Kent v0.1.0-rc.8

Kent v0.1.0 release candidate 8 (architecture 3.4.0). main carries the release line (PR #3 merged).

Changes since rc.7

• Thinking-budget triage, for Kent's auto calls:
  • When it runs: when the router sends a Kent call to default, the gateway first asks the local model one extra question: how likely a correct reply without thinking is, on a 0–9 scale. It sends the real conversation and tools plus that question, gets back 1 token with thinking off, and reads the token probabilities.
  • What it decides: an expected digit below 5.0 raises that call's thinking budget from 2048 to smart's 4096. Any error, a 30 s timeout, or no usable answer leaves the call at 2048.
  • What it leaves alone: the operator's calls, calls that name a tier, Gent calls, and frontier escalation.
• Settings:
  • configs/triage.json installs as /etc/kent/litellm/triage.json. The installer validates it, and edits take effect without a restart.
  • Each decision is logged as a kent_event: "triage" line. It's linked to its call by litellm_call_id, which llm_call lines now carry too.
• Calibration, on 115 bench probes:
  • The threshold sends about 30% of probes to 4096. On those probes this scored 88.7% in 57 s per item, against 85.8% in 50 s for always 2048 and 88.1% in 65 s for always 4096. These figures are in-sample: they come from the same probes the threshold was set on.
  • The question's routing-check preamble was dropped: 54 tokens instead of 74, with the same separation. Shorter wordings made the model start answering instead of rating.
• Measured on the real model: decisions match the offline check, and the real request reuses the triage's cached prompt. The cost is about 1.5 s per triaged turn, because the triage question comes after the conversation and is never cached.
• Conformance: new checks that the triage settings are valid, raise only to smart's budget, and apply to Kent only. 165 PASS / 0 FAIL / 17 INFO on the reference machine; 580 unit and 50 live tests pass.

Known limitations

• The threshold comes from bench probes, not real Kent traffic. Telemetry and shadow runs, planned work, are how it will be recalibrated. The low-water mark (sending easy calls to thinking off) is still unset.
• The cloud tiers (cheap, frontier) are verified only in simulation, with an oracle in place of the provider. The DeepSeek model id is unverified. v0.1.0 final follows a smoke test with real keys.
• Kent can call any tier from its shell: its gateway key is visible to its terminal tool. This is within policy, but it's an open cost control; see TODO.md.

This is a reference implementation, not a certified system; open controls are listed in docs/controls.md.

Kent v0.1.0-rc.7

Kent v0.1.0 release candidate 7 (architecture 3.3.1). main carries the release line (PR #2 merged).

Changes since rc.6

• Five inference tiers:

  • fast: the local model, thinking off
  • default (new): the local model, thinking up to 2048 tokens
  • smart: the local model, thinking up to 4096 tokens
  • cheap (new): DeepSeek V4.1 Flash, a placeholder that nothing routes to yet
  • frontier: Claude Opus 5.5

  The thinking budgets come from a 115-probe bench curve.

• Who may use which tier:

  • The cloud tiers (cheap, frontier) are Kent's and the operator's only.
  • Gents stay local-only: router, fast, default, smart. This is enforced by the gateway policy, a check on every upstream call, the installer guard and conformance.

• Interim auto routing:

  • Ordinary work goes to default; work classified as frontier escalates.
  • A failed or timed-out classification now stays local; it used to go to frontier.
  • Call logs record both the classifier's label and the tier that actually answered. Dashboards and the digest group by the answering tier.

• Keys: a new optional DeepSeek key (install.sh --set-deepseek-key, kent-admin set-deepseek-key).

• Model server:

  • upstream llama.cpp v0.6.0 with a 128k context and MTP speculative decoding
  • host performance tuning retired
  • batch threads follow -t

• Kent:

  • Kent's Hermes runs in a bubblewrap sandbox with an estate broker and per-session folder grants.
  • Hermes rolled forward to v0.21.7 (tirith removed).

• Installer:

  • Grafana plugins: Grafana's plugins are pinned with its package. Grafana had been downloading and updating its plugins on every start, replacing the copies bundled in the pinned .deb. Plugin downloads, web installs and key fetches are now off.
  • Vendor Squid: when Kent installed the squid package, the installer now switches off the vendor squid.service the package had started (a proxy on *:3128).
  • Gent sockets: the Gent bridge sockets start at boot.

