Aliquot 0.5.1: reach it from other harnesses, and the Next fix

• Security: next 16.4.5 fixes the 11 Next.js advisories open against 16.3.3 (GHSA-vcvr-r3jv-pc5j, GHSA-2464-fhr4-w9xw and GHSA-673q-mjm6-r5xr critical; GHSA-cjq9-62q9-8jv4 and GHSA-p3m5-59mp-jv5r high; six medium or low). Overrides lift dompurify (from monaco-editor) to 3.4.17 and drizzle-kit's old esbuild to 0.25. deepmerge has no fixed release, so vendor/deepmerge is 4.3.1 with the GHSA-gcqx-w48m-w2h4 fix and a test. .github/dependabot.yml turns on weekly grouped npm updates.

• Agent backends take a key the lab owns: api_key_env reaches Claude Code as ANTHROPIC_API_KEY and Codex as CODEX_API_KEY. auth_env, a personal subscription's OAuth token, now parses only at placement = "public" and runs only under agent-worker --dev-shared-login; a lab.toml with auth_env at approved or zdr fails to start. The README and the IRB doc no longer suggest claude setup-token; the install guide says which model accounts Aliquot may use, and the IRB doc gains a "Model accounts" section.

• lab.example.toml's OpenRouter example routes Claude to amazon-bedrock and google-vertex, the providers with zero-retention Claude endpoints; only = ["anthropic"] with zdr = true matched none.

• The roadmap puts sign-on, keys and retention (now 0.7) before studies an IRB can cite (now 0.8).

• aliquot ask asks a question through the web door from a terminal or a script. --json prints one line per step (started, tool, finished, refused), each with the run's record link, and the exit code says whether it was answered. --ceiling withholds an answer above a class from a caller that keeps its own copy. pnpm lab0 gains check G: aliquot ask --json gets the same cited answer as the chat page, and a record whose chain verifies.

• aliquot acp speaks the Agent Client Protocol on stdin and stdout, so T3 Code (as a local ACP command), Zed and other ACP clients run Aliquot agents as threads. One session is one Aliquot thread. The tools the run used appear as steps, a refusal ends the turn as refusal, and cancelling stops the run.

• scripts/tmux.sh (pnpm up:tmux) lays out the worker, the web door, the studio and an ask shell as one tmux session. A window whose process exits keeps its last lines. docs/harnesses.md covers all three.

• The chat and record pages show the lab's name at the top right, from a new [lab] name in lab.toml (aliquot init asks for it), or the machine's hostname when it is unset. The header labels "Runs on this machine" and "Read only", the chat page's footer line and its intro paragraph are gone.

• The README demo is a new recording of the current pages, and the chat and record stills are retaken in light and dark.

• Runs (/runs) lists the newest 100 runs with their outcome and how many refusals each had, and shows only the runs with a refusal, or only the failed ones, at a click. Each row opens its record. A PI no longer needs a terminal to find a refused run.

• The chat thread is kept in the browser tab, so opening a record and coming back, or reloading, no longer loses it. New thread starts over. A dropped connection while an answer is pending says to reload, and the reload picks the answer up.

• The record page has Only refusals when a run refused anything, prints cleanly for an IRB file, and arrives with its data in the page instead of a second request. Pages are gzipped: each is one request of about 6 KB, down from up to two requests and 16 KB.

• Every control on the chat, runs and record pages shows where focus is, and asking, opening a record, downloading it and finding a refused run all work from the keyboard alone. The studio's status lines mark their kind by shape (a check, a triangle, a square, a dot), not only by colour.

Aliquot 0.5.0: install it on a lab machine

• One docker compose up on Linux starts Postgres, the worker, the web door and a production build of the studio. The studio applies committed Payload migrations at start, and CI fails when the collections change without one. Ports are published on 127.0.0.1 unless .env sets LABH_BIND. docs/install.md is the guide for research IT.
• PDF sources for knowledge bases, from the kb command. poppler reads them inside the sandbox container (no network, read-only root, uid 65534), never in a Node process. A page that is only an image fails the whole file with a message naming the page, because Aliquot does no OCR. compose.sandbox.yaml gives the Docker socket to the worker only. The studio gets no socket, so PDFs compile with the kb command.
• aliquot init (pnpm aliquot:init, or docker compose run --rm init on a machine with only Docker) writes config/lab.toml and .env. It tests the lab's participant id patterns against ids you paste, with a PASS or FAIL line for each, refuses a pattern that matches ordinary words, and never rewrites an existing .env.
• scripts/backup.sh and scripts/restore.sh back up and restore the database and the payload key. Restore refuses a key the backup was not made with, and ends by checking every run's hash chain.
• scripts/compose-check.sh runs all of it on a machine with only Docker, and CI runs it on a clean Ubuntu runner: a cited answer from the lab0 handbook, a LaTeX PDF and a Word PDF read in the sandbox, a scanned page that must fail, then a backup, wipe and restore that ends with the same run verifying and decrypting again.
• The web door takes --host, so it can listen inside a container. The kb command prints a source it cannot read as one line instead of a stack trace.

