AgenticNetOS 2.43.0

The governed-autonomy release: Agentic-Nets positions as a domain-general backend for designing, operating, observing, and continuously improving governed autonomous processes. Two shipped packages carry the story — a Safe Product Team worked example and a domain-neutral Model Steward whose authority is enforced by capability profile, not prompt hope.

Added

• Safe Product Team is now a complete MCP/Desktop worked example. MCP adds the start-safe-product-team playbook and agenticnets://docs/safe-product-team; the token-free dev-team template now includes repository/product context, decisions, reviewed lessons, structured status, and the Protocol place. The playbook stages a Product Manager, Architect, Developer, Reviewer, Release Guardian, and Chronicle around deterministic hand-offs, explicit repository policy, approval-gated external effects, and an evidence-backed smoke test without defining the product's domain boundary.
• Starter-pattern catalog and provider-free CLI reviewer. MCP now teaches a library of composable concept starters instead of treating one team as the universal entry point. The new headless-cli-reviewer template demonstrates safe MAP → CommandToken → COMMAND → durable result execution through read-only Claude Code or Codex on an executor; dynamic task text travels via environment data rather than shell interpolation.
• Agent Hub now ships Safe Product Team and Model Steward contracts. The versioned safe-product-team package is singleton per model so it writes to canonical p-protocol; it installs stopped with typed product/repository and approval schemas and reasoning-only authority. The domain-neutral model-steward package performs focused or scheduled evidence reviews of any model's nets/processes and can write only its review outputs and Protocol summaries. MCP adds review-current-model plus bundled Model Steward guidance, with an honest connected-client fallback when no server provider is configured.

Changed

• Desktop Lite documentation leads with persona teams and observability. The tray manual, Desktop operator guide, MCP README, and public README now teach the event trail (complete evidence), structured status (analysis), and Protocol (readable narrative) as the product loop; forums/chats are optional adapters rather than the team's source of truth. The same material explains MCP playbooks versus starter templates, versioned Agent/NetHub packages, context/tool-net packages, and the provider requirement of built-in runtime agents.

Fixed

• readiness no longer calls an unusable LLM provider READY (agentic-net-mcp). Provider health checks reachability and model presence, not usability: a cloud model outside the account's plan answers the model list fine and then rejects every inference on billing — a staging model ran 380 consecutive failures over a week while every diagnostic stayed green. When health reports READY, readiness now cross-checks the recent event line; if the last llm/agent fires all failed with zero successes, it reports llm.usable:false with the raw provider error, flips capabilities.llmLanes off, and lists a blocking problem naming the repair. For a product whose stated USP is honest observability, health-as-reachability was the one place the claim was untrue.
• Windows update no longer ends in silence (agentic-net-desktop — SelfUpdater). The tray update spawned a bare interactive msiexec /i from a process that had just quit: the wizard routinely opened behind other windows, so the user watched AgenticNetOS shut down and then saw nothing at all — and even when the install ran to completion, the script simply ended, relaunching nothing (field report from a 2.40.1 install). The installer now runs /passive (progress bar, no clicks) with a verbose log beside the downloaded msi, relaunches the app on success (including exit 3010, success-wants-reboot), and on failure opens the log in Notepad — a visible artifact instead of silence. The tray manual's troubleshooting table explains the older-version behavior and its recovery.

---

AgenticNetOS Desktop Lite

The fast local creator/operator profile: node, deterministic master, gateway,
executor, encrypted local credential vault (no OpenBao), MCP endpoint, and
Studio — supervised by a tray app on bundled Java/Node runtimes. No Docker,
host Java/Node installation, API key, or server-side LLM is required. Connect
an MCP client and let its model build, schedule, inspect, and execute nets.
This loopback-only profile is not the recommended production deployment.

macOS: open the .dmg, accept the license, drag AgenticNetOS to Applications.
First launch of this unsigned build: right-click the app and choose "Open", or allow
it under System Settings → Privacy & Security → "Open Anyway". Verify the download
against SHA256SUMS.txt first.

Linux (Debian/Ubuntu): sudo apt install ./AgenticNetOS-<version>-linux-<arch>.deb,
then run /opt/agenticnetos/bin/AgenticNetOS. An
.rpm is provided for Fedora/RHEL. On servers without a desktop the app runs headless;
the tray is optional.

Windows: run AgenticNetOS-<version>-windows-x64.msi (unsigned; SmartScreen may
warn on first run). Upgrades install over the old version in place; the upgrade path
is CI-tested against the previous published release. Data in ~/.agenticos is never
touched by the installer, including by a failed one.

Build it yourself: agentic-net-desktop/scripts/build.sh (or build-windows.ps1)
in the repository bundles an installer for your machine from this release's
standalone binaries (agentic-net-node-*.jar, agentic-net-master-*.jar,
agentic-net-gui-*.zip below — EULA applies), no Docker needed.

Connect an MCP client: the tray copies a ready Codex config.toml block,
Claude Code command, or generic MCP URL + bearer token. Studio: tray menu →
"Open Studio" signs you in automatically (a single-use link exchanges the admin
secret server-side; it never reaches the browser).
Server-run AI lanes can be enabled later, but fresh installs use
llm.provider=disabled, so new AI lanes default to MCP external fires and need
no server model.

Data lives in ~/.agenticos/ and survives updates. The bundled node, master and
gui binaries are covered by the EULA shown at install (also in the app dir);
everything else is BSL 1.1.

