Feral v2026.08.11

Added

• A task can now say what "done" means, and the world checks it. Put a
  done_when: line on any message — done_when: exists report.md,
  done_when: contains report.md "Q3", done_when: run npm test — and the run
  is a success only if that assertion passes, whatever the agent says about
  itself. Without one, the run is recorded as unverified rather than quietly
  as finished, because "I'm done" is the weakest evidence in the system: an
  agent that inventoried 9 files out of 250 and politely offered to continue
  used to have that accepted as an answer. Now it is sent back to work with the
  failure quoted at it.
• Unattended work survives the process that started it. A long task now
  keeps a durable record: every turn, what changed on disk, and what it still
  owes you. Kill the machine mid-task and the next boot picks the task back up
  where it was — or, if it cannot, tells you that instead of going silent. When
  it finishes, the report is delivered even if the process that produced it is
  long gone.
• The agent keeps a notebook. remember with a note: key writes something
  it will still have on hour six, rendered in full every turn rather than
  searched for. Search does not fix hour six: what it has forgotten it knows is
  exactly what it will not think to look for. The notebook is capped, so keeping
  it current is curation rather than hoarding.
• A permanent scratchpad. Its own workspace that survives restarts, and the
  desktop shows what it wrote there while it worked.
• Every completion says what it cost. A per-turn breakdown of where the
  tokens went — system prompt, tool schemas, the drawers, the conversation, tool
  output — in two accounts that are never mixed: what we measure and what the
  provider billed. /tokens on a chat surface prints the same thing.
• Your own commands can run on the agent's events. Hooks fire when a turn
  starts, when a tool runs, when a turn ends.
• feral migrate — brings an existing OpenClaw or Hermes Agent setup across.
  It finds the install itself (--source for unusual locations), then prints
  three sections before writing anything: what it will import, what it could
  not — every key in their config that no importer claimed, listed by name —
  and what it refused to overwrite. --dry-run stops after the report and
  --json gives the whole plan to a script. This release imports the persona
  markdown you wrote by hand (SOUL.md, AGENTS.md, IDENTITY.md); anything it
  replaces is copied into ~/.feral/migration/ first, so undo is one cp.
  Providers, connectors, secrets and cron jobs still show up in the "not
  imported" list — they arrive in later releases, and until then the report says
  so instead of leaving you to discover it. Your OpenClaw/Hermes install is only
  ever read, never written to.
• feral uninstall — removes Feral and keeps ~/.feral: settings,
  memory, API keys and downloaded models survive, so changing your mind costs a
  reinstall rather than a fresh start. It prints exactly what it will delete
  (with sizes) and what it is keeping before asking. --purge deletes the data
  too, and says plainly that it is permanent. On npm/apt/dnf installs it hands
  you the package manager's own command instead of racing it, and it refuses
  outright to touch a git checkout you build from.

Changed

• Walk-away runs are sized for a working day, not eighty minutes. The
  ceiling used to be 3 continuations of 20 minutes, and 80 minutes was recorded
  for weeks as an observed limit before anyone read the arithmetic. An unattended
  run now has an 8-hour deadline and a continuation budget sized to reach it; a
  scheduled job gets an hour instead of five minutes, which predated the agent
  doing multi-step work at all. The deadline is the term and the counter is the
  safety net — a wedged run stops on the clock rather than spending its whole
  budget.
• A stuck run tries a different way in. Proven no-progress — the same call
  returning the same result — no longer burns the rest of the budget. It gets one
  replan, is told plainly that the approach is refuted, and is allowed to answer
  "there is no other way in" and stop. An invented approach run for another hour
  is worse than an honest stop.

