeline recovers frames lost to a connection blip

​

Bug fixes

• Reconnect gap-recovery — on reconnect the timeline re-fetches events published during the outage and merges them by event id, so a frame delivered twice renders once.
• Honest tail on failure — a failed recovery fetch changes nothing on screen; the next reconnect retries. Nothing is fabricated to fill a gap.
• Conflicting style classes resolve last-wins — components merge classes through one Tailwind-aware implementation.

​

Admin model library: edit rates and set the default from a row

​

What’s new

• Edit rates in place — the pencil on a catalogue row opens a dialog for the context cap and per-token rates; provider and model id stay fixed.
• Make any model the default from its row — a star action sets the platform default (you enter the provider API key, stored in your vault).
• Consistent action icons — every Create button shows a plus icon, and the fleet Install button a download icon.

​

API reference

• GET /v1/admin/platform-keys — each row now includes model, the priced (provider, model_id) the default resolves to (null for a provider that has been stood down).

​

Models page becomes a registry

​

What’s new

• One row per configured model — sorted by model or provider, with the platform default pinned first.
• Key names are identities — a key name you already stored (same provider) updates that key in place and points the new model at it, so models share one credential. A name belonging to a different provider’s key is rejected, not overwritten.
• Custom endpoints can go keyless — the API key field is optional.
• Per-row actions — View details (provider, endpoint, key name, created date — never the key), Edit, and Remove (blocked with a reason on the row powering inference).
• Switch with one click — an inactive row’s Switch button activates it immediately.

​

API reference

• GET /v1/tenants/me/models — lists registered entries, each joined to its key’s provider/kind/endpoint and an active flag; also returns platform_default_available.
• POST /v1/tenants/me/models — registers {model_id, secret_ref}. secret_ref is required and names the stored provider key or keyless custom-endpoint record. 404 UZ-MODELS-002 when it names no stored key; 409 UZ-MODELS-003 on an exact duplicate.
• PATCH /v1/tenants/me/models/{id} — changes an entry’s model_id. 404 UZ-MODELS-004 when the id isn’t yours.
• DELETE /v1/tenants/me/models/{id} — removes an entry; idempotent. 409 UZ-MODELS-001 when it’s the active entry.
• PUT /v1/tenants/me/provider also registers the matching model entry when none exists.
• Activating a self-managed model takes the model from the PUT body or the registry entry, never the stored key. An activation that resolves no model returns 400 UZ-PROVIDER-004.
• Deleting a stored key still referenced by a model entry returns 409 naming how many entries reference it.

​

Crisper cards, clearer isolation modes, per-account avatars

​

What’s new

• Sharper cards and tables — resting-state borders and card backgrounds are brighter.
• Pinned table header on Billing usage — the “Date / Amount / Type / Description” header stays visible while scrolling.
• Isolation mode as option cards — Settings → Runners → Create runner picks its mode from four described cards instead of a dropdown.
• A distinct account avatar — with no uploaded photo, your avatar is a pattern generated from your account.

​

Error responses stop leaking internal names

​

Bug fixes

• No more raw internal error names — an authentication-middleware failure returned a raw identifier (e.g. error.TokenExpired) in detail; it now returns a curated message, with the raw identifier logged server-side only.
• Plainer failure messages — around three dozen internal-failure responses now return plain English; several previously-generic connector and provider failures return distinct, diagnosable codes.
• Model-provider errors say “library” — they previously said “catalogue”.
• UZ-AUTH-014 is now 409 Conflict — submitting a login verification code before approving the session returned 410 even though the session was still approvable.

​

API reference

• The error codes reference is generated from the backend error registry on every release, so it cannot drift.

​

Fleets need an approved integration grant before minting provider tokens

​

Upgrading

• Existing GitHub/Zoho/Jira/Linear fleets without a grant stop minting after this release. One-time fix per fleet: POST /v1/workspaces/{workspace_id}/fleets/{fleet_id}/integration-requests (body {"service": "github", "reason": "..."}), then approve it from the dashboard. Already-approved fleets are unaffected.
• Slack fleets and static secrets you pasted yourself (${secrets.<name>.<field>}) are not gated.

​

What’s new

• Grants are requestable for github, zoho, jira, and linear — the endpoint previously rejected these services.
• A refused mint returns UZ-GRANT-001 (403, “No integration grant for service”) with the request-grant endpoint in the hint.
• Revoke works mid-run — revoking refuses the fleet’s next token request even while its run is leased; re-approving restores minting with no reconnect.

