The AI Toolchain — issue 018, September 6, 2026

Pi can now run inside Docker Sandboxes through the sbx proxy, which substitutes real credentials on egress to api.anthropic.com so provider keys never enter the container. Credentials are wired with sbx secret set-custom --host api.anthropic.com --env ANTHROPIC_OAUTH_TOKEN --placeholder for Claude Pro/Max OAuth tokens, or sbx secret set anthropic for API keys, using the same kit-based sentinel/substitution model. Pi launches inside a sandbox via sbx run --kit 'docker.io/sbx/pi-kit:latest' pi, with the current directory auto-mounted as the workspace and Pi pre-baked into the image, and can be driven non-interactively in a running sandbox with sbx exec <sandbox-name> -- pi -p '<prompt>'. Pi also reads ANTHROPIC_OAUTH_TOKEN natively and prefers it over an API key, so no extra configuration is needed once the sandbox proxy sets it.

$ claude setup-token
sbx secret rm anthropic
sbx secret set-custom \
  --host api.anthropic.com \
  --env ANTHROPIC_OAUTH_TOKEN \
  --placeholder 'sk-ant-oat01-{rand}'

$ sbx run --kit "docker.io/sbx/pi-kit:latest" pi

$ sbx exec <sandbox-name> -- pi -p "list the failing tests"

Adds kirocrew secrets import command to move plaintext credentials out of .env into the encrypted vault, leaving a secret:// reference behind; dry-run by default, --apply to commit.

$ kirocrew secrets import --apply

Adds a no-install local dictation engine: a whisper.cpp model runs resident in the gateway, transcribing short utterances in tens of milliseconds with live text as you speak. The whisper, mlx, parakeet, and faster dictation providers are retired; saved settings fall back to the new local provider, which downloads its own model (default: base, 148 MB; stored turbo pulls 1.6 GB). Run kirocrew doctor to audit materialized defaults.

Adds AWS Control built-in app with Accounts, Library, Drive, Backup, Bill, and Access views over a private versioned S3 bucket, with audited mutations. This replaces the old cloud backup path: kirocrew snapshot --to s3://…, the --aws-profile flag, and the s3:// fetch path are removed.

Adds a durable workflow library: promote a session's workflow to a global library, manage revisions from Agent Capabilities, and invoke saved definitions with /workflow.

Adds kirocrew update command for atomic self-update: installs the new version into a signature-verified tree and switches to it atomically.

Adds slack.trusted_bot_ids config key to let named bots bypass the bot filter in multi-gateway meshes, with a per-thread turn limit to prevent infinite mutual replies.

Adds session_send agent tool to deliver a message into another session as its next turn, enabling coordinator agents to direct peer sessions.

Adds a built-in conductor agent that decomposes a goal, opens a session per work item, checks acceptance, and manages rounds on a monitoring loop that survives tab closes and turn caps.

Adds 'Set up & show QR' one-click phone access that enables trust, restarts the gateway, publishes over Tailscale, and issues a sign-in QR code; phone sessions now survive gateway restarts. Adds one-time sign-in link minting from a signed-in device for phones that have lost their session.

Adds security_policy.json support: an administrator publishes one policy file at a URL and every host fetches, caches, and periodically refreshes it fleet-wide with no restart.

Adds kirocrew chat tool-permission prompts so approval requests surface in the CLI instead of hanging silently until timeout, plus bulk approval and single-rejection controls: one click answers all waiting tool calls, or refuse one call and still be asked about the rest.

Adds video attachment support in the composer: up to 512 MB, streamed to disk and available from the phone photo picker.

Adds timezone and skipped-date support for app cron jobs via code or app.json, so scheduled tasks fire at the correct local hour.

Adds session_color agent property to tint every session an agent starts, applied at render time so editing the agent re-tints live sessions.

Adds session tabs: open multiple sessions as tabs above the transcript via middle-click or modifier-click, with live status per tab and persistence per surface.

Adds enterprise MCP governance: on an enterprise Kiro account with an admin-configured MCP registry, org-level MCP controls including version pins take effect.

Adds snapshot restore-into-live-state: replace or merge a snapshot into the running install per component, with a rollback ledger.

Adds openai/gpt-6-astra model support, selectable with an OpenAI API-key profile or an eligible ChatGPT/Codex account, with text and image input, Responses tool calls, async function tools, WebSocket steering, and reasoning controls including /think ultra orchestration.

