arizuko › changelog

changelog

What shipped, dated, terse. Reverse chronological. The chat broadcast for each release lives at the top of every block; the bullets below expand it for operators.

arizuko v0.70.11 — 24 October 2026

On GitHub every mention starts a turn, each comment shows where it sits, and the agent acts instead of promising.

• Mentions — a mention in a batch starts a turn even when newer CI or review rows follow it.
• Location — each GitHub message names its thread, file, lines and diff; replies name their comment.
• Engagement — only a person's message or mention keeps a chat engaged; #engaged routes extend it.
• Progress — no progress comment on GitHub; chats delete the progress message when the turn ends.
• Skills — the agent drops the skills that forbade it to push, merge or open a PR.

Full notes: CHANGELOG § v0.70.11

arizuko v0.70.10 — 24 October 2026

On GitHub the agent now acts before it replies, answers in the right thread and hears comments on its own PRs.

• GitHub style — replies lead with a short TL;DR, put detail in a collapsed block and name their comment.
• Bot-authored PRs — a human comment on a PR or issue the bot opened counts as a mention.
• Duplicates — a redelivered late message no longer stores a second copy.
• Turn end — a successful turn no longer reports a failure when its deadline signal arrives.
• Grants — every grant write refuses an action name that no gate reads.

Full notes: CHANGELOG § v0.70.10

arizuko v0.70.9 — 23 October 2026

A turn now stays open while its background agents work, so their results no longer arrive after the session closed.

• Sessions — a claude session ends when its work is done and Claude Code is idle; one submit_turn posts the result.
• Background agents — a Stop no longer ends the turn while background tasks run.
• Deadline — one process deadline covers every run, and the agent gets a [deadline] note 60 seconds before it.
• Steering — steering lines reach a waiting session and no longer go to subagents.

Full notes: CHANGELOG § v0.70.9

arizuko v0.70.8 — 22 October 2026

An agent no longer sees its own message repeated as context, and deleting a folder now stops its running turn.

• Context — the observed window leaves out the message the turn is already answering.
• Delete — arizuko group rm and the dashd delete page stop the folder's running turn first.
• Memory — each turn log shows peak guest memory; guests give freed pages back to the host.
• Store — the PostgreSQL buffer pool is capped at 32 MB.

Full notes: CHANGELOG § v0.70.8

arizuko v0.70.7 — 22 October 2026

routd now gets the same turn limit as runed, so it stops redispatching turns that runed refuses.

• Run cap — compose delivers MAX_CONCURRENT_CONTAINERS to routd, so queued turns stop redispatching in a loop.
• Deleted folders — deleting a folder stops its running turn after the purge.
• Bare folder chats — a chat addressed by a folder path no longer starts onboarding.
• Four adapters retired — the Reddit, LinkedIn, Twitter/X and Bluesky adapters are removed.

Full notes: CHANGELOG § v0.70.7

arizuko v0.70.6 — 21 October 2026

Agents deliver answers explicitly, keep task updates together, and start GitHub work only for requests or watched pull requests.

• Explicit answers — addressed work gets one reminder before a visible failure notice.
• Task threads — an immutable summary opens the conversation, with live progress, answers and attachments inside its thread where supported.
• Queued follow-ups — fresh requests wait for the active turn.
• GitHub requests — PR mentions, direct requests, assigned-PR changes and completed CI trigger work; incidental activity remains context.
• Shorter approvals — a hold asks in one line, and /always pins only the tool’s declared keys.
• Separate bot accounts — each variant reads its account profile; nonempty labeled keys override base credentials.

Turn-result prose stays private. Hidden callbacks require the socket’s exact turn ID. Select claude or codex if pi is configured. Existing GitHub sources need legacy trigger-route cleanup and CI event subscriptions; the full notes include the operator steps and API changes.

Full notes: CHANGELOG § v0.70.6. Placement: live progress.

arizuko v0.70.5 — 18 October 2026

The agent shows its work as a single message it keeps rewriting, and it can hand you a file on a pull request.