AgenticNetOS 2.42.0

The persona-first release: for judgment-heavy goals every surface now proposes a named specialist or team before exposing workflow machinery, and a persona can keep its full bounded agent loop while reasoning through a local headless Claude Code or Codex session — unattended, with no server LLM provider. Proven end to end before shipping: a bash-mode developer persona on a provider-less master answered a task with nobody connected, input consumed exactly once.

Added

• Persona-first authoring across MCP, CLI, integrations, and Desktop. Newcomer guidance now starts with named specialists (developer, health coach, domain expert) and specialist teams, then teaches the Agentic-Net beneath them: charter, inbox/outbox, durable context, deterministic review hand-offs, context playbooks via typed link transitions, and reviewable learning that can crystallize into tool-nets. MCP adds agenticnets://docs/personas and the design-persona-team prompt; the tray manual teaches the same model in both Desktop editions.
• Explicit persona execution backends (agentic-net-mcp). spawn_persona accepts server, claude-code, codex, connected-client, or health-aware auto; add_transition kind:"agent" exposes llmMode:"bash" and binary:"claude"|"codex". Every persona creation result names its backend and whether it runs while disconnected.

Changed

• Persona agents are the default product language. MCP instructions, CLI agent knowledge, the OpenCode integration, and the Claude control skill now proactively translate judgment-heavy goals into a specialist or team and reserve naked workflows for deterministic routing and bookkeeping.

Fixed

• Provider-disabled master no longer strands CLI-backed agent transitions (agentic-net-master). The scheduler, direct dispatcher, start warnings, external-fire roster, and runtime status now distinguish provider-backed AI lanes from agent lanes that reason through a local headless Claude Code/Codex process. CLI-backed personas stay master-owned and schedulable; diagnostics expose executionBackend and requiresServerLlmProvider so clients do not race or misreport them. The explicit bash backend is now honored even when an agent declares no tier, and Codex sessions run ephemerally in a read-only sandbox with the non-repository prompt directory handled explicitly.
• CLI availability is probed, never assumed (agentic-net-master, agentic-net-mcp, agentic-net-desktop). Three layers of the same honesty gap, found in review. (1) Master now probes each headless CLI by actually running it — command -v alone passes a wrapper whose vendor payload is broken, seen live — and reports llm_health.headlessCliBinaries; a bash-backed lane whose binary is unreachable is skipped by the scheduler and refused by explicit fires (tokens preserved, preset locks released) instead of flapping through exit-127 → error → RestartBackoff, and the servable verdict returns a new stranded reason CLI_BINARY_MISSING naming the actual repair. (2) spawn_persona execution:"claude-code"|"codex" fails fast against that probe rather than building a persona that could never fire; readiness.capabilities.headlessCliAgents and the youAreTheRuntime guidance now reflect the probe instead of asserting support; scheduler_status marks a scheduled CLI-backed lane with an unreachable binary willNotFireUnattended. (3) The desktop launcher appends ~/.local/bin, /opt/homebrew/bin and /usr/local/bin to its children's PATH — a tray-launched app inherits launchd's minimal PATH, so master could not see the claude that works in every terminal, which would have made the flagship backend fail with exit 127 on the flagship platform.
• A bash-mode persona without tier config no longer inherits the API provider's model name (agentic-net-master — AgentSessionService). With a provider configured (say Ollama) and llmMode:"bash", the tier resolver's fallback handed the provider's default model to the CLI — claude --model <ollama-model> fails. The CLI now receives a model only when the inscription explicitly names a tier or model; otherwise it uses its own default.

---

AgenticNetOS Desktop Lite

The fast local creator/operator profile: node, deterministic master, gateway,
executor, encrypted local credential vault (no OpenBao), MCP endpoint, and
Studio — supervised by a tray app on bundled Java/Node runtimes. No Docker,
host Java/Node installation, API key, or server-side LLM is required. Connect
an MCP client and let its model build, schedule, inspect, and execute nets.
This loopback-only profile is not the recommended production deployment.

macOS: open the .dmg, accept the license, drag AgenticNetOS to Applications.
First launch of this unsigned build: right-click the app and choose "Open", or allow
it under System Settings → Privacy & Security → "Open Anyway". Verify the download
against SHA256SUMS.txt first.

Linux (Debian/Ubuntu): sudo apt install ./AgenticNetOS-<version>-linux-<arch>.deb,
then run /opt/agenticnetos/bin/AgenticNetOS. An
.rpm is provided for Fedora/RHEL. On servers without a desktop the app runs headless;
the tray is optional.

Windows: run AgenticNetOS-<version>-windows-x64.msi (unsigned; SmartScreen may
warn on first run). Upgrades install over the old version in place; the upgrade path
is CI-tested against the previous published release. Data in ~/.agenticos is never
touched by the installer, including by a failed one.

Build it yourself: agentic-net-desktop/scripts/build.sh (or build-windows.ps1)
in the repository bundles an installer for your machine from this release's
standalone binaries (agentic-net-node-*.jar, agentic-net-master-*.jar,
agentic-net-gui-*.zip below — EULA applies), no Docker needed.

Connect an MCP client: the tray copies a ready Codex config.toml block,
Claude Code command, or generic MCP URL + bearer token. Studio: tray menu →
"Open Studio" signs you in automatically (a single-use link exchanges the admin
secret server-side; it never reaches the browser).
Server-run AI lanes can be enabled later, but fresh installs use
llm.provider=disabled, so new AI lanes default to MCP external fires and need
no server model.

