NativeAgent 0.4.1

NativeAgent 0.4.1

Requires macOS 26 (Tahoe) or later. This release raises the minimum system
version from macOS 14 — the app now builds on the macOS 26 SDK and adopts
Liquid Glass throughout. If you are on an older macOS, stay on 0.4.0.

Real-time Mac attention

The agent can now explicitly pay attention to the Mac across a sequence of
fused views (mac_attention start / next / status / stop):

• Bounded 15–1,800 s sessions with passive local/global input observers — no
  timers, no frame polling; next wakes event-driven on new activity.
• Human takeover is absolute. Physical input after the agent's last view
  makes every motor call return yielded_to_user until it re-observes — checked
  at tool entry and immediately before each emitted event. A drag interrupted
  mid-gesture releases the button instead of stranding a synthetic press.
• The agent's own synthetic events carry an in-process identity tag so it can
  never mistake itself for the human.
• Privacy: keyboard activity is recorded as a content-free pulse only; no
  screenshots, text, key content, or history are stored; attention state is
  ephemeral and fully torn down on stop/expiry.
• Coordinate drags interpolate locally (80–2,000 ms, 4–60 steps) for smooth
  visible motion without spending model tokens.

Whole-system tightening

A challenged whole-repository audit tightened existing owners across five
waves plus a structural closeout — no new subsystems:

• Fail-closed authority: one immutable trust-policy generation per
  authorization; malformed injection-spend state, invalid signing keys, corrupt
  external-send receipts, and out-of-root backup restores all fail closed;
  pairing secrets are durable before publication on Mac and iOS.
• No lost work, no repeated effects: Telegram updates gain a durable
  replayable claim before their offset advances; scheduler occurrences are
  claimed durably before external effects; timed-out background work stays
  quarantined until it actually exits; Workshop settlement is
  restart-reconcilable; screenshot composers clear only after turn acceptance.
• Activity truth: local-only activity data cannot silently enter a
  cloud-model request (model access is a separate explicit consent that a
  policy file can only turn off); agent-driven Mac actions no longer count as
  human activity; activity queries return complete, bounded, correctly
  filtered results.
• Consolidation: one canonical MemoryV2 owner at the default root; bounded
  Knowledge Graph SQL; per-turn appraisal derived once; manual and automatic
  chat compaction share one compactor (manual force bypasses only the
  automatic gates — never validation, verified backup, keep-tail, or durable
  write); CloudKit transport skips legacy Drive work when active.
• Release proof: published releases require an exact-commit test receipt;
  iOS release tests cannot silently skip; one release attestation binds source,
  test proof, exact artifact bytes, and notarization; shipped symbols are
  stripped with the private dSYM archived.
• Proven-dead code islands removed (Frozen Mind v1 runner, duplicate feedback
  ranker, inert cognition islands) with persisted-compatibility kept.

Liquid Glass feel pass

• The UI adopts real Liquid Glass: cards and chrome render with
  glassEffect (tinted where accented), with an opaque fallback under
  Reduce Transparency.
• A shared interaction vocabulary makes the app answer the cursor everywhere:
  spring-animated hover fills on rows and cards, press feedback on buttons —
  reduce-motion aware, and hover state can never stick on recycled rows.
• Smooth composer, session list, Desk, Activity, Inbox, Skills, Trust,
  Settings, MCP Hub, and command-palette interactions.

Memory quality, round 2

• The rule-based extractor no longer parrots first-person speech as facts
  ("my whole thing is I was just trying to…" can never stage), and discourse
  nouns ("my whole thing/point/deal is…") are not attributes.
• Truncation-shaped fragments ending on determiners/quantifiers are rejected
  for automatic extraction — while deliberate agent-committed memories are
  explicitly exempt, so the agent's own judgment lane is untouched.
• Historical junk identity facts swept from the active store.

Docs

• New internals documentation: anatomy of a turn, the optional subconscious
  capsule, and a connected internal-workings map.
• README/CAPABILITIES/USER_GUIDE surface Mac computer control and the ambient
  activity watcher where agents actually read.