​

A guide to connecting GitHub, Slack, Zoho Desk, Jira, and Linear

​

What’s new

• Connectors guide — the connect round-trip, the GitHub App-install exception, and which providers issue a refresh token.
• Secrets page links to the guide and calls out the difference between a pasted vendor key (${secrets.<name>.<field>}) and a connector.

​

Runners, Model library, and Secrets adopt the standard table

​

What’s new

• Runners page — renders in the same table as API keys and secrets. Enrolling is the “Create runner” dialog, which shows the install token once with a notice that it won’t be shown again.
• Runner labels — “Host id” is now “Host name”; “Sandbox tier” is now “Isolation mode” with plain options: Linux · Landlock, Nested container, macOS · Seatbelt, and None.
• Model library — “Model rates” is renamed “Model library” across the nav, page, and dialog.
• Secrets — “Secrets & ENVs” is now just “Secrets”. Renaming a secret is its own dialog, opened from the Name column.

​

Bug fixes

• Model library token counts — large counts rendered inconsistently between server and client (a locale mismatch).

​

API Keys stands alone, Buy credits works, library copy drops “template”

​

What’s new

• API Keys page — the sidebar’s “Workspace” entry is now “API Keys”, a standalone page; /settings redirects here. Switching and creating a workspace stay in the top-right switcher.
• Buy credits — renamed from “Purchase credits” and now a live mailto: link instead of a disabled button.
• “Create fleet library” replaces “Add library entry” across the dashboard and CLI empty states.
• Left-nav active indicator — the selected item shows a left accent bar.
• Scopes reference — a new page listing every scope a tenant token can carry, linked from UZ-AUTH-022.

​

Bug fixes

• Models page — the active-model row no longer glows permanently (a [data-live] selector matched the “not live” state too); its redundant “Switch to platform defaults” button is removed.
• UZ-PROVIDER-009 — switching back to platform defaults when none is configured returns plain English instead of leaking “operator action required”.

​

Fleet library replaces Templates, Secrets gets its own page

​

Upgrading

• agentsfleet templates → agentsfleet library; --template → --library. No alias — update any script or continuous-integration job calling the old command or flag.
• agentsfleet credential → agentsfleet secret. Same for credential add/list/show/delete.
• Routes renamed, no deprecation window: /v1/admin/fleet-templates → /v1/admin/fleet-libraries; /v1/workspaces/{workspace_id}/fleet-templates → .../fleet-libraries; /v1/workspaces/{workspace_id}/credentials → .../secrets. Wire fields platform_template_id/tenant_template_id → platform_library_id/tenant_library_id.

​

What’s new

• Fleet library — “Add library entry” replaces “Create a template”; the ?library= deep-link query param replaces ?template=.
• Secrets & ENVs — vault secrets get their own sidebar entry and page.
• Models page collapses to one list — the platform-default model renders as a normal row. The “Other provider” form’s Provider field is a dropdown of real catalogue models instead of free text.

​

Bug fixes

• Friendlier errors — every error response can carry an optional plain-English user_message field (RFC 7807 problem+json body). It is written for ~15 codes: UZ-PROVIDER-001..004, UZ-VAULT-001..003, UZ-BUNDLE-001..002, and UZ-APPROVAL-001..006. A code without one omits the field rather than nulling it, so untouched responses are byte-identical.

​

Readable account settings, a copyable workspace ID, consistent labels

​

What’s new

• Copy the workspace ID — the Workspace page lists the workspace name and ID as labelled rows with copy buttons. The ID is the value the agentsfleet CLI and the API expect.
• One label size — section headers, table columns, and sidebar groups share a single type size.
• Clearer first-run screens — Dashboard, Fleets, and Models empty states lead with Learn more plus one primary action.

​

Bug fixes

• Account settings dialog — headings, your email address, and the close button rendered dark-on-dark on the dark theme.

​

Connect Grafana, Zoho Desk, Jira, Linear, Fly, and Datadog

​

What’s new

• OAuth connectors — Zoho Desk, Jira, and Linear connect with a browser OAuth round-trip and store a refresh token. Jira resolves its Atlassian cloud instance during connect.
• API-key connectors — Datadog, Grafana, and Fly take an operator-supplied key, checked by a live validation probe before it is vaulted; a rejected key returns UZ-CONN-005 and nothing is stored.
• Connector catalog — GET /v1/connectors lists every provider with its archetype and whether it is configured and connected.