Data lives in ~/.agenticos/ and survives updates. The bundled node, master and
gui binaries are covered by the EULA shown at install (also in the app dir);
everything else is BSL 1.1.

AgenticNetOS 2.41.0

Everything here comes from one field report: a Claude Code client on a Windows Desktop Lite install built a scheduled persona net whose reasoning step spawns headless Claude Code, and documented every place our own teaching misled it. Two patterns we shipped as canonical turned out to be wrong.

Added

• docs/real-agents — building real agents on nets (agentic-net-mcp). The new knowledge doc answers what a client needs before it starts rather than after it has guessed: a persona is a net (charter place, task inbox, reasoning lane, output place), and its reasoning step has four possible executors — a server llm/agent lane, a command lane spawning a headless CLI agent, an external fire, or host_transition — with a table of which are unattended and what each requires. The consequence worth knowing up front: when master has no LLM provider, a command lane spawning headless Claude Code is the only fully unattended reasoning path, so a provider-less install can still fetch, compute and reason with nobody connected. Also covers workingDir as the context switch (a spawned agent auto-loads that project's memory — capability and hazard), multi-agent systems as nets sharing places, and the cost/secret boundaries. Reachable as agenticnets://docs/real-agents and through search_knowledge.

Fixed

• The documented way to spawn a CLI agent was the quoting trap (agentic-net-mcp — server instructions, docs/commands, docs/recipes). We taught claude -p '<prompt>' … < /dev/null. Through the chain of command token → executor process spawn → shell, those nested quotes can be consumed: the CLI then starts with no prompt at all, waits ~3s for stdin, and answers at its own discretion — with the workingDir project's memory loaded, so the output looks plausible rather than obviously broken. Every occurrence now teaches printf '%s' '<prompt>' | claude -p --model sonnet …, which removes nested quoting entirely and supplies stdin, so the redirect that the old form needed is no longer a separate thing to remember.
• Windows command-lane setup was documented wrongly (agentic-net-mcp — docs/commands, docs/real-agents). "Windows needs Git Bash on PATH" does not describe what happens: the executor spawns /bin/sh, which Windows resolves against the current drive root, i.e. C:\bin\sh.exe. The docs now give the actual one-time bridge (copy Git's usr\bin\sh.exe and msys-2.0.dll into C:\bin\, create an empty C:\tmp\), name the trap that Git's other sh.exe is a 47 KB launcher which cannot work relocated, and state the shell's real constraints — no MSYS mount table (/c/... paths are meaningless), no GNU userland, so use Windows paths with forward slashes and an absolute args.workingDir.
• docs/llm implied a session-bound feature was the unattended answer (agentic-net-mcp). Its provider-disabled section offered host_transition for "unattended AI lanes", but hosted lanes run only while the MCP session is connected. It now points at the command-lane path for genuinely unattended reasoning and keeps host_transition in its true role.
• The server instructions omitted external-fire from the topic list (agentic-net-mcp). The doc shipped and was searchable, but the one place that enumerates the pack for a new client never named it — a gap in exactly the area a provider-less install depends on.

Changed

• Knowledge-pack budget and its guard (agentic-net-mcp). The pack cap moves 72 KB → 78 KB for the new doc; the 8 KB per-doc discipline is unchanged. The instructions size test now pins the multi-model build as well as the single-model one — the multi-model preamble is longer, and that build was already 23 bytes over the cap with every test green.

Windows update repair. If you are on 2.40.0 or earlier, this release's update still runs through the old updater — if it stops with "cannot close AgenticNetOS" or "error writing to file", end the leftover AgenticNetOS/node.exe/java.exe processes (or reboot) and run the installer from the releases page. Your data in ~/.agenticos is never touched by the installer, including by a failed one. From this version on, the updater handles that case itself.

Added

• Windows upgrade is tested in CI (.github/workflows/desktop-windows.yml). Nothing in any suite ran msiexec, so the upgrade path could only be tested by shipping it. A new job installs the previous published release, runs it (Studio answering on 4200 proves the jlink runtime, service jars and static GUI all reached the bundle), seeds a marker under ~/.agenticos, upgrades in place, and asserts exactly one registered install at the new version, the marker intact, and the upgraded app still serving.

Fixed

• Updates identify our processes positively before killing anything (agentic-net-desktop — new PidRegistry, InstallProcesses). Two independent identifications, either sufficient, nothing less accepted. (1) Every spawned child is recorded at ~/.agenticos/desktop/run/<service>/pid as <pid> <startEpochMillis>; an entry counts only when the live process's start instant matches the record — pids are numbers the OS reuses, and a crashed launcher's orphans still carry their records. (2) A scan for processes whose executable resolves under the install root (symlinks resolved — macOS /var is one) and carries a shipped image name (java/node/AgenticNetOS), the fallback for lost registrations. Identified processes are killed and awaited until provably dead; a process under the root that is not positively ours is never killed — it surfaces as a survivor and the update aborts naming it, rather than letting msiexec fail into a rollback. Descendants are deliberately not expanded: tree membership is not identity. On macOS the sweep runs before the update applier is spawned, since the applier is itself a java process from the install runtime and must not be swept.
• Windows tray update could destroy the installation (agentic-net-desktop — SelfUpdater, Supervisor, TrayUi). The updater started msiexec FIRST and then began the multi-second service shutdown, so the installer's files-in-use scan always caught the app running. Windows Restart Manager cannot close the background node/java children (no windows, not registered), and force-closing the tray process skipped the JVM shutdown hook and orphaned them — an orphaned MCP node.exe then held handles under app\mcp\, the install failed with "error writing to file", and cancelling rolled back a half-done upgrade whose old version was already removed, leaving no installation at all. The update now stops every child and waits for the kills to land (including after destroyForcibly, since handles release only at actual process death), then launches msiexec through a detached script with a ~2s delay so the launcher itself has exited before the scan runs. User data under ~/.agenticos/ was never at risk — the msi only manages the app directory. Recovery on affected versions: end the leftover AgenticNetOS/node.exe/java.exe processes (or reboot) and re-run the installer.