• One progress message — a status is created once and edited in place, ending ✓ or ✗, instead of a trail of interim notices
• Marked as reading — the message that started a turn carries a 👀 until the turn ends, set in one place for every channel that can react
• Send a file on GitHub — send_file posts the file’s text as a comment, and refuses a binary or an oversize file before anything is sent
• Answers only where wanted — a GitHub comment reaches the agent when it names it or the assignees include it, not on every pull request
• googd holds the Google credential — the daemon is named for the key it carries, not for one of the APIs it reaches

Full notes: CHANGELOG § v0.70.5

arizuko v0.70.4 — 16 October 2026

An agent can now be mentioned on a pull request and answer there, and an inline review comment gets its reply under the code line it is about.

• GitHub ingress and reply — a comment, review comment or review request reaches the agent and its answer posts back as the bot
• Tag it for review — a review request, an assignment or an @-mention wakes the agent; a push or a label no longer does
• Email reaches Gmail — emaid speaks SASL XOAUTH2, so an access token works where Google stopped accepting passwords
• A failed turn says why — the agent’s own last line is the reason, instead of the boot noise that followed it
• The operator docs are one design system, guarded by a test that fails on a page-local style

Full notes: CHANGELOG § v0.70.4

arizuko v0.70.3 — 14 October 2026

Agents can end a conversation after answering, and operators can rename a folder subtree with a checked inventory and a recovery journal.

• disengagement — explicit stops survive final prose and tool replies
• thread mentions — bot participation in a human thread adds no automatic mention
• engagement control — ENGAGEMENT_TTL=0 disables automatic windows
• folder rename — stores, files and operational links move under one mapping

Full notes: CHANGELOG § v0.70.3

arizuko v0.70.2 — 7 October 2026

A failing turn now names its cause, the journal is readable again, and both build gates can report a real result for the first time in weeks.

• A failed turn says why — 27 terminal failures named no cause at all, while the log on disk said “you’ve hit your individual spend limit”.
• 4110 fewer error lines an hour — the guest’s file server was reporting its own uid clamp three times per file operation, burying every real error beside it.
• make lint reports 0 issues — the gate could not read its own config, so 80 findings had accumulated behind it, 6 of them the error-swallowing class it exists for.
• make test can pass — it ran with Go’s default 10-minute per-package timeout on a two-core host, so it reported failure on a healthy tree every time.
• The guest boot budget is measured — 1.54 s median against a 1.0 s target, read from the guests’ own uptime over 60 live turns.

Full notes: CHANGELOG § v0.70.2

arizuko v0.70.1 — 5 October 2026

v0.70.0’s image refused every turn: it wrote an IPv6 knob the runed container cannot write. The seal now reads first and writes only when the family is open.

• Turns start under the v0.70.0 substrate — 33 refusals in two minutes on sloth, none after the fix.
• The IPv6 seal still refuses a turn when the family is open and will not close.

Full notes: CHANGELOG § v0.70.1

arizuko v0.70.0 — 5 October 2026

Docker has left the turn path: every turn now boots its own virtual machine, and egress isolation stopped being a setting an operator can leave empty.

• One KVM guest per turn — runed boots the release’s own kernel, exports the turn’s files over virtio-fs and reaches the guest over vsock. The folder, the skills and the session history arrive at the same paths as before.
• Egress cannot be off — the guest’s one interface is a tap whose rules accept its own proxy and drop everything else, and runed refuses to start without the proxy binary. EGRESS_IMAGE and its three companions are gone.
• No resolver in the guest — a host name is only meaningful inside a request to the proxy, which closes the UDP/53 side channel by construction. IPv6 is taken off the tap before the link comes up.
• The turn’s credential is the guest’s vsock CID, a host-kernel fact a guest cannot forge, in place of the container’s uid.
• 2800 lines net gone in one commit — the Docker runtime, the per-folder network carve, the proxy-container lifecycle, RUNED_SUBSTRATE, CONTAINER_IMAGE and the docker socket.
• The web server idles at 0% and a third of the memory — it watches pages with inotify instead of polling 48k files, and reference clones left the public tree; a group’s web slot holds pages only.
• routd and dashd publish on loopback only, and the instances’ host ports move above 49000; only proxyd faces the network.

