Invarail 0.4.0 — a 9B model through the front door

Invarail 0.4.0 — five months and 610 commits since 0.3.0. LocalClaw became Invarail, the engine moved to a governed open loop, and a 9B model can now drive the whole system through the front door. Every number below links to a published, reproducible eval.

Highlights

• Small models are a first-class target. On the config the setup wizard writes, qwen3.5:9b passes the full 12-task front-door battery 36/36 over three runs (gemma4:12b 36/36, qwen2.5:7b 30/36). → evals/2026-09-e2e
• Misroutes no longer become half-done jobs. Category descriptions now say what each specialist cannot do, and a specialist whose answer claims or announces an action it has no tool for gets one re-dispatch through the full security path. Requests needing two specialists' tools: 18/30 → 30/30 on small models. → routing
• The arena engine. A duel showed scripted pipelines cost 4.7× for the same result, so most categories now run a governed ReAct loop inside the same six security layers. Pipelines survive only where stages verify something: research, code_gen and the heartbeat.
• A setup wizard that detects before it asks — ranks the models you have by the published evals and what fits your GPU, writes a small-model prompt profile for ≤14B foregrounds, offers sidecars but never installs system software behind your back — plus npm run doctor, which checks the machine against what your config enables.
• Memory, four ways. memory.backend = graph (FalkorDB), flat files, or your Obsidian vault (optionally as an Open Knowledge Format bundle), and embeddingModel: "none" runs memory with no embedder at all. Every fact records how it is known: stated, observed, or inferred.
• Research that checks itself. Claims are tested against the pages they came from; high-impact ones are cross-checked with an independent search; a correction now needs evidence that names the claim's own subject, and corrections are spliced one sentence at a time by code.
• Security reviews closed. Three outside reviews triaged and fixed: the web token is the owner's credential, code sessions run inside the Docker sandbox and fail closed, no exec when the requested sandbox is missing, cross-site writes refused by Origin, symlink-aware path containment, a rollback halt marker the doctor and npm start both honour.
• Windows in CI. A blocking windows-latest job runs the suite, the e2e selftest and the wizard smokes; a Node supervisor replaces the bash one (npm run supervise). Windows is tested, not yet a supported install.
• Measured, in public. A 41-configuration engine eval (2026-08), the small-tier boards, and an end-to-end harness whose --selftest proves every scoring check before any model is graded. DECISIONS.md records what failed and why — disproven theories included.

Also in this release

Pi as the coding worker and the owner-gated self-modification rail · the FlowMCP/MCP bridge with a small-model accommodation layer · graph experience memory and lessons (advisory only — learning never expands authority) · a read-only email steward · target-bound standing grants · a shadow router (a 421M encoder logged beside the live router, never deciding) · voice that is on when a Kokoro/faster-whisper server is detected and off otherwise · docs reorganised under docs/.

Upgrading

• Run npm install, then npm run doctor: it names anything your config enables but the machine lacks.
• router.reroute.enabled defaults to on. Set it to false to keep routing exactly as before.
• Docs moved: ARCHITECTURE, ROUTING, SPECIALISTS, MEMORY-SYSTEM, FEATURES and SEARXNG now live in docs/.
• History was rewritten on 2026-09-30 to remove personal data from public commits. If you cloned before that, re-clone (or git fetch and git reset --hard origin/main on a clean tree).

Full history: DECISIONS.md