Tandem v0.7.0
See the assets below to download the installer for your platform.
v0.7.0 (2026-07-15)
Licensing Boundary Correction
Tandem 0.7.0 is planned to correct the Additional Use Grant for the protected
BUSL governance and enterprise components. Evaluation, development, testing,
source inspection, genuine personal non-commercial use, and non-production
proofs of concept remain permitted without charge. Commercial production use,
including internal commercial use, client production deployments, and managed,
hosted, SaaS, white-label, embedded, OEM, and reseller offerings, requires a
separate commercial license from Frumu LTD.
Agencies, consultants, and systems integrators may use the protected components
for training, demonstrations, integration/template development, and
non-production client proofs of concept. Those permissions do not authorize a
client production deployment; it requires either a commercial license issued to
the client or a separate written partner agreement with Frumu LTD.
Tandem 0.7.0 also relicenses the tandem-server engine crate from
MIT OR Apache-2.0 to BUSL-1.1 under the same Additional Use Grant. The
server contains substantial production governance enforcement and composes the
other protected components, so it now sits inside the same commercial
boundary. The permissive protocol, SDK, client, and tooling crates are
unchanged.
This is a prospective change. Each released version remains governed by the
license distributed with that release, including v0.6.9. Existing tags and
release artifacts are not modified. The in-progress v0.7.0 BUSL license files
are stamped with a new rolling Change Date; the release owner must verify it
matches the final release date plus four years before publication.
The final grant requires review by a qualified software-licensing lawyer before
publication. This release introduces no signing keys, activation, telemetry,
runtime entitlement checks, billing, license servers, or other technical
enforcement.
Tandem 0.7.0 turns Control Panel chat into a first-party product-authoring
surface. A user can describe an automation or multi-workflow process in normal
language, let the selected model plan it with Tandem's native tools, inspect a
durable workflow artifact directly in the conversation, revise it over several
turns, and materialize a disabled draft when it is ready. The authoring path
uses the signed-in user's existing Tandem identity, keeps external connection
credentials behind their normal provider boundaries, and applies the same
validation, permission, and confirmation policies as the rest of the product.
Model-First, Authenticated Product Authoring
Product-authoring prompts now reach the selected model instead of stopping in
a repeated "did you mean" setup loop. Tandem distinguishes authoring,
explanation, inspection, and consequential control intent, then exposes the
appropriate first-party capabilities while leaving the model enough context to
ask useful questions only when information is genuinely missing.
New natural-language workflow and automation requests always begin in the
workflow planner rather than asking the model to synthesize a raw Automation
V2 definition. Disabled-draft authoring records external integrations as
requirements or blockers without discovering or executing MCP connector tools;
live integration inspection happens only when the user explicitly requests it.
The Control Panel session is the authentication boundary for these first-party
tools. Tandem derives tenant and actor identity from the trusted dispatch
session, ignores model-supplied identity fields, and records the verified
author on persisted changes. Users are not asked to provide a Tandem API key
inside Tandem chat. External MCP servers and services remain separate: they use
the user's or organization's principal-scoped connection, and their credentials
are never placed in the prompt or exposed to the model.
Durable Authoring And Operator Tools
Chat can now drive the workflow planner lifecycle end to end: start and read a
plan, revise it, preview and validate it, inspect available capabilities, and
materialize it. It can also inspect and manage Automation V2 drafts, perform
authorized automation controls, and inspect orchestrations. Validation returns
structured assumptions, blockers, warnings, connection requirements, and
approval requirements instead of treating every tool response as success.
Planner sessions, revisions, chat/run provenance, and artifact links are
durable. Follow-up requests such as "revise it" resolve to an explicitly active
artifact when one is available, and ambiguous conversations do not silently
edit an arbitrary plan. Materialization is draft-first and disabled by default.
Supported consequential controls remain permission- and confirmation-gated,
while unsupported publish and enable requests are not exposed as chat actions.
The run path is designed for interruption. Prompt submission, planning,
revision, materialization, and automation mutations use durable idempotency so
retrying after cancellation or reconnect does not create duplicate drafts or
replay stale state. Conflicting revisions are rejected, cancellation stops the
active planner work, and the chat transcript retains the authoritative link
between the request, tool activity, persisted artifact, and acting user.
