Concord v0.9.0

Concord v0.9.0 — DRAFT (not published, not tagged)

What Concord is

Concord gives engineers AI answers they can check. Ask an engineering question in plain English; Concord routes it to a real solver (not the language model), puts the result next to the textbook hand calculation, and stores a reproducible record of the inputs, assumptions and solver used. The same engine runs across a large set of focused workspaces ("lenses") — accounting, science, trades, creative tools — plus ConKay (parametric engineering/CAD workspace), Concordia (a persistent Unity world on the same backend), and an MCP server so other AI agents can call the same verified compute. Live at https://concord-os.org.

This is the first tagged release. 0.x because the roadmap still has open work.

Highlights

MCP Execution Bridge (#1225)

Agents can now do things in Concord, not just read.

• 4 new MCP tools: run_lens_action, list_lens_actions, conkay_solve, conkay_solver_list (MCP catalog: 118 → 122 tools).
• Reuses the real lens-action and ConKay solver paths — no parallel fake implementation.
• Scoped service identity for agents (first user: Hermes). It never impersonates a human user; impersonation attempts are rejected.
• F0 capability gates by identity and risk class: anonymous calls blocked, cross-user design reads blocked, high-risk actions (e.g. marketplace purchase) blocked. Dry-run, idempotency and approval controls for consequential calls. Every call is logged.
• Live acceptance suite passed against production.

ConKay north star, steps 1–3

• Parametric vehicle assembly and studio viewer for the four-seat car (#1190)
• Build fix after #1190 (#1210)
• Assembly X section cut now lands where the slider says (#1211)
• Also this cycle: Ed25519-signed ConKay receipts anyone can verify (#1187), tub/chassis, cooling, crush-path and drag screening work (#1065–#1077).

Lenses that work now

• Music: playback, priced previews, vision audio, media delete — and paid tracks no longer stream in full to accounts that didn't buy them (#1112)
• Code & Projects: one Run button, no missing-session chat fetch (#1115)
• Manufacturing: OEE, work-order and SPC boards that could never show data now do (#1208)
• Education: assignments work; user IDs no longer leak (#1207)

Honesty & security fixes

A theme of this release: lenses stop pretending.

• Real Estate (#1201): no more invented school/walk/commute scores — shows "unavailable" when there's no real data.
• Nonprofit (#1202): thank-yous/messages no longer claim to be sent when they weren't; card pledges refused, check pledges recorded as manual.
• Government (#1204): payments no longer record uncaptured card charges as paid; cross-account access blocked.
• Logistics (#1203): rate quotes no longer fabricate carrier prices or "Guaranteed" badges; labeled as estimates.
• E-sign (#1205): links survive server restarts; placeholder frontend URLs rejected.
• Welding portal-pay (#1196), Plumbing dispatch ownership (#1195), Supply-chain org access approval (#1197), Alliance identity leaks (#1194), Questmarket (#1192), private-by-default Philosophy debates (#1191).
• BYOK key wrapping hardened with versioned PBKDF2 + production secret gate (#1185).
• Repair cortex wired to live failure signals, with untrusted/anonymous signals filtered out (#1170–#1180).
• Detector sync-fs highs cleared (#1206).

Every PR listed as live above was merged, deployed to production and checked as a real user in Chrome (two accounts where data isolation matters).

Known gaps (honest)

• Lens sweep is not done. Every lens has been touched by a sweep, but most have not had their main buttons clicked in a browser yet (~166 load fine but are untested end to end).
• Still broken, no fix PR yet: Garage, Fishing, Courtship, Ingest, Black Market, Temporal, App Maker, Observe, DX Platform. Four are security issues and are next in line: Temporal (other users' private DTU titles visible), App Maker & Observe (can be made to fetch internal addresses), DX Platform (anyone can join a team).
• A handful of lenses are in an unknown state pending cleanup of old uncommitted work.
• Services lens needs a production Stripe key.
• #1199, #1200 (incident fixes) and #1209 (ConKay car styling) are still in the ship queue.
• The agent service identity currently needs an extra "unknown"-area permission due to how the MCP endpoint labels requests — cleanup pending.
• CI on main isn't fully green; live verification is the bar we ship against.
• Pre-revenue, no paying users yet.

How to run / try it

• Use it: create a free account at https://concord-os.org/register, open Chat, paste a beam question, check it against PL³/48EI. Then try the Engineering lens.
• Run the checks yourself:

git clone https://github.com/ConcordDev/concord-cognitive-engine.git
cd concord-cognitive-engine/server
node --test tests/engineering-question-extract.test.js tests/fea-frame-element.test.js tests/fea-reactions.test.js

• MCP: GET /mcp/tools lists tools; POST /mcp/call {tool, args} calls one (auth + capability gates apply).

Full changelog: ~768 commits on main in the last 30 days.