Fixed

• A provider's bad second no longer ends a night's work. Only rate limits
  were retried; a 502, a dropped socket or a gateway restart threw on the first
  failure, and from there the turn was not continuable and the whole unattended
  run stopped with the error text delivered as the answer. Over eight hours
  against any cloud provider that is not a possibility, it is a certainty.
• Answers about files nothing opened are marked as such. A turn that
  describes a file, having made no tool calls at all, now carries one line
  saying so — and if it claims it went and looked ("I checked", "just now") when
  nothing ran, that is flagged too, because with zero tool calls that is not a
  doubtful claim but a false one. The same detector, pointed the other way, adds
  the one instruction the model actually obeys when your message names a file or
  asks for something to be checked.
• A model that cannot see images says so. Sending a photo to a text-only
  model produced either a shrug ("something went wrong") or, worse, a confident
  description assembled from the filename. The rejection is now named as an
  action, and the image itself carries an instruction to admit blindness rather
  than guess.
• Tool calls in an unfamiliar dialect are read, not thrown away as prose.
  Models fall back to other function-call formats mid-task; one namespaced
  variant slipped past the parser entirely and reached the user as raw markup
  with the task abandoned. Asking a model to switch syntax does not work —
  reading the format it actually speaks does.
• Long conversations stop losing what they established. Compaction used to
  summarize its own summaries, so a long session drifted into invention; the
  summary now carries exact facts forward verbatim and is never re-compressed.
  A separate treadmill — re-fetching the same numbers after every compaction —
  cost one task 117 file reads for 24 files without finishing.
• /new works on Discord and Slack. The escape hatch for a conversation that
  has gone wrong was unreachable on the two surfaces most likely to need it.
• WhatsApp stops trying to pair by itself. An unlinked connector spun through
  reconnect attempts — 47 in 90 seconds — and reported itself healthy while doing
  it. Pairing is something you start.
• Shutdown takes a second, not thirty. A reader's copy of the sender kept the
  channel open long after everything else had stopped.
• Destructive commands aimed outside the workspace are refused, and the agent
  can see the work it did in any configured root rather than only the first.
• The live status message no longer eats the start of the answer (Discord and
  Slack). While the agent worked, one message was edited to show what it was
  doing ("🔎 searching…"), then became the answer. Those status edits were sent
  without waiting and both platforms queue them behind a rate limiter, so one
  issued a moment before the answer could be applied a moment after it —
  overwriting the first 2000 characters. A long reply appeared to start
  mid-sentence, and nothing was logged. The more tools a turn used the likelier
  it got, so it hit exactly the long answers that could least afford it.
• Research reports say what they could not confirm. deep_research was told
  only "do not invent facts", which nothing checks. Now: specific values (file
  paths, config keys, version numbers, prices, benchmark figures) may only appear
  if a source actually contained them; a vendor's own repository outranks a blog
  or an AI-generated wiki, and a claim resting only on the latter says so where
  it is stated; and every report ends with Not confirmed — what the question
  asked that the sources do not answer. A report that reconstructs a
  plausible-looking config path reads exactly like one that researched it.
• feral update works on a from-source install. On a headless server the
  command did not merely fail, it pointed the wrong way: update lives in the
  npm launcher, so a server that built from source either had no such subcommand
  or was told to npm install -g feral-agent@latest — which installs a second,
  unrelated feral earlier on PATH and leaves the real one behind. Feral now
  detects how it was installed and runs that install's actual update: a git pull
  and rebuild from source, npm where npm applies, the installer elsewhere. The
  gateway restart still only fires if a gateway was already running, so the
  Discord/Slack connector lands on the new build.

Feral v2026.08.01

Reliability on long tasks. Every fix here is something you only hit after the
agent has been working for a while — which is exactly when it hurts most.

This is the first release measured against a walk-away benchmark: real tasks run
end to end, unattended, nine times each. It is why several of the entries below
name a number instead of a hunch.

It also closes out a hardening pass against the agent runtime, using two mature
agent runtimes as behavioural references. Most of what that pass produced is not
in this list, because most of it was evidence rather than repair: the four
capabilities most likely to fail a user quietly — surviving a restart, switching
provider mid-session, resuming memory, and writing memory — now have tests that
prove the behaviour instead of code that looks correct.

Added

• Feral stops when it is provably stuck. If a tool returns byte-identical
  output for the same arguments twenty times over, repeating it cannot make
  progress, so the turn ends and says which tool got stuck — instead of quietly
  burning up to 500 iterations or your whole time budget on the same call. A
  tool whose output keeps changing (a build still running, a job still queued)
  is left alone: waiting is not looping.

• feral update — pulls the latest release and restarts the gateway, so a
  connector already running on Discord or Slack picks up the new build instead
  of quietly serving the old one until you notice.

Fixed

• Web search works, with no setup. It did not work at all before, on any
  install: the only real backend was a SearXNG server you had to host yourself,
  and both paths meant to cover its absence were dead — the no-backend fallback
  called a DuckDuckGo endpoint that answers definitions rather than searches,
  and the escalation to deep_research searched through a service that now
  requires a paid key. Three dead paths, so nearly every search failed, each
  time with a different-looking error.