$ /think ultra

Adds tools.sessions.visibility config key to control cross-agent session scope; set to agent or self for narrower access, with ordinary agent-to-agent access enabled and all-session visibility as the default.

tools.sessions.visibility: self

Enable Settings → Labs → Custom plugin UI to let plugins contribute Control UI pages, panels, and session actions, or customize the composer and workspace.

Adds plugin icon packaging at assets/icon.png, loaded without a network request; missing or invalid icons no longer block plugin loading.

Swarm concurrent sub-agent orchestration is now on by default, producing structured results and live progress, while preserving explicit opt-outs, tool restrictions, and the separate Code Mode opt-in.

Adds Slack Block Kit rich replies, guiding agents to use supported Block Kit layouts for proactive Slack replies, plus a native Stop button, session processing and approval status, and synchronized session titles; the latter requires enabling the documented Slack session-event subscriptions.

Adds Gateway RPC latency phase breakdown in OpenTelemetry and Prometheus diagnostics to distinguish slow dispatch from slow execution.

Adds a Devices page showing device types, resource meters, capability chips, and Desktop availability, with native iOS CPU/memory and Android memory/disk reporting.

Adds personal connected accounts — add provider accounts from Settings → Profile → Connected accounts or the CLI and choose an account per chat — plus provider account priority exposure through the Gateway.

Adds COMPUTER_IMAGE, SUPERVISOR_IMAGE, BOT_IMAGE, LANGGRAPH_IMAGE, and SERVER_IMAGE environment variables to pull pre-built images from ghcr.io/copilotkit/openbot-<service> instead of building from source, activated with IMAGE_PULL_POLICY=missing. Each release now publishes five such images with linux/amd64 and linux/arm64 support and build provenance attestations, with digests pinned in container-images.json.

$ export COMPUTER_IMAGE=ghcr.io/copilotkit/openbot-agent-computer@sha256:<digest>
export SUPERVISOR_IMAGE=ghcr.io/copilotkit/openbot-supervisor@sha256:<digest>
export BOT_IMAGE=ghcr.io/copilotkit/openbot-bot@sha256:<digest>
export LANGGRAPH_IMAGE=ghcr.io/copilotkit/openbot-langgraph@sha256:<digest>
export SERVER_IMAGE=ghcr.io/copilotkit/openbot-server@sha256:<digest>
export IMAGE_PULL_POLICY=missing
docker compose up

Removes the COPILOTKIT_LICENSE_TOKEN requirement; deployments now need only INTELLIGENCE_API_URL, INTELLIGENCE_GATEWAY_WS_URL, and INTELLIGENCE_API_KEY to start. Also makes secrets.licenseToken optional in the Helm chart so managed-Intelligence installs are no longer refused at helm install.

INTELLIGENCE_API_URL=https://intelligence.example.com
INTELLIGENCE_GATEWAY_WS_URL=wss://intelligence.example.com
INTELLIGENCE_API_KEY=sk-live-...

Adds three structured log keys for OAuth connection failures — oauth-token-endpoint-unreachable, oauth-registration-endpoint-unreachable, and oauth-connection-not-recorded — plus oauth-token-endpoint-unusable for catalogue-side faults. Also adds a TRUSTED_ORIGINS fallback to port 3010 (the actual app port) instead of http://localhost:3000, preventing broken OAuth redirects on deployments that leave the variable unset.

Published service images now use zstd compression instead of gzip, reducing agent-computer from 962 MB to 886 MB on the wire with significantly faster decompression. This requires a zstd-capable client (Podman or current containerd); older Docker daemons without zstd support will fail to pull.

Ships a skill-creator skill granted to general-assistant with four tools for listing, reading, and saving skills via POST /api/plugins/skills, letting skills be authored interactively in conversation instead of the /skills form. Ships a matching bot-creator skill, also granted to general-assistant, with tools for listing, reading, and saving coworkers via the same person-facing endpoints.

Adds a 400 response naming the agentId field when POST /api/channels/:id/activity receives a blank or whitespace-only value, replacing the previous misleading 404 Agent not found.

Treats an empty PORT or SERVER_PORT as unset rather than parsing to NaN, defaulting to port 4300, and refuses non-numeric or out-of-range values instead of silently binding a wrong port.

Adds a standing-instructions box in Settings — one text field per person, spliced into every built-in coworker's prompt on every run including overnight routines — stored under migration 0026_user_instructions.

