v0.6.8 - Agentic Phase 2: multi-call steps, approval gating, trace tooling

• Multi-call steps: one assistant turn may request several tools; the loop validates, approves, executes, and reinjects them in order with limits and cancellation checked between calls. All three protocols now parse every well-formed call per step.
• Approval gating: every tool declares a risk class (ReadOnly / LocalWrite / ExternalSideEffect). The default policy denies declared external effects as structured, traced, model-visible rejections; hosts embed custom gates via ApprovalPolicy::custom. CLI: --allow-unsafe-effects.
• Trace tooling:
  • ember trace diff - structural comparison of two runs (status, totals, final-answer digest, event-type skeleton with first divergence; --fail-on-diff for scripting)
  • ember trace replay - re-executes recorded deterministic tool calls offline against a fresh registry (no model loaded) and verifies stable payload digests
  • ember trace report - self-contained HTML report: summary card, timeline bars, artifacts, full event table; inline CSS only, no JavaScript
• Replay digests: every execution records payload_sha256 plus a rerun-stable replay_sha256 under all privacy modes.
• image_fixture built-in: deterministic PNG through the artifact path (image/png), proving binary media flows end-to-end.
• Docs: docs/agent-runtime.md; README gains an agentic section.

Also fixes the last platform-dependent serialization site in protocol renders (aarch64-only serde_json preserve_order flip) and adds a source-level regression guard.

Tests: 47 lib unit + 27 hermetic integration tests; replay verified against a live Qwen2.5-1.5B run (3/3 digests match).

v0.6.7 - Agentic Phase 1: tool runtime, structured calls, research tracing

• Agentic execution layer (ember::agent): model -> parsed structured tool call -> schema validation -> execution -> result reinjection into the same session -> continuation -> final answer, as an explicit state machine with hard limits (steps, tool calls, wall time, per-tool timeout, per-turn tokens, result bytes).
• Tool runtime: JSON-Schema-compatible schemas (string/number/integer/bool/array/object/enum), strict validation collecting every violation, frozen registry with duplicate rejection, watchdog timeouts, contained panics.
• Protocol boundary: Qwen2.5 <tool_call> and Llama 3.x <|python_tag|> codecs plus a generic-JSON testing mode; renders pinned byte-exactly; broken calls reject loudly instead of silently degrading to text. One call per step (documented).
• Research tracing: crash-tolerant JSONL (ember.agent.trace.v1, monotonic sequence, torn-line tolerant), privacy knobs with documented defaults, provenance events (version/git/rustc/target/model sha256/quant/tokenizer hash/tool-schema snapshot), hashed artifact records.
• Deterministic built-in tools: calculate, lookup, echo, write_artifact, fail, sandboxed read_text_file/search_text. No shell/network tools by design.
• CLI: ember agent run, ember agent demo, ember trace inspect.
• Validation: 40 lib unit tests + 19 hermetic scripted-model integration tests; real-GGUF gate executed against Llama-3.2-1B-Instruct-Q8_0 (llama3 protocol) and Qwen2.5-1.5B-Q8_0 (qwen25 protocol, 4-tool research workflow with correct arithmetic and a hashed artifact).
• Performance: orchestration overhead ~0.5-1.9 ms per mock run; tracing adds ~0.2 ms; ~16 events (~5 KB) per one-tool run.

All changes are additive: no attention/KV/tokenization/encoder/tensor code touched, zero unsafe added.

Ember v0.6.6 — multimodal patch

Multimodal patch on top of the v0.6.5 foundation: live voice conversation and Arabic speech output at reference parity.

Highlights

• ember voice --converse — full model-in-the-loop conversation in one command: capture ring → energy VAD → streaming audio → VoiceSession → LLM → speech out → playback ring, with barge-in (generation-phase cancel + KV rollback, playback-phase interrupt) and a hermetically pinned transition graph.
• MMS-TTS (VITS) engine in Rust (src/tts/vits.rs) — first genuinely Arabic-capable open-weight TTS path (character vocab over raw Arabic script, no G2P). Full parity ladder vs HuggingFace reference: embeddings exact, encoder 2.5e-7 rms_rel, flow z 3.4e-7, decoder substages ≤5e-6, waveform rms_rel 8.8e-6 / cosine 0.99999999996 with exact sample counts; residual proven below torch's own f32-vs-f64 cross-precision floor.
• SpeechOut seam — OuteTTS and MMS-VITS interchangeable behind one streaming API (--vits-model); Arabic S2S integration test drives bank audio → transcript → reply → PCM against real weights.
• Duplex rework: onset+endpoint survive one chunk, utterance head never lost, single validated resample path.