  Search now runs keyless on DuckDuckGo out of the box, and it is paced —
  one query every 5 seconds, with parallel calls queuing rather than bursting.
  The pacing is the fix, not a precaution: DuckDuckGo throttles by rate, so a
  burst of 14 searches got 7 answered and then a ten-minute block, while the
  same 14 paced through the new limiter returned 14 for 14. If the limit is
  tripped anyway, Feral backs off and says so instead of reporting an empty web.
  A self-hosted SearXNG is still worth it — several engines, no rate limit, no
  pacing delay — and if it goes down, searches fall back to DuckDuckGo and say
  which backend answered.

• A tool with a backup now actually falls back to it. Tools can declare a
  standby to try when they fail. If that tool also declared a retry policy,
  the standby was skipped for exactly the failures it was meant to cover — a
  missing file, a bad argument — and you got the original error instead of the
  working result. The two code paths that handled this had drifted apart; they
  are now one path and cannot drift again.

• A hung tool can no longer hang the whole agent. One internal failure shape
  left a tool call waiting forever with its own timeout already switched off.
  Nothing could recover it short of restarting. It is now impossible to reach
  that state.

• Parallel tool calls all run now, instead of just the first one. When the
  model batched two actions into a single reply — "pause the losing campaign and
  raise the winner's budget" — only the first was executed, nothing recorded the
  loss, and the model reported both as done. Half a task, reported as finished.
  On the benchmark this failed 5 runs out of 17; after the fix, 0 out of 9. A
  call that genuinely can't be read is now counted and named back to the model,
  so it re-sends what's missing rather than assuming it landed.

• A batch of calls no longer collapses into one. Providers that omit the
  wire-format index had every call in a batch folded into the same slot, where
  names overwrote each other and arguments concatenated into garbage. Three lead
  imports became one; a "check the CRM, then write" dropped the check and
  duplicated a person already on file.

• Tool calls in the format the model actually speaks. Feral now reads the
  shapes models fall back to when they abandon the format they were asked for —
  <function=…>, [tool:name], Harmony channels — instead of showing them to
  you as prose. Unrecognised tool names are rejected, never invented.

• "No model loaded" no longer hides the real error. On a cloud model, a
  failed request used to fall back to the local engine — which the app had
  deliberately unloaded when you switched to cloud — and report its complaint
  ("no model selected") instead of what actually went wrong. You now see the
  real cause: rate limit, expired key, or a conversation grown past the model's
  context. As a side effect, a single cloud hiccup no longer drags a multi-GB
  local model back into memory.

• A tool call cut off mid-argument is retried instead of run blind. When a
  reply hit its token limit while the model was still writing a tool call's
  arguments, the truncated JSON was silently treated as no arguments at all —
  so write_file ran with no path and no content, and nothing flagged it. Feral
  now recognises the truncation and asks the model to re-send the call.

• Compressing a long conversation no longer throws away the recent half.
  The summary that replaces older turns was built from only the first few
  thousand characters — the opening of the session — so every file path,
  command, and fix from the actual work was lost. That is why the agent forgot
  paths it had just written and repeated steps it had already done. The summary
  now covers both ends of what it replaces and is told to keep paths, commands,
  and outcomes verbatim.

• Extension (MCP) tools are available on the very first message. They
  connect in the background at startup, and a message sent in that window used
  to be answered with "I don't have a tool for that" for a server you could see
  was connected.

• shell_exec tells the truth about its timeout, and the 5-minute ceiling
  is now raisable (FERAL_SHELL_MAX_TIMEOUT_MS) for builds that legitimately
  run longer.

• Discord DMs reach the agent. They never had. The connector asked Discord
  for direct-message events but not for the one extra flag that lets an
  uncached DM channel through, so every DM was dropped before any Feral code
  ran — while the connector's own documentation said it always answers DMs.
  Confirmed against a live bot: two DMs arrived at a client carrying the flag
  and neither arrived at Feral's.

• A bare @mention gets an answer instead of silence. Mentioning the bot with
  no other text stripped down to an empty message, which was discarded without
  a reply, a reaction, or a log line — indistinguishable from a dead bot. It now
  acknowledges and asks what you need.

• In a server, Feral answers you without an @mention by default. Naming
  channels (feral connectors set discord --channel …) still narrows it to
  exactly those. The allowlist is unchanged and remains the real gate: only
  people you list are ever answered, so this means "answers you anywhere it can
  see you", not "joins every conversation".

• feral doctor no longer reports a healthy sidecar as dead on Windows and
  macOS. It contradicted itself in the same output — api port said the
  sidecar was alive, sidecar said it was DOWN and pointed you at the log to
  investigate a failure that had not happened. The liveness guess came from a
  PID-file check that only ever worked on Linux; everywhere else it answered
  "cannot tell" and the caller printed that as "dead". Liveness now comes from
  the gateway itself, which is the only thing that knows.