---

AgenticNetOS Desktop Lite

The fast local creator/operator profile: node, deterministic master, gateway,
executor, encrypted local credential vault (no OpenBao), MCP endpoint, and
Studio — supervised by a tray app on bundled Java/Node runtimes. No Docker,
host Java/Node installation, API key, or server-side LLM is required. Connect
an MCP client and let its model build, schedule, inspect, and execute nets.
This loopback-only profile is not the recommended production deployment.

macOS: open the .dmg, accept the license, drag AgenticNetOS to Applications.
First launch of this unsigned build: right-click the app and choose "Open", or allow
it under System Settings → Privacy & Security → "Open Anyway". Verify the download
against SHA256SUMS.txt first.

Linux (Debian/Ubuntu): sudo apt install ./AgenticNetOS-<version>-linux-<arch>.deb,
then run /opt/agenticnetos/bin/AgenticNetOS. An
.rpm is provided for Fedora/RHEL. On servers without a desktop the app runs headless;
the tray is optional.

Windows: not yet published — planned.

Build it yourself: agentic-net-desktop/scripts/build.sh (or build-windows.ps1)
in the repository bundles an installer for your machine from this release's
standalone binaries (agentic-net-node-*.jar, agentic-net-master-*.jar,
agentic-net-gui-*.zip below — EULA applies), no Docker needed.

Connect an MCP client: the tray copies a ready Codex config.toml block,
Claude Code command, or generic MCP URL + bearer token. Studio: tray menu →
"Open Studio" (login secret is one click away under "Copy Studio Admin Secret").
Server-run AI lanes can be enabled later, but fresh installs use
llm.provider=disabled, so new AI lanes default to MCP external fires and need
no server model.

Data lives in ~/.agenticos/ and survives updates. The bundled node, master and
gui binaries are covered by the EULA shown at install (also in the app dir);
everything else is BSL 1.1.

AgenticNetOS 2.40.1

Windows update repair. If you are on 2.40.0 or earlier, this release's update still runs through the old updater — if it stops with "cannot close AgenticNetOS" or "error writing to file", end the leftover AgenticNetOS/node.exe/java.exe processes (or reboot) and run the installer from the releases page. Your data in ~/.agenticos is never touched by the installer, including by a failed one. From this version on, the updater handles that case itself.

Added

• Windows upgrade is tested in CI (.github/workflows/desktop-windows.yml). Nothing in any suite ran msiexec, so the upgrade path could only be tested by shipping it. A new job installs the previous published release, runs it (Studio answering on 4200 proves the jlink runtime, service jars and static GUI all reached the bundle), seeds a marker under ~/.agenticos, upgrades in place, and asserts exactly one registered install at the new version, the marker intact, and the upgraded app still serving.

Fixed

• Updates identify our processes positively before killing anything (agentic-net-desktop — new PidRegistry, InstallProcesses). Two independent identifications, either sufficient, nothing less accepted. (1) Every spawned child is recorded at ~/.agenticos/desktop/run/<service>/pid as <pid> <startEpochMillis>; an entry counts only when the live process's start instant matches the record — pids are numbers the OS reuses, and a crashed launcher's orphans still carry their records. (2) A scan for processes whose executable resolves under the install root (symlinks resolved — macOS /var is one) and carries a shipped image name (java/node/AgenticNetOS), the fallback for lost registrations. Identified processes are killed and awaited until provably dead; a process under the root that is not positively ours is never killed — it surfaces as a survivor and the update aborts naming it, rather than letting msiexec fail into a rollback. Descendants are deliberately not expanded: tree membership is not identity. On macOS the sweep runs before the update applier is spawned, since the applier is itself a java process from the install runtime and must not be swept.
• Windows tray update could destroy the installation (agentic-net-desktop — SelfUpdater, Supervisor, TrayUi). The updater started msiexec FIRST and then began the multi-second service shutdown, so the installer's files-in-use scan always caught the app running. Windows Restart Manager cannot close the background node/java children (no windows, not registered), and force-closing the tray process skipped the JVM shutdown hook and orphaned them — an orphaned MCP node.exe then held handles under app\mcp\, the install failed with "error writing to file", and cancelling rolled back a half-done upgrade whose old version was already removed, leaving no installation at all. The update now stops every child and waits for the kills to land (including after destroyForcibly, since handles release only at actual process death), then launches msiexec through a detached script with a ~2s delay so the launcher itself has exited before the scan runs. User data under ~/.agenticos/ was never at risk — the msi only manages the app directory. Recovery on affected versions: end the leftover AgenticNetOS/node.exe/java.exe processes (or reboot) and re-run the installer.