Full notes: CHANGELOG § v0.70.0

arizuko v0.69.0 — 19 September 2026

A stamped operator header is worth nothing on its own, and nine dashboards were taking it at face value; they check proxyd’s signature now.

• Nine dashboards verify the transit proof — eight channel adapters and ttsd read X-User-Groups and nothing else, so anyone who could reach the port could send ["**"] and get the operator page.
• A folder can hold gh:write — an agent whose folder was granted it can approve and merge pull requests with gh, and an operator ** does not confer it.
• A person admitted to a group gets a profile — every caller of the writer was a test, so new people stayed nameless on every operator surface.
• gitd has a documentation page, and the docs no longer describe daemons that were deleted in June.

Full notes: CHANGELOG § v0.69.0

arizuko v0.68.0 — 16 September 2026

SQLite leaves the code. Every daemon reaches its owner’s tables on the instance’s store server and nowhere else, so there is no file path left to point at the wrong place.

• One store, not two — the branch each daemon’s boot took between a file and the endpoint is gone, and so are the two SQL migration chains.
• An instance needs a store server — DYNAMODB_URL is required, and a daemon without one refuses to start instead of opening an empty file.
• The test suite proves the real protocol — every fixture runs against a DynamoDB endpoint, so a green suite is evidence about the store production has.

Full notes: CHANGELOG § v0.68.0

arizuko v0.67.0 — 13 September 2026

Your instance’s data now lives on a DynamoDB-protocol server instead of SQLite files on the box, so it can run on a managed store and every daemon reaches only what its own key allows.

• The store is a network service — one server per instance, tables per owner, a bounded key per daemon; the same driver points at Amazon DynamoDB.
• Message search runs in the router — no full-text engine under it, and the grammar is terms, “phrases” and -term.
• The gateway owns spend — one ledger, enforced on the request.
• Migration is hand-driven — the migrate subcommands are gone.

Full notes: CHANGELOG § v0.67.0

arizuko v0.66.0 — 29 August 2026

An agent can now hold a real token for a tool it runs in its own shell, every harness enforces the same policies, and a queue-wide re-verification closed fourteen defects — several of them cross-tenant.

• gh works — one named secret per shell:env:<KEY> grant, nothing implicit.
• codex and pi get the skill guard, the tool log and mid-turn steering.
• Folder containment is one exact predicate — a folder named % reads nothing.
• The egress proxy no longer follows a redirect on the caller’s behalf.
• A group born on any surface can speak, and five daemons drain on SIGTERM.

Full notes: CHANGELOG § v0.66.0

arizuko v0.65.0 — 21 August 2026

Your group’s container can now run Claude Code, codex or pi behind the same arizuko contract, and two long-silent context bugs are fixed.

• codex and pi join the agent contract — pick one per instance with ARIZUKO_BACKEND.
• codex resumes its own session, so turn two is no longer blind.
• codex shows interim ⌛ status — it showed none before.
• A re-fed turn keeps its ambient context instead of losing it.
• The guard that scans skills is now one function, not three that had drifted.

Full notes: CHANGELOG § v0.65.0

arizuko v0.64.0 — 15 August 2026

Every phase-5 spec is shipped and re-verified against the code. The fixes that matter are the ones where a daemon reported success it had not earned.

• The web chat no longer hangs — the SSE key is read from the chat, not derived from a token.
• inspect_routing no longer shows an agent other folders’ routes.
• whapd stops reporting a WhatsApp send it never made; a rate limit now reaches you instead of silence.
• Products carry their own live tests, run by arizuko’s own eval harness — and a product may no longer ship payloads nothing reads.
• Slack and Discord retain an inbound routd rejected, so a deploy no longer drops it.
• A dead-lettered message is readable and replayable instead of only countable.