• The endpoint allowlist stays an allowlist after you switch models. If you
  pin the servers Feral is permitted to send your conversation to
  (FERAL_TRUSTED_BASE_URLS), that list used to be quietly thrown away and
  replaced the first time the model was changed — and the check that was
  supposed to enforce it then validated the new address against itself, so it
  could never refuse anything. The list now holds across model switches: a
  switch picks from it and cannot widen it. Unchanged if you never set the
  variable, which is the default.

Feral v2026.07.19

A big one. Feral can now split work across sub-agents, ask you a question
mid-task from any channel, and train a personal LoRA on your own machine. It
also installs in a single command on every platform, and a batch of local/cloud
model-selection bugs are gone.

Added

• Sub-agents. The agent can now hand a piece of work to a fresh sub-agent
  (delegate_task), run several in parallel, and stream their progress back
  live. A depth guard stops an agent from recursively spawning itself into a
  fork bomb.
• The agent can ask you a question mid-task — from anywhere. If it hits a
  real fork in the road it stops and asks instead of guessing. This now works
  over the connectors (Discord/Slack/WhatsApp — the question comes back in the
  same channel) and in the feral chat TUI, not just the desktop app.
• On-device LoRA trainer, bundled. Feral can now fine-tune a personal
  adapter on your own hardware (Unsloth when available, with a graceful
  fallback), gated behind an A/B eval so a worse adapter never gets promoted.
  Requires an NVIDIA GPU to train.
• Universal one-command installer. A single command detects your OS and sets
  everything up — Windows, macOS, and Linux. Per-platform quick-install lines
  are now at the top of the README.
• Per-connector persona. Each connector can run with its own persona
  (--persona), so the same Feral can be a support bot in one channel and your
  personal agent in another.
• The agent can see its own subsystems. Every RSI layer now reports into
  self-health, so the agent can actually reason about the parts of itself that
  were previously running invisibly.

Fixed

• Replies are no longer cut off. A phantom 4096-token cap on chat replies is
  gone — long answers finish.
• A local model no longer shrinks your cloud model's context window. A
  resident local GGUF was stealing the context window from an active cloud
  model (e.g. capping a 1M-context model at 8192). Local and cloud windows are
  now independent.
• You pick the model — always. Switching to a cloud model used to leave the
  local GGUF resident, and some paths let the API pick a model on its own. The
  model you choose is the model that runs, and switching away actually unloads
  the old one.
• The Dream Cycle no longer runs with no model loaded. Background
  self-improvement is gated on there being an active model.
• web_search no longer reports success on an empty result. An empty search
  is now treated as the failure it is, so the fallback path actually fires.
• Cloud model settings show only what applies (temperature, not local-only
  knobs), and folders start collapsed.
• BYOK base URLs are normalized on the plain-env path the same way the
  keychain path already did them.

Feral v2026.07.14

Hotfix. Everyone on 2026.07.13 should take this update.

Fixed

• A crashed sidecar could kill the app permanently. If the sidecar ever went
  down hard, it left its lockfile behind with its process id in it. The guard
  that is supposed to recognise an abandoned lock asked only "does a process
  with this number still exist?" — and operating systems reuse process ids. On
  the report that surfaced this, Windows had handed the dead sidecar's id to
  svchost, a system process. The probe came back "exists, but you may not
  touch it", the lock was declared alive, and the sidecar refused to start on
  every launch from then on. The app was dead, and the only cure was deleting a
  file the user had never heard of.

  Two things were wrong. "You may not touch it" was read as alive, when it
  actually proves the opposite: the sidecar runs as you, so a process you cannot
  even signal cannot be it. And more fundamentally, a process id is not an
  identity — fix the first half and the next recycled id, this time landing on
  something you do own, would have looked alive and bricked the app just the
  same.

  So liveness is now something the sidecar has to demonstrate: a running one
  touches its lockfile every few seconds, and a lock nobody has touched in a
  minute is treated as abandoned, whatever id it claims. A dead process cannot
  keep touching a file, no matter who inherits its number. The case where the OS
  hands the new sidecar the dead one's id is closed too.

  If you are stuck on 2026.07.13 and cannot get past "Feral Agent went offline",
  delete ~/.feral/agent/.writer.lock and restart — then update.

Feral v2026.07.13

First public release. Feral is source-available under the Business Source
License 1.1 (free for individuals and for organizations under $2M revenue;
each version converts to Apache 2.0 after four years). Windows and macOS
builds are unsigned — see the README for the SmartScreen and first-launch
steps.

