koinon 26.11.12

koinon 26.11.12 keeps Library and Uploads progress current automatically, including long-running processing and newly appearing uploads. Shared status indicators combine text, icons and consistent success, processing, attention and failure colors.

Indexing and installation model checks release database transactions before waiting for providers, then recheck authority before publication. PowerPoint extraction accounts for text incrementally. The documented Office performance study includes measured time, CPU and memory with its sample limits.

This release requires PyFly 26.11.7 within the 26.11 series; its official tag is v26.11.07. It adds no database migration beyond 26.11.11. Follow the installation and first-start verification guides when updating API and workers.

Release notes | Installation | Library guide

The 18 attached assets are the exact qualified hosted outputs. SHA256SUMS covers the 17 payload files; the SBOM and unsigned provenance describe the build inputs and qualification. Source CI, source-free installed runtime and PostgreSQL lanes, SDK consumers, packaged MCP behavior and packaged documentation passed. Actual deployment and external-client acceptance are separate checks.

koinon 26.11.11

koinon 26.11.11

Organize your own Library

New installations start with an empty Library. Create the spaces, projects and folders that fit your team; koinon no longer creates predefined or protected knowledge folders. Existing folders and their contents remain in place. Authorized users can reorganize them through the ordinary catalog actions, while installation provenance remains immutable.

The Library fills the available page height, including empty and short lists. Its background context menu offers actions for the current location; item menus apply to the selected item. Available actions still follow the same server permissions. See the Library guide.

Add files and follow their progress

Select several files in one upload. koinon chooses each file's use from the installation's available capabilities: Word, PDF and PowerPoint files are prepared for content search, while supported spreadsheet and tabular formats such as Excel and CSV are prepared for row and column analysis. An optional per-file choice explains the effect as Search document content or Analyze rows and columns. There is no mandatory global technical mode.

The picker shows the destination, familiar file icons, readable KB/MB/GB sizes and rejected-file reasons. Format hints and effective limits come from the server's installed parsers. Transfer progress counts confirmed uploaded content; it does not invent a percentage for extraction or indexing.

You can close the upload panel or navigate within the app while uploads keep their original destination. Keep the browser tab open until transfer finishes. Submitted processing continues on the server; Uploads follows recorded status automatically and offers recovery only when applicable. Logout or an account/organization change clears local observation and prevents late responses from entering the next session. Failed and uncertain outcomes remain distinct, and an uncertain write is not automatically replayed. See formats and upload flow and durable intake.

The embedded MCP file review also uses readable, locale-aware sizes. Its single-file upload still requires explicit private approval; the documented Python, TypeScript and Java batch methods retain exact size/hash fields. See MCP upload and SDK workflows.

Validate Office files through the native readers

Bounded document intake rejects unsupported extensions and binary payloads disguised as text instead of falling back to a text parser. Capability descriptors use the admitted parser kinds and installed dependencies. Genuine DOCX, PPTX, XLSX and CSV fixtures exercise extraction and original-file preservation; spreadsheet/CSV readers also verify materialized rows and source coordinates. Legacy .ppt requires conversion with Save As .pptx in a compatible editor, not renaming the extension.

Original bytes, source versions and structured coordinates remain tied to their recorded receipts. Slide order is not a fabricated Word page number, and retaining images does not imply vision interpretation. The file ingestion reference describes the actual parser and resource limits. Local file intake does not provide SharePoint, OneDrive or Google Drive synchronization; that connector work remains separate.

Connect the desktop bridge through browser sign-in

The desktop MCPB source supports explicit browser OAuth with an operator-registered public client and an exact local callback. Sign-in starts only when the user requests it. Tokens stay in bridge memory; restart, expiry or revocation requires reconnecting. Additional scopes require consent, and the bridge never replays the original operation automatically.