Full notes: CHANGELOG § v0.64.0

arizuko v0.63.0 — 31 July 2026

Install capabilities as packages, wire OAuth connectors from config, and re-delegate grants with a WITH GRANT OPTION level.

• arizuko packages install|upgrade|remove — capabilities from a git source, hot-applied, no restart.
• Surrogate OAuth connectors — add a “Connect <service>” flow with a TOML drop-in + env creds.
• Grant delegation — pass onward only a subset of what you hold, WITH GRANT OPTION.
• route_tokens REST folded onto its resreg resource — one handler, both faces.

Full notes: CHANGELOG § v0.63.0

arizuko v0.62.0 — 28 July 2026

Channel adapters are plain docker compose files now, and a package manager installs a whole integration — fragment, routes, grants, skills — from a git source.

• Native compose packaging — each adapter ships as template/services/<name>.yml, a partial compose file docker includes verbatim. Per-adapter proxyd routes move to a sibling <name>-routes.json. The custom TOML mini-format and the PROFILE var are gone; optional daemons run via COMPOSE_PROFILES, which arizuko generate derives from the feature flags. Existing data dirs auto-convert their services/*.toml on the next generate. Spec 5/27.
• Package manager — arizuko packages install | upgrade | remove | list installs a git-or-local package that bundles compose fragments, proxyd routes (hot-applied to the live proxyd_routes table, no restart), grants, and skills. Each install writes an installed-package record (source + revision + owned assets + per-asset hash); upgrade refuses a locally edited asset instead of overwriting it; remove withdraws routes before dropping fragments. Installed packages show at /dash/packages/. See the packages reference.

Full notes: CHANGELOG § v0.62.0

arizuko v0.60.1 — 15 July 2026

Agents lead with a reaction when a clear one fits, and never leave you hanging when you expect a reply.

• Reaction-first — a clear 👍/✅/👀 beats a limp text “ok”; a reaction is the floor when a reply is expected (silence on an addressed message is a bug).
• Leaner agent runbook — the in-container guidance is 50% denser with no behavior lost, so agents attend to it better and cost less per turn.

Full notes: CHANGELOG § v0.60.1

arizuko v0.60.0 — 15 July 2026

Agents can post a checklist and update it in place, X replies actually thread, and Slack’s permanent send errors stop retry-storming.

• Live status checklists — post ONE message and edit it to tick tasks off (☑ done · ⏳ running · ☐ pending), instead of a stream of ⏳ pings. send/reply/send_file now return the posted message id; the progress skill drives it, for multi-step turns only.
• X replies thread — a reply now threads under the message instead of posting standalone (twitd /send honours reply_to).
• Fewer stuck deliveries — permanent Slack send errors (gone channel, dead thread) give up cleanly instead of retrying as transient.

Full notes: CHANGELOG § v0.60.0

arizuko v0.59.0 — 15 July 2026

Release notes stop broadcasting to every channel, and Slack thread replies no longer vanish.

• Opt-in release announcements — tag one channel per server with #announce on its route target; the version-bump note posts only there, deduped per server. Untagged channels stay quiet; drop the tail to mute. See routing § modes.
• Slack thread replies land — a reply into a thread Slack can’t find now posts at the channel root instead of failing silently; the Slack error is logged.

Full notes: CHANGELOG § v0.59.0

arizuko v0.58.0 — 14 July 2026

Chat links and webhooks can carry per-link handling instructions, “Connect GitHub” wires your own credentials, and agents stop dying or forgetting mid-chat.

• Chat-link & webhook context — a link or webhook can carry issuer-authored instructions for how its inbound is handled (<link-context>).
• Same link, your identity — post as yourself when logged in, anonymous when not.
• Connect GitHub in the dashboard — OAuth writes and refreshes your token; no pasted PATs.
• Chats stay answered — agents no longer error out or forget the thread after a quiet spell.
• New product: Argus — an AWS SRE agent; each engineer acts with their own AWS keys.