---

AgenticNetOS Desktop Lite

The fast local creator/operator profile: node, deterministic master, gateway,
executor, encrypted local credential vault (no OpenBao), MCP endpoint, and
Studio — supervised by a tray app on bundled Java/Node runtimes. No Docker,
host Java/Node installation, API key, or server-side LLM is required. Connect
an MCP client and let its model build, schedule, inspect, and execute nets.
This loopback-only profile is not the recommended production deployment.

macOS: open the .dmg, accept the license, drag AgenticNetOS to Applications.
First launch of this unsigned build: right-click the app and choose "Open", or allow
it under System Settings → Privacy & Security → "Open Anyway". Verify the download
against SHA256SUMS.txt first.

Linux (Debian/Ubuntu): sudo apt install ./AgenticNetOS-<version>-linux-<arch>.deb,
then run /opt/agenticnetos/bin/AgenticNetOS. An
.rpm is provided for Fedora/RHEL. On servers without a desktop the app runs headless;
the tray is optional.

Windows: not yet published — planned.

Build it yourself: agentic-net-desktop/scripts/build.sh (or build-windows.ps1)
in the repository bundles an installer for your machine from this release's
standalone binaries (agentic-net-node-*.jar, agentic-net-master-*.jar,
agentic-net-gui-*.zip below — EULA applies), no Docker needed.

Connect an MCP client: the tray copies a ready Codex config.toml block,
Claude Code command, or generic MCP URL + bearer token. Studio: tray menu →
"Open Studio" (login secret is one click away under "Copy Studio Admin Secret").
Server-run AI lanes can be enabled later, but fresh installs use
llm.provider=disabled, so new AI lanes default to MCP external fires and need
no server model.

Data lives in ~/.agenticos/ and survives updates. The bundled node, master and
gui binaries are covered by the EULA shown at install (also in the app dir);
everything else is BSL 1.1.

AgenticNetOS 2.40.0

Changed

• external can only be set explicitly (agentic-net-master, agentic-net-mcp, agentic-net-desktop). A provider-less master used to auto-mark every newly deployed llm/agent lane external, overloading a marker that is supposed to mean "I chose MCP-only execution" with "master happened to lack a provider that day" — and because starting a lane writes an explicit opt-out, one start_transition then made it invisible to the only thing that could run it. Now nothing but set_external produces that status. A provider-less master instead skips its llm/agent lanes: they keep a normal lifecycle (deployed, or running) and wait, rather than firing into a guaranteed LlmDisabledException and flapping error ⇄ running on RestartBackoff — which, for any lane carrying the when:"error" emit branch we tell every client to add, was quietly consuming real input tokens into error tokens on every retry. Lanes already carrying status=external keep it; set_external {all:true, external:false} returns them.

Added

• The CLI can serve AI lanes (agentic-net-cli). New agenticos transition lanes [--all] lists llm/agent lanes with their servable verdict, and agenticos transition serve [id] runs them with the CLI's own LLM provider. MasterApi gained listAiLanes, setExternal, prepareExternalFire, completeExternalFire and abandonExternalFire. This is the external-fire protocol, not EXECUTE_TRANSITION: master still binds and leases the tokens, applies the inscription's emit rules, consumes exactly what it showed the client, and books usage — so a lane served from outside behaves identically to a master-run one, which is what makes a provider-less master a configuration difference rather than a behavioural one. Verified end-to-end against a live master: input consumed exactly once, @response.json parsed by master into the postset. Agent lanes are skipped with a pointer, since they need the authorized tool loop an MCP client provides; a failed serve always abandons its lease so the inputs stay retryable rather than blocked for the 30-minute TTL.
• The AI-lane roster with a servable verdict (agentic-net-master, agentic-net-mcp). GET /api/transitions/external/ready gains includeAll=true, listing every llm/agent lane of a model whatever its status, each with servable + servableReason (MARKED_EXTERNAL · MASTER_HAS_NO_PROVIDER · LANE_IDLE · MASTER_OWNS_IT · NO_TOKENS_BOUND · POSTSET_AT_CAPACITY · FIRE_IN_FLIGHT · NOT_DEPLOYED), plus a provider block. list_external_fires exposes it as includeAll, counts stranded lanes, and returns a hint pointing at the wider view whenever the provider is off — the default view is precisely the one that hides stranded lanes. The verdict is advice, not a gate. set_external {all:true} now resolves lanes through this one endpoint instead of sweeping /runtime/transitions and re-deriving "is this an AI lane" client-side.
• A client can take over a running AI lane (agentic-net-master). prepare_external_fire and complete_external_fire no longer refuse running lanes (only starting, which has no stable bindings): with no provider, refusing left a lane unrunnable by anyone. Master stands down while a prepared fire is in flight, closing the one hole the existing token lease did not already cover (preset-less agent lanes). The prepare response carries takenOverFromMaster so a client can say so rather than doing it silently.
• The protocol volunteers the external-fire backlog (agentic-net-mcp). Without a server-side provider, llm/agent lanes run only while an MCP client is connected, and a cron on one is armed but dispatched by nobody. That was previously discoverable only by knowing to call list_external_fires. Now readiness reports llm.youAreTheRuntime plus an externalFires block counting the lanes holding bound tokens, and warns naming them (a backlog is pending work, so it does not make the installation unready); scheduler_status marks such lanes willNotFireUnattended and lists them under headline.externalScheduled; the server instructions tell the connected client to check the count early in a session, report it, and offer to work it; and the new work-external-fires prompt is that recipe on demand. The scheduling instructions and docs/scheduling no longer claim that every scheduled transition runs unattended, which was false for exactly these lanes.
• Newcomer manual in the tray (agentic-net-desktop). A new Manual (Start Here) item, grouped with the MCP connect actions, opens a self-contained guide written for people who have never seen a Petri net: what Desktop Lite is (memory, clock and hands for an MCP client that already thinks), how to connect Claude Code or Codex and verify with readiness, the five-term vocabulary, seven things worth building (durable memory, composable linked context, scheduled nets replacing repeated sessions, autonomous personas, zero-LLM watchers, local command lanes, crystallization), copy-paste starter prompts, an honest table of what does and does not run while no client is connected, cost/safety boundaries, and a symptom-to-tool troubleshooting table. The launcher serves it from its own jar at http://localhost:4200/manual, so it versions with the app, needs no login nonce, and stays readable while the services are still starting or failing to start. DESKTOP-LITE.md remains the operator reference.