Builds: Windows x64 and Linux x64 (Vulkan), macOS Apple Silicon (Metal), macOS
Intel (CPU — llama.cpp's Metal backend targets Apple GPUs, so an Intel Mac gets
the CPU engine, which is what it would have fallen back to anyway). An opt-in
NVIDIA CUDA build is published as a separate download for Windows and Linux;
it is deliberately excluded from the auto-updater, so it does not update itself.

Feral in the terminal

• A real terminal client. feral chat opens a full TUI: streaming answers
  rendered at 30fps, tool calls as inline pills, a thinking panel you can fold
  away, and slash commands (/think, /verbose, /usage, /restart,
  /compact, /model, /connectors). Layout is borderless and flat, in the
  shape terminal users already know from Claude Code.
• It behaves like a terminal program should. NO_COLOR is honoured
  globally, there is an ASCII mode for terminals without glyph support, the
  mouse wheel scrolls, manual scrollback is not yanked away by an incoming
  stream, Esc interrupts the generation instead of quitting the app, Ctrl+C
  needs a second press, input history works, and a panic restores the terminal
  instead of leaving it wedged.
• Failures are legible, not silent. No model, runtime offline, runtime
  lost, rate-limited — each gets an error card explaining what happened, with an
  automatic retry countdown where retrying makes sense.
• A setup wizard and a --plain mode for scripting and for terminals where
  the full UI is not wanted.

Feral without the desktop app

• The runtime is no longer trapped inside the desktop app. It has been
  extracted into a feral-core crate that both the desktop app and a headless
  gateway boot through the same way — one runtime, several faces.
• A feral command-line tool. Gateway lifecycle (start/stop/status),
  feral doctor, model management, logs, connectors, dreams, config, shell
  completions, and --json on everything for scripting. Plain feral in a
  terminal opens chat.
• A public runtime HTTP API on loopback: /runtime/* for reads and
  actions, POST /runtime/chat for streaming chat over SSE (cloud keys work
  headlessly), and /events as a live SSE feed of what the runtime is doing.
  Stability is declared per route — see the API stability contract below.
• One feral to install. The npm package now ships the Rust binary and the
  sidecar together, so there is no second thing to install and no drift between
  them.

The model picks itself

• Brain Stack: capability-routed model selection. Instead of pinning one
  model to everything, the runtime classifies the task and routes it to a model
  that can actually do it, weighing cost and health. A cheap model handles cheap
  turns; the expensive one is spent where it earns its keep. feral doctor
  checks the routing config for you.

Onboarding

• Guided first run. Feral now looks at your machine before asking you
  anything: an existing config, GGUF files already on disk, a hardware-tier
  model download, provider keys in the environment, a running Ollama, or an
  OpenClaw config to import. Each candidate is verified with a real
  completion before it is saved, so a route that is persisted is a route
  that works. Available in the desktop wizard, in feral setup (with
  --classic for the old wizard), and as a guided screen in the terminal
  client.
• WhatsApp pairing without the terminal. The pairing QR now renders in the
  desktop Connectors page with a live countdown to the next code, and in the
  TUI via /connectors add whatsapp and /connectors qr.

Local models and GPU

• Partial GPU offload. Offload used to be all-or-nothing: if the model did
  not fit entirely in VRAM — including the KV cache — Feral dropped to full
  CPU. A card that missed by a few hundred MB ran the whole model on the CPU.
  Feral now fits as many layers as VRAM allows and leaves the rest on the CPU,
  sizing the budget from the model's real geometry rather than an estimate.
• A GPU build no longer breaks the CPU fallback. On some cards (verified on
  an RX 580) llama.cpp routed buffers through the Vulkan device even at zero
  offloaded layers, so when the GPU could not take the model the CPU fallback
  failed too and the model did not load at all — the GPU build was worse than
  the CPU build for those users. The last-resort CPU path now detaches the
  device.
• You can see where the model is running. A badge next to the model name
  and in Settings → Hardware shows the real outcome after the load
  (GPU (vulkan, 24/32 layers), or CPU). If a GPU-capable build lands on the
  CPU anyway, Feral raises one notification explaining why and what to try.
• NVIDIA CUDA build as a separate, opt-in download. Vulkan stays the
  default for everyone (it runs on NVIDIA too). The CUDA assets are
  deliberately excluded from latest.json and do not auto-update.