Full notes: CHANGELOG § v0.58.0

arizuko v0.57.0 — 1 July 2026

Model API keys move into their own dashboard section, agents see only the tools they’re granted, and arizuko can call REST APIs like DNS providers directly — with the token brokered so it never enters the container.

• Model keys — /dash/me/env: set your ANTHROPIC_API_KEY / OPENAI_API_KEY / CODEX_API_KEY in a dedicated section, kept user-scoped.
• Grant-gated tools — an agent’s tool list shows only what its folder is granted; ungranted connectors stay hidden.
• External REST tools — [[ext]] descriptors let arizuko call Cloudflare / Porkbun / Gandi / Namecheap DNS APIs directly; the token never enters the container.
• BYOA fix — your own capability key (e.g. GITHUB_TOKEN) now resolves for MCP connector calls, not just the folder default.

Full notes: CHANGELOG § v0.57.0

arizuko v0.56.0 — 26 June 2026

Users can bring their own API keys via the dashboard, Discord threads stay live after the bot’s first reply, and per-group settings are consolidated into one JSON config column.

• BYOA — /dash/me/secrets: store personal API keys (e.g. ANTHROPIC_API_KEY) encrypted at rest; they override the group’s keys for your spawns.
• Discord threads — the bot responds to follow-up messages in threads it started, without requiring @mention.
• Thread fix — thread_replies=false suppresses new thread creation only; in-thread replies still land in the thread.
• Groups config — behavioral settings migrated to a JSON config column; arizuko group thread-replies CLI.

Full notes: CHANGELOG § v0.56.0

arizuko v0.55.0 — 19 June 2026

Security, correctness, and reliability across the board: dashboard CSRF guards, XSS fixes, 14 codex-audit bugs resolved, status messages that thread with replies, and timed tasks that no longer lose their next-run.

• Dashboard — CSRF guard on state-mutating forms, pair-status XSS fix, routes PATCH authz, label validation, nav/design polish.
• routd — deliverTurn centralizes threading policy; status messages thread with the triggering reply.
• timed — reschedule with computeNextRun on enqueue failure; tasks no longer drop to NULL next_run.
• chanlib — typing indicator starts even when eager send fails; stale-inbound is 200, not 503.
• codebase — 3-round dead-code sweep, 100+ lines removed.

Full notes: CHANGELOG § v0.55.0

arizuko v0.54.0 — 17 June 2026

The operator dashboard gains four control planes and a redesigned conversation view that works like ChatGPT — session history, continue links, and search.

• routd control plane — errored chats with retry; runed control plane — active spawns with kill.
• Audit log browser — every operator action, filterable by category, actor, and folder.
• Usage analytics — 7-day instance totals, per-group breakdown, and daily volume chart.
• Chat session list — auto-titled sessions grouped Today/Yesterday/7 days/Older with continue links and search.
• Branding — ASSISTANT_NAME labels the nav and page titles; DASH_ACCENT_COLOR overrides the accent per instance.

Full notes: CHANGELOG § v0.54.0

arizuko v0.53.0 — 16 June 2026

The operator cockpit gains a live services grid and federated per-daemon control planes for onboarding and scheduled tasks. Includes the v0.53.1 / v0.53.2 sign-in fixes.

• Services hub — /dash/services/ probes all 8 core daemons concurrently; DNS failure = unknown, refused/timeout = err; linked tiles for built pages only.
• Onboarding queue — GET /v1/onboarding list + approve/deny/reprompt; /dash/onbod/ control plane.
• Scheduled tasks control — /dash/timed/ shows the task table, loop health, and lag/stuck flags via routd /v1/tasks.
• Portal alert banner — the landing page surfaces errored-chat and failed-task counts with a link to status.
• Sign-in fixed (v0.53.1/.2) — /auth/* proxies to authd instead of 302-ing to the internal URL; the refresh-token cookie is exchanged and identity headers stamped; branded login page.