Inline Workflow Artifacts
Created and revised workflows now appear as durable artifacts in the chat
transcript rather than requiring a navigation detour. Each artifact summarizes
the trigger, nodes, named transitions, outputs, approvals, execution
constraints, assumptions, required connections, and validation state. Parallel
branches are presented as concurrent work, so workflows with several nodes
running at once are not misrepresented as a sequential chain.
Users can validate, request another revision in chat, duplicate or create a
draft, and open the exact linked artifact and current revision in the full
workflow planner. Revisions update the artifact in place while preserving the
earlier conversation, and streaming tool events show running, completed,
failed, canceled, and approval-wait states without remounting the artifact.
Stable layout and retained transcript position remove the flashing and viewport
jumps that made earlier updates difficult to follow, including on narrow
viewports and keyboard or screen-reader paths.
Enterprise Policy Enforcement Follow-Through
Enterprise/global admins can now explicitly author tenantless enterprise rules,
while workspace administrators remain restricted to their verified tenant.
Policy supersession uses the same canonical organization, workspace, and
deployment matching as runtime enforcement, so harmless casing or padding drift
cannot strand an old published rule and global rules cannot be confused with
tenant rules.
Approval-required enterprise policies are now a first-class governed dispatcher
result rather than a denial-shaped error. Native, batch, global HTTP,
server-backed CLI, and bridged MCP paths preserve a pending handle containing
the winning policy and rule version, approval class, optional request ID, and an
opaque exact-action binding. A pending decision never enters pre-send or tool
execution. Resume re-evaluates policy and atomically consumes one matching,
unexpired approval; changed arguments, tenant scope, policy version, MCP
connection generation, expiry, or replay fail closed.
Predicate policy decisions now include bounded, privacy-preserving evidence:
the expression result, at most 32 condition results, stable indeterminate and
truncation reasons, and deployment-scoped HMAC digests for the expression,
selector, and permitted selected values. Raw request arguments, operands,
selected values, paths, repository URLs, and email local parts are not copied
into evidence, and low-cardinality values omit their digest. Hosted and
enterprise deployments must configure TANDEM_AUDIT_HMAC_KEY or
TANDEM_AUDIT_HMAC_KEY_FILE; predicate decisions and enterprise-authored
exact-action approvals fail closed without that authority.
Automation Wizard Reliability And Live Progress
Long-running workflow generation now reports live progress in the automation
wizard. The progress panel identifies whether Tandem is dispatching, waiting,
receiving a response, retrying, or validating the plan, and shows the selected
provider and model, elapsed time, and received response size. These events are
tenant- and request-scoped so concurrent tabs cannot consume one another's
progress, and deliberately exclude prompts, reasoning text, and response
content so users can see that planning is active without exposing model data.
Planner normalization now turns every upstream input_ref into an explicit
scheduling dependency before validating the workflow graph. This repairs a
common model-output mismatch that previously produced a fallback scaffold even
when the intended workflow was otherwise valid. When planning still fails, the
Review step presents the concrete diagnostic, states that no automation was
created, and visibly blocks the Create action until the plan is repaired.
Creating an automation from an approved plan is now retry-safe across protected
audit failures. If the mandatory audit record cannot be persisted, Tandem rolls
back the provisional automation and governance record and releases the
idempotency reservation before returning a retryable error that explicitly says
the operation was not applied. The audit reader also recovers valid chains from
legacy files where concurrent appenders placed multiple complete JSON objects
on one physical line, while malformed or truncated records still fail closed.
Product-Authoring Acceptance Gate
A dedicated acceptance suite protects the conversation-to-artifact contract.
It covers vague, partial, and detailed requests; scheduled and parallel
workflows; follow-up revisions and active-artifact references; explain-only
versus create intent; validation, connection, overlap, and provider failures;
supported control confirmations and honest publish/enable capability gaps;
permission denial; cancellation, retry, and
reconnect; and attempts to disclose credentials or cross tenant boundaries.
The gate checks authoritative outcomes as well as assistant wording: selected
tools and policy decisions, persisted plans and automations, revision
continuity, audit actors, draft-first defaults, tenant isolation, parallel plan
structure, idempotent replay, and the absence of unauthorized side effects. It
also fails when chat intercepts a valid authoring prompt before model execution,
claims success without a corresponding persisted artifact, or asks for an
unnecessary internal Tandem credential.
Full Changelog: v0.6.9...v0.7.0