Agent and memory

• Sessions survive a restart. Working memory now rehydrates from the
  episodic store, so a conversation is not amnesiac after a restart or an
  eviction. Machine sessions (cron/RSI/dream) still start clean.
• A provider error is now its own error. The "local fallback" was a keyless
  copy of the boot-time cloud provider, so after switching providers an error
  on the new one silently re-called the old one — and the old one's failure was
  what you saw. The fallback target is now always loopback, and if no local
  engine is serving, there is no fallback.
• MCP tools are callable. They were discoverable but impossible to call:
  the tool schemas were snapshotted before the MCP servers finished connecting,
  so the tools appeared in the list and said "enabled" while the model had no
  function to call. The registry is versioned now and the agent loop rebuilds
  its prompt, grammar and schemas when it changes.
• New remember tool, so the agent can write to memory directly instead of
  waiting for the asynchronous extractor. recall searches facts too.
• FERAL_HOME is honoured. It was documented but ignored by eight modules
  (SOUL/IDENTITY, onboarding, the memory graph, the four RSI roots), so an
  isolated profile still read and wrote the real one.
• Resume works. resume_get always returned null — nothing ever recorded
  the current task.
• Cloud transcripts get room to breathe. The transcript budget on cloud
  providers is raised to 200k, and the agent is nudged to reach for web_search
  first rather than guessing from memory.

Feral improves itself — and shows its work

This is the part of Feral that is not like other assistants: it evolves its own
configuration and, now, its own code. Every step of that is gated, journalled
and reversible, because an agent that can rewrite itself and cannot be audited
is not a feature.

• Dream Cycle. When you are idle, Feral runs a seven-stage cycle over what
  it learned, proposes changes to itself, and evaluates them. You can trigger it
  yourself ("Dream now") and watch which stage it is in.
• Nothing is promoted on a hunch. A statistical confidence gate decides
  whether a candidate actually beat the champion or merely got lucky;
  rejections are counted and shown rather than swallowed. A Tier 0 sanity floor
  is enforced at promotion, so a candidate that wins on the metric but fails the
  basics cannot be crowned.
• An Evolution Journal with receipts. Every episode is journalled with
  honest budget accounting and per-candidate fitness, surfaced in the Dreams
  panel. Champions are archived per niche (a "tree of champions") rather than a
  single global winner.
• Code-level self-improvement, behind a wall. Feral can now propose patches
  to its own source. They are parsed, checked against a patch policy wall on
  both sides of the boundary, and evaluated in a disposable git worktree — the
  candidate never runs in your working tree. A patch that passes still waits for
  your approval in the Dreams panel. On approval it is applied, the sidecar
  rebuilds and restarts, and a watchdog reverts it automatically if the new
  build crashes.

Governance

• A policy layer over what Feral is allowed to do to itself, with a
  fail-closed loader: if the policy is missing, unparseable, or violates the
  ground rules, every governed action is refused rather than allowed.
• The audit trail is hash-chained. The evolution journal and the policy
  history are chained, and governance verify walks the chain and tells you
  which file or row broke it — so tampering is detectable, not merely
  discouraged.
• Propose / approve / reject / rollback / freeze, available from the CLI
  and from a Governance card in the desktop app with an approval inbox.

Modules

• Feral's internals are becoming swappable at named seams. A module is a
  Bun subprocess with a manifest, run behind resource walls with a seeded RNG,
  speaking JSON-lines — so a replacement for a piece of Feral can be evaluated
  without being trusted.
• Promotion is earned by a paired shadow evaluation against the builtin,
  with floors it has to clear. A promoted module that misbehaves is
  auto-quarantined by a watchdog after repeated strikes and the seam falls back
  to the builtin. Visible from IPC, the API, the CLI, and an Architecture card.

Personal adaptation (LoRA)

• Feral can fine-tune itself to you, on your machine. A dataset is built
  from your own interactions, a LoRA adapter is trained locally, and it is
  promoted only if it beats the base model on an eval gate — with provenance
  recorded and one-click rollback. Adapters, the...

Feral v2026.06.29.1

Hotfix for the v2026.06.29 release — completes the macOS Intel build that was
queued forever because the macos-13 runner image is no longer available.

Added

• macOS Intel bundle (Feral_x64.dmg + Feral_x64.app.tar.gz) — the
  macos-13 runner image was deprecated; this hotfix bumps the Intel matrix
  entry to macos-14 so the build picks up a current runner.

This release is otherwise identical to v2026.06.29. If you already have
v2026.06.29 installed on Linux, macOS Apple Silicon, or Windows, you do not
need to update — only macOS Intel users are affected.

Feral v2026.06.29

Power-user preview — Windows, macOS (Apple Silicon + Intel), Linux.