Full notes: CHANGELOG § v0.53.0

arizuko v0.52.0 — 15 June 2026

Reply threading lands on every platform, Slack @mentions reliably reach the agent, and a whole class of silent failures got fixed.

• Replies thread, sends don’t — reply starts/joins the platform thread (Discord, Slack, Telegram); send is top-level; preference per group.
• Thread @mention promotion — replies inside a thread where the bot already posted auto-promote to mention, so the agent stays in the conversation.
• Slack @mentions delivered — app_mention events were silently dropped since launch; now wired; outbound converts CommonMark → mrkdwn.
• Turn retry on OOM/timeout — a run killed mid-flight reschedules with a 10s backoff instead of failing permanently.
• Observability — spans, 9 metric families, and HTTP middleware (OTLP-exportable); ARIZUKO_DEFAULT_MODEL sets the instance default model.

Full notes: CHANGELOG § v0.52.0

arizuko v0.51.0 — 9 June 2026

Every operator action is now reachable both ways (agent MCP and HTTP REST), each world gets its own web address, and a big internal cleanup makes each daemon own its surface.

• Uniform MCP+REST — manage ACLs (add_acl/remove_acl), invites (invite_create/list/revoke), and post/forward/quote/repost/voice from agents OR HTTP, one handler each.
• Web virtual hosts — each world is reachable at its own derived hostname (e.g. krons.fiu.wtf → that world), no per-host config; get_web_presence reports the public URL.
• Slack stays put on quiet channels — the watchdog no longer restarts on silence, only on real auth failure.
• Directory URLs serve index.html — /pub/<x>/foo/ now resolves.
• Leaner core — removed ~900 lines of dead monolith-era code; each daemon owns its own auth/routes/groups surface.

Full notes: CHANGELOG § v0.51.0

arizuko v0.50.0 — 7 June 2026

The gated monolith is gone: arizuko now runs as three focused daemons instead of one — and Telegram replies that were silently failing are fixed.

• The gated monolith is retired — auth, routing, and execution are now separate daemons (authd / routd / runed); the split is the only topology.
• Telegram replies work again — including second accounts that were silently dropping every outbound message.
• Tighter isolation — every action is bound to your folder, identically on the agent (MCP) and REST surfaces.
• Eight new creative skills — ASCII art, diagrams and more, auto-discovered on demand.
• Routing is self-documenting — the agent explains trigger / observe / mention-only correctly.

Full notes: CHANGELOG § v0.50.0

arizuko v0.49.0 — 1 June 2026

The agent now formats and threads replies correctly across Telegram, Slack and Discord, and the reference docs match the running code again.

• Telegram replies render right — bold and headings no longer show raw markdown.
• Per-channel styles refresh every turn — tone/format fixes actually take effect.
• Reliable thread replies — the agent resumes Slack/Discord threads instead of restarting.
• Reactions work while messaging is paused — read-only channels can still react.
• Reference docs rebuilt to match the code — schema, MCP tiers, env vars, changelog.
• Security — dashd memory endpoints now require an admin grant on the target folder.
• Under the hood — the daemon split flips to in-process MCP behind CUTOVER_SPLIT (dormant; default still runs gated).

Full notes: CHANGELOG § v0.49.0

arizuko v0.48.0 — 30 May 2026

A correctness pass across the router and every adapter — agent audit logging restored, inbound messages no longer drop on transient failures, and reply threading fixed on email + Mastodon.

• Audit logging restored — agent tool calls are recorded again (was silently off).
• No dropped inbound — Bluesky & X stop losing messages on a transient send failure.
• Honest health — Telegram/Slack/X report disconnected when the platform link drops.
• Reply threading — email & Mastodon replies thread correctly; adapter capabilities now match reality.
• Tests — 74+ new unit/integration tests across 13 packages.
• Under the hood — the authd/routd/runed split daemons land as additive groundwork behind a flag (dormant; default still runs gated).