Automatically names conversations from their opening exchange (up to 600 code points) using the model named by tenantPackage.model, replacing the last-message preview in the channel roster's second line.

Respects the auth scheme prefix in custom MCP server tokens — a token beginning with Basic or Bearer is now forwarded as written; bare tokens still default to Bearer.

Redacts toolResult and toolArguments (camelCase MCP/computer-tool spellings) in audit_events.payload, in addition to the already-redacted tool_result and tool_arguments.

Moves routines out of the global sidebar and into each coworker's own dialog section, with run-state chips showing channel, last-run outcome, and next scheduled time. The global /routines sidebar entry is removed, though direct links to /routines still resolve.

Introduces a three-step coworker creation wizard (identity, visibility, endpoint) and replaces the side panel with a full coworker management dialog accessible from any surface, including mobile.

Adds a native MTP governor with seed-uncertainty margin, bounded AR calibration for a context-matched baseline, geometric backoff with relaxation, and a confirmed final rung. Includes a measured depth economics probe comparing configured depth versus D1, an MTP depth ladder D3 -> D1 -> AR with margin 1.0 using cheap probes and promotion back to D3, a per-request retry budget for re-entry and promotion probes, and a per-cycle trace switch for governor audits.

Adds qwen4_exp QSA index pool retention across decode calls, opt-in multi-row gates for grouped GDN projections and compiled HC, a MoE route-overlap diagnostic for multi-row verification, and an affine MoE pair kernel with opt-in mixed gate/up layouts and 3/6-bit experts — now enabled by default. Also enables verify-width grouping by default, with full-model receipts.

Accepts JSON-schema native tool prompts for MiniMax-M2.7, Qwen3.8-27B, and Nanbeige models, and treats an explicit null for a required nullable tool-call argument as a value rather than a missing argument.

Adds --flashinfer-mxfp4-moe-precision fp8 to quantize activations to FP8 when serving MXFP4 MoE experts on Hopper, gaining ~12% output throughput on DeepSeek-V4-Flash with no GSM8K accuracy change (requires FlashInfer 0.6.18).

$ python -m sglang.launch_server --model deepseek-ai/DeepSeek-V4-Flash --flashinfer-mxfp4-moe-precision fp8

Adds --moe-a2a-backend deepep_v2 to enable DeepEP's new ElasticBuffer engine for DeepSeek-V3/V4 and Qwen3-MoE in FP8, enabling CUDA-graph-compatible decode across nodes with fixed-size buffers.

$ python -m sglang.launch_server --model deepseek-ai/DeepSeek-V4 --moe-a2a-backend deepep_v2

Adds SGLANG_OPT_KDA_FUSED_ACCEPT_STATE=1 environment variable to enable a fused accept-state path for KDA MTP verify-and-commit, cutting latency 45–63% on Kimi-Linear shapes with bit-identical output.

Adds --enable-layernorm-sp flag to activate layernorm sequence parallelism on dense Qwen3 models, reducing prefill time by 3.5% on H100 and 5.6% on B200.

Ships a new persistent Lean attention kernel enabled by default on AMD MI300X/MI355X, giving up to 1.52x throughput and 3.62x lower inter-token latency; set SGLANG_DISABLE_LEAN_ATTENTION=1 to opt out.

Adds pipeline parallelism (PP) support in full-prefill CUDA graphs, with prefill CUDA graph proxy tensors yielding up to 2.48x throughput at 2K-token forwards on Qwen3.5-397B on GB300.

Adds Q8KV8 sparse MLA prefill runtime backend for DeepSeek-V4, improving prefill throughput +4.4% to +7.5% across 3.5K–160K input lengths on H20.

Supports decode context parallelism (DCP) on the trtllm_mla decode backend for Blackwell MLA, enabling continued scaling past ~680 tokens/s at 128K input on eight B200s.

Adds multi-adapter LoRA support with EAGLE, NEXTN, DFLASH, and DSPARK speculative decoding; Nemotron 3.5 Lightning speculative decoding support; support for custom draft worker classes; extensible draft attention backends; mixed chunk prefill support when speculative decoding is enabled; and DSA top-k backend selection via --speculative-dsa-topk-backend and --dsa-topk-backend flashinfer (FlashInfer 0.6.18).

Adds DFlash2 speculative decoder with local convolution and candidate selector, achieving 3.43x over no-spec at batch 1 and ~24% over DFlash at concurrency 64.

