v1.8.0

Kyber v1.8.0

Changes since v1.7.0. Published 2026-09-27.

New features

• Move an agent between machines and installations (disk export and
  import).
  • Export: from Agent Detail, export an agent's persistent disk as a
    verified ZIP with a versioned manifest.
  • Import: the Create Agent wizard, or POST /api/v1/agent-imports,
    creates a new agent from an export or from an uploaded archive. The new
    agent boots only after its restored volume is checked against the archive.
  • What moves with it: the whole agent, not just its disk:
    • model, prompt and flags, resources, soul, profile and avatar, public
      capabilities, A2A peers, and the identity repo;
    • scheduled jobs, which arrive paused;
    • webhook bindings, which arrive disabled with new signing secrets, so
      nothing fires twice before cutover.
  • User secrets: the values are copied inside the cluster when the source
    is an export on the same installation. From an upload, their keys are
    listed for you to re-enter.
  • Cutover checklist: lists everything left to do.
  • Credentials: harness login files are never restored, so the new agent
    signs in with its own credential. Files shipped by the base image are no
    longer flagged as credentials or crontabs.
  • Uploads: they go in 32 MiB parts, so multi-gigabyte archives pass
    proxies such as Cloudflare. Exports and uploads can be deleted before
    retention ends.
• Switch an agent's harness in place. Move an existing agent between Claude
  Code, Codex and Hermes on the same volume, including across auth modes. It
  keeps its disk and transcripts, then asks the target harness to authorize.
• Custom inference endpoints.
  • Point a Hermes or Codex agent at an OpenAI-protocol endpoint that Kyber
    does not host (spec.inference).
  • Set its API key from the console, with no manual Secret needed.
  • Self-hosted endpoints report their served context window.
• Agent avatars in the console.
  • Upload, replace or remove an avatar from General settings. It shows in the
    agent list and the agent header.
  • Images are cropped square, scaled to 256 px and stripped of metadata such
    as EXIF and GPS.
  • Avatars now work on every installation, with no object store required.
• Pause jobs and disable webhooks.
  • Scheduled jobs can be paused and resumed. A paused job never fires, and
    Run now refuses it.
  • Webhook bindings can be disabled. A disabled binding answers 409 after
    verifying the signature.
• Hermes reports its goal, like the other harnesses.
• Identity-repo capability reporting. GET /config says which identity-repo
  modes the installation supports. Create requests it can't serve are rejected
  up front, and the wizard offers only the modes that work.

Fixes

• Run now:
  • It uses the job's saved prompt and its exclusive and clearContextAfter
    flags, so it works immediately after a job is saved.
  • It reports a failed or skipped dispatch instead of always answering 202.
  • It still works against agent images from before this release.
• Credential saving: saving an OAuth or API-key credential never answers
  500 once the credential is stored, even when the agent is changing state.
• API-key agents:
  • Creating one without a key is rejected with 400 naming the field.
  • A pod missing its Secret shows the kubelet's reason right away.
• Identity repos:
  • A stale index.lock no longer blocks identity sync, and kyber-skills
    never takes the index lock.
  • New identity repos get a single scaffold commit. Scaffolding tolerates
    GitHub's brief replication lag on a newly generated repo.
  • Agents waiting on an identity repo show as Creating and recover on their
    own.
• File secrets: these can keep file names such as vault-cert.pem.
  Key-value secrets keep the environment-variable naming rule.
• Skills:
  • kyber-skills install PATH installs from the given path.
  • Skills that exist only on disk are reported as local.
  • Folders without a SKILL.md are no longer flagged.
• Hermes: agents on slow custom endpoints get a 900 s stream timeout
  instead of 180 s.
• Tables: tables sort numeric suffixes naturally (agent-2 before
  agent-10).

Security

• Responses whose content type is sniffed never resolve to HTML or XML, which
  closes a reflected-XSS path.
• Dependency updates address fast-uri (GHSA host-confusion and SSRF
  advisories) and uv in the Hermes image (GHSA-2cv4-cqwr-gwf7). The dev-only
  esbuild advisory (GHSA-g7r4-m6w7-qqqr) is pinned out of the build.

