Skip to main content

What's new

Behavior changes worth knowing about, grouped by the release that introduced them, newest first. This page summarizes; the deployment's full changelog carries every entry.

Current version: 0.7.6.

0.7.6 (current release)​

Kaizen 0.7.6 requires Kamiwaza 1.3.3 or later. It adds the fixes that reached the 1.3.0 release line after the 0.7.4 images were built, and uses a new version so none of them replaces the images behind an installed 0.7.4. Tasks still ship turned off. Version 0.7.5 was reserved but never shipped; everything planned for it is in 0.7.6.

Service credentials are generated for each deployment​

Kaizen's internal service tokens and object-store keys used to ship with the same default values in every installation. Kamiwaza now generates them for each deployment and keeps them as deployment secrets, so you type nothing when you launch Kaizen. An existing 0.7.4 deployment does not move to 0.7.6 in place: an administrator installs 0.7.6 as a new deployment, which gets its own values. The 0.7.4 deployment's data does not carry over to it. See Configuration.

info

A direct Compose installation has no defaults for these five keys. Add PI_SIDECAR_TOKEN, PKG_RUNNER_TOKEN, SANDBOX_WORKER_TOKEN, SEAWEEDFS_S3_ACCESS_KEY and SEAWEEDFS_S3_SECRET_KEY to .env with the loop in .env.example before you run docker compose up, down, ps or logs. Compose refuses to read the file without them.

The sandbox worker token stays out of Pod specs​

The sandbox controller used to write the worker token's value into each sandbox worker Pod spec, where anyone who could read Pods in the sandbox namespace could see it. Worker Pods now read the token from a Kubernetes Secret instead. See Configuration.

A run's credential is never recorded as its turn​

Kaizen recorded each Pi run's capability token in places that should hold only an identifier. The token authorizes the run's model and tool callbacks for as long as the run is live. Every model call a run made was audited under it. Prompt-chain steps, prompt-cache warms, injection refusals, runs whose sidecar failed before answering, and some tool audit records also used it as the turn identifier, so it reached audit records, journal events, artifact checkpoints and persisted turns. A sidecar-reconnect log line also printed it. Every run is now recorded under its turn, or under an identifier derived from the token when it has no turn of its own. The sidecar also rejects a run that names no turn. See the threat model.

Choosing a shared chat's agent no longer fails at random​

Choosing which agent answers in a shared chat could occasionally fail with a server error when the choice landed at the same moment as other activity in that chat, such as your own next message. The agent stayed unchanged until you tried again. The choice now waits its turn behind that activity and then takes effect.

Documents shared with a Project reach search and chat​

A private document that a collaborator shared with your Project appeared in the Library, but search, document questions, citations and chat attachments ignored its contents. Project members can now search it, attach it, ask about it and cite it. When the owner stops sharing it, access ends on the next read. See Projects.

Kaizen says what it cannot do​

When you asked for something no available tool could carry out, the turn could end with a generic "run could not be completed" error and a suggestion to retry. Kaizen now answers that it cannot do the request and names the missing capability. See Chat.

Filing into a collection you don't have also used to go wrong in a second way. Kaizen reached for a workroom search index instead of a Library collection, the write failed, and the reply quoted an internal service address. Kaizen is now guided to say it can't create a collection and to ask you to create one on the Collections screen or name an existing one, and a failed write no longer shows an internal address. When the collection exists, it files the documents. See Collections.

A finished answer notifies you in a background tab​

If you switched to another tab while a long answer was running, Kaizen still treated you as watching the chat, so the answer could finish without any notification. Once a chat tab has been hidden for ten seconds, Kaizen now stops counting you as watching. A finished answer then notifies you, and the tab title shows your unread count. Switching back picks the chat up where it is. A quick glance at another tab does not change anything. See Notifications.

A certificate problem says so​

When Kaizen could not verify the platform's TLS certificate, every chat turn said "The assistant is temporarily unavailable" and the cause was only in the pod logs. The turn now says why Kaizen can't verify the certificate and what an administrator needs to do: add the platform's CA certificate to the kamiwaza-edge-trust ConfigMap and redeploy when the CA isn't trusted, or renew or reissue the certificate when it has expired or doesn't cover the platform's host name. See Troubleshooting.

0.7.4​

Kaizen 0.7.4 requires Kamiwaza 1.3.0 or later. It adds the fixes that reached the 1.3.0 release line after the 0.7.3 images were built, and uses a new version so none of them replaces the images behind an installed 0.7.3. Tasks still ship turned off.

Chat answers behind the platform's sealed gateway​

When the platform admits a session through its sealed gateway, Kaizen could list models but failed before answering. Kaizen now exchanges the platform's verified admission for a short-lived credential bound to the chosen model and operation, so chat, compaction and planning complete. This needs Kamiwaza 1.3.1, and an administrator must admit Kaizen for model inference on the platform first. Ordinary sign-in and desktop flows are unchanged.

Use in Chat can analyze the whole file on the first question​

Choosing Use in Chat on a document, then asking for an analysis of every row, used to fail on the first turn: the code step reported that no file was attached, and the answer fell back to the few passages search had found. Reattaching the same file in the composer was the only workaround. The original file you pick from Documents now reaches code execution straight away in a chat that only you are in, on every code step — including the first look around before the assistant reads the file list — so it no longer takes several attempts to find the file. A shared chat still never receives your private library files. See Documents.

Retrying a file no longer flashes the file pane​

When the assistant's first attempt at building a file failed and it tried again, the file pane opened and closed once per attempt. It now closes once on the first failure, stays closed while the assistant retries, and opens again on the finished file. See Artifacts.

Enter no longer drops a message on a fresh chat​

Pressing Enter in a new chat before Chat had finished checking for an available model, most often right after Use in Chat, discarded the press: nothing was sent and the message stayed in the composer. Chat now holds that message and sends it once a model is confirmed, the same moment Send becomes available.

0.7.3​

Kaizen 0.7.3 requires Kamiwaza 1.3.0 or later. It is the first published build of the fixes that reached the 1.3.0 release line after the 0.7.2 images were built, and it uses a new version so none of them replaces the images behind an installed 0.7.2. Tasks still ship turned off.

Search and document indexing reach the embedding model again​

On some Kamiwaza 1.3.0 installations, hybrid search and document indexing fell back to keyword matching without warning because Kaizen addressed the embedding model through the platform's public address. Kaizen now reaches it through Kamiwaza's in-cluster address, honours the platform's TLS setting, and repairs embedding addresses saved by an earlier version. External model providers stay on verified TLS.

Reasoning effort reaches Qwen3.8 deployments​

Qwen3.8 deployments served through Kamiwaza were treated as non-reasoning models, so the effort you chose never reached them. Kaizen now sends each effort level as a value those servers accept.

Model discovery works on sealed platform sessions​

When the platform admits a session through its sealed gateway, Kaizen now uses the model-discovery access the platform grants that session to list chat and embedding models. A missing or invalid grant fails visibly rather than silently, and the grant is never passed on to inference.

A refused step no longer cuts the answer short​

When an agent made a tool call that Kaizen refused — for example one with malformed arguments — the turn used to stop on the spot, leaving only what the agent had written before the call, such as "Resuming now:". The agent now reads the refusal and carries on: it corrects the call or explains what it could not do. The refused call still never runs, and a second refusal of the same call ends the turn as before. The Agent Builder is also clearer about finishing an agent whose package has just been approved: it resumes the draft itself rather than handing the work back to the Package Creator.

A file that could not be made says so plainly​

When the code building a requested PowerPoint, PDF, or other file stops with an error, the answer now names the file, says it was not produced, and gives the cause in one readable line instead of raw tool output. The assistant also gets clearer guidance for the common document libraries and is told to fix and rerun a failed run unless you asked it not to retry, and an explicit request to create a report or other artifact now produces one even when the content is short. See Artifacts.

A brief network hiccup no longer ends a turn​

A short interruption between Kaizen's own services could end a chat turn partway through — for example right after a delegated research step had finished — with "The assistant is temporarily unavailable". Kaizen now retries those internal checks briefly before giving up, and if the connection really is gone the turn says so: it lost contact with the Kaizen service, and trying again usually works.

Built-in agents and everyday data work run air-gapped​

Kaizen's bundled agents and everyday sandbox data work no longer need a route to the internet (pi-lens's language-server tools are the one remaining exception). The Software Engineer and Web Researcher agents' package dependencies are pre-installed in the images instead of being downloaded from npm on first use, so tools such as hypa_ls no longer time out on an offline installation. The code sandbox bakes in a pinned data and document stack — pandas, NumPy, SciPy, Matplotlib, the Excel, Word, PowerPoint and PDF libraries, Pillow, ReportLab and more — so those imports never reach a package registry. Requesting a package outside that set still needs a registry or an internal mirror; offline, that request now fails within seconds with an explicit message instead of a two-minute stall. See Air-gapped installations for the recommended settings.

0.7.2​

Kaizen 0.7.2 requires Kamiwaza 1.3.0 or later. It is the first published build of everything that reached the 1.3.0 release line after the 0.7.1 images were pinned: Tasks now ship turned off, and this release also brings federated cluster tools, the mobile experience, scoped public web access, and the fixes merged alongside them. It uses a new version so none of that replaces the images behind an installed 0.7.1.

Tasks are held for a later release​

Tasks ship turned off. Their unattended and scheduled workflows have not finished qualification for this release, so a new installation shows no Tasks rail or tab entry, no task creation in the Library or chat, and no task tools for agents; a saved Tasks link opens Home. Nothing is deleted: existing task definitions, run history, approvals, notifications, and audit records are kept.

Tasks will return in a later release once that qualification is complete; no date is set. An administrator can still turn them on with TASKS_ENABLED, but that is outside what this release was tested to do. Turning Tasks off does not cancel work already in flight, so an installation that runs Tasks should drain or cancel current runs first, and should check its setting after upgrading: a deployment that already carries TASKS_ENABLED=true keeps it. See Feature flags and Task scheduler operations.

Work with federated Kamiwaza clusters from Chat​

When an administrator turns on FEDERATION_TOOLS_ENABLED and lists the Kamiwaza federations members may use, Chat can link a member's identity in each federation's shared sign-in realm and then read from or run jobs on that cluster as the linked identity. Members approve the link in their own browser; reads never prompt, and writes follow the member's approval settings. Every link and every federated call is audited. See Tools and Identity.

A failed file pane checks before it closes​

When a turn fails while producing a file, the pane now confirms the selected run and the call that produced the file against a fresh read of the conversation before it closes. A read that fails, or a retained file whose origin is ambiguous, leaves the pane in place rather than erasing it.

0.7.1​

Kaizen 0.7.1 requires Kamiwaza 1.3.0 or later. It uses a new version so installations of 0.7.0 can upgrade to notice-bearing images without replacing images behind an existing version.

A trimmed table now says what it left out​

Large results are trimmed for display, and that used to happen silently: a table showing the first 500 rows of a much larger result looked exactly like a complete one. An answer drawn from the visible rows could be confidently wrong, and nothing on screen hinted at it.

Trimmed results now say so. A table reports how many rows it is showing out of how many exist and names any column left out, a spreadsheet preview says when a sheet was cut at its row limit, and the assistant is told the same thing before it summarizes a table — so it will tell you the result was incomplete instead of drawing a conclusion from the part it was given. Download the produced file to get everything.

Notices in every release image​

Each of Kaizen's nine release images carries the Kamiwaza EULA pointer and third-party notices under /licenses/, copied from one pinned bundle. The platform still owns EULA acceptance and license enforcement. See Licensing & notices.

0.7.0​

Kaizen 0.7.0 is the same product as 0.6.0 and requires Kamiwaza 1.3.0 or later. On an older Kamiwaza, keep Kaizen 0.6.x, which remains available for those platforms.

Configured workroom markings​

Kaizen now reads the optional level configured for a workroom without assuming a particular marking vocabulary. Unmarked workrooms remain unmarked. The platform workroom inventory adds level_id; the older classification field is still returned but deprecated, and is removed with Kamiwaza 1.4.

Draft tests run without a deployment service identity​

A draft's safe test no longer needs the deployment to hold a platform service identity. The test uses the member's own session through a sealed, single-use grant bound to that one test run, so a member can test a draft on a deployment that authorizes scheduled work only through the platform. Run now and scheduled runs are unchanged. See Task automation security.

Production Tasks can use host-served models​

Production Tasks now call Kamiwaza's guarded inference API, so an already deployed host model can run a Task with the same authorization and usage accounting as a serving replica. This needs a compatible Core build. Draft tests continue to use the member's session; a successful draft test alone does not establish production access.

Chat task requests tolerate unused fields​

Asking chat to create or manage a task no longer fails when the model writes out the empty defaults of fields the request does not use. A turn context missing one of its identifiers now reports which one, instead of reporting background jobs as unavailable.

A failed file no longer leaves "Creating…" on screen​

When the assistant tries to build a file such as a PowerPoint and the attempt fails, the Artifact pane now closes. It used to stay on "Creating PowerPoint…" after the turn ended. The pane also closes when the turn ends without the file and the live update about it was lost. Shared rooms no longer receive the model provider's own tool-call identifier inside the "Creating…" placeholder.