---

AgenticNetOS Desktop Lite

The fast local creator/operator profile: node, deterministic master, gateway,
executor, encrypted local credential vault (no OpenBao), MCP endpoint, and
Studio — supervised by a tray app on bundled Java/Node runtimes. No Docker,
host Java/Node installation, API key, or server-side LLM is required. Connect
an MCP client and let its model build, schedule, inspect, and execute nets.
This loopback-only profile is not the recommended production deployment.

macOS: open the .dmg, accept the license, drag AgenticNetOS to Applications.
First launch of this unsigned build: right-click the app and choose "Open", or allow
it under System Settings → Privacy & Security → "Open Anyway". Verify the download
against SHA256SUMS.txt first.

Linux (Debian/Ubuntu): sudo apt install ./AgenticNetOS-<version>-linux-<arch>.deb,
then run /opt/agenticnetos/bin/AgenticNetOS. An
.rpm is provided for Fedora/RHEL. On servers without a desktop the app runs headless;
the tray is optional.

Windows: not yet published — planned.

Build it yourself: agentic-net-desktop/scripts/build.sh (or build-windows.ps1)
in the repository bundles an installer for your machine from this release's
standalone binaries (agentic-net-node-*.jar, agentic-net-master-*.jar,
agentic-net-gui-*.zip below — EULA applies), no Docker needed.

Connect an MCP client: the tray copies a ready Codex config.toml block,
Claude Code command, or generic MCP URL + bearer token. Studio: tray menu →
"Open Studio" (login secret is one click away under "Copy Studio Admin Secret").
Server-run AI lanes can be enabled later, but fresh installs use
llm.provider=disabled, so new AI lanes default to MCP external fires and need
no server model.

Data lives in ~/.agenticos/ and survives updates. The bundled node, master and
gui binaries are covered by the EULA shown at install (also in the app dir);
everything else is BSL 1.1.

AgenticNetOS 2.39.0

Hardening wave driven by a field report from an MCP client that built a real
scheduled data pipeline: everything below removes a way the platform could
mislead or endanger unattended work.

Added

• Desktop Lite MCP is focused by default (agentic-net-desktop, agentic-net-mcp). The bundled server registers the curated lowercase product surface instead of also exposing the full native uppercase catalog; standalone/server deployments remain backward-compatible with all, and advanced Desktop users can opt back in with AGENTICOS_NATIVE_TOOLS=all.
• Batch authoring and cleanup tools (agentic-net-mcp). add_transitions creates similar lanes sequentially with explicit per-item partial-success results, while delete_tokens requires an ArcQL query, caps a run at 100 tokens, and reports every matched/deleted id.
• Bounded FOREACH batches (agentic-net-mcp, agentic-net-executor). add_transition(mode:"FOREACH", batchSize:n) writes LIMIT n plus take:ALL, reports the exact per-fire semantics, and the command executor now runs once per bound driver token instead of discarding all but the first.
• Scheduler and HTTP guidance for model-free MCP operation (agentic-net-mcp). The connected model is taught fail-closed scheduling, IANA cron timezones, armed-vs-fired telemetry, stopped schedules, safe smoke fires, raw response.text/diagnostic response.meta, and CSV processing recipes.

Changed

• fire_once safely tests running deterministic lanes (agentic-net-mcp). It defaults preserveRunning:true, so a connected Claude/Codex session no longer needs the risky stop/fire/start sequence; lifecycle is unchanged, although the action's own side effects still happen.
• Scheduler status explains unattended work (agentic-net-mcp). It passes through timezone, local next-fire time, honest fire/outcome timestamps and counters, headlines stopped and invalid schedules, and keeps intentional stops as readiness warnings rather than declaring the whole installation unusable.
• Large nested token values truncate structurally (agentic-net-mcp). JSON values that exceed preview limits become a parseable __truncated__ object with byte count and preview instead of a broken JSON fragment.

Fixed

• preserveRunning actually reaches the master (agentic-net-cli). MasterApi.fireOnce and the agent FIRE_ONCE tool now forward the flag (and advertise it in the native tool schema); previously the MCP's default lifecycle-safe smoke test silently degraded to the legacy 409-while-running because the CLI dropped the parameter.
• One Desktop executor discovers and serves every model (agentic-net-executor, agentic-net-desktop). Wildcard model discovery polls continuously, status distinguishes READY/STANDBY/UNAVAILABLE, and MCP describes STANDBY as command-capable capacity rather than a failure—so a model created after startup does not silently lose command transitions.
• Per-model protocol journals and MCP duties are discoverable (agentic-net-mcp, agentic-net-desktop). Connected sessions are explicitly told to service external LLM/agent fires, choose a fresh model for a substantial domain, use local headless command lanes where appropriate, and write/read structured protocol entries that open from the tray.