Upgrade notes

New archive store: disk archives are enabled by default
(agentArchives.enabled: true, storage.backend: builtin). The first upgrade
creates an archive-store Deployment and Service, a token Secret, and a 100Gi
ReadWriteOnce PersistentVolumeClaim on the default StorageClass (or
agentArchives.storage.builtin.storageClassName). The store follows the
control plane's node placement.

• macOS, WSL2 and k3s: nothing to do. The volume is a local-path
  directory, and its size is a request, not an allocation.
• GKE: the default standard-rwo class provisions a billed 100Gi zonal
  disk. Set a smaller agentArchives.storage.builtin.size before upgrading if
  you don't want that (a volume can grow later but never shrink), or use
  backend: gcs.
• EKS: clusters on 1.30 and later have no default StorageClass. Use the
  updated EKS preset (storageClassName: kyber-ebs), set the class yourself,
  or use backend: s3. Without one, the chart refuses to render, so the
  upgrade stops before it changes anything instead of leaving the volume
  Pending.
• Anywhere: agentArchives.enabled: false turns the feature off.
• PostgreSQL: disk archives need it (KYBER_POSTGRES_URL). Without it,
  the feature reports itself unavailable.

See upgrading: disk archives
for the self-upgrade path.

CRDs: apply them before upgrading; the self-upgrade Job does this for you.
All CRD changes are additive:

• spec.inference
• spec.jobs[].paused
• spec.inboundBindings[].disabled

Existing agents keep their jobs active and their bindings enabled.

RBAC: the control-plane ClusterRole adds delete on configmaps.
Avatars are stored in ConfigMaps owned by each agent.

Avatars stored before this release: avatars in the durable-tasks object
store still display. They move to a ConfigMap on the next upload, and are
removed when their agent is deleted.

pwa-views: now at 0.62.0 and versioned independently.

• Its React peer range widened to ^18.3.0 || ^19.0.0, so existing hosts keep
  working.
• @tanstack/react-table v9 is bundled and is not a peer dependency.

No incompatible API changes are known. New endpoints:

• switch-runtime
• agent exports, archive uploads and agent imports
• archive DELETE
• profile/avatar, now documented

Publishing this release does not install it on any cluster. Apply it through
the installation's update mechanism, then verify the reported version and the
agent rollouts.

Validation

• Required main CI passed at the release candidate, including integration,
  CodeQL, the pinned A2A contract, and the official HTTP+JSON TCK.
• Live testing on the GCP development install (kyber-dev):
  • Disk export and import: exported a 1.49 GB agent, uploaded the archive
    through the public Cloudflare URL, and restored it on a second machine with
    its configuration, paused jobs, disabled bindings, copied secrets and
    resumed conversation. The harness login stayed behind.
  • Harness switch: Claude Code → Codex in place.
  • Avatars: upload, replace and removal in the console, on an install
    with no object store.

See the release runbook,
upgrade guide,
disk archives and
agent profiles.

Full Changelog: v1.7.0...v1.8.0

v1.7.0

Kyber v1.7.0

Kyber v1.7.0 expands the agent harness contract and closes the conformance gaps validated in the GCP development environment.

Highlights

• Add a live, platform-owned one-line goal for each agent across the API, dashboard, terminal peek, detail view, and fleet list.
• Support conforming runtimes that do not expose model discovery or explicit model selection.
• Improve desktop and mobile agent-list layouts, including bounded goal and model columns with expandable operational details.

Reliability and conformance

• Classify Claude credential, provider, transport, and persistence failures so operators receive the correct recovery path.
• Make Claude Code and Codex credential rotation recoverable across write-back failures, runtime restarts, and pod replacement.
• Restore podless Codex device-login recovery.
• Discover Claude Code and Codex transcripts under the durable rootfs layout for tailing, pruning, and session saving.
• Force atomic same-version harness replacement when repairing a corrupt runtime executable.
• Keep infrastructure scheduling, volume attachment, rootfs seeding, and image pull time out of the runtime startup-timeout budget.
• Add validated lifecycle evidence for the full HC-01 through HC-10 harness conformance matrix.

Upgrade notes

• No incompatible changes are known.
• The Agent CRD update is additive. The standard Kyber upgrade flow applies the bundled CRDs before the Helm rollout.
• The published chart pins the complete v1.7.0 image set; avoid overriding individual image tags when using the coordinated release.