When Kaizen cannot approve a task's platform consent, the error now says whether the member's session was missing, the platform's consent link was unusable, or the platform refused the request, with its HTTP status. A chat that retries a background launch in the same turn now sees that cause rather than a reused-input error. See Troubleshooting.

Search imports before indexing​

Search finds extracted ZIP, XML, and other uploads as soon as their lexical import completes, even when hybrid retrieval is unavailable or disabled. Existing semantically indexed matches remain visible. Dense indexing remains optional.

Code runs no longer stop on files their own turn created​

A turn that queried data, created an artifact, or ran code once, and then ran code again in the same turn, could be refused with "code execution is unavailable", although the sandbox was healthy. A run's own new files no longer stop it; they join the chat's shared files for code from the next message. Any other change still stops the run, now with a message to try again instead of a report that the sandbox is down. So does an artifact or document the turn itself revised, because code would otherwise read its previous version. Code that runs again no longer saves a second copy of a file whose contents did not change, so each output is listed once in the chat. The run audit also records which resource check refused an unavailable run. See Isolation boundaries and Troubleshooting.

0.6.0​

Chat with a whole document folder​

Select a folder checkbox in Documents, then Chat with selected. Chat opens with every selected file in its retrieval scope, without loading the files into the prompt or stopping at 20 files. Ask about a topic to retrieve relevant passages; searching does not inspect every file for exhaustive work. See Documents.

Folders in Documents and Workspace start closed. Select a folder to show its files. Workspace sections can also be collapsed. Attached files stay under Imports when a new artifact uses the same filename.

Daily model-token cap is opt-in​

Members no longer hit a default daily model-token quota during long-running Tasks or Chat. Operators can set a positive per-member cap when model cost needs a ceiling; 0 leaves daily usage unlimited. Per-turn and per-run safety limits still apply. See Configuration.

Kaizen reads the platform's vision feature​

A chat deployment that Kamiwaza lists with the vision feature is treated as able to see attached images, whatever its name, once the platform populates that field. Previously Kaizen ignored the feature and treated such a model as text-only unless its name matched a known multimodal family, so images were silently withheld from it. An explicit false still marks a deployment text-only, and explicit declarations that disagree now resolve to text-only instead of to whichever field was read first. See Models & embeddings.

Sandboxes have more room for hard jobs​

A code or browser sandbox may now use up to 2 CPUs and 4 GiB of memory, up from 1 CPU and 2 GiB, so an agent working a moderately hard job has room to use more when the cluster has it, instead of hitting a low ceiling. Each sandbox still reserves only 50m CPU and 256 MiB, so an idle pool costs what it did. A namespace quota on limits sized for the old ceilings admits half as many sandboxes; set SANDBOX_RESOURCE_CPU_LIMIT=1 and SANDBOX_RESOURCE_MEMORY_LIMIT=2Gi to keep the old ceilings. Lowering a ceiling below the reservation now means lowering the matching SANDBOX_RESOURCE_*_REQUEST too: otherwise the sandbox controller stops at startup with an error such as requests.cpu (50m) exceeds limits.cpu (25m), where it used to create sandboxes that could never start. See Configuration and Requirements & capacity planning.

Kaizen v4 installs beside v3​

Kamiwaza 1.3.0 does not turn an existing Kaizen v3 deployment into v4. On an upgraded platform, an administrator deliberately selects Kaizen 0.6.0 in Extension version selections, reads the different-product warning, and acknowledges that nothing is migrated before confirming the switch. Existing v3 deployments remain unchanged; install v4 as a separate deployment with a distinct name when v3 still uses kaizen. Never use Upgrade All to cross between these products. See Install & upgrade.

You can import ZIP, TAR, compressed TAR, and XML files. Search and Chat can find text inside an archive and cite the entry path; XML attributes remain searchable. Archive contents are never executed or unpacked into your workspace. Extraction limits prevent an oversized archive from silently appearing ready. See Documents.

A folder shows every file's upload outcome​

Upload a folder in Documents to see progress for all its files, including nested files. The folder row counts completed, in-progress, failed, and canceled uploads. Index folder indexes eligible files beneath it even when search hides a file. Another member cannot index your private files. See Documents.

Indexing covers the whole file​

Selecting Index now makes every part of a document semantically searchable, whatever its format. Very large XML, JSON Lines, JSON, CSV, and text files used to be indexed by the opening of each large piece only; a match deep inside such a file is now found too. See Documents.

Corpus graphs show everything the run produced​

A corpus Task's graph no longer stops after a 1,000-node sample. It loads the run's graph page by page, drawing only what is in view so graphs with tens of thousands of elements stay responsive. The graph is unavailable if the run cannot be reached. Anything derived from a source you can no longer access is left out and counted, never shown. See Tasks.

Background Tasks keep the Chat's agent pipeline​

When you send work to a background Task from a Chat with a selected agent pipeline, the Task uses that pipeline too. Tasks you start outside Chat keep their usual routing. See Tasks.

The Verified badge is gone​

A search result, a chat citation, and the document preview could carry a Verified badge, and an administrator could stamp or clear one from the preview. Both the badge and that control are gone. The badge recorded a one-time human judgment that nothing kept current, so a source attested a year ago looked exactly as trustworthy as one checked this morning — and a trust signal that quietly goes stale is worse than no signal at all.

Nothing else about a source changed: the preview, its citations, the collections it belongs to, and who is allowed to read it are all as they were. Attestations made before this release are not kept, so nothing returns if the badge comes back in another form later. See Documents.

Asking to make a chart no longer hides your data​

A message that began "Make me a chart ..." or "Create a report ..." could produce an empty artifact, and the agent sometimes said its data tools were unavailable. Kaizen had made the artifact writer the only tool the agent could see until a draft was open, so the agent opened the draft before it could read anything. A request to show a result in the chat canvas had the same problem: the canvas was the only tool in view until it had been used. Both are now preferred rather than required, so the agent keeps its data tools and can gather what it needs first. A chat request such as "Make me a PDF report of ..." prefers the agent's code execution when the agent has both code execution and the artifact writer, instead of being steered into an HTML page. See Artifacts and Tools.

Agents no longer answer an empty message you never sent​

After using a tool, an agent could end a successful reply by saying your message "came through empty" and mentioning a temporal context block. You had sent nothing else. The clock information Kaizen adds to each model call was arriving as a message of its own after the tool results, and the model took it for an empty follow-up from you. That information is now attached to your own message, so replies speak to what you actually asked. See Anatomy of a chat turn.

Removing a collaborator no longer fails at random​

Removing a collaborator from a shared chat could occasionally fail with a server error. This happened when the removal landed at the same moment as other activity in that chat, such as your own next message. The collaborator stayed in the chat until you tried again. The removal now waits its turn behind that activity and then completes. See Collaboration.

Workroom retrieval reports what it found​

When the assistant searched your workroom's connected documents, its activity line always said the search returned 0 results, even when it found and used relevant passages. It now reports the real number, says when some of your collections could not be searched, and shows the search as failed when none of them could. The retrieved passages the assistant reads are still held to the same length limit as before.

Put your own picture in your circle​

The circle beside your name in a shared chat can now carry a picture you upload. Choose Upload a picture under Settings → Your circle, or drop one onto the control, then frame it inside the round crop window — drag to move, zoom to close in, and watch the two previews, which are the real sizes a chat row and the settings page draw. Remove picture puts your letter back whenever you want.

Your letter now carries the color you chose, which it did not before: until this release the color only appeared if you had also chosen a symbol, so anyone who picked a color on its own was looking at a plain gray circle.

The eight symbols are no longer offered. A picture or a letter is the choice every comparable product makes, and the symbol grid was the part of that screen people liked least. If you already chose a symbol, it still shows everywhere and stays until you change it, and the screen gives you a one-click way to move to your letter. See Your preferences.

Prompt trim removes filler before the model reads your message​

A new member-owned switch under Settings → Chat compression takes the filler out of your prompt on its way to the model: request preambles, apologetic asides, filler adverbs, and closing courtesies. It joins Tool-result compression and Plain-speak responses, defaults to off, and applies from your next turn.

Your message is never rewritten where it counts. The chat, your history, and every replay keep your own words; only the copy handed to the model is shorter. Code, inline code, quoted text, and links stay byte-for-byte, a sentence with a negation in it is left alone, and a message that would lose too much is sent as you wrote it. There is no extra model call and no extra wait. Trim works from a fixed list of phrasings, so unusual hedging passes through untouched.

See Chat compression and Context management & compaction.

0.5.0​

A Project shares prompts and artifacts, not just documents​

Filing a prompt or an artifact into a Project used to store it private whatever your Share new documents with this Project preference said, so the other members saw nothing and there was no control that could change it. Every Library kind now follows the same preference, can be switched between Shared with Project and Make private afterwards, and appears for the Project's other members as read-only work labeled Shared with Project rather than as their own.

The grant is read-only in the strict sense: open, read, and run a shared Prompt; open and read a shared artifact; never edit, rename, publish, delete, or re-share. Links you made before this release keep exactly the access they were stored with — nothing was widened for you. See Projects.

A conversation that outgrows its model says so​

A turn whose conversation no longer fits the selected model's context window used to end with "the assistant is temporarily unavailable", which was both wrong and unactionable — nothing was unavailable, and trying again failed the same way. Kaizen now measures the turn before sending it, says the conversation has become too long for the selected model, and names what helps: start a new conversation, remove some attached content, or choose a model with a larger context window. A rejection of that kind is no longer retried, so the answer arrives sooner as well.

A dropped connection announces itself in a private chat​

A shared room already said Reconnecting while its live connection was being re-established. A private conversation said nothing, so a dropped stream looked exactly like an application that had frozen. Every conversation now shows the same notice, and the stream resumes from where it left off without anything being lost.

Prompt caching is now opt-in​

Prompt caching is off unless an installation turns it on. It saves money on a repeated prefix, but when a provider serves a stale or mismatched one the result is a wrong answer rather than a slow one, and that is not a trade an installation should make without deciding to. Operators who want the saving set PROMPT_CACHE_ENABLED; it is also the master switch, so composer-time warming stays inert until it is on. See Configuration.

Hand a chat to your own agent​

The general assistant used to delegate only to the two specialists in its reviewed definition, so an agent you built yourself was unreachable without switching the whole chat over to it. Those two are now the defaults rather than the limit: Add to chat → Sub-agents lists every chat agent you can use, and the one you add gets handed the sub-task and reports back inside the same conversation.

An agent can also be added to its own list, which lets it fan a job out over slices — one child run each — instead of working through them in a single reply.

Nothing is delegable until you add it, adding it applies to that chat, and it grants nothing new: you can only add agents you could already open and run, and Kaizen re-checks your access to one at the moment work is handed to it. See Sub-agents & delegation.

Pick a symbol for your circle​

The circle beside your name in a shared chat used to show one letter. Now you can choose a symbol and a color for it, so your own contributions are easy to spot in a busy room. Pick yours under Settings → Preferences → Your circle; choose Letter to go back to your initial.

Everyone sees each member's own choice, and nobody can change anyone else's. Members who choose nothing keep exactly the circle they have today. See Your preferences.

Agents address you by name​

Chat answers and visible thinking now use the name on your platform profile instead of calling you "the user". The name is supplied by the platform for every turn, applies to every agent rather than a single persona, and stays private to your own turn in a shared chat. See Chat and Anatomy of a chat turn.

Search cards stay inside their column​

A result with a very long source path now shortens it inside the card instead of stretching the card past the results column or forcing the page sideways.

New chat always starts empty​

Asking for a new chat now opens a genuinely new surface. Opening a saved Prompt hands its canvas and Prompt Builder to that chat, and until now that state could come back the next time you chose New session, sometimes even returning you to the previous conversation. A new chat now starts with an empty composer, no attachments, no open canvas and your usual agent, including when you ask for it from the chat screen itself. Returning to Chat from the rail still restores the message you were writing, and a reply still streaming in the chat you left keeps running there. See Chat.

Drag an artifact or document into a Project​

Pin the Projects you work in and they appear under Projects in the left rail. You can now drag an artifact, document, or collection from its Library onto one of those pinned Projects to add it there, and the rail tells you what was added and where. Dropping on Projects itself opens the usual picker, so the gesture works before you have pinned anything.

The existing Add to Project action is unchanged, and so are the access rules: only an active Project you own or can edit accepts the drop, a read-only or archived Project refuses it, and dragging a file from your computer still uploads it. See Projects.

A dialog above a full-screen artifact keeps the keyboard​

Expanding an Artifact pane to full screen no longer takes Escape away from whatever opens above it. Answer the dialog with Escape and the artifact stays expanded behind it; the next Escape leaves full screen.

A published artifact opened from a share link no longer shows a full-screen control. That page is the artifact already, so the control could only shrink it into a narrow column beside nothing — and Escape now leaves the artifact filling the page instead.

A2A saves no longer overwrite another administrator​

The A2A screen now reads the stored version of the public address, the published agent mappings, and the capability secret, and saves each change against it. Those three settings previously reported no version, so a save from a screen that had gone stale silently replaced whatever another administrator had saved in the meantime. Such a save is now refused as a conflict; reload the screen and repeat the change. See Feature flags and Ops API.