Full notes: CHANGELOG § v0.48.0

arizuko v0.47.0 — 30 May 2026

The docs site got a full redesign and the “ask the agent” chat became a real, persistent popup; a batch of platform-reply bugs are gone.

• Docs redesign — reference & components use a navigable three-pane; concepts, how-to & products read as a guided tour; version + updated date on every page.
• Ask-the-agent chat — a bottom-docked popup (full-screen on mobile) with persistent, browsable threads.
• Bluesky — default replies, likes, and deletes now resolve (were silently failing); send returns the post URI.
• More platform fixes — Reddit delete works, email history carries the trust signal, X/Telegram cursor fixes, feed verbs record into the thread.
• Under the hood — authd token authority, routd/runed daemons, and a proactive interjector land as additive groundwork (not yet switched on).

Full notes: CHANGELOG § v0.47.0

arizuko v0.46.1 — 29 May 2026

The agent stays in the conversation, scheduled tasks fire on time, and a batch of routing, delivery, and auth bugs are gone.

• Slack threads — the agent auto-attends a thread it started, no re-@mention needed.
• Auth — pin/unpin/pane/inspect tools that were wrongly denied for everyone now work.
• Scheduled tasks — fire correctly even when their next-run carries a non-UTC offset.
• Onboarding — the per-gate daily admission cap now holds across days (counts by admitted_at, migration 0071).
• Web publishing — agents redirect a clean top-level URL into their own slot.
• Hardened — two data races, audit-webhook delivery, per-turn web-chat isolation, and a web/standard deploy break.

Full notes: CHANGELOG § v0.46.1

arizuko v0.46.0 — 28 May 2026

Agents can now search the whole message history, pin/edit/delete messages, and the entire cold-tier config is one reflective engine you export and apply as YAML with an auto-generated OpenAPI doc.

• find_messages — FTS5 full-text search over messages (phrases, OR/NOT, prefix, NEAR; bm25-ranked + snippet).
• Message actions — pin / unpin / edit / delete, native per platform.
• resreg engine + YAML manifests — one struct → SQL + REST + MCP + OpenAPI + YAML; arizuko export/apply round-trip the cold tier.
• GET /openapi.json on every daemon — engine-generated, no codegen.
• Tool deferral — connector tools load on demand, not every turn (SDK 0.3.153).
• Fixes — replies/voice/files thread correctly (reply is now the default response tool); FK CASCADE actually enforced.

Full notes: CHANGELOG § v0.46.0

arizuko v0.42.0 — 19 May 2026

Five new dashd pages, three security fixes, and secrets now encrypted at rest. The operator dashboard is usable for day-to-day ops without touching .env or the DB.

• Invites page — issue/revoke onboarding links from /dash/invites/.
• Per-group model selector — pick Opus 4.7, Sonnet 4.6, or Haiku 4.5 per group.
• Skill enable/disable — toggle agent skills per group without editing files.
• Grants viewer — add/revoke ACL rows per group from /dash/groups/{folder}/grants.
• Workspace links — settings page links to /dav/{folder}/ for file editing (CLAUDE.md, PERSONA.md, MEMORY.md).
• Secrets encrypted AES-256-GCM — SECRETS_KEY separate from AUTH_SECRET. Plaintext rows rejected on startup.
• Security fixes — list_acl MCP tool now works; inject_message and escalate_group tier gates now enforced; tier-2 web mount scoped to own group dir; egress wildcard restricted to tier ≤ 1.

Full notes: CHANGELOG § v0.42.0

arizuko v0.41.0 — 18 May 2026

Mint a public chat URL or a webhook URL with one MCP call; both flow into the same agent through the same store.

• Route tokens (issue_chat_link / issue_webhook MCP tools) — agents mint URL-bound credentials on demand.
• New /chat/<token>/ and /hook/<token> — legacy /slink/* 301s to the new paths.
• arizuko token issue|list|revoke CLI plus REST /v1/route_tokens for operators and dashd.
• route_tokens table replaces groups.slink_token; no backfill — reissue by hand.

