v1.1.0

About 1,700 commits since the previous prerelease, v1.0.2-rc1 of 2026-08-30. Aura is now a
multi-user appliance: every person has their own identity, memory, sandbox, skills and model key.

Upgrading from v1.0.2-rc1

• Back up first. The release adds 26 database migrations (0113 to 0138), applied when
  Aura starts. See Backup and restore. That backup is also the
  way back: v1.0.2-rc1 refuses a database at the new schema, so rolling back means
  restoring the pre-upgrade dump into a new database, not just changing the image.
• The model key and the Telegram token moved to the cockpit. compose.yaml no longer
  passes OPENROUTER_API_KEY, TELEGRAM_BOT_TOKEN or AURA_LLM_* to Aura. An admin sets
  the route, the model, the OpenRouter management key and the bot token in the first-run
  setup or in Settings. They are stored encrypted in Postgres and kept out of the process
  environment. A key that lived only in .env must be entered again.
• The strict profile is the default. An unset AURA_PROFILE now means
  single_user_hardened: stricter config validation, fatal sample credentials, and shell
  and file tools routed through the per-identity sandbox. Set AURA_PROFILE=dev to keep the
  old behaviour on a development machine.
• The installer config changed. install.conf is now format 2 and only asks for the
  infrastructure. A format 1 file is refused rather than half-applied.
• Removed settings. Several memory tuning knobs are gone from compose.yaml
  (AURA_MEMORY_*_MAX_*, AURA_MEMORY_LEXICAL_MIN_SCORE, AURA_REASONING_FIFO_RUNES,
  AURA_VISION_CLOUD, AURA_PROFILE_DIR and others). Values left in .env are ignored.

Multi-user

• Each identity gets its own memory database, sandbox box, skills folder and OpenRouter key.
• Admins mint each person's key from one management key, with a credit cap, and see spend
  on a credit dashboard. Web and Telegram turns are billed to the person's own key.
• Two roles. Admins create and remove identities from a roster, and set the OAuth client
  for each mail and calendar provider. Members only connect their own accounts.
• Skills belong to an identity and can be shared with a named person. The house library
  stays readable by everyone and editable only by admins.
• Removing an identity tears down its sandbox, key and memory, and a failed removal can
  be finished later.

Memory

• One recall over facts, past conversation turns and the agent's own reasoning traces.
• Entities are typed as person, object, location or event, and recall follows a second hop
  through shared mentions.
• The agent receives the part of the graph a question lands on, not a list of sentences.
• Every vector records the embedding model that produced it. Changing the embedding route
  goes through a preview and a confirmation, then re-embeds memory and documents without
  extracting them again.
• Each turn decides once how much effort it needs and preloads the tools it used before.

Documents

• Hybrid search is reranked and can answer that the corpus holds nothing relevant.
• A hit can bring the passages around it, and the search reports how far ingestion has got.
• When dense search cannot run, documents are answered from the full-text index.

Images, video and audio

• Studio: generate images and video clips through OpenRouter, with the price shown
  before you spend.
• Photo and video editors open from Studio results, chat media and attachments.
• Video Studio: a timeline editor with transitions, audio lanes, voice recording,
  text to speech, in-browser noise removal and automatic ducking under speech.
• Telegram receives generated images and clips as native media.
• Hands-free voice mode in the cockpit.

Agent and tools

• A real browser runs in each person's sandbox, with a live view in the cockpit.
• Stdio MCP servers can run inside each identity's sandbox (aura mcp add --box), and
  streamable HTTP servers can be added with aura mcp add --url.
• MCP servers can ask the user a question mid-run, answered in the chat. The run's time
  limit stops while the user answers.
• A tool call that outlives its window, or a shell command that reaches its cap, moves to
  the background instead of being killed.
• Outbound messages are saved as drafts and reviewed before they are sent.
• Web fetch reads PDFs and hands script-only pages to the browser.
• Scheduled tasks can be paused and resumed. A task that fails three runs in a row pauses
  itself (AURA_SCHEDULER_PAUSE_AFTER_FAILURES, 0 disables).
• A ChatGPT subscription can be connected through the sandbox browser.