Validation

• Required main and release CI passed, including integration, CodeQL, the pinned A2A contract, and the official HTTP+JSON TCK.
• Live GCP development testing verified durable Claude Code and Codex session capture, corrupt-runtime repair, lifecycle timing, authentication, and fresh-session continuity.

Full Changelog: v1.6.0...v1.7.0

v1.6.0

Kyber v1.6.0

Changes since v1.5.0. Prepared for publication on 2026-09-10.

New features

• Hermes agent harness: create and operate Hermes agents alongside Claude
  Code and Codex. The preview supports API-key authentication through
  OpenRouter, fresh-session restart, native session resume, model and context
  reporting, authenticated model discovery, token usage, skills, and Telegram,
  Discord, and Slack channels. The console exposes Hermes authentication,
  observed provider/model/context data, and stable harness versions.
• Full Slack conversations: Slack agents can now edit messages, react with
  emoji, transfer scoped files in both directions, and present interactive
  Block Kit buttons in addition to text and threaded replies. A mentionOnly
  option limits shared channels to direct mentions, replies to the bot, and
  direct messages. User and channel allowlists continue to be enforced by the
  sidecar, and runtime tools never receive Slack credentials.

Fixes

• Publish the Slack sidecar in main-branch canary charts so a newly installed
  canary actually contains the Slack build represented by that chart.
• Send Slack external-upload reservation fields using Slack's expected form
  encoding, restoring outbound file uploads. Upload failures now retain
  bounded field-level validation details in the tool error and sanitized
  diagnostics in sidecar logs.

Upgrade notes

Use the released Helm chart and apply its CRDs before upgrading; Kyber's
self-upgrade Job performs that CRD step. Release CI builds the complete image
set for amd64 and arm64, including the Hermes runtime and Slack sidecar.

Hermes remains a preview and requires an installation-level Hermes image tag
plus an OpenRouter API-key credential. It does not advertise durable tasks,
scheduled-job turn hooks, subscription login, context compaction, or runtime
repair.

For Slack rich features, review the Slack app configuration before rollout.
The bot needs the history scopes for subscribed conversation types plus
chat:write, reactions:read, reactions:write, files:read, and
files:write. Socket Mode must be enabled, event subscriptions and interactivity
must reach the app-level connection, and the bot must be a member of each
allowlisted channel. Reinstall the Slack app after changing scopes. Existing
Slack configurations default to accepting all allowlisted messages unless
mentionOnly is enabled.

Publishing this release does not install it on any cluster. Apply it through
the installation's update mechanism and verify the reported version and agent
rollouts afterward.

PWA views are independently versioned at 0.43.0. External hosts must consume
the published package version; the embedded console ships with the control
plane.

See the release runbook,
upgrade guide,
chat-channel guide, and
harness conformance evidence.

v1.5.0

Kyber v1.5.0

Changes since v1.4.1.

New features

• Slack conversations: connect an agent to Slack from Comms using Socket
  Mode, a bot token, and explicit user/channel allowlists. Claude Code and Codex
  can receive text and send threaded replies without exposing Slack tokens to
  the runtime. Restart the agent pod after configuration changes. Attachments,
  reactions, and interactive buttons are not part of this initial Slack bridge.
• Private agent avatars: upload, replace, or remove a PNG, JPEG, or WebP
  avatar up to 1 MiB through the API. Avatar upload is not yet exposed in the
  console. Images use authenticated API access.
  The installation currently needs durable tasks enabled and task object
  storage configured for this feature.
• Simpler console navigation: agent details group observation, automation,
  and configuration; Settings groups fleet defaults, observability, health,
  and API access. Desktop uses a local rail and mobile a full-screen menu.
  Existing Metrics and Logs links remain usable.
• Versioned harness integration contract: Claude Code and Codex expose
  runtime descriptors, auth modes, and observed feature availability. Shared
  services use runtime-owned auth, session, transcript, repair, and receipt
  contracts. Missing or stale capability evidence prevents unsupported task
  and job controls from being advertised as ready.