Looking for testers and contributors. This is the first public preview
of Feral's self-improvement engine (RSI) and the redesigned Memory view.
Both are early-stage — see "Known issues" below for what to expect.

Highlights

• Memory Layers — a clean, non-technical view of everything Feral
  remembers about you, grouped by recency (Today / This Week / This Month /
  Older). Live dream-cycle history and a status pill for the self-improvement
  engine live on the same page.
• RSI — Recursive Self-Improvement (Faza 1). Feral tunes its own
  parameters (temperature, system prompt, tool preferences, context budget)
  while you're away. An evolutionary algorithm evaluates candidate
  configurations against a frozen test suite and ratchets improvements to a
  git branch. Dream cycles run automatically during idle periods.
• GPU acceleration that's actually reliable. Vulkan on Windows/Linux and
  Metal on macOS, with automatic CPU fallback when the GPU is unavailable.
  CUDA detection on NVIDIA, Vulkan dev-launcher with auto-CPU-offload for
  embedding on AMD, and auto-reload of the last model on startup.
• Inference deadlines. Time-to-first-token, total, and stall timers with
  heartbeat progress. The streaming indicator now shows the prefill phase and
  live tok/s, so you always know if the model is loading or stuck.
• Onboarding "Choose your brain". Pick a provider during setup: OpenAI,
  Anthropic, Google Gemini, DeepSeek, Groq, Mistral, OpenRouter, Kimi, GLM,
  MiniMax, or any custom OpenAI-compatible endpoint. BYOK keys are stored
  locally and never proxied.
• Token economy. Tools are advertised only when needed (on-demand memory
  and skill drawers), so the system prompt doesn't waste tokens on capability
  you'll never invoke. Cloud fallback when no local model is available.

Added

• Memory Layers page (/memory-layers) with recency grouping, a stats
  hero, an RSI status pill, and a "Feral's Dreams" panel showing recent
  self-improvement episodes with token counts and ratchet progress.
• RSI engine (Faza 1) — event bus, population manager, eval worker,
  ratchet handler, mutation grammar, selection handler, recalcitrance
  tracker, and GoalMode orchestrator, wired sidecar → Rust → UI.
• Inference deadline enforcement — TTFT, total, and stall timers with
  heartbeat progress; streaming indicator now shows prefill phase + tok/s.
• GPU detection improvements — CUDA feature auto-cap on the context
  pool, Vulkan dev launcher with auto-CPU-offload for the embedding model,
  auto-reload of the last model on startup.
• Onboarding "Choose your brain" step with provider selection (BYOK or
  local model).
• On-demand tool drawers for memory and skills — tools advertised only
  when needed, reducing prompt token waste.
• Cloud fallback for inference when local models aren't available.
• Workspace scanner improvements — detect hardcoded secrets, API keys,
  and code security anti-patterns.
• Live smoke tests for the dream-cycle pipeline and real-GGUF model
  load (FERAL_SMOKE_GGUF-gated).
• Boot stability probe — automated observation of startup panics and
  steady-state health.

Fixed

• lopdf CVE-2026-0187 (severity 7.5 high) — upgraded pdf-extract to
  0.12.0, which pulls lopdf 0.42.0 (fixes stack overflow in deeply nested
  PDF objects). cargo audit is now clean.
• Memory Layers scrollbar — the scroll area used to extend into the
  titlebar and overlap the window controls; now respects the AppShell
  titlebar spacer.
• Memory Layers theme — was hardcoded to a dark palette that clashed
  with light mode; now uses the project's theme tokens and adapts to
  light/dark automatically.
• ControlsPopover visibility on light theme — bg-white/alpha made it
  invisible; switched to theme tokens.
• FractalMemory.clusterLeaves — was silently dropped by the
  feat/reactive-pixel-tree merge; restored. Drill-down tests pass again.
• Prune-emission contract — rebuild() no longer emits prune events
  (eviction is a separate path); test aligned to match.
• workspace-roots.test.ts — fixed hardcoded ; path separator that
  only worked on Windows; now uses delimiter from node:path.

Changed

• Memory Layers visualization simplified. Three iterations of a
  painterly tree didn't match the hand-painted references, so we replaced
  the whole renderer with a clean tiered list view that surfaces what users
  actually care about: what Feral remembers, when, and how much it's
  improving. Net −1,184 lines.