Fixed

• CI: benches/multimodal_batch.rs exited 2 when run argless by cargo test --all-targets, turning the v0.6.5 release run red on both tiers; now skips silently.

Ember v0.6.2

Changed

• Q4_K/Q6_K production matmul now uses canonical transient Q8_K activation
  packing and integer dots for decode and prefill. The exact-f32 dequantize/dot
  implementation remains an explicit slow oracle. Non-finite activations fail
  before destination mutation; warmed workspace and accumulate semantics are
  explicit contracts.
• Execution plans retain loader fallback provenance and identify the numerical
  runtime with kernel_revision = 2 while preserving offline verification and
  hashes of historical revision-1 plans. Plan/dispatch disagreement is a
  release-mode error, and the cache key now includes Rayon thread count.
• The superseded internal K-quant modules (k_gemv, k_prefill,
  k_matmul_x86) and their ad-hoc examples/benches were replaced by
  k_quant_matmul. Ember's Rust library is internal/unstable; this is an
  intentional source-level break rather than compatibility shims over dead hot
  paths.
• The v0.4 planned-decode interpreter moved out of src/llama.rs into
  src/planned_decode.rs (resolved ops, scratch-arena session, planned and
  fused kernels, forward_last_logits_planned). Zero behavioral change;
  src/llama.rs keeps the model, eager forward, dispatch, and plan
  construction. The v0.5 research contract's reference to the interpreter
  path was updated accordingly.
• Toolchain pinned via rust-toolchain.toml to 1.92.0 (the declared MSRV
  and CI toolchain); local builds now match CI.
• Dependencies: crossbeam-epoch 0.9.18 → 0.9.20 (RUSTSEC-2026-0204),
  anyhow → 1.0.104 (RUSTSEC-2026-0190), memmap2 → 0.9.11
  (RUSTSEC-2026-0186). cargo audit is now part of CI.

Added

• First-class KV-prefix snapshots for the Llama/Qwen CPU runtime through the
  ember kv command family: deterministic ember.kv-snapshot.v1 artifacts,
  strict integrity and compatibility checks, bit-exact same-model replay,
  cache comparison and perturbation diagnostics, replay traces, and explicit
  RoPE remove/reapply research utilities. The validation matrix and benchmark
  evidence are recorded under artifacts/benchmark-kv-v1/2026-08-08/.
• The bilingual “Road to Ember 1.0” documentation series and a substantial
  native-console visual refresh, while preserving the same v0.5 experiment
  execution path and offline behavior.
• A pinned llama.cpp known-answer verifier for Q8_K bytes and Q4_K/Q6_K dots,
  fail-closed 1B real-model scalar/x86 validation, a dedicated x86 CI gate,
  adversarial kernel matrices, and schema-4 path-interleaved benchmark output
  with checksums and full dispatch/workspace provenance.
• tests/property.rs: proptest suite (tensor shape ops vs hand-rolled
  references, decode-arena disjointness/alignment/isolation, K-quant dequant
  contracts) plus fuzz-style robustness tests for the untrusted-input
  boundaries: the GGUF loader, the v0.5 spec parser, and the npy reader must
  never panic on arbitrary input.
• benches/hooks_overhead.rs: planned-decode cost with a noop experiment
  runner attached vs bare (Gate H evidence; measured ≈0% overhead).
• Rustdoc lints (broken_intra_doc_links, private_intra_doc_links) and a
  CI docs step (RUSTDOCFLAGS=-D warnings cargo doc).