Admin can see the sandbox network scope that is really in force​

The setup checklist now carries a Sandbox network access entry. It names the outbound scope member-authored code actually reaches, the ports the proxy enforces, and the destinations — cloud metadata, loopback, link-local, multicast, unspecified, and reserved addresses — that stay denied in every mode. Where the saved mode cannot be enforced, the entry reports isolation and which prerequisite is missing, instead of showing a saved value that nothing applies.

Two rules behind it are now explicit. A configured mode this release does not define resolves to isolation rather than to the public-Internet default, and a provider name supplied in a tool call can no longer ask for network access on a deployment that is switched off, isolated, or unable to enforce its policy. See Isolation and Feature flags.

Code can open the files you attached, on any turn​

An assistant that can run code now reaches the original bytes of every document attached to your chat, not only the ones attached with the message you just sent. Ask a follow-up question that needs the file itself — sum a spreadsheet column, reshape a CSV, read a PDF's structure — and the code opens your upload rather than guessing from the text pulled out of it.

Code can work on at most 20 attached files totalling 8 MB at once. When you go past that, or a file is still processing or has been deleted, the assistant now names the file and the limit that stopped it instead of reporting that code execution is unavailable, and it never quietly answers from the extracted text instead. See Documents and Limits.

The assistant can file things in your collections​

The assistant can work with your library​

Ask the assistant to put something somewhere and it does it, instead of telling you to go and do it yourself. It can list your documents, artifacts, collections, prompts and projects to find what you meant — "put that in Testing", "add the runbook to the Q3 launch project" — then file the item and tell you where it went. Filing the same item twice refreshes the entry rather than duplicating it.

It files only into collections you own and projects you can write to, and only items you can already open; anything else it declines without changing anything. It cannot create, rename, delete or share a collection or a project, and it cannot copy anything out of a connected system such as Microsoft 365 or GitHub. A collection holds documents, so an artifact goes in once it is one of your documents — or add the artifact to a project instead. See Collections and Projects.

Exported documents keep your own images​

A picture you uploaded now appears in the Word and PDF downloads of a document you export, instead of vanishing and leaving you to paste it in by hand. Reference the file by name in the canvas — ![Kamiwaza logo](logo.png) — and the export embeds it at a size that fits the page. You are never asked to paste an image as encoded text.

Only your own pictures are embedded. A reference to someone else's file, or to an image on the web, prints its description text instead: an export reads nothing your account cannot already open, and Kaizen makes no request to the internet while building the file. See Documents and Limits.

Kaizen reads the words in pictures inside your documents​

A photograph, chart, or screenshot placed inside a report or slide deck is no longer invisible. Kaizen now reads the words in that picture and files them with the document, labeled with the figure and the page it sits on, so you can search for wording you only ever saw in a picture and an answer can tell you which file and page to open. A picture with no readable words is still recorded as a figure, so Kaizen says a file contains one instead of telling you it found nothing.

Kaizen still does not look at a picture inside a document — to ask what one shows, attach the picture as its own image file and use a chat model that supports images. See Working with documents and Ingestion & indexing.

A task run shows what it produced​

A finished run has an Output tab in Tasks. It shows the answer the run wrote, any artifacts it created with their exact version, and a link that opens the run's own conversation, so you no longer have to hunt for the chat a scheduled task wrote into. A run that produced nothing says so, a failed run shows its safe diagnosis, and a run whose conversation is no longer retained says that rather than looking empty. Output stays private to the task owner. See Tasks.

Two installs that used to fail now start​

A deployment whose installer generates the database password no longer crash-loops: the bundled connection string is built from POSTGRES_PASSWORD instead of restating it, so Postgres and every service that connects to it move together. And a deployment handed a theme directory that was never mounted now starts on the stock brand and logs which path was missing, rather than refusing to boot. A theme that is mounted and malformed still fails loudly. See Configuration.

Finishing a stopped artifact continues the same version​

If you stop the assistant while it is writing an artifact and then ask it to finish, it now picks the same version back up. Previously the assistant could start a second artifact with the same title and leave the stopped version unfinished, because the tool that completes an open version was not among the ones it was shown for that reply. See Tools.

Browser sessions are off in this release​

Embedded browser sessions now ship turned off. A browser session streams the page to you through a relay server that your organization provides, and Kaizen does not include one, so on a default install the assistant would offer to open pages it could not show you. With browser sessions off, the assistant does not offer to open a page and chat shows no browser pane.

Administrators who have configured a relay can set SANDBOX_BROWSER_SESSIONS_ENABLED=true to turn them back on. See Feature flags and Configuration.

Chat about a document straight from its row​

Starting a grounded chat from Documents used to mean opening the document first and selecting Use in Chat in the preview. A ready document now offers Use in Chat on its own library row, so one click opens a fresh chat with that document attached. The preview button still works, and both do exactly the same thing. A document that is still uploading or being extracted offers nothing to attach yet. See Documents.

A long answer shows how long it has been thinking​

A running turn now carries a clock beside its status, so an answer that is taking its time reads as working rather than possibly frozen. The clock counts the run, not your view of it: leaving the conversation and returning, or reloading the page, keeps the real age of the answer instead of restarting at zero, and it disappears the moment the turn ends.

Once a run passes about half a minute, the turn also says that you can leave the screen or start another chat while it continues. That was always true — the work runs on the server and the answer waits for you, with a notification if you are elsewhere when it finishes — but nothing on screen said so, and members were reloading healthy runs rather than risk losing them. See Chat.

Tasks are on again​

Tasks and chat-managed background jobs ship turned on. They were held back because a scheduled or unattended run could not reach a model: Kamiwaza Core did not accept Kaizen's workload identity where it executes Run now and scheduled runs. Core now does, and a run reaches a model end to end.

Nothing about the safety rules changed. Tasks still appear only while Kamiwaza reports the complete delegated-workload graph ready, so on a Kamiwaza that does not, the rail entry stays hidden and your administrator's setup checklist names the platform hold rather than leaving you to guess. TASKS_ENABLED=false remains the reversible rollout and emergency-stop control. See Feature flags and Task scheduler operations.

A chat no longer stays busy after its turn dies​

A turn that loses its hold on the room now ends as a failed turn you can see, instead of leaving the chat waiting forever. If the process running a turn disappears and nobody returns to the room, Kaizen now clears the stuck turn in the background within a few minutes, so the room is ready for the next message.

The artifact pane keeps its right edge​

Opening an artifact or browser pane beside a chat could push the pane's edge, with its resize handle and close control, past the edge of the window on a smaller screen. The chat row no longer reserves space for a scrollbar it never shows.

Easier to read and to tap​

The smallest labels across Kaizen are now at least 11px, every control is at least 24px in both directions, and several colored labels (the Personal tag in Settings, About callouts, source badges, and status pills) now meet the 4.5:1 contrast minimum in light and dark themes. Compact document cards show the file icon instead of an unreadable text miniature.

Approving a paused task run resumes it where it stopped​

A task that asks before writes now remembers what it had already done. When you approve, it reuses the work it finished before the pause instead of starting the whole task over, and it performs exactly the write you approved rather than asking the model to produce it again. See Tasks.

Approving a paused task run resumes it​

A task that asks before writes pauses when a step wants to write, and shows Task paused in chat. Approving that request used to fail with a server error and left the run waiting until it expired. Approving now resumes the run, even when you approve the moment it pauses. Deleting a task now also cancels its waiting runs instead of leaving them queued.

A corpus job now retries a partition whose model answer came back empty or malformed, within its attempt limit, instead of failing the whole run. See Tasks.

Turning a task on no longer opens a consent page​

Turn on task now approves Kamiwaza's authorization for that exact task revision with your signed-in session, the same way a background job from Chat already did. Scheduled tasks, Run now, and chat background jobs also run their model calls under that authorization end to end. See Tasks.

Tasks that cannot start expire instead of waiting forever​

A scheduled run, Run now, or chat background job that the platform would not authorize used to stay queued indefinitely, retried on every repair pass, and would all have started at once when authority returned. Such a run now expires after an hour and appears as missed. See Tasks and Task scheduler.

Long task steps show they are still working​

A task step whose model call ran past a minute used to show nothing between its start and finish, so a busy run looked stalled. The step's Run trace row now shows the time of its latest activity while it works. When a provider sends a tool call's arguments only once the call is complete, the live status also keeps updating while that call is being written. See Tasks.

Steering gets its own answer, and a partly failed script names its files​

Steering the active run in a shared chat used to leave the steering message without an answer: the queued steer carried no model, so its turn failed as soon as it started. It now carries the same server-resolved model as a normal message and is answered in its place in the queue. See Chat.

When a code run saves a file and then exits with an error, the answer now names the saved file and says the rest of the change may be incomplete, instead of reporting that nothing could be confirmed.

Release UAT tells a provider limitation apart from a defect​

Some checks in the release browser journeys depend on what a model provider streams rather than on Kaizen itself: stopping an artifact mid-build can only retain a partial version if the provider sends tool arguments as they are generated, and the live Thinking panel can only be exercised if the provider returns reasoning text. Claude models served through AWS Bedrock do neither, so those checks used to fail on Bedrock-only clusters and read as product defects. The release runner now probes each chat deployment for both behaviors first, reports the verdicts, and marks the affected checkpoints not applicable only when the probe positively found the behavior absent. See Models for what this means for members on those deployments.

Platforms behind a private certificate authority discover models again​

A platform whose certificate comes from a private authority mounts its trust bundle into Kaizen, but model discovery ignored it and reported no deployments while every other platform call verified. Kaizen now hands that bundle to the discovery client at startup, so the chat and embedding pickers fill without an operator setting anything. See KAMIWAZA_CA_BUNDLE in Configuration.

A tool that keeps failing the same way no longer runs out the turn​

When the assistant re-sent one tool call with the same input after it had already failed, the turn used to continue until its processing limit and then ask you to continue — which started the same loop again. The turn now stops after the third identical failure and says so. A failed step in a shared chat also records why it failed, as a short class such as "invalid argument" or "timeout", so a transcript can be read back without the error text.

Chat layout fixes at narrower widths​

The artifact pane in a shared chat no longer pushes its close control past the edge of a 1280-pixel window, the run-settings menu on a new chat opens clear of the composer instead of covering Send, and a Project's detail view measures the same width as the Projects list whether or not the page scrolls.

A generated file no longer waits on a lost progress frame​

When a turn builds a file such as a PowerPoint deck, the side pane used to leave "Creating…" on screen if the live progress frame that finishes it was missed, even though the file was already saved to the chat. The pane now completes from the saved record as well, so the preview appears without a reload. The same applied to an artifact the assistant updates in place: if the frame carrying its identity was missed, the pane kept showing streaming source instead of the preview. It now settles from the saved answer.

About diagrams are easier to read and explore​

Architecture and workflow diagrams now use a wider reading area and can fill your screen. Each diagram also includes node search, semantic details, authored upstream and downstream reach, and directed route playback. You can find a service, inspect what connects to it, and follow a route without leaving the About page.

Reviewed agent pipelines can be compared safely​

Kaizen now has a restricted internal capability for comparing reviewed agent pipelines. Each design can own its loop and lifecycle differently, but all of them must use the same trusted model, tool, authorization, budget, journal, audit, and terminal-settlement boundaries.

Every Chat composer shows Tomo in the pipeline pane at the left of model and run settings. Pipeline selection ships off, so Tomo is disabled until a reviewed deployment enables it. Enabling the flag still grants no access by itself: only an allowlisted administrator can choose another pipeline. Other members see only disabled Tomo without receiving experimental identifiers.

The composer rail now keeps only primary controls and the session token count. Open More for transcript and response-compression settings. Model and run settings open centered over the chat instead of against one edge.

Pipeline assignment is stable for the conversation. If a selected pipeline becomes unavailable, Kaizen permanently falls back to Tomo before another effect. Broader assignment remains at 100% Tomo until contract, shadow, administrator comparison, and owner-approved rollout stages succeed.

The upgrade changes each member's opaque client preference scope once. Selector access remains release-bundled and is not exposed through ordinary member settings. Browser-stored approval preferences return to their defaults even when the field-encryption key does not rotate.

Abandoned artifacts no longer linger in your list​

A reply that finished perfectly could still leave an artifact behind that never loaded. Opening it did nothing and no follow-up could revive it, because the version belonged to a call the assistant had started writing and then dropped — nothing was ever generated for it. Kaizen kept it anyway, labeled as though a generation had been interrupted, so a healthy conversation accumulated one or two dead entries.

Kaizen now tells the two situations apart. A generation you stopped is still kept and still resumable, exactly as before. One the assistant began and abandoned is removed when the reply finishes, so your artifact list holds only versions with real content behind them.

A tool that failed is no longer reported as a success​

Some tools report a problem by answering normally and putting the failure in the answer — the request went through, nothing was flagged, and the body says the operation errored. Kaizen read only the flag, so the assistant was told the call had succeeded and went on to describe a result that did not exist, with none of the later checks able to correct it. Kaizen now reads the answer as well: a result whose own contents report a failure ends the call as a failure, and you are told what went wrong instead of being given a confident account of work that never happened.

The same turn had a second way to mislead you. Tables and images are moved out of the assistant's reply and onto the chat canvas beside it, and the assistant is told to summarize what is on screen. When the canvas could not be rendered, that instruction stayed behind, so the assistant summarized rows it had never been shown and told you they were displayed above. A canvas that does not render now withdraws the claim with it, and the assistant will not describe output you cannot see.