Personal access tokens remain an explicit compatibility mode. Existing MCPB PAT configurations must select pat when upgrading. Server permissions remain authoritative in both modes. See desktop OAuth for registration, reconnect and revocation steps. Controlled protocol checks do not establish acceptance in an installed Claude client or a hosted connector.

Reduce repeated reads and qualify worker isolation

Knowledge and answer paths reuse bounded policy observations, batch catalog ancestry reads and validate audit memory at the final boundary. Conversation capacity is bounded separately from background-worker capacity. These changes reduce redundant work without relaxing authorization or claiming a deployment-specific response-time improvement.

PostgreSQL integration coverage exercises concurrent claims in separate worker processes, overlapping native document parsing, exclusion of a third claim at the configured limit, and cancellation fencing for one batch without replaying another. This is controlled worker qualification, not a cloud-scaling or production-capacity result.

Update the installation

Use 26.11.11 across runtime packages, canonical SDKs and interface assets. The runtime uses pyfly 26.10.32.

Apply native migration koinon_0043_ordinary_folders through the separate migration process before starting the updated application. It retires special folder protection while preserving existing content, identities and installation receipts. It does not delete folders or create a replacement default structure. An image-only update is insufficient.

Back up the database and rehearse the exact upgrade on a restored copy. Follow schema and role changes, then verify API and worker readiness, authorized folder operations, ingestion and an evidence-backed conversation. Preserve original files, source versions, conversation evidence and email delivery history; this release does not claim new email delivery or replay earlier messages.

koinon 26.11.10

koinon 26.11.10

Keep regional preferences personal

Your account now includes language and region, calendar, time format, time zone and response language. New browser profiles can use the device's reported regional settings once. Existing profiles retain their saved choices, including explicit English and UTC settings. Corporate identity synchronization does not overwrite personal regional preferences.

The profile API and Python, TypeScript and Java 21+ SDKs support both explicit updates and conditional first-use initialization. Concurrent initialization cannot replace a saved choice. See the profile guide for the controls, examples and precedence rules.

Select structured evidence correctly

Structured answers select recorded cell and derived values through their evidence identifiers. Those values are no longer treated as document quotations. New model answer plans must specify the response language; historical evidence records remain readable. A bounded repair can correct an invalid selection without weakening source or lineage validation.

Product help also supports questions combining the assistant's identity and capabilities. The streaming transport has additional HTTP regression coverage for incremental answer events and completed audit information.

Preserve the shared email template

The primary link markup matches the recipient-confirmed template, including its visible destination address. Welcome messages, invitations, security notices, access changes and summaries share that template. HTML and plain-text alternatives retain branding and Foundation attribution.

A received diagnostic verifies one message, not every future welcome or summary. Confirm the intended message at the recipient mailbox after changing a deployment. Previously sealed messages and welcome history are preserved; upgrading does not resend them. See communications.

Update the installation

Use 26.11.10 across runtime packages, SDKs and interface assets, with pyfly 26.10.32. Before starting the updated application, apply native migration koinon_0042_profile_preferences through the separate migration process. This adds an initialization marker without changing saved preferences. An image-only update is insufficient.

Back up the database and rehearse the exact upgrade on a restored copy. Preserve source versions, original files, conversation evidence and email delivery history. Follow schema and role changes, then verify API and worker readiness, existing and new profiles, knowledge ingestion, an evidence-backed conversation and the configured email flow.

koinon 26.11.9

Preserve every document read during RLM answers

RLM may inspect metadata from several authorized documents before reading the passages it needs. The evidence record now retains all of those document identities, including documents whose metadata was inspected but whose text was not selected for the answer. Citations still identify the passages actually used.

Each recorded document remains subject to the original token scope, current catalog permissions and workspace checks. Later Audit and answer delivery can therefore enforce revocation for the complete read set. A search no longer fails simply because a metadata-only read falls outside the final citation subset.