Full notes: CHANGELOG § v0.41.0

arizuko v0.33.0 — 2 May 2026

Voice replies close the loop on the audio channel that Whisper opened months ago, and the router stops guessing JID kinds from sign bits — every adapter now emits typed addresses (telegram:group/…, discord:<guild>/<channel>) so routes, grants, and onboarding speak one language.

• Voice replies (send_voice) — agent-controlled TTS via a bundled ttsd proxying Kokoro-FastAPI; Telegram/WhatsApp render as push-to-talk, Discord as inline audio. Per-agent voice via PERSONA.md frontmatter. Cached by hash.
• Thread-scoped history (get_thread MCP) — pull just one topic out of a chat’s history; tier-gated like inspect_messages.
• External agents over slink (POST /slink/<token>/mcp) — register a token-bound URL as a remote MCP server in Claude Code or any MCP client; three group-scoped tools (send_message, steer, get_round). Token is the auth.
• OAuth account linking (/dash/profile) — one canonical sub across providers, with a collision-resolution UX when a new OAuth identity doesn’t fit silently.
• Typed JID routing — telegram:group/* scopes to groups but not DMs; sign-bit guessing retired across the router and grants tables.
• Idle-timeout default raised to 60 min — stops mid-turn container kills caused by stale per-instance overrides reading 60 ms.

Full notes: CHANGELOG § v0.33.0

arizuko v0.32.2 — 30 Apr 2026

URL polish on the slink round-handle protocol shipped in v0.32.0. The verb does the work now — POST extends a round, GET observes it — and special tokens (/turn/, ?steer=) disappear.

• Cleaner round URLs — the second URL segment after the token IS the round handle. GET /slink/<token>/<id>, …/status, …/sse; POST /slink/<token>/<id> means “steer this round.”
• CLI + docs follow — arizuko send and /pub/slink/reference/ updated to the new shape; old paths retired.

Full notes: CHANGELOG § v0.32.2

arizuko v0.32.1 — 30 Apr 2026

Quiet bugfix release. Closes a cross-world spam vector revealed by v0.32.0’s own release broadcast: tier-1 world agents could send to chats that route to other worlds, producing the same notice 2–4× per chat.

• Outbound MCP authorization — every send-shaped tool (send, send_file, reply, post, like, dislike, delete, edit, forward, quote, repost) resolves the JID’s owning folder and checks subtree containment. No tier bypass; even the instance root cannot direct-send across worlds.
• Inter-world communication goes through delegate_group/escalate_group instead. Unrouted JIDs are denied for every caller.

Full notes: CHANGELOG § v0.32.1

arizuko v0.32.0 — 30 Apr 2026

Slink becomes the universal “drop a message, observe the round” surface. Every agent run is now a first-class object with a stable handle, pageable frames, an SSE stream that closes cleanly, and steering for chained follow-ups — useful for cron jobs, web pages, and scripts that need to talk to the agent without a full chat client.

• Slink round-handle protocol — POST /slink/<token> returns {user, turn_id, status:pending}; the round is observable via snapshot, cursor paging, cheap status, or live SSE with a terminal round_done event.
• Steering — inject a follow-up onto an in-flight round; per-folder queue serialization makes it the immediate next round, with chained_from linking the two.
• arizuko send CLI — inject messages from the server into any group via slink; --wait, --stream, --steer flags.
• Public web docs at /pub/concepts/slink.html and /pub/slink/reference/.
• Group state machinery removed — no more closure-then-archive cycle, no spawn_ttl_days, no daily cleanup loop. Groups exist until explicitly removed.
• Crackbox DNS & davd healthcheck fixes rolled in from v0.31.1 — per-folder networks now resolve crackbox; davd reports health.

Full notes: CHANGELOG § v0.32.0

older

Everything before v0.32.0 lives in the canonical CHANGELOG.md on GitHub.