---

AgenticNetOS Desktop Lite

The fast local creator/operator profile: node, deterministic master, gateway,
executor, encrypted local credential vault (no OpenBao), MCP endpoint, and
Studio — supervised by a tray app on bundled Java/Node runtimes. No Docker,
host Java/Node installation, API key, or server-side LLM is required. Connect
an MCP client and let its model build, schedule, inspect, and execute nets.
This loopback-only profile is not the recommended production deployment.

macOS: open the .dmg, accept the license, drag AgenticNetOS to Applications.
First launch of this unsigned build: right-click the app and choose "Open", or allow
it under System Settings → Privacy & Security → "Open Anyway". Verify the download
against SHA256SUMS.txt first.

Linux (Debian/Ubuntu): sudo apt install ./AgenticNetOS-<version>-linux-<arch>.deb,
then run /opt/agenticnetos/bin/AgenticNetOS. An
.rpm is provided for Fedora/RHEL. On servers without a desktop the app runs headless;
the tray is optional.

Windows: not yet published — planned.

Build it yourself: agentic-net-desktop/scripts/build.sh (or build-windows.ps1)
in the repository bundles an installer for your machine from this release's
standalone binaries (agentic-net-node-*.jar, agentic-net-master-*.jar,
agentic-net-gui-*.zip below — EULA applies), no Docker needed.

Connect an MCP client: the tray copies a ready Codex config.toml block,
Claude Code command, or generic MCP URL + bearer token. Studio: tray menu →
"Open Studio" (login secret is one click away under "Copy Studio Admin Secret").
Server-run AI lanes can be enabled later, but fresh installs use
llm.provider=disabled, so new AI lanes default to MCP external fires and need
no server model.

Data lives in ~/.agenticos/ and survives updates. The bundled node, master and
gui binaries are covered by the EULA shown at install (also in the app dir);
everything else is BSL 1.1.

AgenticNetOS 2.38.0

Changed

• Default Ollama model lineup is now glm-5.2 + kimi-k3 (deployment/.env.template, all compose files, agentic-net-desktop). Default/low/medium tiers default to glm-5.2:cloud, high/thinking to kimi-k3:cloud (previously a deepseek-v4/llama3.2 mix that no longer matched any real deployment). Explicit env values override as before.

Added

• Desktop: tray glyph matches the brand icon (agentic-net-desktop). The tray icon and the Linux application icon now draw the three connected places of the Agentic-Nets icon instead of a single place with two tokens — monochrome per platform theme, dimmed while starting, red corner badge when a service needs attention.

• Desktop: Windows parity + release-built msi (agentic-net-desktop, .github/workflows/desktop-windows.yml). The launcher now behaves on Windows like everywhere else: Start at Login writes a Startup-folder entry, self-update resolves the windows-<arch>.msi asset and launches the verified installer (per-user, fixed UpgradeCode so it upgrades in place), the tray glyph follows the Windows taskbar theme, and the installed-binary lookup knows the Windows jpackage layout. build-windows.ps1 gains the missing Maven wrapper and runs in GitHub Actions per release using the release assets (no Docker, no Windows hardware), attaching the msi to the release; sign-windows-asset.sh (private ci repo) folds its checksum into the signed manifest so Windows self-updates stay inside the pinned-key trust chain. Command transitions on Windows need a bash on PATH (Git Bash); MCP-first usage does not.

• Desktop: LLM provider settings in Studio (agentic-net-desktop, gui). The Settings page gains a "Desktop LLM" card (visible only under Desktop Lite): provider (disabled/Ollama/Claude), Ollama base URL, default + low/medium/high/thinking tier models, and the Anthropic key (stored 0600 in desktop.properties, returned masked, blank never wipes it). Saving goes through a new launcher-served loopback API (/desktop-api/llm-settings, gateway-JWT-authenticated, DNS-rebind-guarded) that rewrites desktop.properties comments-preserved and restarts just the master child (~10s) with the new environment — no file editing, no full-stack restart. The tray gains "LLM Settings" deep-linking into the authenticated Studio settings page.

• Desktop: Linux menu entry + Start at Login (agentic-net-desktop). First launch inside a Linux desktop session installs a per-user application-menu entry with the brand-glyph icon (packages stay free of xdg postinst hooks, so headless installs keep configuring cleanly), and the tray gains a "Start at Login" toggle — XDG autostart on Linux, a LaunchAgent on macOS.

• Desktop: one-click Studio login, signed updates, notarization hooks (agentic-net-desktop, SECURITY.md). "Open Studio" now signs the user in automatically: the tray mints a single-use 60-second link, the built-in Studio server exchanges the admin secret for a JWT entirely server-side (the secret never reaches the browser) and seeds the GUI's own session storage — no more copying the admin secret; replayed, forged and DNS-rebound requests are refused, and the desktop gateway issues day-long tokens so Studio stays signed in. Release checksums now carry a detached Ed25519 signature verified against a key pinned in the launcher and the clone-and-build scripts (published in SECURITY.md): the self-updater and release-asset fetchers refuse unsigned or tampered releases, so a compromised download channel can no longer feed updates to existing installs. build-desktop.sh gains Developer ID signing + notarytool/stapler hooks (AGENTICOS_MAC_SIGN_IDENTITY, AGENTICOS_NOTARY_PROFILE) that activate when the credentials exist, and the macOS update applier verifies the staged app's code signature before swapping.