​

Bug fixes

• Bounded broker calls — token exchanges are deadline-armed and fail closed.

​

Reliability fixes for logs, credential help, and approval enforcement

• agentsfleet fleet logs — a malformed event timestamp no longer throws RangeError and aborts the command; that row renders — and the stream continues.
• agentsfleet workspace credentials — the redirect points at the real agentsfleet credential command group instead of a non-existent agentsfleet agent credential.
• Approval enforcement — an approved or denied grant is honored by the fleet’s lease path even when the Redis mirror of that decision fails to write; the durable database row is the fallback.

​

Error reference matches the server

• UZ-PROVIDER-003 hint — now states that provider and model are required and api_key is required only for a named provider (optional for an openai-compatible endpoint). The old wording had clients sending an unnecessary api_key.
• Error-code reference — removed the UZ-AUTH-009 and UZ-AUTH-010 rows, which have no producer in the server registry (both superseded by UZ-AUTH-022). The retired UZ-AUTH-021 stays as a struck-through historical entry.

​

Add a workspace template from the dashboard

​

What’s new

• Dashboard onboarding — Add template calls the workspace template onboarding API and refreshes the gallery.
• Empty states — Fleets and Events use simple “No … found” copy with direct links.
• Models navigation — the nav labels the page Models, and Bring your own key uses the same primary button style as Install fleet.
• Route motion — route changes no longer wobble.

​

Operator dashboard access follows the same scopes as the API

• Error code — a request missing an operator capability returns UZ-AUTH-022 (Insufficient scope), whose detail names the required scope; the former UZ-AUTH-021 is retired.
• Scope hierarchy — a held higher scope satisfies a lower one on the dashboard exactly as at the API (model:admin covers model:read, runner:write covers runner:read).
• Marketing-site analytics recovers from a transient load failure instead of staying dark for the rest of the visit.

​

Slack: mention @agentsfleet in a channel, get an answer in the thread

​

What’s new

• Connect Slack from Integrations — the callback stores the bot token in the workspace vault. The row shows “Slack connected: {team}” and offers Reconnect if the install is revoked.
• One fleet per channel — later mentions in any thread reuse it. Memory is channel-scoped.
• Answers land in-thread — never at channel top level, never in another channel.
• Recent thread context — each mention re-reads up to 20 recent messages in its thread. Best-effort: if Slack throttles the read, the mention still processes.

​

API reference

• POST /v1/workspaces/{workspace_id}/connectors/slack/connect (scope connector:write) — returns the Slack authorize URL carrying a signed single-use state; GET /v1/connectors/slack/callback finishes the round-trip and vaults the bot token.
• GET /v1/workspaces/{workspace_id}/connectors/slack (scope connector:read) — status as {status, team}, where status is connected, reconnect_required, or not_connected; never a secret.
• POST /v1/connectors/slack/events — the signed events ingress, authenticated by Slack’s request signature (a hash-based message authentication code over the raw body, 5-minute replay window), not a Bearer token.
• New error codes: UZ-SLK-010 (401, invalid signature), UZ-SLK-011 (401, stale timestamp), UZ-SLK-020 (200, event from a team with no install is acknowledged and ignored), UZ-SLK-022 (502, OAuth token exchange failed), UZ-SLK-030 (502, answer delivery failed — logged and retried; the run never fails). UZ-CONN-001/UZ-CONN-002 now cover Slack as well as GitHub.

​

Connector platform: one uniform API, bounded vendor calls

​

API reference

• POST /v1/workspaces/{workspace_id}/connectors/{provider}/connect and GET /v1/workspaces/{workspace_id}/connectors/{provider} — start a connect and read status for any registered provider (slack, github), Bearer-authed with connector:write / connector:read.
• GET /v1/connectors/{provider}/callback — the vendor redirect target; Bearer-less, authenticated by the signed single-use state minted at connect.
• UZ-CONN-003 (502) — an outbound vendor call hit its enforced deadline, could not be time-bounded, or the vendor was unreachable. Transient — retry.
• UZ-CONN-004 (404) — the {provider} matches no provider on this deployment; the body names it.

​

Earlier entries