Cockpit

• Tool results render as what they are: terminal output, patches, file text, search
  results, images, memory reads and todo lists.
• Conversations can be archived and deleted in bulk.
• Inline and full-screen previews for HTML artifacts.
• Several files can be selected and handled at once on a phone.

Install and operations

• One-command installer: npx create-aura-appliance, local or on a remote host over SSH. It detects
  CUDA, Vulkan or CPU for the embedding model.
• The appliance can update itself from the edge channel, and asks an admin before it
  restarts into a new build.
• Remote access through Cloudflare, configured from the cockpit.
• Optional trust for the Caddy local certificate authority.

v1.0.2-rc1

Changelog

• df5c6f8: @ (@chetto1983)
• 09f8ab8: @ (@chetto1983)
• e883572: @ (@chetto1983)
• ab88a40: @ (@chetto1983)
• c3f408d: Add FunctionGemma-270M tool-calling fine-tune spike (finetune/) (#8) (@chetto1983)
• 472fed5: Add L1 microcompact measurement harness (@claude)
• 771cac8: Add L2.4 LLM context compaction (ADK-inspired), the deferred L3 (@claude)
• 7fd6a73: Add Python search-document identity, mirroring Go's SearchDocumentID (@chetto1983)
• 2982181: Add Task 1b: fix 0093's pending-trigger-event failure (@chetto1983)
• e68046d: Add first-operator bootstrap login (@chetto1983)
• 33a7cbb: Add proactive memory preload (ADK preload_memory), Phase 2 (@claude)
• d09ba88: Add the closing plan the handoff was missing (@chetto1983)
• f106c18: Add the ingest sidecar image, with the two things that fail quietly without it (@chetto1983)
• 6eb5b58: Add the third answer to the middle problem: carry nothing, re-derive (@chetto1983)
• fc009e5: Align load chaos with ArcadeDB memory (@chetto1983)
• a843515: Apply 0093 to the live deployment and restore the observability lens (@chetto1983)
• e106f08: Ask ArcadeDB which documents exist, instead of a column nobody writes (@chetto1983)
• b26ba47: Ask the box which directory is a project, since only the box knows (@chetto1983)
• 2440f9b: Ask the ledger before accepting an edit as finished (@chetto1983)
• 0c71b82: Assert observability sidecar liveness from outside aura's namespace (@chetto1983)
• 9650b02: Assert the whole canary sentence, and measure reflow only inside it (@chetto1983)
• 4ef8b2b: Authenticate the MUSR approval seed (@chetto1983)
• 73cbcf6: Authenticate the MUSR seed turn (@chetto1983)
• ce02125: Authorize isolated production document E2E (@chetto1983)
• 975b7d5: Authorize production document corpus (@chetto1983)
• 0a3d248: Bound chunks by the model's real 2048-token ceiling, not by bytes (@chetto1983)
• d477447: Bound conversation history by tokens, because rows never knew the window (@chetto1983)
• 182a76e: Bound industrial Agent Memory inputs (@chetto1983)
• 1082a74: Bound the HTTP MCP transport Close with a timeout (F-035) (@claude)
• 67539ef: Break down the skill tool's manifest cost by field (@claude)
• c5ee440: Build a card for every supported file, on both ingestion paths (@chetto1983)
• cb603f6: Build arcadedb-mcp from the whole internal tree (@chetto1983)
• c34a92e: Build the canary corpus with the document skills, and score the extractor on it (@chetto1983)
• eaed5e8: CI fix (@chetto1983)
• 62331a1: Calibrate lexical relevance by query shape (@chetto1983)
• d2afda7: Call the collapse that 02fba54 only defined (@chetto1983)
• 29fc194: Cancel the tool-surface phases (@chetto1983)
• 51e68f4: Cancel the tool-surface rewrite; the surface works (@chetto1983)
• a5afccf: Carry an attachment's real name beside its key, not inside it (@chetto1983)
• bd97c7b: Carry every open item into the handoff, including the ones I would rather not write (@chetto1983)
• 8ab4dbf: Carry the Passage's source key so a retrieval hit can resolve back to its file (@chetto1983)
• ea09deb: Carry the view descriptor to the surface, correlated to the call that made it (@chetto1983)