• Bench and perf tooling: bench runner, model-server checks, triage label builder and report. Bench items, fixtures and answer keys stay private.

• Tests and conformance:

  • Conformance: 163 PASS / 0 FAIL / 16 INFO on the reference machine.
  • 552 unit and 50 live tests.

Known limitations

• Cloud tiers verified only in simulation. cheap and frontier have run only against an oracle in place of the provider, not against the Anthropic or DeepSeek APIs. The DeepSeek model id is unverified. v0.1.0 final follows a smoke test with real keys.
• Kent can call any tier from its shell. Kent's gateway key is visible to its terminal tool, so a shell command can call any tier directly, cheap and frontier included, without going through auto. This is within policy (the cloud tiers are Kent's), but it is an open cost control; see TODO.md.

This is a reference implementation, not a certified system; open controls are listed in docs/controls.md.

Kent v0.1.0-rc.6

Kent v0.1.0 release candidate 6. main now carries the v0.1.0 release line (PR #1 merged).

Changes since rc.5

• Installer: first end-to-end install.sh run on a clean host; Grafana and Alloy pinned; progress display.
• Model server (llama): the selected model set is hashed and checked at each start; the models drive is recorded for start diagnostics; two slots with a unified KV cache, so Kent and a Gent (or two Gent workers) run at once; errors-only logging.
• Observability: GPU metrics every 15 s; Kent load dashboard.
• Gents:
  • named deliverables are saved as files
  • retries are told why the first attempt was rejected
  • workers and the validator are told today's date
  • events and verdicts flow back to Kent
  • the Gent inbox is readable again
• Kent:
  • checks for stuck Gents
  • Gent reports and operator notices (CLI and in chat)
  • a frontier review when a Gent project completes
• Gateway: earlier tool calls cut off at the token limit are repaired before the next request (the local model server used to fail every later request with 500 "Failed to parse tool call arguments").
• kent.conf: TEMPLATE_COMMITS and NOTICE_LOOKBACK_HOURS, both for evaluation runs.
• Docs: architecture 3.2.6; conformance baseline 149 PASS / 0 FAIL / 15 INFO on the reference machine.

Known limitation

The cloud tiers (smart, frontier) have been verified only in simulation, with an oracle in place of the provider. They have not yet run against the Anthropic API. v0.1.0 final follows a smoke test with a real key.

This is a reference implementation, not a certified system; open controls are listed in docs/controls.md.

Kent v0.1.0-rc.5

Fifth release candidate. A safe, verifiable uninstall, built from what a full uninstall of rc.4 to a never-had-Kent state taught us (all 12 modules exited 0; a few gaps and some May-2026 prototype leftovers had to be removed by hand). Architecture 3.2.1.

Uninstall

• Pre-flight (./uninstall.sh --check, no root; also automatic before any module): refuses when a Kent account has processes outside Kent's own services (an open kent chat, a login shell), Docker is down, the dpkg lock is held, a manifest has unknown entries, or the models drive is missing. Nothing is changed.
• Stops at the first failure with a plain-language likely cause, where the log is, and the exact resume command. --keep-going keeps the old behaviour.
• --verify (verify-clean.sh, no root): checks a fixed list of Kent accounts, units, paths, sudoers/polkit/ufw rules, Docker objects and ports. Runs automatically after a successful --purge.
• Exit codes: 0 ok, 1 module failed, 2 usage or not root, 3 pre-flight refused, 4 leftovers found.

Gaps closed

• Every systemd-managed unit directory is recorded in its manifest (enforced by a test; fixes the left-behind /var/cache/kent-llama).
• Timer stamp files are removed with their timers; units that were never enabled are only stopped (no systemd noise).
• The llama uninstall refuses to run while the models directory is unavailable, rather than leaving files owned by a deleted group.
• Installers log the options they were run with.

Models by profile

• lab: the operator keeps ownership; only write bits are removed; uninstall leaves the files alone. hardened: root:kent-models 0750/0440 with record and restore. The read-only mount and the per-load hash check apply in both.
• kent-admin models rehash now logs each added, changed or removed model file with who ran it, and keeps the previous record.

338 unit tests (104 new); shellcheck clean. Root-only paths are exercised in the Phase 5 reinstall/uninstall cycle.