Wait for worker capacity without cancelling active work

Communication and corporate-profile workers defer a claim when the process has no available work capacity. A waiting consumer no longer cancels another consumer that already holds an admitted task. Errors after admission remain visible, and capacity limits are unchanged.

Update the installation

Use 26.11.9 across runtime packages, SDKs and interface assets, with pyfly 26.10.32. This patch does not change database migrations or role provisioning. Preserve installation history, original files, source versions and communication outcomes when updating images. Do not rerun first-start jobs or replay uncertain messages as part of the update.

After API and worker readiness, verify a conversation over multiple documents with the configured model, inspect its sources and Audit, and check background processing under the installation's normal capacity limits. See the installation guide, knowledge setup and worker operations.

Packages include Python, TypeScript, Angular and Java 21+ SDKs, desktop MCP integration, documentation, SBOM and release provenance. Verify downloads with SHA256SUMS.

koinon 26.11.8

Help users understand their assistant

The assistant can explain its configured name, purpose, available tools and basic navigation. These answers use the current product configuration and the tools authorized for that conversation. Audit identifies this as product configuration rather than presenting it as a document citation.

English and Spanish responses follow the language requested in the conversation, with the user's preferences providing the fallback. Source quotations remain unchanged so they can be checked against the recorded evidence. Other response languages are not included in this server-rendered language support.

Publish verified responses and inspect their evidence

Tool activity remains visible while the assistant works. Once the complete answer passes its evidence checks, SSE publishes its text in ordered chunks. Reconnecting resumes the recorded stream without repeating text already received. This is progressive delivery of verified text; it does not expose unverified model tokens.

Audit becomes available when the response finishes. It retains the tool results, exact source versions and answer policy used for that response. Completed earlier answers remain inspectable while another response is running. Exports and shared answers preserve the same product configuration or knowledge evidence used by the original response.

An invalid evidence selection receives one bounded repair attempt. A model that declines to answer, a search with no matching evidence, and an invalid final selection now have distinct recorded outcomes. A failed selection is no longer described as an empty search.

Configure knowledge and AI by task

Knowledge & AI opens with an overview of the organization's setup. Model connections hold provider access, model assignments select the available chat and embedding models, and knowledge answers control retrieval behavior. The assistant settings contain the organization's default assistant and conversation memory policy.

Unsaved changes remain protected when moving between these settings. Follow the guided setup to configure each part and check its availability.

Read documents from Library

The document reader shows the extracted text associated with a recorded document version. Page and extraction references remain visible, and long documents load in bounded pages. Downloading the original uses the selected version; opening a document does not silently replace it with a newer source.

Supported images can be previewed, and a prepared PDF opens in the browser's native viewer. Extracted text is presented as text rather than executable content. Closing the reader or changing the signed-in authorization context clears its retained preview.

Library also provides a context menu for folder and item actions. Each action checks the current selection and permissions before proceeding. Read the Library guide for navigation and document workflows.

The context menu includes Read document. File rows show their observed processing availability without a second stale processing badge. Draft, disabled, archived and custom catalog states remain visible alongside that availability.

Keep chat navigation responsive with a bounded connection pool

Conversation, project and assistant navigation share a primary authorization transaction instead of holding one connection while waiting for another nested authority read. Permissions are still checked against the primary database. This fixes the reproduced navigation timeout without increasing the connection pool or weakening revocation checks.

Audit and conversation snapshot orchestration also release their enclosing connection before the final independent authorization checks. PostgreSQL tests cover a bounded pool, concurrent reads and permission or token revocation during output authorization. The change does not remove those final checks or route them to a replica.

Snapshot repository queries explicitly declare their read-only primary transactions. This also preserves export and sharing workflows on SQLite when another transaction holds its write lock.

Measure the complete initial interface bundle

The bundle check follows static JavaScript imports as well as the HTML entry files. Shared workbench services and optional panels now have separate package entry points, while existing public imports remain compatible. Some optional loaders may request panels after the first render; the initial bundle measurement does not imply that all deferred code waits for a click.

