Arbiter 0.1.3 (pre-release)

v0.1.3

An update to the 0.1.2 pre-release: the phone's commands now help instead of failing, /tail says when
things happened and what a session is waiting on, agents can read documents attached to a ticket, and a
license that ends no longer locks your stored credentials in the stronger security modes.

Fixed

• In security mode balanced, extended or strict, a license that ran out, was revoked or refunded, or whose
  seat on this machine was deactivated, left credentials.db (your provider keys and Claude seats) locked for
  good. Now, while the engine runs, Arbiter moves credentials.db onto this machine's own key, switches the
  home to security mode compat and says so in the log, with how to switch back after renewing. This also
  happens when the license's end date passes while the license server cannot be reached; a renewed license
  is checked first and never taken for an ended one. 14 days before a license ends, the log warns that
  credentials.db needs it. If the engine starts after the license has ended, it says plainly that
  credentials.db is locked until the license covers this machine again, and that nothing in it was
  changed. The default mode, compat, was never affected. While a license has not ended, a network error or a
  server error never moves a key.
• arbiter deactivate no longer says that no database is stranded when it could not move one; it says why.
• On the phone, /ticket attach ARB-041 sent as a message answered that there is no ticket "attach", and a
  photo sent with no caption was refused. Both work now (see New).
• An album sent from the phone no longer answers "Queued behind the turn that is running" for every photo
  after the first, and one sent while a turn runs is no longer cut to five photos.
• The agent count in /agents never went down: it counted every agent a session had ever started. It now
  says what they are doing, for example agents: 2 running, 14 finished.
• The usage forecast read days spent at the weekly limit as an idle week, so after a reset it put the pause
  days too late or said the week "does not run out". Averages now leave out the time a seat was locked out,
  and the forecast says how much it left out.
• The Windows installer showed a rights notice where the pre-release terms belong. It now shows the Arbiter
  pre-release terms, and the activation screen has a Read the terms button that shows the same text.
• The message of a build past its 365 days now says where to get the current version: arbitermcp.com or
  the GitHub releases page.

New

• /tail starts every line with its time on your own clock: 23:18 for today, Tue 23:18 for this week,
  11 Nov 23:18 for older days. The header says when the session started and when it last did anything.
• /tail lists the background work a session is waiting on, newest first, and its last background result.
  A session that is idle but waiting on background work says so, in /tail and in /agents.
• /tail arbiter agents lists that session's agents, running ones first. /tail arbiter agent 2 reads one.
  You can name an agent by its number in the list, the start of its id, or words from its description.
• Attach files from the phone in three ways. Send /ticket attach ARB-041 as a message, then send photos or
  files: for ten minutes each one is kept on that ticket, and a caption is added as a note;
  /ticket attach off stops it. Or send a photo or file with no caption: Arbiter asks once which ticket
  should keep it, with buttons for your open tickets, a new Inbox ticket, or Ignore. Or write the ticket key
  as the caption.
• A mistyped command on the phone answers with the nearest commands as buttons, plus a button to ask the
  brain instead. A ticket, project or ticket type that does not exist answers with the nearest ones. Nothing
  runs until you tap.
• Ticket keys are read the way you type them: arb-41, ARB 41 and arb41 all mean ARB-041. A key that
  could mean two of your tickets is never guessed: Arbiter asks which one.
• /ticket new with parts missing walks you through it: tap the project, tap the type, then send the title
  as your next message. /ticket done, drop, reopen, block and note with no key show the tickets
  they can apply to.
• /help is one short page with topic buttons. /help tickets, /help tail and /help all go further,
  and every command comes with an example to copy.
• An agent can read a PDF, Word, Excel, PowerPoint, old Office or OpenDocument file attached to a ticket.
  Arbiter gives it a private copy to open with its own tools and removes the copy when the connection
  closes. Arbiter itself never opens the file. A file with macros, or in an old Office format, comes with a
  warning. Programs and archives are still never handed to an agent.