Fixed

• forward_last_logits_planned had hard-coded ExecutionMode::Planned, so
  planned-fused parity tests never executed F1-F5. It now routes the model's
  actual mode; tests use execution counters. This exposed Q8_0 F5 overwriting
  the residual (Q8_0 assigns rather than accumulates), so Q8_0 F5 now de-fuses
  with a serialized reason while f32 and canonical K kernels execute F5.
• Owned reader-backed K weights now receive the loader-resolved execution tier
  at construction, matching mmap-backed weights. Loader fallback reasons and
  original dtype survive model construction into execution plans.
• Build provenance now exports the EMBER_GIT_COMMIT name consumed by plans,
  traces, and benchmarks (plus dirty-tree status for benchmark records).
• tests/k_parity.rs::v04_planned_inactive_hooks_real_model failed on Q8_0
  models: the plain run uses the v0.3 native fast path (contract D1) while
  the hooked run uses the generic hooked path, so bit-exact logits were not
  the right contract there (tokens always matched). The test now skips
  models without K-quant tensors; all parity suites (Q8_0, Q6_K, Q4_K_M)
  pass 5/5.
• All 8 rustdoc warnings (math-notation brackets parsed as links,
  private-item links, unclosed HTML tag in a doc comment).
• Stale #[allow(dead_code)] on KQuantWeight::try_from_mmap (the loader
  calls it), on the generic LlamaMlp/Attention/Block structs, and dead
  gemma4 forward_full paths (test-only attention ported behind
  #[cfg(test)]).
• // Safety: comments on the previously undocumented unsafe sites: the
  matrixmultiply::sgemm call in tensor.rs and 29 SIMD kernels in
  simd.rs.

Ember v0.6.1

Added

• ember gui (native console): light/dark theme toggle in the header
  (defaults to dark). Every color role in the console switches with the
  palette, including iced widgets (inputs, combo boxes, editor, buttons)
  which follow the iced Theme.

Ember v0.6.0

Added

• ember gui — a native, single-window experiment console for live demos
  (v0.6): an iced app on the tiny-skia software renderer (no GPU or
  webview dependency) with embedded Noto fonts (src/gui_fonts/) for
  offline Latin + Arabic coverage, dark console theme.
• ember web-gui — an offline, single-page browser console for live demos
  (v0.6). A thin presentation layer over the existing v0.5 pipeline: the
  page translates every action into an ember.experiment.v1 specification,
  validates it through the standard RawExperimentSpec::resolve() gate, and
  executes it with the same prepare_run / execute_prepared code as
  ember experiment run. One resident model session serves repeated
  baseline / intervention / restore runs, so the demo loop never reloads the
  model. Bundles are written and self-verified exactly as in v0.5; the
  restore-original leg reports a bit-exact match against the baseline.
  Light/dark theme toggle (defaults to the system preference, persisted in
  localStorage). See docs/v06-gui.md.
• src/gui_native.rs: the native console — same GuiSession core and
  parse_run_request gate as the browser console, runs executed in a
  worker thread so the UI never blocks.
• src/gui.rs + src/gui_page.html: tiny embedded HTTP server (tiny_http,
  localhost only) and a self-contained page (no web framework, no external
  assets) with Arabic/RTL rendering via the browser (dir="auto" per field;
  the UI itself stays LTR).
• cli_experiment::prepare_run / execute_prepared: the v0.5 run path was
  split into a reusable model-load step and an execute step so a loaded
  model can be kept resident. ember experiment run behavior is unchanged
  (it calls both in sequence).

Ember v0.5.1

Patch release on top of v0.5.0 (CI-green on the pinned Rust 1.92 toolchain).

Fixed

• CI clippy on Rust 1.92: src/v05/testutil.rs had a file-level
  #![cfg(test)] alongside the #[cfg(test)] module gate in mod.rs;
  rustc 1.92 rejects the duplicated attribute. Verified locally with
  cargo +1.92.0 clippy -- -D warnings and cargo +1.92.0 test --all-targets (237 + 19 + 46 + 5 tests green).
• Docs: docs/usage.md repointed the v0.2 activation-artifact schema
  reference from docs/experiments.md (now the v0.5 doc) to
  activation-artifacts.md / activation-patching.md.

Added

• Recorded capture-from-bundle real-model workflow (Gate D evidence)
  on Llama-3.2-1B-Instruct-Q8_0: baseline captures prompt-final
  attention-output across all layers; a second run replaces layer 8's
  row with the baseline bundle's layer-3 row; a third run adds
  restore-original. Results: layers 0-8 bit-exact, 9-15 diverge;
  restoration reproduces the baseline with all 16 capture layers exact
  and outputs equal. Specs/hashes under
  artifacts/benchmark-v05/capture-from-bundle/, commands in
  docs/interventions.md.
• Refreshed Gate H matrix with the release binary: ordinary runs
  2.58 s / 2,751,028 kB RSS vs 2.61 s / 2,751,024 kB with experiment
  machinery unused; experiment workloads +2.2% RSS (gate ≤3%).

Binaries: build from source (cargo build --release); no model files
are distributed.