A turn that stops making progress now stops​

A chat turn could keep going for twelve minutes and finish with nothing to show for it. The model was replying — the turn looked busy the whole time — but the replies were empty: no answer, no tool use, nothing added to the conversation. Because each reply arrived on time, everything watching the turn read it as healthy, and the same request went back out again and again. It ended by telling you the assistant was temporarily unavailable, which invited you to wait for something waiting could not fix.

Kaizen now recognizes replies that carry nothing as a lack of progress rather than a sign of life. A handful of them in a row ends the turn instead of repeating the request, and the message you get says the model kept returning empty replies, so you can try a different wording, model or reasoning effort rather than waiting. A turn that is genuinely working — answering, thinking out loud, or using a tool — is unaffected, however long it runs.

A waiting approval no longer reads as a cancelled one​

When Kaizen needed your approval before writing something, it said the operation "was blocked", that the tool "did not run", and that the call "made no changes" — which read as a failure you could do nothing about, and never mentioned that it was waiting on you at all. Kaizen now says plainly that the change needs your approval before it can run, that this particular call has not run and so has changed nothing, and that asking again will put the request back in front of you. It is careful not to claim more than that: an earlier change in the same reply may already have been made, and it will ask for your approval afresh rather than relying on the request it stopped waiting for. You get this reply even when the assistant asked to use other tools in the same step as the change it was waiting on; those other steps are simply left undone. A genuine refusal still says so, in its own words.

Long pauses no longer interrupt an agent-builder or sandbox reply​

When you try an agent out in the builder, or chat in the Studio sandbox, the reply can go quiet for a while — the model is thinking, a tool is running, or a write is waiting on your approval. Some networks treat a quiet connection as an abandoned one and close it, which stopped the reply from streaming partway through. Those two surfaces now send a small signal during the pauses so the connection stays open, and operators can tune the interval to their network. Ordinary chat already did this and is unchanged. If a connection does still drop, the reply is never lost: it arrives complete, just in one piece rather than word by word.

Typing indicators work in a shared chat​

In a shared room, "Kaizen UAT Peer is typing" was supposed to appear while someone else was composing. It never did — for anyone. Presence rides a frame the live connection sends when it has been quiet for a moment, and a typing update announced itself in a way that counted as activity, which reset that quiet period and cancelled the very frame carrying the news. The indicator was then cleared about a second and a half after the last keystroke, so it had always expired before the next opportunity to send it.

Kaizen now delivers presence the moment it changes. You see a collaborator start and stop typing as it happens, and each member's view is still computed for them alone: you never see yourself listed as typing, and the indicator still carries no draft text — only who is typing, which is unchanged.

The Artifact pane keeps the width you gave it​

Widening the Artifact pane beside an open Workspace panel appeared to work and then rendered narrower than what you set, because the pane was treated as flexible space the layout could reclaim. The width you choose is now the width the pane renders, and it stops widening at the point where the conversation column and the Workspace still fit — so the pane no longer offers you a width it cannot keep.

Asking for one document gets you one document​

Asked to create a single artifact, the assistant would sometimes create it, succeed, and then create it again — and again — leaving a panel full of identical copies of something you asked for once. It was most visible on deployments backed by a local model, where a single request produced nine copies in half a minute. Deleting eight of them was left to you.

The assistant no longer gets the chance. Kaizen remembers what it already saved during a turn, and a repeat of exactly the same save is answered with the original rather than done again: nothing new is written, and the assistant is told plainly that the thing already exists and how to refer to it. This applies only where doing the same thing twice really would leave you two of something — running a piece of code again, or clicking the same button on a page again, are normal and still happen. Two requests that differ in any way are still two different requests, and asking again in a later message always creates a second copy.

note

If you ask for two byte-identical copies in a single message — same title, same contents, nothing to tell them apart — you may get one. The assistant is asked to give them different names when you want both; if it does not, ask for the second one in a follow-up message and it will be created. We would rather occasionally make you ask twice than hand you nine copies of something you asked for once.

Citations point at the right page, and search finds words it used to lose​

A citation from a multi-page PDF could send you to the wrong page — the passage quoted came from page two, and following the link opened page one. Searching for a distinctive phrase you could see in a document sometimes returned nothing, or returned the document while highlighting the wrong part of it.

Both came from the same cause. When Kaizen broke a document into passages, it discarded the line endings inside a paragraph without putting anything in their place, so the last word of one line and the first word of the next were run together into a single word that appears nowhere in the document. Both real words disappeared from the index, which is why an exact phrase could not be found; and with the distinctive words gone, the passage that actually matched lost to a near-identical one elsewhere in the same file, which is where the wrong page number came from. List items and quoted passages ran together the same way.

Passages now keep their line structure, so exact phrases are findable again and a citation opens the page its text is really on.

Important for administrators: this improves how documents are broken into passages, and Kaizen does not re-process a document just because that changed. Content indexed before this release keeps its old passages until it is reindexed. Connector and filesystem sources recover with a reindex; an uploaded file has to be removed and uploaded again. See Ingestion & indexing for when to reindex.

A run that will not compile no longer costs you the answer​

Asked to write and run a piece of code, the assistant would sometimes make a few mistakes in a row — an import that does not exist, a name it forgot to define. That is ordinary; reading the error and fixing the next attempt is how the tool is meant to work. What happened instead was that Kaizen counted those attempts as the code sandbox misbehaving, took the sandbox away mid-answer, and in some cases ended the whole turn with "the assistant is temporarily unavailable" — losing everything the turn had already produced.

Kaizen now separates a tool that cannot do its job from a tool that did its job and handed back your program's own error. A traceback is a fact about the program, so the assistant keeps its ability to fix and re-run. Repeating the exact same failing code is still refused, but that refusal is now something the assistant reads and works around rather than something that ends the conversation turn. Failures are also recorded with the reason the tool actually gave, so an operator can diagnose one from the log.

Tools work reliably on a locally served model​

On a deployment backed by a local model, the assistant would drift: asked to use a tool it would answer in prose instead, a canvas would not appear, and a handoff to another agent would quietly not happen. The same request against a hosted model behaved correctly, which made it look like the local model was simply weaker.

It was not. Kaizen describes its tools to the model with a schema, and one field in that description declared a size limit large enough that the local model server gave up on the description entirely — then answered anyway, without it. Every tool in the turn lost its structure at once. Kaizen now keeps the description within what a local model server accepts, so tool use, canvases and delegation behave the same way there as on a hosted model. Nothing about what a tool accepts has changed.

A task says when the deployment cannot run it​

A task whose deployment holds no platform authorization used to fail the way a broken draft fails: a few seconds in, with a generic message and a Test again button. Testing again produced the same failure, because nothing about the draft was wrong — the deployment could not reach a model on the task's behalf at all. The only way out was to delete the task and start over, which did not help either.

Kaizen now recognizes that case before the task runs, and says so: the run stops immediately and reports that the deployment is missing its platform authorization and an administrator needs to configure it. There is no Test again button on that message, because a retry cannot change the answer. Tasks on a correctly configured deployment are unaffected.

Kaizen reaches its own API on service-mesh deployments​

On a deployment where the platform runs Kaizen inside a service mesh, the app loaded and then immediately reported that it could not reach its member API. Everything behind it was healthy; requests were being discarded in transit before they arrived, because the app addressed its own API by the name a member types in the browser rather than the name the mesh routes on. Kaizen now sends both — the routable address for the hop, and the browser's own address for the things that need it.

The browser address is still what a login or logout return is built from, so a deployment published on a non-default port continues to return members to that port. Deployments outside a mesh are unaffected.

Indexing says when it did not start​

A request to index a document can be declined — the document is already indexed, it is being indexed right now, or it holds nothing left to embed. Previously a declined request looked exactly like an accepted one: the document came back unchanged with nothing to read anywhere. Now it says which of those it was, in the library rather than only in a server log. Index selected already reported an outcome per document; the single-document action now matches it.

Nothing about what gets indexed changed, and no document that could be indexed before is declined now. See Documents.

Open a real web page beside the chat​

Kaizen can now open a website in a pane next to your conversation and let you use it properly — click, scroll, sign in — with the assistant looking at the same page. The page runs on Kaizen's side rather than in your own browser, so it works on sites that refuse to be embedded at all, and the site's code never runs where your Kaizen sign-in lives.

Who can watch follows the conversation's existing access. Members, collaborators, and the assistant work in one isolated Chromium window; there is no second agent browser to drift from what the room sees. Before typing a password or one-time code, a member can switch on private text. Other viewer peers are disconnected and the assistant's page access is refused until it ends. The assistant still asks before every click or keystroke, so page content cannot act without a member approving the exact effect.

The pane uses a slim embedded media client rather than a room interface. It joins automatically and omits the adapter's login, roster, chat, voice, microphone, clipboard, and media controls. A login shown inside the page belongs to the website being visited.

A session is a lease rather than a document. It does not appear in your Library, it ends after about fifteen idle minutes, and the browser behind it — cookies, sign-ins, storage — is destroyed when it does. See Browser sessions.

For operators, this sits behind SANDBOX_BROWSER_SESSIONS_ENABLED, which now ships off (see "Browser sessions are off in this release" above), and fails closed without a signed egress grant, a 2Gi-capable worker, and operator-configured TURN relay URLs (the relay secret is derived from the field key unless overridden). WebRTC is relay-only: dynamic sandbox pods stay private and receive short-lived per-session credentials rather than public addresses or NodePorts.

When a browser cannot start, the assistant now reports the exact bounded capacity or transport reason instead of alternating between open and read calls until its tool budget is gone. The failed open is non-retryable for that turn; an attempted substitute is blocked by the same shared repair gate used by other governed tools.

The pane now behaves like a normal browser tab when members navigate: a bare hostname becomes HTTPS, explicit web schemes are preserved, and a failed navigation reports its reason without dropping the browser control connection. A member who opens a page can expect the assistant to be able to read it, and can say otherwise: "don't read it", "never summarize the page", "don't click anything" withhold that capability for the turn. Acting on the page still asks for confirmation every single time, which is the boundary that matters. An earlier build tried to infer from phrasing whether a read had been requested; measured against adversarial corpora it both read pages members had told it to leave alone and refused plain questions like "what's the status", so the guess is gone rather than tuned.

Navigation is now reliable, and the picture is sharp. Pages that used to hang indefinitely load in about a second: the sandbox no longer attempts a protocol it cannot route, resolves public hostnames without paying a cluster search timeout on every lookup, and no longer lets Chromium's own vendor service calls open a connection that a member's navigation would reuse and lose. A navigation that does fail now says why, in the browser's own words, and within a bounded time rather than never. The page is captured at the size the driver's pane occupies on their display, in their display's pixels, and follows it as they resize, so text is rendered rather than rescaled.

Chromium's "unsupported command-line flag: --no-sandbox" warning no longer sits across the top of the page. Nothing about isolation changed: the worker keeps its seccomp profile and dropped capabilities, which is why Chromium cannot build its own sandbox, and Isolation boundaries states the trade. What is gone is a banner over a shared page about a decision only an operator can make.

Every side pane now goes full screen from its header, including run outputs and the browser, and Escape brings it back. For the browser that also means more detail, not just more room: the capture follows the pane.

Sessions lease the same pool as run_code but hold a worker for as long as a member keeps a page open, not for the execution ceiling. The pinned media adapter, Playwright, Chromium, Xorg, and the media stack all ship in the sandbox worker image, so size image distribution and burst capacity for concurrent browser sessions. Read Feature flags & rollout and Isolation boundaries first — the honest weak point is that the browser runs without its own internal sandbox, and that page says why and what it costs.

FIPS-validated container baseline​

Every Kaizen runtime image and code-producing build stage uses a FIPS-validated Chainguard base — application, workers, web tier, PostgreSQL, object store, cache, document extraction, agent harness, sandbox, and egress proxy included. The separate notice-only source contributes text, not compiled code or runtime executables. Runtime images use approved-only cryptography against a NIST-validated OpenSSL provider and need no FIPS-mode host kernel.

Two operator-visible consequences come with it. MD5 and SHA-1 are unavailable anywhere in the stack, so anything that previously derived a value from them now uses SHA-256 — pseudonymous member keys in usage reporting change value once as a result, though their format does not. And PostgreSQL moves to 18, which does not start against an existing version 17 data directory: plan a dump/restore or pg_upgrade as part of this upgrade rather than a rolling restart.

See Compliance & evidence for what this does and does not let you claim, and Install & upgrade for the database step.

Chat works again on deployments behind a workroom​

Every chat turn on an affected deployment failed the same way: the member saw "The assistant is temporarily unavailable", and the turn ended without any model output. The cause was on Kaizen's side of the boundary. Kaizen was attaching the member's workroom assertion to its model calls, and Kamiwaza's model routes — which are deliberately not workroom-scoped — fail closed when they receive a workroom header with no verified session binding behind it. A turn is sampled after the originating request has ended, so that binding was always gone by the time the call went out, and the platform correctly refused every one.

Kaizen now sends only the member's credential and a correlation id on a model call, which is what those routes actually authenticate. Nothing about who may use which model changed: the header was never granting access, only withdrawing it. Deployments that were unaffected see no difference.