Aliquot 0.4.0: Word sources and a record you can keep

A lab's own Word documents, and a record a reader can keep.

• Word (.docx) sources for knowledge bases, from the kb command and the studio. Core reads them to Markdown with no new dependency: headings by style name, list items, tables, tabs and line breaks; deleted tracked changes, images, comments, headers and footers are dropped. The lab's participant id patterns see the Word text. A .pdf or .doc source gets a message saying to save it as .docx.
• A summary at the top of every record: outcome, time, model calls, tokens, tool calls by name, knowledge base entries retrieved and refusals. In the record page, in aliquot record and in --json.
• Download JSON on the record page, so a PI or IRB reader can keep the record. Each event's kind is marked by shape (run, model call, tool call, refused) with a legend, and the legend names the data classes.
• Chat answers keep their structure: paragraphs, lists, headings and code blocks, still without parsing model text as HTML. Each answer says what its run read and how long it took.
• pnpm run doctor: pnpm 10's built-in doctor command shadowed the bare pnpm doctor that 0.3.1 documented. The docs now say pnpm run doctor, and a test keeps them that way.
• docs/ROADMAP.md: the next releases, who each serves and how it is checked. Next is 0.5, installing it on a lab machine.

Checks on this commit: 347 tests on Linux CI (303 pass, 44 skip, 0 fail); pnpm lab0 9/9, pnpm slice1 12/12, pnpm unit3 9/9. On macOS with Docker: 347 of 347 pass, and pnpm unit2 6/6.

Aliquot 0.3.1: doctor and terminal tools

Terminal tools and a preflight on top of 0.3.0:

• pnpm doctor: a read-only preflight. It checks Node, pnpm, the installed dependencies, Docker, the Postgres port, ports 3000 and 3001, the aliquot-sandbox image, the agent CLIs and lab.toml, and prints the fix for each problem. It exits 1 when something pnpm demo needs is missing.
• pnpm aliquot runs [--limit n] lists the newest runs with their start time, agent version, outcome, event count and chain check.
• --json on aliquot record and aliquot runs prints the same view as JSON, for scripts.
• aliquot prints one line for setup problems instead of a stack trace, and never prints the password. Exit codes are documented in --help.
• pnpm aliquot no longer prints Node's ExperimentalWarning for --allow-net.
• The [tools] refusal no longer promises a version for contributed tools.

Checks on this commit: 340 tests on Linux CI (296 pass, 44 skip, 0 fail).

Aliquot 0.3.0: reading papers

Four more literature tools, all built into core, all public (D0) hosts:

• europepmc_search: PubMed, PubMed Central and preprints, with which hits are open access.
• europepmc_fulltext: an open-access article's full text section by section, with its license.
• doi_lookup: Crossref's record for a DOI, plus a legal open copy from Unpaywall when the lab set a contact email.
• citation_walk: references or citing works of one paper, through OpenAlex.

The studio gained a read-only Tools panel, and its panels and the record page got empty, loading, error and phone layouts. Design: docs/design/DESIGN-v03.md.

Aliquot 0.2.0

• Claude Code and Codex as confined agent engines on macOS, behind a bridge to Aliquot's own tools and a host-pinned proxy.
• Built-in research tools: OpenAlex, PubMed and arXiv search, datasets by class, and run_code for R and Python in a container with no network.
• Native Anthropic Messages and OpenAI Responses clients, and per-class model routing.
• A chat page for members, a record page for each run, pnpm aliquot record in a terminal, and pnpm demo, which runs the synthetic lab0 lab in one command.

Design: docs/design/DESIGN-v02.md.

Aliquot 0.1.0

The first public release: the durable run loop, data classes and the single egress decision, the boundary scanner and the runtime network seal, knowledge bases with a coverage gate, the authoring studio with five roles, the web door, the encrypted payload store and the hash-chained audit stream. Design: docs/design/DESIGN.md.