Update the installation

Use 26.11.8 consistently across runtime packages, SDKs and interface assets. The runtime remains on pyfly 26.10.32. Preserve the installation identity, uploaded originals, recorded answers and communication history when applying the update.

Wait until both API and worker revisions are ready before verifying the running installation. Follow installation and migration checks, then test upload processing, document reading and a source-backed conversation with your configured models.

Packages include Python, TypeScript, Angular and Java 21+ SDKs, desktop MCP integration, documentation, SBOM and release provenance. Verify downloads with SHA256SUMS.

koinon 26.11.7

koinon 26.11.7

Preserve uploads through processing failures

The upload dialog confirms a successful server acknowledgement before refreshing the list. If that refresh fails, the uploaded original remains confirmed and the interface offers a refresh without asking you to upload it again. An authorization failure clears information that the current session can no longer access.

Queued document publication now keeps its authorization lock in an explicit native transaction while document services use their own datasource. This prevents a worker from waiting on its own earlier lock during publication.

Recover a failed processing attempt

A failed native attempt can be reviewed and retried when it has no extraction, its original and version are unchanged, and its failure belongs to the current job attempt. The confirmation records that exact evidence. The worker checks it again before proceeding, preserves the original job and attempt history, and does not create another uploaded copy.

An uncertain or partially published result remains ineligible for this action. Review the bulk intake guide before recovering retained work.

Investigate email delivery and recover a welcome

Administrators can inspect a communication's submission and provider observations separately. Provider acceptance does not establish that a recipient has seen the email. Opening delivery details does not resend a message or contact the provider automatically.

An explicit welcome recovery creates a new communication linked to the original. It uses the current authorized recipient, installation identity, language and sender configuration. The review explains the possibility of duplicate delivery; a stable request key prevents a lost response from creating another recovery. Earlier communications and delivery observations remain recorded.

The Python, TypeScript and Java 21 SDKs expose the same typed review, history and confirmation operations. Follow the SDK guides and communications administration documentation for authorization and retry behavior.

Diagnose chat failures safely

Worker diagnostics identify bounded exception types and stack locations without recording exception messages, source text, local variables or credentials. Knowledge responses still require authorized source evidence; diagnostic improvements do not permit answers from unverified model knowledge.

Report the configured platform accurately

Index health establishes the authorized native workspace before opening its read-only transaction. Active indexes no longer appear missing because a database snapshot began without that scope. Email readiness uses the organization's selected verified sender and language, rather than treating multiple available senders as an unconfigured channel.

These checks report index readiness and email configuration. They do not claim that a document has finished processing or that an email reached its recipient.

Update the installation

Use version 26.11.7 consistently across runtime packages, SDKs and interface assets. The runtime remains on pyfly 26.10.32. Apply native migration koinon_0041_email_recovery and the associated least-privilege provisioning updates before starting the new runtime. Preserve existing installation identifiers, uploaded originals and historical communications.

Wait until both API and worker revisions are ready before testing a retained job. Follow installation and migration checks, then verify upload processing, a source-backed chat response and communication delivery in the running installation.

Verification

This release contains 18 verified distribution files, including Python, TypeScript and Java 21 SDKs, the desktop MCP bundle, skills, interface assets, documentation, a CycloneDX SBOM and SHA256SUMS. The installed runtime passed 205 tests; hosted checks include 87 native PostgreSQL tests and 413 browser journeys. The final source tree matches the tested pull-request merge tree. Deployment and recipient email receipt are separate installation checks.

Performance follow-up

A subsequent dependency-graph review found that the initial-bundle check omitted indirect static imports. The management application totals 505,678 uncompressed JavaScript and CSS bytes against its 500,000-byte budget. The follow-up corrects the checker and loading of optional interface features; the published distributions remain unchanged.

koinon 26.11.6

This release makes retained upload recovery available in Library and the typed Python, TypeScript and Java SDKs.