A refused model credential no longer looks like a permissions problem​

A model call that failed upstream reported the same thing whether the platform had refused the credential or refused the caller. Those are different faults with different fixes, and telling them apart meant reproducing the call by hand.

They are now distinct: a refused credential reports model_credential_rejected, and a caller who is not entitled to that model still reports model_access_denied. Members see the same normalized message as before — nothing about the upstream failure reaches a member — but the api-backend log now names which of the two happened. The troubleshooting guide has the lookup.

Kaizen boots without Slack or Linear configuration​

A deployment outside the App Garden catalog no longer has to invent values for settings it does not use. SLACK_BOT_TOKEN, LINEAR_TRIAGE_TEAM_ID, LINEAR_REOPEN_STATE_ID, and LINEAR_WEBHOOK_SECRET were required at startup even though the Slack connector is opt-in and ticketing defaults to off, so a Compose, Helm, or raw-image run refused to start until all four were supplied. They are now required only when the feature that reads them is switched on. Catalog installs are unaffected — the platform already supplied blank values.

Turning either feature on without its configuration still fails loudly, with the same wording as before, but the two fail in different places. The Linear credential rule, the webhook secret, and the reopen-state startup probe each refuse at startup, so the deployment does not come up. A Slack connector missing its token refuses when connectors are built — and because the inventory is built in one pass, the first refusal aborts the whole thing, stopping every configured connector's ingest rather than only Slack's. Nothing crashes: the failure is caught and logged, and the deployment runs on with no connectors ingesting. The configuration reference lists the log keys to search for. One case is newly enforced rather than newly relaxed: with ticketing enabled, an absent or blank LINEAR_WEBHOOK_SECRET previously left the inbound webhook route verifying signatures against an empty key, which any caller can reproduce. That route now refuses to mount instead. Operators running inbound Linear ticketing should confirm the secret is actually set, since a deployment that relied on the blank value will now say so at startup.

Upstream model failures say what went wrong​

A model call that fails at the provider now records the provider's own error type, message, and status in the server log, bounded and redacted. Members still see only the normalized category — nothing about the failure reaches a member response, an audit payload, or a metric — but an operator no longer has to capture traffic inside the pod to learn why a turn failed.

The gateway also stops replaying requests a replay cannot help. Its one non-streaming retry is still spent on timeouts, 5xx responses, transport failures, the 4xx statuses that are themselves transient — 408, 425, and 429 — and rejections that name streaming itself, since turning streaming off is what the replay changes. A rejection the provider will simply repeat is now answered from the first attempt, halving the upstream cost of a turn that was never going to succeed. A provider that names a billing failure only in prose also keeps its replay, because that is how the gateway earns the confirmed status its member guidance is built from.

Stronger sub-agent and sandbox work​

Sub-agents now cross a typed boundary in both directions. Each child receives a digest-bound objective and bounded prerequisite results; the coordinator gets a digest-bound answer plus only the citations and artifacts Kaizen observed during that child run. Hidden reasoning and raw tool output still stay inside the child.

Iterative Python and Node work can retain supported state between code cells. The state rides in the owner-scoped workspace snapshot, so the worker returns to the shared pool after every cell instead of being pinned to a conversation. Code can call snapshot-authorized read tools without receiving the callback credential.

Workspace source edits now use the OMP-compatible Hashline grammar. Reads return trusted four-hex snapshot headers and record only displayed lines; guarded edits can replace or insert ranges, resolve syntax blocks, cut and paste named registers across calls, recover unchanged stale anchors, and commit multi-file moves or removals as one rollback-protected sandbox transaction. Snapshot text and registers remain owner/workspace scoped outside the untrusted workspace.

Localized artifact revisions now use version-bound Hashline ranges instead of resending a complete document. The Artifact pane labels each selected range and shows its provisional before-and-after stream. Separate non-overlapping ranges commit as one immutable version. Markdown, HTML, SVG, and widget previews update live; React and Mermaid retain the last valid render until the exact candidate succeeds. Ranged reads reach content beyond the initial context, and stale or stopped edits leave the committed version unchanged.

Operators can also configure bounded response-correction rules. Matching output is discarded before publication, a fixed reminder is recorded, and the runtime captures a fresh provider step. These rules improve model behavior but do not replace backend authorization.

Live work stays live, and downloads travel cleanly​

An accepted Chat turn now keeps recovering in the tab that sent it as well as in a tab opened later. Replacing an API process no longer leaves the original screen frozen until refresh: bounded, authorization-checked wakes resume the same fenced input from the append-only journal. Shared viewers also receive the same cumulative staged-artifact snapshots, including begin/append/finalize generation, and the composer token tooltip stays inside the viewport.

Pi tool-call streaming now tolerates every supported identity cadence: call identity may arrive at start, with deltas, at end, or only with completed arguments. The one shared descriptor-driven consumer preserves fragments and generative UI without model-name exceptions. Platform output capacity is also bounded to 25% of the resolved context window by default, keeping a usable prompt budget when a deployment advertises or inherits an output maximum as large as its whole window.

Visible Thinking and HTML artifact source now keep advancing throughout a turn instead of pausing behind persistence or provider-rendered tool markup. Durable Thinking checkpoints still recover the trace after reconnect without repeating what a current viewer already saw. A room refresh also preserves a longer live trace instead of temporarily replacing it with an older durable prefix. The selected reasoning level crosses the model proxy in its universal effort field, so reasoning-capable deployments receive the requested level while deployments without reasoning support continue normally. Incomplete artifact calls remain unable to execute. Artifact source now paints between bounded durable checkpoints, the model-activity status remains present until actual visible bytes arrive, and the live token indicator marks its open-call estimate with ~. Each Pi model-call boundary now replaces open-call estimates with cumulative prompt, output, cache, and call-count usage. Provider-reported checkpoints are exact; tokenizer fallbacks remain visibly estimated when a provider omits counts. A long tool run therefore does not carry stale open-call estimates into later cycles.

Shared-room usage checkpoints are now durable at model-call boundaries, so a member joining or refreshing during a response sees the same token basis as the other participants without writing once per token. Thinking follows its tail only while you remain at the bottom; scrolling upward keeps your reading place. The sharing dialog also keeps keyboard focus while the parent conversation continues streaming.

A collaborator can now ask Kaizen to revise an artifact another member created in the room without failing the turn or changing the creator's history. The stream becomes a new collaborator-owned remix, carries its exact source lineage, and is linked back into the shared chat so every active participant converges on the same canvas and completed result after refresh.

Opaque local deployments can now receive an exact operator-declared context window and reviewed reasoning-budget parameter when authenticated inventory has not published them yet. The declarations bind only to the canonical provider model ID and the two Pi-supported budget fields. This keeps local reasoning bounded by the selected effort and preserves answer or tool-call capacity without guessing from a display name.

That same capability-bound path now carries exceptional reasoning wire shapes without model-name branches. In particular, a local chat template can receive the selected effort and its independent numeric thinking limit together, while ordinary platform models keep the universal proxy format. Natural requests for an image or illustration also enter the durable SVG artifact protocol directly, so a chat model without a separate raster generator creates the graphic in the shared Workspace instead of merely describing what it could create.

Reasoning checkpoint commits now drain behind ordered terminal barriers instead of pausing the next provider token. The Pi reconnect log also uses constant-time steady-state appends, eliminating the progressively larger history copy that could turn long responses into alternating bursts and pauses. Both paths remain bounded and preserve exact replay order.

Substantial new artifacts now use one bounded begin, append, and finalize transaction. Each piece is durably sequenced and integrity-checked, recovery continues the same private draft under a fresh execution fence, and an expired worker cannot race it. The assistant cannot claim completion before finalize; truncated tool calls are rejected before execution and may be reissued on the next same-effort model step. This prevents long game or app generation from ending with a missing artifact after an otherwise lengthy Thinking trace. Each append now derives its maximum from the selected deployment's trusted output capacity, so a large game can usually arrive in one append instead of repeatedly replaying the growing draft through many small model calls.

The begin, append, finalize, and discard actions are now advertised as one bounded capability. A provider step receives the complete authorized protocol or none of it, and a stale step that requests an unavailable staged action fails once while preserving its private checkpoint. This removes the repeated recovery loop that could consume many full-context calls without ever making an artifact completable.

Shared-room delivery now keeps conversation order while allowing different rooms to drain independently. API processes reuse a bounded Valkey command pool and multiplex viewers over one subscription, so additional connected members do not allocate a connection each. Durable journal heads remain completion barriers, and reconnect still converges from the authorized PostgreSQL record.

Downloading an HTML or widget artifact now produces a complete standalone HTML document while the in-app editor keeps its preview-friendly fragment. The Documents list and grid add lazy visual thumbnails for images, PDFs, and bounded extracted content. Background upload and ingestion progress survives navigating away and returning during the same app session. An explicit inline canvas or canvas-mode request now renders bounded Markdown inside the chat turn without creating a saved artifact. Chat and Project invitation links also keep an acceptance action when the recipient's cached inbox is late, with a visible safe retry if acceptance fails.

info

If your platform's certificate is issued by a private or self-signed authority, check this before upgrading. Task traffic previously ran unverified — a defect, now fixed — so it tolerated any certificate. It now verifies, and against a private authority the connection fails and scheduled tasks stop working. Kaizen cannot detect this at startup, because the check would have to make the call to find out. Either inject KAMIWAZA_VERIFY_SSL=false for that deployment, which the platform already does where verification is deliberately off, or give Kaizen a trust bundle for your authority.

Prompt resource finder and step capabilities​

Prompts now have an IDE-style fuzzy @ finder for saved Prompts, Documents, Tools, Connectors, Agents, Collections, and Artifacts. Single requests and multi-step flows are both labeled Prompts in the member experience. In structural Agent positions the same shortcut remains Agent-only, so resource selection cannot corrupt the flow grammar.

Selecting a Tool or Connector creates an explicit attachment for that step. The catalog is not limited to the selected Agent's defaults, so a Prompt can request another available capability without editing the Agent. Every validate and run resolves the attachment again under the running member, live deployment policy, active package or Connector state, and the effective Agent's capability ceiling. Unavailable attachments block before execution; admitted calls retain the normal approval, audit, collaboration, and sandbox boundaries.

Offline tokenizer startup​

The API-family image now contains the exact integrity-checked cl100k_base data used by document ingestion and token accounting. API and worker processes verify that image-owned cache before dispatch, so normal air-gapped startup no longer needs a first-use tokenizer download or an egress exception. A legacy TIKTOKEN_CACHE_DIR override now fails startup and must be removed.

Governed data artifacts​

Trusted tool results can now save structured data as durable, inert Artifacts. The server-attested envelope retains the authorized JSON payload or opaque content-bound reference together with its source context, structured security markings, text fallback, and JSON download. Native tables render as text-only cells. An administrator can compose a reviewed first-party renderer pack into an exact API/web image pair and enable its exact digest for one versioned renderer and payload contract. The reviewed module then runs in the existing Artifact pane inside a scripts-only opaque-origin frame; the authenticated parent transfers only receipt-declared, size- and digest-verified assets. The active backend pack must also readmit the exact stored content, and the browser verifies that content-bound admission before mounting. Kaizen never discovers or downloads renderer code at runtime. Unknown, disabled, mismatched, rejected, or failed renderers show the producer's fallback. Unresolved result references remain fallback-only and are never fetched or rerun when opened. A named top-level security banner is sticky host-owned chrome outside the renderer, so its exact text survives loading, WebGL display, renderer failure, and text fallback.

Manual member edits and ordinary model-authored artifact tools cannot revise a governed envelope. A trusted producer refresh may update the same Artifact only when its source, context, and markings remain unchanged; a different binding creates a new Artifact instead. Fork and remix copy the stored envelope exactly without creating new producer authority. Member library actions also cannot rename, attach, or publish a governed result; unpublish remains available to reduce access. Governed results produced inside a shared chat can already be room-scoped by the trusted path.

The upgrade migration quarantines any older member-created code row that used the now-reserved renderable-artifact language before server attestation existed. It becomes ordinary JSON code while its exact content, title, identity, and complete version history remain unchanged. No manual SQL preflight is needed.

0.4.2​

The Kamiwaza palette, and one typeface​

The accent palette that used to be called Tide is now Kamiwaza, built from the corporate brand guidelines: teal #0DCC8A with light teal #9EEBD0, on the brand's own black, white, gray, and charcoal. It is the default for a new browser profile, and dark mode is its native form — teal on black, the same northern-lights look the brand uses in its own artwork. Aurora, Halo, and Ember are unchanged and still one click away in Settings → Preferences.

Type across every palette now asks for Avenir, the brand's primary family, falling back to the platform's own sans where Avenir is not installed. Font weights collapsed from thirty ad-hoc values onto the six named Avenir cuts, so emphasis means the same thing on every screen.

Readable in every theme​

The color tokens behind every surface were re-measured against the surfaces they actually land on, in all eight combinations of light/dark and the four palettes. Muted text, links, status colors, and the label on a filled or destructive button now clear the WCAG AA contrast minimum everywhere — several of them previously did not, worst of all a white button label on a light accent in dark mode. Type sizes snapped to a single scale, so sub-pixel steps like 12.5px no longer render differently from one machine to the next, and a reduced motion preference is now honoured across the whole app rather than on three surfaces. Nothing moved: the palettes, the picker, and your saved choice are unchanged.