Fixes and cleanup

• Include the Slack sidecar's release image tag in the packaged Helm chart,
  matching the image built by release CI.
• Generate the release change range from the previous stable Kyber tag instead
  of accidentally selecting an independently versioned PWA package tag.
• Correct documentation for Slack, profiles, disk/runtime recovery, portable
  versus node-local storage, authenticated model discovery, durable tasks/A2A,
  PWA publication, and operator-controlled upgrades.
• Remove an unused skills-report helper and an unreachable release-script
  compatibility fallback.

Upgrade notes

Use the released Helm chart and apply its CRDs before upgrading; Kyber's
self-upgrade Job performs that CRD step. This release includes Agent schema and
both runtime integration changes from the harness/Slack/profile features.
Release CI builds nine images, including Slack, for amd64 and arm64.

Publishing this release does not install it on any cluster. Use the installation's
update mechanism and verify its reported version afterward. Existing agents
retain their configured authentication modes; the compatibility API fields and
routes remain available. Runtime feature availability depends on observed
integration health, and the conformance guide retains explicit evidence gaps.

PWA views are independently versioned at 0.40.0. External hosts must consume the
published package version; the embedded console ships with the control plane.

See the release runbook,
upgrade guide, and
harness conformance evidence.

v1.4.1

Install this instead of v1.4.0. Everything new in v1.4.0 — A2A support, durable tasks and the rest — is unchanged and listed there.

Fixed

• v1.4.0 could not start. Two task file-size limits were written into the control plane's settings in a form it cannot read, so it quit on boot and the upgrade stalled with the old control plane still serving. It happened on every cluster, whether or not durable tasks and A2A were switched on.
• A metrics retention window longer than 11 days was silently ignored and fell back to 7 days. Same cause.

v1.4.0

Upgrading

A2A and durable tasks ship off. Turning them on needs PostgreSQL, api.durableTasks.enabled, api.a2a.enabled, and requestReplyEnabled on each agent you want reachable. A cluster that leaves them off is unaffected.

Added

• Agent-to-agent (A2A 1.0) support. Kyber agents can be given work by outside systems and can hand work to other agents. Each agent publishes its own Agent Card on an authenticated endpoint.
• Durable tasks underneath it. A task survives a control-plane or agent restart, reports progress, returns text, JSON or file results, can be cancelled, and can ask the caller a question mid-run and wait for the answer.
• Live task streams. A caller can follow a task as it runs and reconnect without losing events.
• Per-caller ownership. A caller sees and controls only its own tasks, with a separate scope per operation.
• A published capability list per agent, empty until an operator fills it in. Nothing about an agent is exposed automatically.
• Outbound peers. Allowlist named HTTPS peers and their credentials; the agent gets tools to discover, delegate, follow up and download artifacts, and never sees the URL or the token.
• Conformance runs in CI against the official A2A test kit.
• Agents can read their own profile — name, runtime, model, phase, skills. Not placement, credentials or channels.
• Disk usage shows a soft reservation as a reservation, alongside the real free space on the underlying disk.

Fixed

• The installed PWA stays signed in instead of asking for the API key again after every control-plane restart.
• Durable-task settings in the chart never reached the control plane, so the feature could not be switched on at all.
• Row menus in the agent list offered actions the agent's state does not allow; they now match the detail page.
• Text requests submitted through the request API never reached the agent — the request ID format was rejected in the pod.
• A skill written as a single flat file kept warning as unmanaged, and stale skill links are now cleaned up.

v1.3.1

Changed

• Request/reply is now on by default for a cluster. Every existing agent stays
  off after the upgrade — an agent only accepts requests once you turn it on.

Added

• A per-agent request/reply switch, in Agent Details and on the create/read/patch
  API (spec.requestReplyEnabled). Turning an agent off rejects new requests
  with a stable error; requests already in flight still complete.

Callers still need requests:write / requests:read. Redis stays required, and
the API fails closed without it.

v1.3.0

Upgrading

Installing restarts the control plane, then every agent. An agent loses its
current session unless it has session resume switched on.

Two new agent states appear in this release: DiskExhausted and
BrokenRuntime. Both are recoverable and both are described below.