Known issues

• RSI evals can return empty content on cloud-hosted endpoints. Tracked
  as emptyResponses in dream.jsonl; the engine scores these as 0 and
  moves on, so RSI itself is not blocked. Local GGUF models (Qwen, Llama
  instruct) are unaffected.
• RSI improves configuration, not weights. Visible gains accumulate
  over many dream cycles, not overnight. The eval suite is intentionally
  basic (fact lookups, simple math, JSON format checks) — it will be
  expanded in a future release.
• macOS is not Apple-notarized yet. First launch on macOS requires
  xattr -cr /Applications/Feral.app from Terminal to clear the
  quarantine flag. We'll fix this once we have a Developer ID.
• Windows ships .exe (NSIS) only in this release. The .msi target
  is paused because WiX 3 rejects any product version whose major component
  exceeds 255, and our CalVer year (2026) trips that limit. We'll restore
  the .msi alongside a WiX 4 upgrade or a custom ProductVersion fragment.

Internal

For contributors and reviewers:

• dream.jsonl telemetry now records errors (capped at 5 per cycle)
  and emptyResponses counts. Previously both were silently lost.
• Bridge error logging — scoreGenome, fetchTier0, and invokeAgent
  adapters log bridge failures to stderr with method, outcome count, and
  genome ID. Previously swallowed.
• GoalMode error propagation — failed-eval error messages are collected
  in GoalResult.errors and carried through the sidecar → dream-cycle →
  telemetry chain.
• RSI candidate branch format — genome/<id> was rejected by Rust's
  git validator (single-segment name required); now genome-<id> (dash).
• Sidecar rebuild — bundles the new engine modules and all fixes.
  Tests: 1255/1255 pass.

Feral v2026.06.17

Security hardening release — Windows, macOS (Apple Silicon + Intel), and Linux.

Security

• Sandboxed the agent's built-in tools. Code execution is now off by default
  and runs with a minimal environment (it can no longer read app secrets); file
  read/write is confined to the agent workspace; and web requests are blocked
  from reaching local/private network addresses.
• Encrypted sensitive memory at rest. Facts the agent remembers about you are
  now encrypted on disk with a key kept in your operating system's secure
  keychain. High-confidence personal data (card numbers, IBANs, national IDs,
  emails, phone numbers) is automatically redacted before being stored.
• Disk-encryption check. Onboarding now tells you whether your disk is
  encrypted (BitLocker / FileVault) and nudges you to turn it on if it isn't.
• Tamper-evident activity log. The audit log is now hash-chained, so any
  after-the-fact edit or deletion is detectable.

Changed

• Switched release versioning to the calendar-date format described above.

Feral v0.2.3

Released 2026-06-14 — Windows, macOS (Apple Silicon + Intel), and Linux.

Added

• GPU acceleration. Feral now ships a GPU backend on every platform —
  Vulkan on Windows and Linux, Metal on macOS — and offloads the whole model
  to the GPU by default. Local models that previously ran CPU-only (slow,
  sometimes "not responding" for minutes) now use the graphics card. If the GPU
  can't be used — missing or old driver, no Vulkan runtime, or not enough VRAM
  for the model's context — Feral automatically falls back to CPU so the model
  still loads instead of failing.
• Desktop control (opt-in). The agent can now drive native applications
  through the OS accessibility tree — list windows, read controls, type, click,
  and send real keystrokes. Off by default; enable it under Settings → Agent,
  with a Safe mode (confirm every action) and a YOLO mode (no prompts). A hard
  denylist (password managers, system security dialogs, Feral itself) can never
  be controlled.
• Configurable token budget. The agent's conversation budget is now
  unlimited by default — no more hitting "budget exhausted" mid-task. Optional
  caps (1M/5M/20M/50M) are available under Settings → Agent for cost control.
• Live context ring. A live indicator of how full the model's context
  window is, so you can see when the conversation is approaching the limit.

Fixed

• Loading a model no longer crashes the machine. Modern models advertise
  enormous training contexts (up to 256K), and the KV cache was sized to that
  full context and allocated up front — roughly 90 GB for a 4B model, which
  instantly exhausted memory (a kernel panic and reboot on macOS, a near-hang
  on Windows). The load-time context is now capped to a safe default (8192,
  raisable via FERAL_MAX_CONTEXT), clamped to what the model actually
  supports.

Feral v0.2.3-rc.4

ci(release): use TheMrMilchmann/setup-msvc-dev (ilammer action was 404)

The previous attempt referenced ilammer/msvc-dev-cmd, which no longer exists
as a repository — GitHub failed every matrix job at "Set up job" (action
resolution happens for all steps regardless of their `if:`), so Linux and
macOS regressed too. Swap to TheMrMilchmann/setup-msvc-dev@v3.0.2 (confirmed
to exist) to load the MSVC environment for the Ninja-based Vulkan build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>