Tandem v0.4.39

See the assets below to download the installer for your platform.

v0.4.39 (Released 2026-04-23)

This release makes governed workflow repair durable. Strict-quality automation nodes now pass their repair policy into the engine, fail closed when required evidence never materializes, and stop downstream workflow branches from advancing on placeholder artifacts.

Governed workflow repair

• Request-scoped repair policy: Engine prewrite requirements now carry node-derived repair_budget and repair-exhaustion behavior so governed runs can enforce fail-closed repair semantics without depending only on a global strict-mode environment variable.
• Fail-closed strict-quality nodes: Nodes resolved as strict_research_v1 now block with a structured repair_budget_exhausted outcome when retries are consumed, instead of waiving unmet evidence requirements and proceeding to a best-effort write.
• Budget propagation from workflow enforcement: The automation server now forwards node repair budgets and exhaustion behavior from existing output_contract.enforcement settings into the engine request, keeping workflow authoring on the same governance surface.
• Better repair-tool targeting: When a repair is specifically missing concrete reads and workspace inspection is already satisfied, the engine now favors read over repeated glob exploration, making governed recovery attempts more purposeful.
• Validator and orchestration alignment: Server-side repair inference now uses the same repair budget semantics as the engine, so strict governed nodes stay blocked after exhausted evidence-gathering instead of being treated as soft needs_repair completions.

Built-in Tandem Docs MCP

• Preinstalled across control panels: Tandem now bootstraps the official tandem-mcp server at https://tandem.ac/mcp during engine startup, so connected control panels immediately see the Tandem Docs MCP without requiring an operator to add it first.
• Same granular controls as other MCP servers: Because the docs server is registered through the normal MCP registry path, it still shows up in Settings with the usual connected/enabled state, per-tool allowlist controls, and standard connect/refresh/disable behavior.
• Catalog visibility for recovery: Tandem Docs MCP now also has a curated catalog entry, making it discoverable through the MCP browser and easier to restore if an operator removes it intentionally.

Hosted Codex OAuth import

• Codex auth.json schema drift tolerance: Hosted control-panel imports now accept Codex CLI auth files whose last_refresh metadata is stored as a string timestamp instead of a numeric value.
• No more immediate readback failure after upload: Tandem now ignores that metadata shape difference when reconstructing the uploaded OAuth credential, fixing the hosted-server error that reported “The imported Codex auth.json could not be read back on this machine.”

Full Changelog: v0.4.37...v0.4.39