2026.7.3

The trust release. One theme: prove it, don't claim it — the taste hit-rate score, measured cost before you spend, evidence drill-downs, governed out-of-workspace access with a hard floor for secrets, upgrades that verify themselves and roll back, and Windows joining as a supported (degraded) platform.

Security

• Same-origin gate on the console: cross-origin browser requests are rejected on both HTTP and the
  WebSocket handshake (closes cross-site WebSocket hijacking and file-endpoint CSRF; non-browser clients
  and the console's own frontend are unaffected). Applies even on loopback.
• Skill integrity lock enforced on the production paths: a tampered trust: untrusted skill is refused
  at the recall index, at every disk-scan fallback, and again before sandbox execution.
• Deterministic context ceiling at the LLM gateway choke-point: a request whose assembled context
  (messages + system + tools schema, CJK-aware estimate) exceeds the model's window is refused fail-loud
  instead of being sent to fail.

Fixed

• H2A decision cards: every proposal kind now lands in the decision column (reject button + payload intact);
  multiple pending cards no longer overwrite each other; pending cards (incl. deferred) survive restart.
• Domain deontic rules (forbid/oblige/permit) now reach the runtime guardrail (previously only
  value.md did — and it was dropped entirely when value.md was blank); no double-injection with compiled
  per-role prompts.
• Decisions made over REST now feed the preference flywheel and the decision log exactly like WebSocket ones.
• Task terminal states (done/error) are recorded into Trace, so the async evaluators see task-level outcomes.
• Backend Chinese reason/detail strings are translated in the English UI (contract-tested: a new backend
  reason without a translation fails the suite).

Added

• Taste hit-rate — "more you", proven: before you decide a card, the system quietly predicts your
  call from your crystallized preferences; after you decide, it settles the bet. The decision-prefs
  panel now shows "it predicts your calls N% of the time (last 20; previous period M%)". Honesty
  built in: only bets placed before your decision count, failed predictions aren't counted, and
  below 10 samples it says "still learning you" instead of a fake percentage.

• Cost before you spend: execution-type decision cards (delegate / rerun / roundtable) show what
  recent similar tasks actually cost ("~12.4k tokens each, range 8k–18k, last 10") — measured from
  per-task token attribution, never guessed; hidden until there are at least 3 real samples.

• One-click MCP channel presets — the Coding capability card now has a "Connect a channel" section:
  pick a well-known MCP server (filesystem scoped to a folder — defaults to the workspace, web fetch,
  GitHub, memory, time, SQLite), fill in a folder/token where needed, and it's written into
  config.yaml's mcp.servers (secrets stay in config.yaml, never echoed back). The UI states honestly
  that MCP servers connect at startup, so a restart is required to load the new tools.

• The decision flow is now phone-friendly — open the LAN token link (karvyloop url) on your phone
  and approve/reject/edit decision cards comfortably: on small screens the cockpit stacks into a single
  column with the decision column first, ACCEPT/DEFER/REJECT become thumb-sized full-width targets, the
  edit-then-accept textarea no longer triggers focus-zoom, and chat opens as a full-screen sheet. Purely
  additive CSS (one media query) — the desktop layout is untouched by construction.

• Out-of-workspace access, governed: roles are confined to the workspace by default; when one needs
  a path outside it, the denial surfaces as a decision card ("grant this folder?") — approve once and
  the grants ledger opens exactly that path (tool boundary + capability chain + sandbox mounts all honor
  it; revocable in the Capability overview). Sensitive paths (API keys, ssh, credential stores) are a
  hard floor: never grantable, immune even to bypass mode.

• Open a company (starter templates): five staffed, working domains — personal research, finance
  research, job hunt, content studio, home ops — each with values, hard deontic rules, and roles with
  souls; one click in the Domains panel, yours from the first use.

• Upgrades now snapshot state, verify the install, and auto-roll back on failure (one click back on
  the console): before switching versions the updater records the current commit
  (~/.karvyloop/update_rollback.json) and backs up your instance state files
  (~/.karvyloop/backups/, last 3 kept, honest scope in each manifest.json); after install it
  smoke-checks that the new code actually imports, and a broken build is rolled back to the previous
  known-good commit automatically — with the reason stated out loud, never a silent broken restart.
  POST /api/update/rollback + rollback_available/prev_version in the update status payload.

• karvyloop export — your instance is a folder, now with a button: packs ~/.karvyloop
  (skills, knowledge, preferences, history) into one portable archive with a self-explaining
  MANIFEST.txt; secrets (config.yaml with your API keys, console.runtime.json, *.lock)
  are deliberately left behind. Unpack on the new machine, add your key, karvyloop console — home.

• Idle = 0 LLM calls is now a tested contract (tests/test_idle_zero_llm.py): when nothing
  changed, the daily slow side burns nothing — knowledge consolidation and skill tagging hit their
  watermarks without touching the gateway, and the daily loop's idle path provably exits before any
  LLM work. No overnight heartbeat bills.

• Windows is now a supported (degraded) platform: the runtime, console and your own crystallized
  (knowledge-only) skills run fully on Windows; only third-party skill scripts are refused — fail-closed,
  with a clear message explaining the degraded mode (no sandbox on Windows yet; Linux/macOS keep the full
  sandbox). Ships a one-line PowerShell installer mirroring install.sh
  (irm https://raw.githubusercontent.com/Caprista/KarvyLoop/main/scripts/install.ps1 | iex): dedicated
  venv under %LOCALAPPDATA%\karvyloop, a karvyloop.cmd shim on the user PATH, Python 3.11+ guard with
  py -3.11 fallback.

• Edit, then accept on decision cards: kinds with an actionable text field let you fix the proposal
  in place and approve your version — the original→edited contrast feeds decision-preference
  crystallization (the richest taste signal there is), and an edit counts as real judgment for the
  high-stakes gate.

• Under-the-hood drill-down on task details: expand any task to see the real actions beneath the
  narration (tool calls and outcomes, projected from the Trace).

• Kinder first-run: model-connection failures now say what's actually wrong (bad key / wrong
  endpoint / unreachable) before the raw error, and a local Ollama install is auto-detected and
  offered as a one-click, no-API-key path.

• Semantic tag layer for skill recall (tags: in SKILL.md, matched alongside token overlap — no vectors),
  with a daily slow-side backfill that tags untagged own skills once (untrusted skills untouched).

• Capability overview (/api/capability/overview + a card in the Skills panel): one table for
  tools × mode floors and skills × trust/network/integrity-lock.

Changed

• Internal restructuring, no behavior change: the workflow / distill / roundtable engines moved out of
  console/routes.py into their own console modules, and the core loop moved from cli/main_loop.py
  to the new karvyloop/runtime/ package (karvyloop.cli.main_loop remains as a compatibility shim).

Removed

• Six unreachable packages from an earlier architecture cycle (ethos, syntonos, instance,
  onboarding, l0, bus, ~2.6k lines): superseded by the current design (verify gate + evaluators,
  per-role paradigm compiler, H2A decision cards, a2a/ transport) or parked concepts whose designs
  live in the design docs. No live code imported them; recoverable from git history.