• Queued ingestion restores the original identity and token restrictions before accessing knowledge services.
• Library distinguishes a saved original, failed processing and unconfirmed publication. Review recovery before processing the same original again, finishing a prepared import or acknowledging a completed publication.
• Recovery preserves the source, job, previous attempts and current access checks. Concurrent or stale requests cannot create a second processing job.
• Broad search excludes unfinished documents while preserving authorization checks and binding errors for published knowledge.
• The upload guide explains recovery actions, uncertain outcomes and source updates with desktop and mobile screenshots.

Use the matching 26.11.6 packages and interface assets. Java supports 21 and later. The qualified framework version remains pyfly 26.10.32. Existing installations retain their data and installation identity; this update adds no database migration beyond the existing native40, document21 and structured20 heads.

Release guide and bulk upload recovery describe the upgrade and user flows.

The attached distributions include source, runtime and SDK packages, management and embeddable interfaces, documentation, the desktop MCP bundle, skills, SHA-256 checksums, dependency inventory and release provenance. Verify downloaded files against SHA256SUMS.

Copyright 2026 Firefly Software Foundation. Apache-2.0.

koinon 26.11.5

koinon 26.11.5 improves upload recovery, chat reliability and knowledge administration.

• Recover retained uploads from Library after signing in, with explicit review of the original file and current processing state.
• Fix the PostgreSQL error that prevented the first queued conversation from loading, while retaining current token and application access checks.
• Review, build, inspect and activate knowledge indexes from Settings.
• Improve Library detail layouts and simplify provider configuration.
• Show the actual destination of links in branded HTML emails, preserving the plain-text alternative.

Upgrade the native database to koinon_0040_bulk_pinned before using the updated upload recovery. Preserve existing batches and originals; recover the retained upload instead of uploading it again. PyFly remains pinned to 26.10.32.

The release includes the runtime packages, Python, Java21+ and TypeScript SDKs, Angular components, management frontend, web elements, MCP desktop bundle, skills, documentation, source archive, SBOM and checksums.

Release notes | Installation guide | Bulk recovery

koinon 26.11.4

Answers with recorded evidence

The assistant selects exact source passages and verified dataset values. The server validates that selection before publishing the response and its SSE events in one transaction. A successful retrieval alone cannot authorize unrelated model prose. When the selected knowledge does not support an answer, the assistant asks the user to refine the question or choose another source.

Each published answer records its selected evidence, immutable source revisions, native result hashes and final output hashes. The append-only receipt is available in the answer audit and typed SDKs. Exports, shared conversations, memory and proposed knowledge updates repeat the relevant output and permission checks. Earlier unsealed responses keep their historical records but are not treated as verified assistant knowledge.

This format supports exact quotations and eligible query values. It does not claim unrestricted factual synthesis, verified image understanding from file hashes or control over an external MCP client's final prose. Read knowledge-only responses for the supported evidence and upgrade behavior.

Administrator communications without directory synchronization

An installation operator can configure an explicit, encrypted delivery contact for an administrator when optional directory synchronization is unavailable. The contact binds to the existing verified identity and does not create an account or grant a role. Configuration requires a fresh identity observation, an explicit expiration and the dedicated operator database permissions. Expiration, revocation and identity changes prevent further use.

The native operator command can enqueue a diagnostic through the regular notification workflow. Reusing its operation identifier does not create a second message. Existing welcome attempts with unknown outcomes are preserved. A configured sender, provider acceptance and delivery to a mailbox remain distinct observations. Read operator delivery contacts before provisioning this path; ordinary-user invitations retain their directory requirements.

Knowledge management through MCP

External assistants can create folders, update catalog metadata, move entries, archive and restore supported entries, and inspect processing availability through fixed tools. They use the connected user's current permissions and the canonical service preconditions. Catalog organization does not bypass the separate human review required to publish generated knowledge or approve a file upload.