Changed

• Everything an agent reads from a ticket attachment starts with a label: the ticket, the file's name, type
  and size, where and when it was added, and a reminder that what the file says is information, not
  instructions. Photos and screenshots are handed over without location, camera details or comments; the
  picture itself is not changed, and a damaged image is refused. A text file comes between two marked lines
  that nothing inside the file can imitate. Sibling apps: docs/tickets_mcp_contract.md describes the new
  answer of arbiter_ticket_attachment.
• Phone buttons carry only a one-time code that expires after ten minutes. A tap runs exactly as if you had
  typed the command, so approvals, 2FA codes and stop-all still apply. /approve, /release, /auth and
  /stopall are only ever suggested as text, and a mistyped command never shows your 2FA code back to you.
• Phone replies no longer show patterns such as /release <2FA code>: each one shows an example to copy,
  such as /release 123456.
• /ticket done, drop and reopen change nothing when more words follow the ticket key; they ask instead.
• A seat whose usage poll fails now says why in the log, once for each new reason.
• The app shows each attachment's type in plain words, such as Word document, image or PDF document.
• Arbiter's MCP server runs on the mcp 2.3.0 SDK (it was 1.30.0). The protocol version it offers is
  unchanged, and every refusal still reaches the agent with its reason.
• The license notice shipped with Arbiter names the pre-release terms as the agreement under which you use
  it. The pre-release terms themselves are unchanged.

Build

Built from commit 295348b42e24bc03e066949bd6d5dee29443ca14 of Arbiter's source. Every download is listed with its SHA256 in arbiter-0.1.3-<os>-x64.SHA256SUMS, signed with the Code Reality Labs release key (fingerprint 0CF6 23D6 6975 AC42 EF02 A1EA 98F3 6798 1E68 D3E3).

Arbiter 0.1.2 (pre-release)

v0.1.2

An update to the 0.1.1 pre-release: a first install gets its local model without a command line, and Claude
seats on plans with a weekly limit only (Ultra) are forecast and handled like the others, with a usage
forecast that checks itself against what really happened.

Security

• Arbiter's own HTTPS connections now distrust the eMudhra intermediate certificates whose keys were disclosed
  on 2026-10-20 (CVE-2026-111943). Earlier versions, 0.1.0 and 0.1.1, trusted certificates issued with those
  keys, so someone on your network path holding them could have impersonated the services Arbiter connects to.
  No misuse has been reported. Updating to 0.1.2 is recommended.

Fixed

• A first install could leave the local brain without its model and point you to a command line. The model
  is a separate download of about 5 to 7 GB (Gemma 4, Apache 2.0 license, from Hugging Face; no account is
  needed). The Windows setup now offers it at the end, once, when your graphics card can run it; say yes and
  it downloads when Arbiter starts, with the progress shown in the app. Until the model is in place, every page
  of the app says so and downloads it with one click, as do Config, Brain and a "Brain not downloaded" chip at
  the top. arbiter setup-llm still downloads it on a machine without the app.
• On a machine without Memory (Curator), the MCP page no longer lists it as down, and adding a project with a
  memory domain no longer reports a failure: the project keeps the domain name.
• The daemon's log no longer names a separate product's command on machines where that product was never
  installed.
• Keep timers warm no longer starts a session on a seat whose plan has no 5-hour window. Such a seat was
  started every 30 minutes for nothing.
• "Next free" on the Seats page and in the Telegram report now judges a seat by its most used account window
  against the rotation percentage. A seat whose week was past that percentage, or one with a weekly limit only,
  used to read as free while rotation refused it.