Kent v0.1.0-rc.4

Fourth release candidate. The local model becomes a managed service (architecture 3.2.0), and the first full conformance run since rc.2.

llama.cpp as kent-llama.service

• Runs on demand under its own no-login kent-llama account (no sudo), from a root-owned copy of the llama.cpp build in /opt/kent-llama (hashes in BUILD-INFO), on 127.0.0.1:8080 only, with an NVIDIA device allow-list (exposure 1.6).
• Models are read only through a ro,nodev,nosuid,noexec bind mount at /srv/kent/models, and each model's SHA-256 is checked against the install-time record before every load (F-09).
• A polkit rule lets kent-operators start, stop and restart that one unit: kent llama start|stop|restart|status, audited as human:<name>. A root oneshot applies SMT/boost tuning while the server runs and restores the previous values afterwards.
• The launcher ports the operator's measured configuration (256k context, -ncmoe 40, non-thinking) and validates settings; kent-admin llama set and kent-admin models rehash.

Conformance

• 139 PASS / 0 FAIL / 13 INFO, with about 20 new llama checks.
• Fixes: the timer-armed check treated a running oneshot (activating) as dormant; the SearXNG check retries and names rate-limited engines.

Uninstall

• uninstall.sh --log FILE --trace: full module output and a per-line trace (timestamp, script:line) in separate, user-owned files, with a header naming the commit.
• Emptied shared parents (/etc/kent, /srv/kent) are removed; --purge also removes /var/lib/kent-install.

234 unit tests; shellcheck clean.

Kent v0.1.0-rc.3

Third release candidate. Kent no longer runs as the operator: it has its own no-login account and its own pinned agent runtime, and people use it through an audited command. This closes most of the external review's critical finding F-01 (Kent was root-equivalent). Also: a gateway simulation with production routing, a fix for silently failing escalations, and a routing dashboard plus an operator guide for the monitoring stack.

Kent's own account (architecture 3.1.0)

• kent system account (no login, no supplementary groups). Humans in kent-operators run the kent command as themselves; sudo reaches only kent-exec, which validates each call and records it as human:<name> in the audit chain. Files cross by stream, never through shared directories.
• Pinned Hermes at /opt/kent-hermes (v2026.9.24, commit- and lock-hash-verified), with an administrator-owned managed policy in lab and hardened profiles. Stock tools only.
• tirith 0.4.2 command scanner pinned: lets commands through on scanner error in lab, blocks them in hardened.
• SearXNG module: digest-pinned image running as its own non-root account, on 127.0.0.1 and a Gent bridge.
• Root scripts: install.sh, uninstall.sh [--purge], kent-admin (status, profile, config, Anthropic key, conformance). Kent's timers are system units running as kent.
• Web calls never fall back to anonymous outside search vendors (web.keyless_fallback: false, conformance-checked).

Gateway and simulation

• sim-routed flavour: production routing, with the oracle fixture standing in for Claude Opus 5.5. The oracle can answer with tool calls, so an agent's tool loop runs as it would against the real model.
• Fix: in simulations every smart/frontier escalation failed within about 2 ms and silently fell back to the local model. Hermes sends reasoning_effort and the oracle tiers didn't drop it. Fixed, with a test.
• Failed gateway calls now record error_class and error, so a fallback always explains itself in Loki.

Observability

• "Kent routing" Grafana dashboard: tier decisions, escalation outcomes, fallbacks, failure reasons, p95 latency, tokens per identity, backends.
• Observability guide (open locally in a browser): what Grafana, Prometheus, Loki and Alloy are each for, local URLs, tested LogQL and PromQL, terminal commands, documentation links.
• Alloy live debugging is opt-in; Prometheus-scrape noise is dropped before Loki; Loki's own logging is lowered to warn.

Verification

220 unit tests and all CI-equivalent checks pass (shellcheck, config and Python parsing, pinned artifacts). Conformance has not been re-run for this candidate; the last full run (rc.2) was 99 PASS / 0 FAIL / 6 INFO, and rc.3 adds checks.

Known limitations

• No Anthropic key configured yet: smart and frontier are served by the local model (or the oracle in simulations).
• Still untested end to end: ./install.sh, ./uninstall.sh, kent-admin. A wipe-and-reinstall test is next.
• The lab profile still gives Kent a local shell, and a time-limited development sudo grant exists on the reference host.
• Loki and the Alloy UI have no per-account access control.
• SearXNG only searches; there is no page-fetch backend yet.

Remediation status per finding: external security review §8.