• AgenticNetOS Desktop Lite (agentic-net-desktop, open launcher scaffolding under BSL). One installer provides Studio and a tray-supervised local runtime on bundled Java/Node runtimes, with no Docker or host runtime installation. It starts the file-backed encrypted vault, node, deterministic master, gateway, one direct-mode executor, and the Streamable HTTP MCP server in health-gated order; partial startup is rolled back. Studio is served at :4200 with the same gateway proxy paths as production. Every listener is fixed to loopback, settings and generated tokens are user-only on POSIX, and state under ~/.agenticos/ survives updates. This is explicitly the quick local creator/operator profile, not the recommended production deployment.

  • MCP-first, no server model required. A fresh profile sets llm.provider=disabled. Newly deployed llm/agent lanes then inherit external execution automatically unless an explicit transition/net/session/model policy overrides it. Master still owns token binding/consumption, inscriptions, schedules, policy, accounting, and the event trail while Codex, Claude, or another connected MCP model performs the reasoning. MCP health/readiness treats DISABLED as an intentional capability mode, not an outage. The tray copies ready Codex config.toml, Claude Code, or generic MCP endpoint credentials; server-side Ollama/Claude remains an advanced opt-in.
  • Packaging and updates. macOS .dmg and Linux .deb/.rpm packages cover x64/arm64; the Windows script produces MSI with WiX or an app-image without it. Clone builds resolve closed node/master/GUI artifacts from private source, then checksum-verified release assets, then Docker Hub only as fallback. The tray downloads only assets listed in SHA256SUMS.txt; macOS updates stage and validate a new app before a transactional swap with rollback, while Linux copies the correct apt/dnf command because root is required.
  • Release integrity. Real publication requires clean source trees whose heads match the release tag. A BUILD_PROVENANCE.txt records the core, public, and CI commits plus every staged component hash; --skip-builds refuses a different version, commit, or artifact. The desktop launcher is now part of the public Java CI matrix. Signing/notarization and a published Windows build remain release-infrastructure work.

• Self-contained credential backend — the vault no longer needs OpenBao (agentic-net-vault — new service/CredentialStore.java seam with service/FileCredentialStore.java, config/VaultProperties.java, application.properties). VAULT_BACKEND=file switches the vault from the external OpenBao server to AES-256-GCM encrypted local files (one per {modelId}/{transitionId}, key auto-generated 0600 under ~/.agenticos/vault/, paths overridable via VAULT_FILE_PATH / VAULT_FILE_KEY_FILE). The REST contract and metadata shape are unchanged, so the master works against either backend without modification. Built for the desktop/light install where a secrets server is one moving part too many. Properties: the model/transition ids are bound into the ciphertext as AAD, so an envelope copied between transitions refuses to decrypt; reads fail closed (502) on a wrong key or corrupt file instead of reporting "not found"; versions increment per write like KV2. Default backend remains openbao — existing deployments are untouched.

• MCP HTTP transport is supervisable (agentic-net-mcp — bin/agenticnets-mcp.ts, src/config.ts). Three small gaps that mattered once a desktop launcher supervises the process: AGENTICOS_MCP_HTTP_HOST chooses the bind interface (default stays 0.0.0.0 for compose; a desktop bundle sets 127.0.0.1 so the endpoint is not LAN-reachable), GET /health answers 200 {"status":"ok"} before the bearer check (content-free liveness for healthchecks — previously the server had no probe at all), and a failed listen (port in use) now logs a clear one-liner and exits instead of dying with an uncaught stack. SIGTERM/SIGINT close the server gracefully with a 3s drain cap.

---

AgenticNetOS Desktop Lite

The fast local creator/operator profile: node, deterministic master, gateway,
executor, encrypted local credential vault (no OpenBao), MCP endpoint, and
Studio — supervised by a tray app on bundled Java/Node runtimes. No Docker,
host Java/Node installation, API key, or server-side LLM is required. Connect
an MCP client and let its model build, schedule, inspect, and execute nets.
This loopback-only profile is not the recommended production deployment.

macOS: open the .dmg, accept the license, drag AgenticNetOS to Applications.
First launch of this unsigned build: right-click the app and choose "Open", or allow
it under System Settings → Privacy & Security → "Open Anyway". Verify the download
against SHA256SUMS.txt first.

Linux (Debian/Ubuntu): sudo apt install ./AgenticNetOS-<version>-linux-<arch>.deb,
then run /opt/agenticnetos/bin/AgenticNetOS. An
.rpm is provided for Fedora/RHEL. On servers without a desktop the app runs headless;
the tray is optional.

Windows: not yet published — planned.

Build it yourself: agentic-net-desktop/scripts/build.sh (or build-windows.ps1)
in the repository bundles an installer for your machine from this release's
standalone binaries (agentic-net-node-*.jar, agentic-net-master-*.jar,
agentic-net-gui-*.zip below — EULA applies), no Docker needed.

Connect an MCP client: the tray copies a ready Codex config.toml block,
Claude Code command, or generic MCP URL + bearer token. Studio: tray menu →
"Open Studio" (login secret is one click away under "Copy Studio Admin Secret").
Server-run AI lanes can be enabled later, but fresh installs use
llm.provider=disabled, so new AI lanes default to MCP external fires and need
no server model.

Data lives in ~/.agenticos/ and survives updates. The bundled node, master and
gui binaries are covered by the EULA shown at install (also in the app dir);
everything else is BSL 1.1.