Cortex 1.6.4

Cortex 1.6.4

Cortex 1.6.4 makes provider thinking output operator-controlled and hidden by default, while tightening embedding credential propagation and carrying the release evidence through the repository Docker gate.

Highlights

• Added configurable provider thinking-output controls. Thinking tags are stripped by default, can be shown or hidden with /think show|hide, can be changed with cortex config set turn.show_thinking true|false, and can be configured through config.toml or install-time environment.
• Added CORTEX_EMBEDDING_API_KEY handling so embedding credentials are discovered during install, persisted in the embedding config, and used by embedding requests instead of being silently ignored.
• Cleaned the local redeploy script around the new hardcoded vLLM and embedding endpoints, including the embedding smoke probe and default hidden thinking behavior.
• Retargeted the workspace, SDK package metadata, docs, changelog, roadmap, fixtures, package-surface checks, and release audit evidence to 1.6.4.

Runtime And Safety

• Thinking-output redaction now applies before streaming chunks are emitted when hidden mode is active, so <think> blocks do not leak during streaming responses.
• /think status reports the active visibility state, and /config set hot-updates supported runtime keys without requiring a daemon restart.
• The existing daemon, permission, plugin, replay, RAG, and process-isolation contracts remain covered by the strict gate.

Validation

• ./scripts/gate.sh --docker --require-clean passed after the release commit.
• ./scripts/release-behavior-report.sh --run passed under the repository Docker Compose dev service.
• ./scripts/soak-fault-harness.sh --run passed under the repository Docker Compose dev service.
• The SDK package passed cargo publish -p cortex-sdk --dry-run in the repository Docker environment.
• A destructive local reinstall of the default instance passed with the configured OpenAI-compatible vLLM and embedding endpoints, including /think and cortex config set mutation checks.
• The release archive was built in the repository Docker environment, checksum-verified, and smoke-tested with cortex --version.

Long 24h/72h/7d daemon soak is still a separate release attachment and was not claimed as part of this bounded release evidence.

Packaging

• cortex-v1.6.4-linux-amd64.tar.gz
• cortex-v1.6.4-linux-amd64.tar.gz.sha256

The cortex-sdk 1.6.4 package dry-run verified successfully, but crates.io upload requires a cargo registry token in the publishing environment.