Kent v0.1.0-rc.2

Second release candidate. Kent is now documented as what it is meant to be: a reference template for a well-designed, fully integrated agentic AI stack that meets enterprise stability, supportability, control and audit expectations (the bar for PII-bearing, banking- or medical-class workloads). It is a reference implementation, not a certified system.

New documentation

• Control matrix: every control (access, network, data protection, logging/audit, change and supply chain, AI-specific, resilience) with its implementation, evidence, status, and the ISO 27001 / SOC 2 / NIST 800-53 / HIPAA / PCI DSS requirement areas it addresses; IQ/OQ/PQ validation mapping; the gaps to close before regulated data.
• Manual validation runbook: step-by-step operator checks with pre-formatted Kent prompts, gateway and Gent procedures, audit-chain tamper tests, LogQL, PromQL and Grafana checks, expected outputs captured on the reference machine, and a sign-off table.
• Architecture v3.0.0: rewritten to describe the live system, with each item marked Live or Planned; privilege map regenerated from the install manifests; dev notes, glossary, README, CONTRIBUTING, SECURITY updated.

Changes

• Legacy phase installer, operational scripts and old configs (DeepSeek, Promtail, old Squid, Compose templates) removed; the service modules are the only installer.
• CI rewritten: shellcheck, config/Python validation, pinned-artifact checks, 214 unit tests.
• Crew-designer skill and generator aligned with local-only Gents; the generator now writes a spawnable project.yaml.

Fixes found by executing the runbook

• Kent's every-minute and every-5-minute timers could go dormant after a reinstall, silently stopping escalations, learning review, the circuit breaker and audit ingest. They are now calendar-based and restarted on install, and both the installer and the conformance check require every timer to be armed.
• Learnings of Gents retired before review were never judged. Paused and archived Gents are now reviewed; escalations of archived Gents expire without frontier spend.

Verification

Conformance 99 PASS / 0 FAIL / 6 INFO; 214 unit + 46 live tests; 24 in-container isolation checks; manual runbook executed end to end.

Known limitations

No Anthropic key configured yet (smart/frontier fall back to local). Deferred hardening and regulated-data gaps are listed in docs/controls.md.

Kent v0.1.0-rc.1

First release candidate of the rebuilt Kent stack: the monolithic phase installer is replaced by manifest-driven service modules that install, verify and cleanly uninstall each component.

Highlights

• Single inference gateway (LiteLLM 1.100.1): every request is classified by the local router (fast / smart / frontier) and routed; identity-based access (operator and Kent: all tiers, Gents: local only); falls back to the local model on cloud failure (FALLBACK_TIMEOUT).
• Service modules under install/services/: litellm, prometheus, node_exporter, loki, alloy, grafana, gitea, kent-core, gent. Each has its own system account, hardened systemd unit (exposure 1.2–2.9), pinned and verified artifacts, --dry-run, and a manifest-driven uninstall.sh.
• Gent runtime: isolated CrewAI project teams in Docker (internal network, read-only rootfs, no capabilities, per-Gent Unix user and gateway key), read-only web access through a dedicated egress proxy, escalation to Kent, learnings reviewed and cross-pollinated through the Gitea stack template, circuit breaker, pause/resume/archive.
• Kent core: HMAC-chained audit log with journal anchors, daily digest, learnings review and escalation relay, nightly QA, kent-gent CLI.

Verification

• Conformance check tests/conformance/conformance.py: 99 PASS / 0 FAIL / 6 INFO. See docs/conformance.md.
• 212 unit tests, 46 live gateway tests (including adversarial and prompt-injection cases), 24 in-container Gent isolation checks.
• End-to-end simulation: operator → Kent → Gent (research, code, wrapper, docs) → escalation → assessment → learning adopted → inherited by a new Gent.
• Two full rollback cycles: uninstalling everything returns the host to its pre-install state.

Known limitations (see docs/conformance.md §5)

• No Anthropic key configured yet: smart/frontier currently fall back to the local model.
• Deferred: firewall hardening, AIDE and CVE scanning, seed-from-archive, egress POST allowlist, key rotation.
• The local model (llama.cpp) is operator-run, not a managed service.
• The legacy install/phase_*.sh scripts and old configs are still present and slated for removal.

Requirements

Ubuntu 24.04, Docker, an existing Hermes install with a kent profile, and a llama.cpp server on 127.0.0.1:8080.