Adds scan_vectors() and iter_vectors() enumeration methods across the FAISS, SQLiteVec, PgVector, Qdrant, Weaviate, Pinecone, and Milvus backends, making semantica store migrate functional between backends for the first time. The Weaviate backend also gains delete_vectors() and ErasureCoordinator support.

Adds ErasureCoordinator to semantica.context for cross-store entity erasure, ensuring a purged entity no longer survives verbatim in AgentMemory or as an embedding after purge_node() completes.

Adds first-class provider wrappers for Anthropic, Gemini, Ollama, DeepSeek, and Novita in semantica.llms, matching the existing Groq and OpenAI pattern.

Ships SLSA build-provenance attestation plus Sigstore signing on every release, with .sigstore.json bundles alongside the wheel/sdist on GitHub Releases.

Adds a deterministic, CI-friendly quality gate for ontologies and knowledge graphs to the Ontology package, along with first-class Google ADK integration and a production-ready Salesforce ingestor via the semantica ingest pipeline.

Upgrades Explorer's read-only Markdown viewer to a full editor for live ContextGraph nodes and host-supplied AgentMemory items.

Self-hosters using live billing must stop old checkout producers and finish in-flight requests before enabling checkout traffic on v0.46.0, following the durable-checkout rollout procedure documented at .agent/kb/runbooks/billing-checkout-cutover.md.

Runner redaction now masks long private-key blocks and sensitive argument values that are cut off by output limits, while default rules continue to preserve public AWS access-key IDs and mask recognized secret-key and session-token fields.

Older MCP draft operations without a saved result now return operation_incomplete; inspect the current draft before making another change.

Bulk export now defaults to zstandard (zstd) compression; self-hosted environments can retain gzip via the FF_BULK_EXPORT_DEFAULT_COMPRESSION environment variable.

$ FF_BULK_EXPORT_DEFAULT_COMPRESSION=gzip docker compose up

Adds POST /v2/datasets/{dataset_id}/experiment-runs as the supported public API for paginated experiment comparison.

Adds a reorderable 'Splits (latest)' column to the experiment comparison view showing each example's current dataset split assignments as chips, and each split chip in a row's Splits cell (in both experiment results and comparison views) is now interactive with an 'Edit splits' action to reassign splits without leaving the table.

Loop now runs in a Braintrust-managed runtime, persisting threads across sessions and operating across logs, experiments, and datasets. It can create and edit prompts, scorers, datasets, facets, custom views, dashboards, and automations, with writes paused for approval unless auto-accept is enabled. Loop runs on built-in GPT-5.6 Sol, GPT-5.6 Terra, and GPT-5.6 Luna models so threads work without configuring an AI provider.

The eval-action GitHub Action gains report_scores and report_metrics inputs to limit PR comments to only the specified scores and metrics, avoiding noise from auxiliary checks.

- uses: braintrustdata/eval-action@v2
  with:
    api_key: ${{ secrets.BRAINTRUST_API_KEY }}
    report_scores: accuracy, relevance
    report_metrics: latency, cost

Adds a 'Blind human reviews' project setting that hides peer scores, comments, and aggregates until a reviewer submits their own scores, with reviewers holding the project Update permission exempt from the restriction.

Adds glm-5.3-flash as a built-in multimodal reasoning model selectable under the Braintrust provider in playgrounds, prompts, and scorers, or requestable through the Braintrust Gateway with no AI provider setup required.

safe2 doctor gains --assess, --output, --card-format, and --card-output flags to identify command and configuration indicators for Codex, Claude Code, Antigravity, Hermes, OpenClaw, and Grok alongside host, shell, CI, and WSL metadata. An opt-in --inspect-config flag additionally collects an allowlisted structural summary of supported local JSON/TOML configurations, including selected approval and sandbox settings, without emitting raw configuration values.

Emits dedicated schema contracts safe2.nexus-evidence.v1 and safe2.skillspector-evidence.v1 for NEXUS and SkillSpector adapters, enabling manifest validation against versioned evidence contracts. This is a breaking change: provider bundles generated before this release must be regenerated, as older bundles are incompatible with the new safe2 evidence manifest command.

safe2 feedback record and safe2 feedback summary capture sanitized descriptions of false completion, missing evidence, silent failures, context loss, stuck loops, permission friction, and integration failures.

Adds environment posture and policy evaluation against a named policy, with enforcement producing exit codes 0 (ALLOW), 1 (DENY), and 2 (HOLD) for use by agents and CI pipelines.