• 76936a3: Chain parent_seq in the append INSERT, so a forked branch keeps its history (@chetto1983)
• fb2cae2: Classify the measure build tag as a compiled harness (@claude)
• cba65bd: Close 2.3, and widen it: the hazard was thirty files, not four (@chetto1983)
• df5f4fb: Close 4.1, correcting what its cure would have been (@chetto1983)
• 3a0d127: Close 4.2 and record the silent-run failure underneath it (@chetto1983)
• 5ddfb0e: Close 4.2b, and retract the claim that it recurred during the fix (@chetto1983)
• 37c7aba: Close 4.3 (@chetto1983)
• d817a9f: Close 4.4, and record the live audit closing the loss channel (@chetto1983)
• 09c08c8: Close 4.5 in the handoff, and the older defect it uncovered (@chetto1983)
• 8c694a0: Close item 3 with the CI evidence, and record what the red pushes taught (@chetto1983)
• cdab985: Close phase 45.1: read the mutants, and measure the identity instead of inferring it (@chetto1983)
• 1de5390: Close the second port, and give the appliance a name a browser trusts (@chetto1983)
• 974493d: Close the server half of a live MCP session, and re-point the capability scoreboard (@chetto1983)
• ef9c787: Close the upload dialog when the bytes land, not when ingestion ends (@chetto1983)
• 5a36b85: Collapse the verify-on-stop switches that could only answer one way (@chetto1983)
• 0cc81fe: Consolidate twelve handoffs into one, keeping only what is still true (@chetto1983)
• 8d2701b: Converge the industrial document pipeline (@chetto1983)
• ade9a82: Correct 2.3's commit reference to the hash that exists (@chetto1983)
• 9c8dd9d: Correct stale comment and narrow-regex gaps in the vocabulary tests (@chetto1983)
• 49552df: Correct the RLS probe shape the operator checkpoints inherit (@chetto1983)
• a0eeebb: Correct the constants comment the ceiling split invalidated (@chetto1983)
• 6756e97: Correct the handoff: the dist emptiness was transient (@chetto1983)
• 56c3c68: Correct the plan: arcade.py owns the schema, the stock connector owns the writes (@chetto1983)
• 2914c16: Correct the recall@1 entry: the harnesses compile, nothing runs them (@chetto1983)
• 37f0818: Correct the spike's live-mode claim: -L is not how you get live (@chetto1983)
• 7d23db0: Correct the stale .planning/ claim and drop a dead config key (@chetto1983)
• b0ba9a4: Correct the steering contract against hermes, before it cost anything (@chetto1983)
• 43999e5: Correct the void Qwen3-8B pin in the two governing rewrite documents (@chetto1983)
• 63b456f: Count the agent's rounds, not the client's calls (@chetto1983)
• 167567d: Count the prefix the embedder adds, and run the tests that never ran (@chetto1983)
• aaa3e31: Count the tool manifest in the compaction trigger, since the wire does (@chetto1983)
• 35704ea: Count the two tokens the embedding server adds, not just the prefix (@chetto1983)
• b1fead2: Count tokens with the model's own tokenizer, and let CocoIndex do the splitting (@chetto1983)
• bdb3406: Cover the ported tools' pure logic, which the port had left at zero (@chetto1983)
• 5acc199: Declare only the document statuses Go still writes (@chetto1983)
• c31f8df: Default command-hook fail policy to fail-closed (F-006) (@claude)
• c4cb189: Define capability manifest lifecycle (@chetto1983)
• e161fa7: Define the Agent Memory provenance wire (@chetto1983)
• 68a7a4e: Delete CreateDocumentVersion, superseded and unissued (@chetto1983)
• 7847ecc: Delete Docling, which was no longer converting anything but was still gating boot (@chetto1983)
• b6520a1: Delete five symbols nothing calls, and the tracer bootstrap behind one of them (@chetto1983)
• a7340d5: Delete the /api/documents surface, and stop ingest indexing Aura's own storage (@chetto1983)
• 445d938: Delete the ArcadeDB projection writer, and the schema nobody writes (@chetto1983)
• 4426c4b: Delete the Postgres digest subsystem: no writer, no reader, unreachable state (@chetto1983)
• 632f67e: Delete the RLS proof for the table 0098 dropped...