0.4.1​

Actionable model billing failures​

Chat now distinguishes a provider-confirmed billing or credit rejection from a generic assistant outage. HTTP 402 failures produce bounded guidance to add credits or raise the provider limit, reduce the response size, or select another model, while raw provider account details remain hidden. When an OpenAI-compatible route hides the status in a pre-output stream error, Kaizen retries the same authenticated request once in non-streaming form to recover a reliable status or bridge a healthy completion. It never retries after model output begins and never guesses that an unknown error is billing-related.

Generic Kamiwaza tool surfaces​

Kaizen can now turn authenticated Kamiwaza Core OpenAPI operations into live, searchable tools without a per-application integration. Applications, skills, connectors, workrooms, Context Service, and future Core tags use the same contract, while MCP Guard remains the separate MCP source. Administrators can manage one hierarchy from Kamiwaza → source → surface → endpoint. The root and parent switches apply to every currently discovered child in one atomic, server-resolved cascade; narrower surface and endpoint exceptions remain available afterward. The stored policy stays compact because the cascade records surface selectors instead of every endpoint. Newly published endpoints on those surfaces inherit that choice. Administrators can disable the closed SDK source as one unit, and members can narrow admitted Core, SDK, and MCP tools per conversation. Enabled SDK tools are available with every selected chat agent; read-only agents receive only inspection, while delegated agents inherit the parent turn's SDK selection. Disabling Context, for example, leaves every other service unchanged.

The Core broker preserves the signed-in member's identity, role, and workroom and lets Kamiwaza authorize every call. It does not preload or duplicate platform data. Shared schema caching, single-flight refresh, connection pooling, and hierarchical deferred tool search keep large catalogs and many concurrent members from expanding every prompt. Broad capability questions now use a metadata-only parent-surface view, while action searches load only matching endpoint schemas. Credential-taking request contracts are omitted from Core model discovery; generic non-secret connector settings remain writable under the member envelope and approval gate, credential-shaped nested inputs fail before dispatch, opaque credential references remain usable, and credential-shaped response fields are redacted. Resolved endpoint schemas now pass an independent standards check before catalog admission, with bounded compilation off the request event loop. Invalid endpoints are quarantined individually instead of failing a whole turn. Connector setup language ranks create/update operations together with the live connector type-schema read, excludes destructive siblings, and requires persisted configuration readback before success. Deterministic provider request-contract failures checkpoint after one attempt rather than replaying the same rejected payload.

The new external-source adapter is a separate default-off boundary. A member can ask Kaizen to create tools from an HTTPS OpenAPI site without storing the schema. Endpoint authentication renders as a dynamic browser-only form for API keys, Basic/Bearer/OAuth tokens, and NPE or mutual-TLS material. Use once stores nothing; explicit Remember can write an encrypted DataHub/Catalog bundle and returns only an opaque reference. Signed plans, proxy-only egress, durable non-secret replay receipts, approval classification, and no automatic retry of uncertain writes preserve the boundary under failure. External-source management now consumes the shared resolved permission verdict: approval-required modes pause on the normal conversation item, while Never ask executes without fabricating or demanding an approval receipt.

Credential forms now show the exact destination origin. External schemas use that same origin for their API by default; cross-origin sources and query-string authentication each have a separate default-off admin ceiling. Endpoint results are scrubbed for exact submitted values and common wire encodings before reaching the model, including text, errors, URLs, package instructions, and download metadata.

Catalog inventory tools now stay in the answer and visible Thinking steps without adding a second table canvas. Turn-specific credential forms, jobs, and images remain attached to their producing turn. Long uninterrupted URLs now wrap inside both the composer and sent-message bubble instead of widening the Chat layout.

Pi 0.84.2 migration foundation​

Kaizen now exact-pins its Pi runtime family to 0.84.2. The served Turn Engine remains the durable execution path, while the rollback path uses Pi's supported low-level Agent instead of the unavailable 0.84.2 harness scaffold. Streaming consumes Pi's delta-only message updates directly, finalized compatibility messages persist through the rollback projection, and compaction retains exact entry identity even when adjacent messages have identical content.

The migration deliberately does not create a second recovery system. The PostgreSQL runtime journal remains authoritative; Pi's new named lanes, operation records, and mutable facts stay disabled until they can participate in the same atomic backend sequencing and recovery protocol. The upgraded catalog also recognizes DeepSeek V4 Flash 0731 without an invented local model profile.

Reasoning effort now becomes an engine-specific budget only when authenticated platform metadata identifies the exact supported parameter. Kaizen never guesses from a model name, reserves 4,096 output tokens for an answer or tool call by default, and binds the reviewed budget into the run manifest. If a provider still spends its entire output allowance on reasoning without producing text or a tool call, the turn stops immediately with a specific member-safe explanation instead of retrying an identical empty response.

Long collaborative turns renew their fenced input lease while the shared runtime is active. Losing that lease cancels execution before another terminal can be published. Bounded member-visible Thinking checkpoints also survive an interrupted attempt and are folded into a later recovered terminal answer; hidden provider reasoning remains excluded from the journal.

Administrators now have a Pi runtime tab in AI metrics. It projects Pi's official typed span vocabulary through Kaizen's content-safe audit funnel and shows six-hour request, run, step, tool, hook, compaction, checkpoint, error, and latency aggregates. Its overview and operation table adapt the useful parts of oh-my-pi's omp-stats dashboard, while deliberately retaining PostgreSQL instead of adding its local JSONL-to-SQLite telemetry database.

Sidecar replay now compacts an oversized display-only delta tail into an ordered reset marker while retaining answers, tool terminals, audit mechanics, and terminal outcomes. Critical recovery state that alone exceeds the bound still fails closed. A tool batch in which every call is denied now terminates after the batch rather than paying for another provider request; a mixed batch continues so permitted results can still be reduced into the answer.

An explicit request to call one already-authorized tool is now durable policy, not only prompt advice. For the narrow “must call” and “exactly once” forms, Kaizen binds the named tool into the signed Pi manifest and holds discovery substitutes or an early answer until the call is attempted. The rule never adds a grant, ignores ordinary or ambiguous mentions, and applies uniformly to first-party and reviewed package tools. While that bound call is pending, Pi advertises only that already-authorized tool and requires a provider tool call; this asks the model for arguments immediately instead of spending every retry on prose. The normal Python decision callback still authorizes or denies the call, and later answer synthesis restores the full catalog after the attempt. The Software Engineer's reviewed Hypa inspection tools are now admitted through the existing actor-bound room policy, while hypa_shell remains unavailable in shared rooms; the visible package grant and the runtime room boundary therefore no longer disagree.

Browser authentication return authority​

Browser login and logout returns now preserve a non-default external port when the trusted application URL names the correct host and base path but omits its port. Explicit operator-configured ports still win, and external hosts, caller-supplied forwarded hosts, and sibling application paths remain rejected.

0.4.0​

Scheduled tasks follow the platform, not a named gateway​

Server-side task traffic now goes to the platform origin your deployment is given, instead of an address that named one particular ingress controller. Nothing to configure: the platform supplies the origin, and swapping the controller underneath needs no change here.

Two consequences worth knowing. Task traffic that previously ran over a plaintext in-cluster address now uses verified TLS, and if it cannot — an origin that is not HTTPS, or certificate verification turned off — Kaizen says so at startup rather than leaving you to assume the workload identity it sends is protected. And where no usable origin reaches Kaizen, scheduled tasks are unavailable rather than failing later with an error a member cannot act on; the startup log names which of the two happened and what to set.

Everything else keeps running in that case. A platform published under a routing prefix is supported.

A failing tool no longer ends the conversation​

A tool that broke used to take the whole reply with it: the assistant stopped mid-turn and answered that it was temporarily unavailable, even when the tool in question was only reading something.

Now a read-only tool that fails reports the failure to the assistant, which works around it and finishes answering — the same way it already recovered from a tool interrupted by a restart. Tools that change something still stop the turn when they fail, deliberately: if a change might have half-happened, the assistant should not keep building on it.

Tools are also bounded now. One that hangs is stopped and releases what it was holding rather than occupying the deployment, and stopping a reply also stops the work being done for it.

One collaborative Artifact pane​

Shared-room participants now see the same approved generative Artifact canvas, including a latest snapshot when they join during generation. Interactive artifacts relay bounded clicks, inputs, changes, and key events in ordered batches and replay a short recent window after reconnect. A slow viewer rebuilds from authorized state without blocking room publication. This enables lightweight shared games without introducing a general synchronized-state database.

Chat now uses one Artifact pane for generated work and source previews. Every artifact kind exposes the existing full-screen control; exiting restores the member's saved split width. Generated artifacts no longer repeat under Workspace Imports. Visible Thinking persists with the answer, reloads collapsed, and is available to current room members, while hidden model reasoning remains excluded. Settled approval items collapse into compact history instead of covering later activity.

Starting a chat now keeps one continuous sending surface while the first message mints its durable URL. It no longer returns through the empty new-chat screen or briefly reveals Home or the Chats library before the message appears. The attributed message appears immediately while acceptance is pending, and a rejected submission restores its text to the composer.

Live token progress now separates the initiating message estimate from the larger admitted provider context and advances monotonically through visible Thinking, artifact generation, and answer prose. Permission choices remembered for a shared chat are scoped to the signed-in participant; one participant's choice no longer affects another account using the same browser profile.

Private and shared Chat turns now use one accepted-input queue, journal, live stream, cancellation path, and recovery path. A generated file or canvas is linked to that journal before completion is reported, so sharing the chat does not strand an owner-only artifact outside the room history.

Projects use one Add Library items picker, with Chats as a first-class kind, instead of a separate Add chats action. About overview cards now pack into content-sized columns so sections with shorter cards do not leave large holes.

ARM64 images​

Every Kaizen-owned image now publishes for linux/arm64 alongside linux/amd64, so a single version installs on ARM64 hosts including Apple Silicon. Creating a sandbox worker still names linux/amd64, so agent code execution remains unavailable on an ARM64-only node; see Deployment topology for the current architecture support and that limit.

Kaizen 0.4 identity transition​

This release establishes Kaizen across the product, runtime, APIs, and user-visible copy, and takes ownership of the canonical kaizen App Garden key and tile from the outgoing product. That handover is a fresh-install cutover, not a rolling upgrade: an existing Kaizen 2.x deployment is never adopted or upgraded in place. Old and new application processes must not share the same database during a data migration.

Taking the kaizen key does not remove the outgoing product from the catalog. Kaizen v3 remains installable alongside this release as the separate entry kaizen-legacy, labeled "Kaizen (Legacy)". The two are distinct catalog entries and neither shadows the other, so an operator can still stand up v3 deliberately. Choose it only to keep a v3 deployment you already run going through this release; anything new takes kaizen.

Kaizen v3 is removed in v1.4.0, and there is no supported migration from Legacy to Kaizen in any release. A Legacy deployment's data and configuration do not carry forward, so moving to Kaizen means a new deployment rather than an upgrade — there will be no migration path to wait for at v1.4.0.

Six persisted model, connector, and approval-default selections move to their KAIZEN_* Admin keys. A2A security state intentionally does not: the old shared secret and peer mappings are deleted, so administrators must configure a new Kaizen secret and re-register every peer. See Install & upgrade for the required quiesce, migrate, and start sequence.

Denser operator metrics and reliable research handoff​

The administrator AI metrics command center now uses content-sized summary tracks and masonry-style family columns, removing the empty sixth cell, dead alert column, and gaps caused by unequal panel heights. Operational labels, table headings, descriptions, and values use legible type without restoring the former excess spacing.

Administrators now have a separate Usage tab for product operations. It defines activity as a meaningful message or steer and reports DAU, WAU, MAU, stickiness, new and returning members, exact-day cohort retention, activity and token-per-user distributions, tool and sub-agent outcomes, grounding, approval, and feedback aggregates across reviewed 7-, 30-, and 90-day windows. Generation and embedding leaders are separated. The API returns counts and distributions, never member identities or content, and does not provide an identity drill-down.

Default Chat now evaluates its reviewed specialist roster before a routed turn starts. Public technical comparisons—including differently inflected requests such as “compare,” “compared,” and “versus”—can receive one exact Web Researcher grant. The delegated child is visible in Chat, runs under the initiating member's unchanged authority and budget, and returns its result to Default for the final answer. A routed grant is now an enforced handoff rather than an optional advertised tool: substitute parent tools are refused, and an ignored handoff receives one bounded retry before the turn fails closed. Generic overlap with a specialist's prose description no longer routes a direct-answer request; deterministic routing now requires a reviewed tag match. Routing now also distinguishes a fresh evidence request from a follow-up that transforms material already in the conversation. Creating a presentation from completed research therefore does not force the same handoff again. The coordinator can still retrieve more when the artifact needs missing, fresher, or better-grounded material, and an explicit request for current or new sources still qualifies for pre-dispatch routing. Required handoff policy remains server-owned and is no longer copied into the member's message. Durable queued and collaborative turns use that same resolver before runtime construction, so those execution paths cannot skip an eligible Web Researcher handoff.