Changed

• Claude seats on a plan with a weekly limit only (no 5-hour window, such as Ultra) are forecast in week
  points: when the week fills at your pace, who takes over and when everything pauses, instead of "no pace
  yet". The top bar, the Overview tile, the brief and the rotation reply name the week when it is the limit.
• The usage forecast checks itself. It replays its candidate paces (recent slopes, averages over hours and
  days, the average since the reset, and a model of how many terminals and agents are working against your
  usual load at that hour) over the last 7 days, scores how far each was off 1 to 72 hours later, and projects
  with the blend that did best, or keeps its previous rule where nothing beat it. The panel says how far off
  it was, for example "missed the week by about 8 points 24 hours ahead".
• Model weekly limits such as Fable's are forecast with their seat: when the model runs out on each seat and
  across all of them, and when it is back.
• Seats on different plans count the same work at their own size: measured once a seat has been in use,
  otherwise estimated from the plan (an Ultra week is 10 Pro weeks), and said so. Each seat shows how long it
  would last on its own.
• Tickets record their share of the week on every seat, are fitted in the unit of the seat in use, and say how
  long they take at their own terminals' pace.

Build

Built from commit a6e3d32e4dfdd95d6e61dfd9e0334893381cdcfe of Arbiter's source. Every download is listed with its SHA256 in arbiter-0.1.2-<os>-x64.SHA256SUMS, signed with the Code Reality Labs release key (fingerprint 0CF6 23D6 6975 AC42 EF02 A1EA 98F3 6798 1E68 D3E3).

Arbiter 0.1.1 (pre-release)

v0.1.1

An update to the 0.1.0 pre-release: the local model now fits itself to your graphics card, so a card with
8 GB runs it, and its answers no longer drift after a long request.

Changed

• The local model fits itself to your graphics card. At start Arbiter reads how much memory the card has and
  picks the model and the largest context window that still leave room for your desktop. A card with 10 GB or
  more runs Gemma 4 12B at the full 65,536-token window. An 8 GB card runs the same model at a smaller
  quantization (Q3_K_S, about 6.3 GB on the card), which matched or beat the full-size file on every job in
  Arbiter's own benchmark. Config, Brain and arbiter doctor show the card's memory and why the model and
  window were chosen, and arbiter setup-llm and the app's Get started download the model this card runs. A
  model or window you choose yourself is kept, with a warning when it looks too large for the card.
• On a card with less than 8 GB, the local model no longer tries to start and fails: Arbiter says how much
  memory the model needs and how much the card has, and everything else keeps working.

Fixed

• The local model's answers no longer drift after a long request. With Gemma 4 the brain kept part of the
  previous request's working memory that its sliding-window layers had already overwritten, so a call that
  followed a long chat step could come back wrong: approvals, routing, titles and Curator's extraction on the
  shared brain. A call on such a model now starts from a fresh context, or from a point saved exactly where
  its prompt stops matching a recent one, so a chat step re-reads only what changed since the step before:
  about 5.9 s a step for Gemma 4 12B on a 16 GB card, with the same scores on Arbiter's own benchmark.
• The app, arbiter mode status and Config, Brain said the local model was loaded when it had failed to
  load, for example before the model was downloaded. They now say loaded only once the model is in memory.
• On Windows, closing Arbiter from another program now ends it while it is hidden in the tray. An installer,
  a script or taskkill used to leave it running there, with its program file locked; your own close still
  hides it.

Build

Built from commit 7393bb24bb91967f32f200dd4f1da491e4a18492 of Arbiter's source. Every download is listed with its SHA256 in arbiter-0.1.1-<os>-x64.SHA256SUMS, signed with the Code Reality Labs release key (fingerprint 0CF6 23D6 6975 AC42 EF02 A1EA 98F3 6798 1E68 D3E3).

Arbiter 0.1.0 (pre-release)

v0.1.0

The first public pre-release of Arbiter, the command center above your AI tools: an early build for early
adopters, and the rough edges found here shape v1.