Added

• Agent resource usage. Agent Details shows CPU, memory and disk used against what the agent was allocated, with warnings at 80% and 90% disk. (#158, #170)
• DiskExhausted. An agent that fills its disk is paused instead of dying. The pod and the Shell stay up so you can clear space, and it resumes on its own once you do. (#164, #177)
• BrokenRuntime. An agent whose harness will not run is parked with the actual error instead of looping, and Agent Details offers Repair runtime. (#171, #174)
• Scheduled-job flags on Codex. exclusive and clearContextAfter now work on Codex agents, not only Claude Code. (#162)
• Agent request API. A scoped endpoint for external gateways to send an agent work and poll for the reply. Off by default — it needs Redis and api.agentRequests.enabled. (#155–#163)

Fixed

• A Claude Code agent with no credential now stops at NeedsAuth. It previously reported Running, accepted prompts, discarded them, and recorded every scheduled job as a success. (#175)
• Codex agents keep MCP servers they registered themselves across a restart. (#160)
• A Codex agent whose config is unreadable or unparseable repairs itself at boot, instead of being stuck on a login prompt that could never fix it. (#165, #166, #173)
• exclusive and clearContextAfter work on a brand new agent. They were silently inert until its first restart. (#176)
• Disk usage measures the agent's allocation rather than the node's filesystem, and keeps reporting when it cannot read every file. (#170, #172)
• An agent stuck on its way up now reports what can be seen about it, instead of an empty error and an unchanging phase. (#167)
• Harness upgrades install atomically. An interrupted install leaves the working version in place. (#168)
• EKS machine creation works again — zone and disk size come from the installer profile. (#153, #156)
• Kyber's own Codex tests no longer write outside their temp directories, which could break the machine running them. (#169)

v1.2.0

Added

• AWS EKS as a compute provider. Each Machine and its agents stay in one availability zone, and an agent's EBS volume survives a Spot → On-Demand fallback. Zonal GKE can opt into the same behaviour. (#148)
• Codex agents on a ChatGPT subscription sign in from Agent Details. The verification link and one-time code appear in the panel, with one-tap copy and a countdown. No terminal. (#150)

Fixed

• Start device login works after a failed attempt. From the second press onwards it previously did nothing, while still reporting success. (#149)
• The login panel shows the code instead of spinning forever, and says so when it can't read the agent at all. (#151)
• node-agent images no longer build against an Ubuntu mirror. A stale mirror node failed the v1.1.0 release twice. (#147)

Existing defaults are unchanged and there are no manual steps.

v1.1.0

Highlights

Scheduled jobs can clear the agent's context after each run. A job gains clearContextAfter. Without it an unattended job piles every fire onto one growing conversation, and the agent eventually stops being able to act on new prompts while still reporting healthy. The platform performs the clear — an agent cannot reliably do it from inside its own turn.

Exclusive now means the agent is busy, not the dispatch is busy. The lock only ever spanned the tmux paste (milliseconds), while the turn it started ran for minutes — so a job firing faster than its own work completes stacked prompts onto a single-threaded agent and dispatches were silently dropped. A fire during an unfinished turn now records outcome=skipped reason=agent_busy.

An agent's skills are visible, and provably loadable. A read-only Skills tab on Agent Details, backed by GET /api/v1/agents/{name}/skills. The report scans the pod, not GitHub, so it names skills that are committed but loadable by nothing, malformed or undescribed SKILL.md files, vendored skills shadowing the agent's own, and skill directories written into a runtime home that won't survive a reprovision. The platform relinks and rescans on a loop, so a skill an agent simply writes and commits becomes loadable within a couple of minutes rather than depending on it remembering a command. There is no write path — skills are added and removed by talking to the agent.

A resumed session now receives its startup prompt. With sessionResume and startupPrompt both set, an agent returning from a pod recreate, preemption, or crash is handed the prompt instead of resuming with full context and no turn to act on. An intentional restart-session still starts fresh and delivers the prompt there, unchanged.

PWA browser branding. Transparent cyan Kyber diamond for the favicon and Android/PWA install icons, full-bleed Apple touch icon so iOS applies its own corner mask, and the active cluster name in the browser title.

Also in this release

• CI now builds the status-sidecar on pull requests, tagged by head SHA.
• Node 26 across the build and test toolchain.
• Go, Kubernetes client, and npm dependency bumps (~15 PRs).

Upgrading

• Installing restarts the control plane, then every agent — each loses its current session.
• New CRD field spec.jobs[].clearContextAfter, applied by the chart upgrade. Existing jobs are unchanged; the clear is off unless you set it.
• No manual steps.