See external-agent management for tool scope, concurrency and uncertain outcomes. Actual Claude or ChatGPT account linking remains a deployment-specific verification step.

Navigation, notifications and platform health

The navigation bar separates branding, primary navigation and account controls. A single available organization no longer shows an unnecessary selector. Customized sign-in screens retain the footer attribution without repeating it beside the main logo.

The notification inbox applies unread and type filters immediately. Marking an item read refreshes the navbar count; a failed count request is shown as unavailable instead of zero. Desktop and mobile layouts share the same controls and accessible states.

Administrators can inspect bounded platform-health observations and product information without exposing credentials. Readiness, index availability and provider connectivity are reported separately; a configured service does not imply a completed user journey.

Upgrade

Use matching 26.11.4 distributions with official pyfly 26.10.32. Follow the migration guide to apply native revisions koinon_0038_operator_contacts and koinon_0039_answer_release, then verify the dedicated runtime and operator grants. Preserve the existing installation plan and use the documented recovery procedure for an interrupted first start.

Updating the runtime does not replay welcome emails, publish pending knowledge, enable optional directory access or register an external application automatically.

The release includes Python distributions, the TypeScript and Java 21+ SDKs, Angular packages, the management UI, embeddable elements, the desktop MCP bundle, skills, documentation, source, a dependency inventory and checksums. Verify downloads against SHA256SUMS.

koinon 26.11.3

koinon 26.11.3

Initial knowledge provisioning

The installation workflow now prepares the native document and structured indexes through their required lifecycle states before recording readiness. For documents, the queued target enters the building state before the native PostgreSQL function creates its search index. Both domains must reach the ready state before installation can continue.

These transitions verify the tenant, workspace, target, model configuration and creating operator. Cancelled, retired, activated or changed targets remain protected. A cancellation observed during preparation prevents a ready checkpoint from being recorded. The PostgreSQL tests exercise the actual index functions, vector indexes, runtime roles and row-level security.

An interrupted installation retains its original plan and historical checkpoints. Inspect its receipt and explicitly resume that same plan using the initial knowledge provisioning guide. Updating the packages does not automatically restart the installation or resend administrator welcome messages.

Library availability

Library records distinguish recorded processing from observed availability. A successful extraction alone does not mark knowledge as searchable. The availability view checks the current native source, index and coverage; missing evidence or changed configuration remains unverified. Recorded attempts provide the processing history without changing historical receipts.

The same observations are available through the typed Python, TypeScript and Java SDKs. See the Library guide and knowledge service API.

File uploads and folder navigation

When queued storage is configured, the regular Library upload flow stages verified originals in durable storage and submits them for worker processing. An uncertain acknowledgement is checked through retained status rather than automatically sending the original again. Cancellation, staged originals, processing and search availability have distinct states. Deployments without queued storage retain the bounded synchronous path for smaller files.

The destination picker opens the relevant folder hierarchy without treating a top-level space as an upload folder. The Library root now requests only spaces from the catalog, so projects and their folders appear inside their actual parents while pagination remains server-side. Headless catalog queries retain their existing filters and behavior.

Navigation and access screens

The chat and settings layouts share a bounded sidebar width and consistent content alignment. Settings can be collapsed, and the selected sidebar state is remembered. My activity opens the current user's activity from the navigation bar; organization-wide activity remains an administrator view. Browser routes now expose the existing communications and activity services through the session and CSRF protections.

The access and session-ended screens include an original isometric knowledge library, with responsive artwork for mobile and desktop. Custom organization branding retains its logo and a small Powered by koinon attribution. The sign-in action remains available when the decorative artwork cannot load. See identity and appearance.

Packages and upgrades

Use matching CalVer 26.11.3 distributions and their checksums from GitHub Releases. The runtime remains the official pyfly 26.10.32 release. Apply the normal migration and role checks before resuming any incomplete installation.