Before you start

• Arbiter needs a license. During the pre-release it is free: ask for one at arbitermcp.com, and the email
  brings your key. Activate it in the app's first screen or with arbiter activate.
• Windows will warn that it protected your PC, because this build is not code-signed yet: choose More info,
  then Run anyway. Every download is listed with its SHA256 in a SHA256SUMS file signed with the Code Reality
  Labs release key, so you can check what you got.

Added

• A desktop app (Windows, Linux) with pages for Home, Overview, Chat, Runs, Sessions, Tickets, Activity,
  Brief, MCP, Projects, Channels, Seats and Config. The Auditor and Curator pages appear when TheAuditor or
  Curator is installed beside it.
• One program, arbiter: the daemon (arbiter daemon), the MCP server for your coding agents
  (arbiter mcp), and the commands for projects, runs, tickets, settings, accounts, seats, schedules, the
  license, telemetry, 2FA and the service (arbiter project, arbiter run, arbiter ticket and the rest;
  arbiter <command> --help describes each one).
• A local daemon that dispatches, supervises and recovers work across coding clients, provider APIs and a
  local model. Its control surface is a named pipe on Windows and a Unix socket on Linux; no network port is
  opened unless you enable the HTTP control plane or Telegram's webhook mode.
• Tickets: a work list joined to what your terminals provably did, with phases, estimates from closed tickets,
  and MCP tools so your agents can file and update them.
• Cost-aware routing of each job to Claude Code, Codex, a provider API or the local model, with the decision
  and its reasons recorded.
• Terminals for Claude Code and Codex that survive their window and can be driven remotely: owned consoles on
  Windows (or tmux inside WSL, if you choose that host), tmux on Linux.
• Remote control from Telegram, with Signal and WhatsApp in beta: allowlisted users may read status. Once a
  channel is configured, two-factor approval is on by default: anything that runs code or sends a prompt needs
  a TOTP code from an enrolled authenticator, and is refused until one is enrolled.
• Seats: switch the logged-in Claude account without logging out, by hand or, when enabled, automatically
  before the active one runs dry, with a usage forecast.
• arbiter service install starts Arbiter at sign-in: a per-user entry on Windows, and on Linux a systemd user
  unit it writes and enables. arbiter service start|stop|status controls it.
• arbiter doctor checks this machine (including whether it can run the terminals it is configured for), and
  arbiter doctor --bundle collects versions, masked settings, recent logs and error references for a bug
  report; arbiter error-lookup shows the details behind an error reference.

Security

• All state is kept in SQLCipher databases whose keys are bound to this machine and user. Security modes add
  a license-held key fragment; the credentials database is only openable online in those modes.
• Settings that decide who may drive the machine, what it runs or where secrets go need a 2FA code once an
  authenticator is enrolled. Wrong codes are rate-limited: the sixth within 15 minutes locks further attempts
  for 15 minutes, doubling with each further lockout up to a day.
• Secrets are never shown back by the app or the CLI, and arbiter settings set reads them from a hidden
  prompt or stdin.
• The HTTP control plane is off by default, refuses keys shorter than 16 characters and requires TLS to listen
  beyond this machine.

Telemetry

• Telemetry shows a notice before anything is sent. The default level, lite, sends counts, durations, error
  types and an abstract routing record; it never sends prompts, code, file names, paths, project names or
  keys. arbiter telemetry off stops all of it, and arbiter telemetry status lists every field.
• Licensing is not telemetry: the license is checked in with the license server, and a seat you add talks to
  its provider with the login you gave it.

Requirements and known limitations

• Windows 10 or 11 (x64), or Linux x64. On Linux Arbiter needs glibc 2.34 or newer, and the desktop app needs
  WebKitGTK 4.1. macOS is not supported yet.
• The local model runs on your graphics card through Vulkan, so it needs a graphics driver with Vulkan
  support. It is not bundled: arbiter setup-llm downloads it.
• Claude Code and Codex are installed separately; Codex 0.158 or newer is required.
• This is a pre-release: the databases are versioned and migrate forward, but interfaces may still change.