Completed sub-agent cards now retain the full child answer while the parent model receives a separate readable, bounded projection. Internal partial and truncation facts remain backend diagnostics, so the existing member-facing status presentation stays unchanged. PDF, Word, PowerPoint, and spreadsheet delivery claims now require a matching durable file; clarifying questions and honest failures are preserved instead of being replaced by a generic artifact error.

Native files created from collaborative chats now carry an exact room-scoped reference, so every current participant can preview and download the retained output without exposing the creator's personal artifact library. The shared run result carries that same durable reference, so the terminal answer cannot report failure while the file card succeeds. Raw sandbox logs and unrelated workspace files remain participant-private. PowerPoint, Word, spreadsheet, text, image, and PDF run outputs open in the same split Artifact pane from either the answer or Workspace. PowerPoint includes an embedded browser-local renderer for the actual stored deck rather than a reconstructed text outline; other Office views use bounded server-derived content and preserve the original download. Generated files survive refresh in both their originating answer and Workspace. Shared-turn token progress starts at input acceptance and remains beside the flashing cursor during reasoning and tool work. Project Documents and Artifacts now preview in place instead of navigating the underlying Project to another Library view, and Project collaborators can place a directly shared chat they can access. Sharing an existing private chat now pins native files generated before the invitation into that exact room, closing the timing gap between pre-share and post-share artifact creation without widening the creator's personal library. Current room members can also use a retained native file in a later turn. The model sees bounded metadata while run_code receives the exact authorized bytes read-only, so transformations such as shared PowerPoint-to-PDF conversion work without exposing the creator's other artifacts or decoding binary content into the prompt.

Native file generation now has the same generative feedback as editable artifacts: a requested PDF or PowerPoint opens as a non-downloadable Creating item, then becomes the single validated Workspace resource when its bytes are retained. The transient item is never stored as an import, output, or duplicate artifact. Shared follow-up turns also keep retained native files under Outputs instead of misclassifying their room reference as an uploaded document; real document imports preserve their exact room-scoped preview route. PowerPoint preview startup now tolerates the pane-mount and byte-fetch race and offers a bounded retry. Assistant text preserves exact streaming token adjacency and uses explicit model-message boundaries, eliminating concatenated sentences around tool calls. Shared runs now commit their staged answer and terminal outcome atomically, and the model receives bounded execution diagnostics separately from the sanitized tool status shown to members.

Durable recovery across rollouts and hard failures​

Active chats, prompt runs, and artifact generation now distinguish graceful termination from process or node loss. Orderly API and agent-runtime shutdowns stop new work and drain active producers through their durable cancellation and checkpoint paths. Forced loss depends on no shutdown hook: a shared recovery coordinator fences expired database leases, reconciles exact unfinished artifact checkpoints, and repairs queued document-ingest handoffs.

Reloading a private or collaborative Chat automatically reconnects its active work with current platform authorization. A revoked member, a different input actor, or a stale lease cannot reclaim execution. Release acceptance now includes graceful-drain regressions and a forced-pod-loss browser journey that requires one terminal answer and no artifact version stranded in building. Hard-refresh conversation loading also spans short API rollouts with a bounded retry of the read-only projection; authorization and not-found results are never retried.

Chat now creates its durable orchestration before exposing an accepted HTTP stream. Navigating away immediately after Send can no longer cancel a body generator before the work record exists. Automatic reconnect and a simultaneous hard reload may produce one bounded overlapping resume attempt; lease fencing still permits only one logical executor and one terminal outcome.

The shared Turn Engine also retries a transport-successful but structurally empty model response before failing the turn. The retry is bounded, reuses the same admitted request snapshot, and is allowed only before text, tool calls, or external effects have committed.

Approval is a conversation item​

Kaizen now projects every approval-gated tool as the same generic conversation item. It appears beside the waiting turn instead of blocking the app; the conversation and any already-committed artifact remain inspectable while you decide. The item shows the tool, capability, redacted arguments, and optional tool-specific fields without introducing a second commit protocol. Approval is one-shot and bound to the exact call; a failed write cannot be reported as completed in the assistant response. The same item remains in the conversation with its final decision after execution resumes, anchored beside the turn that proposed it rather than floating below later messages.

The retired ticket submission tools, chat action cards, action-event stream, commit/cancel endpoints, and user-facing ticketing configuration have been removed. Future business actions can add safe review fields to the same generic conversation item instead of creating another bespoke UI.

Artifact creation and updates now respect that item as a backend boundary. A gated create sends no generative artifact content to the browser, mounts no artifact pane, and commits nothing before approval; committed source stays unchanged for a gated update. Approval releases the server-held exact tool call, opening a create or replaying an update in place with the existing code language and syntax highlighting, while denial discards it. A second execution interlock refuses pending approvals before the tool executor. Concurrent proposals for the same artifact remain isolated by their tool-call identity. Interactive approvals also offer Always allow tool in this chat, which approves the exact call and remembers only that tool for the same owner, Chat, and agent. The Chat picker does not change, other tools still prompt, Read only still blocks writes, and Task approvals remain one-shot.

Approval requests and member decisions now also append immutable, content-minimized facts to the conversation journal. The mutable one-shot row still drives pause, resume, and consumption, while the retained request and approved/denied events make room replay independently auditable without storing raw tool arguments.

Stopped or interrupted private turns now retain their accepted member message in the append-only execution journal. The next model call rehydrates that unfinished request with an interruption boundary, so natural follow-ups keep the intended work without relying on a special “continue” command. Once a later turn completes, stale interrupted intent is no longer injected. Artifact generation now follows the same checkpoint model: its next private version opens when generation begins, Stop retains the partial content, and a follow-up completes that exact version instead of losing the edit or adding a second version. Completed and published versions remain immutable and unfinished content stays owner-only.

Attached-image vision again recognizes established multimodal model families when older platform inventory omits a capability flag, while an explicit false still wins. Release UAT now uploads a known-color image through the real UI and requires the selected deployed model to answer from the pixels.

Scripts that require host administrator privileges, including sudoers edits, remain downloadable but are no longer offered to the unprivileged artifact sandbox. Kaizen explains the host requirement before execution.

New script artifacts now remain on their completed source by default instead of immediately replacing it with automatic run output. Members who want that behavior can opt into Auto-run from the artifact pane. Inline rich tool canvases also keep a content-stable identity through terminal replay, so the final answer neither duplicates nor overwrites the canvas already shown. The pane now keeps internal preparation hidden before source arrives instead of showing an empty preview or loading block, and the flashing live cursor stays on the same progress line as the exact token total. When Auto-run is enabled, committed source now remains visible while Kaizen prepares the result; visual output swaps in only when ready, while failed and console-only runs stay behind Show output.

Approval modes at every useful scope​

Administrators can set the workspace approval default, members can inherit or choose their own default, and each Chat agent exposes its persistent default on the agent detail page. The Chat model and effort picker now includes a conversation permission mode, also available through /permissions; Tasks retain their own explicit or inherited mode. Accepted turns snapshot the resolved choice, and unattended approval waits release both task and sandbox leases before notifying the member. New deployments start with Never ask; an administrator can choose a different workspace default. Operators must also update dashboards and alerts from kaizen_task_* to kaizen_task_*; there is no dual emission, so the old series stop receiving samples at the release boundary. Every Pi model request now has an 8,192-token default output ceiling, configurable in Admin with PI_MODEL_MAX_OUTPUT_TOKENS. Recognized catalog profiles are also clamped to that deployment-safe bound. The previous PI_UNKNOWN_MODEL_MAX_OUTPUT_TOKENS name is accepted as an upgrade alias, but operators should replace it after confirming its value is safe as the broader deployment-wide ceiling. Conflicting old and new values fail startup. Model and reranking calls now also reject blank authorization and unrelated cookies at Kaizen's gateway boundary, preserving the member-safe platform_auth_unavailable contract without sending an unauthenticated request upstream.

For new or reset browser profiles, Halo was the default accent palette at that release; the Kamiwaza palette is the default now. An organization theme still wins as the deployment starting palette, and any palette a member selects remains browser-local and takes precedence. Kaizen 0.4 uses a new browser-storage namespace, so pre-0.4 palette, recent searches, pins, and per-chat model choices are not imported. An explicit artifact auto-run opt-out is carried forward once to avoid silently re-enabling automatic code execution.

Project contributors can now choose Shared or Private on each linked document. New document links are shared by default, and every member can change that default for their future document additions from the Project Settings tab. The access path is Project-scoped and read-only; it does not make the source globally shared. Other linked Library kinds keep their existing authorization.

Chat steering is persisted as an actor-bound input in the same room queue as a normal message. Delivery no longer depends on room mode or on the request reaching the same API replica as the running turn.

Coherent packaging and first-install deployment​

Kaizen now publishes every Kaizen-owned service under one release version and uses the extension CLI's standard create-or-update lifecycle. A fresh installation is created through the platform API; later deployments use the same zero-downtime update path. Repository tooling no longer patches the extension resource before or after that lifecycle.

The platform-owned sandbox controller remains an external dependency. Its operator source commit and immutable image digest are recorded together in the release dependency manifest and checked alongside the Compose-to-Bake release contract.

Durable Tasks and chat-managed unattended work now request rollout by default, but remain fail-closed until the complete delegated-workload graph and online authority are available. Kaizen consumes one server-derived decision covering all required capability families, workload attestation, model and dataset resource guards, and report freshness; the browser never assembles readiness from flags or partial platform details. Loss of any required dependency closes every new execution boundary immediately without hiding retained task history. An unavailable authority graph does not make the whole API or worker unready: Kaizen reports the scheduler as held. The worker keeps its inert Task handlers registered during that startup hold, so later authority convergence opens them without a pod restart; every execution still rechecks the live graph. Upgrades also tolerate the old local authority-mode value long enough to reconfigure it, without granting that mode any production authority.

One-shot background work now settles Core authority from the initiating member's current verified bearer before its production run is inserted. Missing or expired authority fails without leaving a queued run that the worker can never claim.

Chat agents can now attach a structured Goal to one-time background work and create bounded recurring Agent loops. Goals expose their outcome, constraints, completion checks, current state, latest safe checkpoint, and pending input in the Task inspector. A loop requires an end time and occurrence cap. Its explicit chat request settles Core authority from that same initiating member and activates server-side, instead of making the model or member test, consent, poll, and activate the loop. Active loops use the existing scheduler, worker, private thread, notification, and cancellation paths. Goal input waits release worker capacity and resume the same run from the exact accepted member response.

Background work a chat started is now also listed under Background tasks in the chat Workspace pane, next to artifacts, attached files, and run outputs. Each row carries the live state and opens that exact run, so a job that settles while you are on another screen no longer needs a refresh to stop looking like it is still going.

Model calls are also less sensitive to which deployment serves them. The run-scoped model proxy now normalizes two provider differences that previously degraded otherwise healthy deployments: servers that resend the whole accumulated answer in every streaming chunk no longer make the answer replay itself, and a model that renders its tool call into the message text instead of the tool_calls wire field now has that call recovered and run. Neither correction looks at the model's name, and a provider that already behaves is passed through untouched.

Reasoning support no longer depends on a deployment's name matching a cataloged model profile. A Kamiwaza deployment can be named anything, and an externally registered one carries no repository identity, so that match routinely failed and effort selection was quietly ignored on models that do in fact reason. Kaizen now carries the platform's own declared reasoning capability through to the agent runtime.

The extension also declares separate control-plane and executor workload roles for the API and background worker. Each uses a short-lived projected Kubernetes assertion and an in-memory sender-constrained proof; queues and durable Kaizen records carry opaque platform references, never bearer credentials, capabilities, private keys, or assertion material. Every delegated model call reserves and consumes an exact one-attempt effect over the receiver-visible method, URI, content type, and body digest before provider I/O. App Garden installs supply the canonical internal delegated-workload API URL, so the single TASKS_ENABLED rollout flag can open the member surface when the platform graph is ready. The projected-identity path does not depend on the retired service-client audience or secret configuration.

Launch without a manually invented encryption key​

Kamiwaza now supplies Kaizen's deployment-scoped field-encryption key when the app launches from App Garden. The launch dialog no longer blocks on an opaque KAIZEN_FIELD_KEY prompt, and arbitrary text is rejected at startup instead of failing later when Kaizen first encrypts a credential. Direct Compose operators can still provide their existing key explicitly.

Demo Builder for staff workflows​

The built-in Demo Builder turns authorized evidence and staff requirements into a versioned JSON Demo Blueprint and paired presenter runbook. It can reopen an earlier pair from a prior chat or Project and update the same Artifact roots, so refinements do not fragment the demo's history.

The bundle is self-contained guidance with no new Kaizen service, screen, database object, feature flag, executable package tool, or credential path. Kaizen now exact-pins the Kamiwaza SDK and supplies closed, request-scoped tools for bounded platform inspection plus preview-bound workroom, catalog-extension, model-download, model-deployment, and catalog-dataset operations. A Kaizen-owned reconciler reuses the SDK's in-process seeding primitives; it does not run the separate operator CLI. The SDK stays in the trusted backend under the member's forwarded workroom envelope; packages and the pi sidecar see neither credentials nor platform endpoints. Managed AWS S3/Cloudflare R2 and unsupported platform work still require a separately governed capability.

Private Kaizen builds carry reviewed SDK and runtime-library wheels with exact source, CI-artifact, size, and hash provenance. Local builds and container CI verify and install the same bytes without requiring a public package release or credentials for another private repository.

Demo Builder can coordinate member-selected specialists during an interactive build, rehearse readiness, and prepare a draft for separate UAT review. It does not execute UAT, approve evidence, assign a verdict, or change a release gate.

More effective Builder specialists​

Agent Builder and Package Creator can now reload their owner-scoped proposals across turns, apply optimistic partial edits without dropping omitted fields, and recover cleanly from stale versions. Package Creator supports bounded per-file preview and apply for local packages and authors guidance as first-class runtime skills rather than display-only metadata.

Package Creator can also author native Pi packages against the exact runtime Kaizen ships, without a second Pi-version selector. Skill-only packages use real Pi discovery without fake Node tests; extensions pass node:test before Pi's real loader checks the reviewed surface. Receipts bind the authored artifact, reviewed contract, and observed runtime. Any contract or file edit clears the receipt, and both submission and administrator approval require a current pass. Kaizen admits tools, skills, prompts, and themes; unsupported Pi hooks fail with bounded repair diagnostics.

Package Creator returns a typed proposal handoff when an agent needs a new capability. Agent Builder can save that dependency, remain blocked while it is unresolved, and resume the same draft after the exact package is approved and active. Rejected, foreign, changed, disabled, or missing packages stay blocked; both submission and administrator approval revalidate the boundary. Protected built-in agents remain source-controlled and cannot be rewritten through this member proposal workflow.

Provider-independent connected-source discovery​

In Chat, you can ask for a folder, file, or fact using the source name you know. Kaizen now queries every connected surface your agent is allowed to use instead of requiring you to identify its configured provider first. Hierarchical sources are navigated through their opaque folder handles, and an unavailable or bounded-out source produces a partial result without widening permissions.

See Chat and Knowledge sources & connectors.

Capability questions now remain authoritative for narrowly scoped agents too. The connector and MCP catalogs report an empty inventory when no operations are granted instead of disappearing behind deferred tool discovery. Natural questions such as “what Kamiwaza connectors are available?” load the live catalog directly rather than relying on the model to guess a deferred tool name.

Type straight away in any chat​

Opening a conversation from the rail, the Chats library, or a reload now leaves the caret in the composer, the way starting a new session already did. Kaizen still yields to a caret you placed yourself, and a read-only shared history has nothing to focus.

Embedding models labeled as chat deployments​

Kaizen decides what a Kamiwaza deployment is from the platform's structured deployment metadata rather than the capability strings it advertises. Because the platform labels many embedding deployments chat.completions, the embedding role could resolve a working model and then reject it on the label alone. The capability check now applies only where Kaizen could not classify the deployment, and still fails closed there. See Models & embeddings.

The packaged connector-sync topology now runs two document-embedding lanes in parallel. This keeps useful fan-out while leaving enough headroom for the single-node platform's authorization hop, preventing its timeout from being reported as a rejected embedding deployment. Authorization failures remain terminal and fail-closed.

Reliable shared-history replay​

Sharing an existing private chat now preserves the terminal state of completed turns that predate durable input identifiers. Collaborators opening the retained history see the normal composer instead of stale active-run controls, while new room input continues through the same durable FIFO queue.

Reliable native document output​

Explicit PDF, Word, PowerPoint, and Excel requests now produce native documents through the code sandbox. Kaizen resolves the Office libraries by their installable package names, rejects text canvases or print-styled HTML disguised with native extensions, and verifies each generated PDF or OOXML package before offering its download. PDF previews pass the stored bytes directly to the browser's native viewer rather than rebuilding pages with custom artifact code. Sandbox code now writes relative to its already-writable workspace, and native-file downloads cross the stream on a field distinct from editable canvas artifacts. A final-answer interlock prevents Kaizen from saying a native file is ready unless a matching durable attachment actually exists.

Generative artifact updates now reopen a previously closed pane on first output, retain their durable render kind when opened from Workspace during the stream, and follow Preview instead of falling back to source code. Tool and sub-agent activity starts collapsed; delegated thinking appears before the child work journal when expanded.

See Artifacts and Code sandbox.

RAG-backed Ontology Builder​

The built-in Ontology Builder now uses the reviewed Kamiwaza ontology building method with Kaizen's own permission-aware retrieval. It produces an evidence-linked Ontology artifact from indexed knowledge or an attached document, without provisioning a separate graph-memory backend. Incomplete evidence finishes visibly as Needs review rather than being reported as a ready ontology.

For exhaustive work, including a 38,000-node ontology, the agent can promote the request through the same general chat-managed background-job path available to every agent. An optional checkpointed Library corpus keeps complete work outside one chat turn. The artifact stays a bounded preview while JSON Lines and GraphML exports contain the complete result.

Library workspaces and exact document tools​

Large text and CSV uploads now preview in bounded, record-aligned pages instead of loading the whole file into browser memory. Library selection works across layouts, and document batch indexing reports an outcome for every selected item. Artifact workspaces can enter a keyboard-safe full-screen mode.

When an agent needs exact file bytes for parsing or transformation, it can promote an authorized uploaded-document retrieval result into a turn-scoped, read-only sandbox projection. Kaizen pins the content digest and records bounded provenance; names and paths are never authority. Retrieval remains a ranked evidence layer, while exhaustive mixed-document corpus jobs require durable, checkpointed Tasks.

Administrators can choose isolated, public-Internet, private-network, or exact host-allowlist sandbox egress policies. Existing deployments remain disabled until an operator explicitly enables egress and supplies its signing key.

Prompt Builder Flow​

Opening one of your prompts now selects Prompt Builder and starts on the authored Flow rather than Preview. Prompt steps run from top to bottom in agent columns, with native vertical scrolling for longer flows; direct source editing remains available in Code.

Both axes now expose native scrolling when a Flow exceeds the pane. Prompt Builder-created canvases are runnable on first open, and artifacts produced by a chain appear as openable run results as well as in the Artifacts library.

Prompt Builder title changes now stay synchronized with the Prompts library. Foreground prompt runs no longer notify you about a completion already visible on screen; unattended notifications return to the exact originating prompt, chat, task, or run. Durable task traces now settle their timing labels when the matching Flow run reaches a terminal state.

Prompt execution now continues when its browser stream is interrupted, emits transport heartbeats during long silent steps, and reconnects from the last durable event. Run history in Prompts shows the recorded output and audit journal for interactive runs alongside links to the authoritative trace for runs launched by Tasks. Stop is an explicit durable control; navigation alone no longer destroys healthy work.

Direct sign-in and session controls​

You can open a Kaizen app link directly. When sign-in is required, Kaizen sends you through Kamiwaza and returns to the page you opened. Sign out remains in your profile menu and now removes the signed-in workspace immediately while platform logout completes.

Administrators can optionally set a Kaizen inactivity timeout. It is disabled by default, so existing deployments continue to follow Kamiwaza's session expiry unless an administrator chooses an earlier browser-side logout reminder and handoff.

Multi-replica sandbox governance​

Dynamic sandbox limits now remain deployment-wide when API replicas scale out. Warm capacity, hard allocation ceiling, FIFO admission, and per-member fairness share one Valkey authority. Routed sessions can continue on another replica; expired ownership uses confirmed destroy-and-replace, and coordination outages fail new admission closed instead of opening an independent local pool. Rolling deployments also drain idle workers from the previous image revision; an active worker finishes safely, then is replaced before another lease.

See Sandbox pool sizing and Isolation boundaries.

Task management & scheduling​

Repeatable work became a first-class object. A Task pins an exact saved Prompt version, runs on a schedule that PostgreSQL — not a browser timer — decides, and produces a durable run trace you can reconnect to.

What to know:

  • Tool approval preferences now support a safe global default, per-agent overrides, and task overrides. Modes cover ask when needed, ask before writes, read-only, and an explicitly acknowledged never-ask posture.

  • Approval-required task runs now pause durably, notify the owner, and release both the task lease and sandbox worker. Approval queues a fresh attempt with a one-shot receipt; denial closes the run without holding capacity.

  • Every draft must pass a side-effect-safe test before it can be activated. Changing the target, inputs, schedule, or limits makes old test evidence stale.

  • Scheduled work is credential-free. It carries a revocable authorization fact, not a token, and writes remain subject to the resolved permission mode, current lease, target checks, and tool resource guard.

  • Any chat agent can manage your tasks conversationally — same service, same owner binding, same audit path as the Tasks screen.

  • Any chat agent can also decide that arbitrary substantial work should continue as a durable one-time Task. Chat remains the primary interface: no saved Prompt or schedule is required, and the returned job card survives navigation and refresh with stop and Task-detail controls.

  • Plain-language requests for "my tasks" select Kaizen Tasks immediately; you no longer have to name Kaizen to avoid an unrelated document search.

  • A prompt open in chat can now be scheduled without copying its runnable Library ID or knowing internal schedule fields. Invalid requests identify the field or rule to correct instead of returning only a generic error.

  • Deleting a saved target no longer prevents the Tasks library from loading. The affected task remains visible as Target unavailable, execution stays disabled, and you can still pause or delete it safely.

  • The notification inbox in the rail footer collects completions, failures, blocks, and approval-required events.

See Tasks & scheduling and Task automation security.

Exhaustive Library corpus jobs​

A Task can now process every authorized source in a Library folder, Collection, or explicit Document selection. Work is partitioned outside browser and model context, checkpointed in PostgreSQL, and resumable on the same run. The Tasks inspector shows exact coverage, pause/resume controls, current-access provenance, and streamed JSON Lines and GraphML downloads.

This is the optional exhaustive layer behind the general chat promotion path, not ontology-specific infrastructure. It can support workloads such as a 38,000-node ontology, a complete folder transformation, or another bounded map/reconcile/reduce job. RAG still supports evidence discovery and review, but ranked top-k retrieval never stands in for a complete coverage manifest.

Product-aware chat​

Every chat agent can now search the About manual shipped with its own build. Questions about Kaizen capabilities, workflows, settings, limits, architecture, or security prefer that canonical source and return direct /docs links rather than treating internal engineering documents as the product manual.

Member chat compression​

Two opt-in, member-owned efficiency tools, both off by default:

  • Tool-result compression shortens eligible sandbox run_code output before the model sees it. Search, retrieval, and any source-bearing evidence bypass it byte-for-byte.
  • Plain-speak responses ask Kaizen to write visible thinking and final answers more tersely, without dropping technical substance. Security warnings, destructive-action confirmations, and approval prompts stay fully clear.

/compression stats opens a local measurements panel without starting a turn or spending a token. See Chat compression.

/compact lets you request context compaction for the active Chat immediately. It runs as dedicated background work, reports progress in the thread, and does not alter the visible transcript or create a chat message.

Projects​

Projects group related chats and Library items by pointing at their existing records. A Project never copies a chat, changes its owner, or replaces its access controls, and unlinking or deleting a Project destroys nothing.

Project membership and direct sharing are independent, additive access paths — removing one leaves the other intact. See Projects.

Shared chat collaboration​

Chats can be shared with named colleagues by verified email. The room has one durable journal, one serialized input queue, and at most one active agent run.

Private and shared answers now keep agent, model, effort, and token details in one compact response footer instead of placing an execution banner above the Thinking panel.

The important boundary: room content is shared; authority is not. Each turn runs under its initiating participant's agent, credentials, tools, and sandbox. Personal workspaces, packages, environment values, and credentials never cross. See Sharing & collaborative chat.

Agent Studio​

Members build their own agents through a guided, step-by-step builder — name, persona, tools, knowledge scope, live test — with no proposal queue and no admin approval. Creating an agent makes it live and private immediately; sharing is a separate, deliberate step.

Publishing an agent to all members remains admin-only. See Building agents in Agent Studio.

Search & Chat default agents​

Both surfaces are powered by agents, each with its own mode-scoped default. Search defaults are tuned for retrieval breadth; Chat defaults for a tight, well-cited answer. Because agents are mode-scoped, a Search agent never appears as a Chat option. See Search vs Chat.

Context window efficiency​

Always-on system compaction keeps long conversations inside the model window without member involvement. It is separate from member compression, cannot be disabled by a preference, and never edits the durable journal — only the bounded projection sent to the model. A compact timeline divider now marks manual progress and every automatically compacted answer; durable automatic markers remain visible after reload and to shared viewers.

Retrieval substrate​

One server-owned matching pipeline serves the Search page, the Projects and Chats library filters, and every eligible agent. Lexical and vector branches run against the same authorization relation inside PostgreSQL and are fused deterministically, so a library filter can never contradict the Search page.

An administrator can optionally select a reranker deployment; with none selected, Kaizen keeps the fused order and makes no reranking call.

Paste an image straight into chat​

Copy a screenshot and paste it into the chat composer. It attaches exactly as dragging the file in does, under the same size and file-type limits, and it gets a dated name instead of the clipboard's placeholder. Pasting text is unchanged, and a paste carrying both text and an image gives you both. See Chat.

Earlier releases​

Foundational work that still shapes the product: the distributed worker queue, the admin console, tool capabilities and ticket actions, the unified retrieval substrate, hybrid retrieval, and model provider capability boundaries.