Week of July 12 -- 19, 2026

This week’s work centered on two major arcs: a comprehensive overhaul of the chat messaging stack — with position-aware @mention routing, native mention rendering across Discord and Slack, and Telegram V2 becoming the default broker — and a sustained push on high-availability reliability, covering stateless HA env-gather, broker ID recovery on restart, and full OIDC transport auth for IAP-protected GKE deployments. Alongside these, a new hub admin settings system shipped with seed/managed config layering, and thinking-level control gained a first-class --thinking-level CLI flag with per-harness env-var injection across the agent stack.

⭐ Highlights

1. Messaging Platform Overhaul: @Mentions, Thread Defaults, and Telegram V2

The chat integration layer received its deepest redesign to date. A new TypeMention message type provides position-aware @mention routing across Discord, Slack, and Telegram — agents are now dispatched via explicit mention rather than being injected as group recipients, eliminating an entire class of incorrect multi-agent dispatch bugs that also received follow-up routing and fallback-to-default fixes on July 19. Native @mention rendering landed in Discord and Slack outbound messages, replacing raw email strings with platform-native <@id> syntax (with duplicate-email handling and cached lookups). Discord gained per-thread default agent resolution via a new thread_defaults table with two-tier resolution, mirroring Telegram’s existing topic_defaults pattern. Telegram V2 became the default broker (V1 remains available via SCION_TELEGRAM_V1=1), gained audio/video attachment downloads, and workstation onboarding now includes a client-side QR code for bot verification.

2. HA & GKE Hosted Broker Reliability

Multiple days of targeted fixes hardened Scion’s high-availability story for production deployments. The most consequential: DispatchFinalizeEnv was rewritten as a stateless, replay-based operation — previously, finalize-env calls routed to a different broker replica caused 404 errors; the fix rebuilds the full create request via buildCreateRequest and dispatches it cleanly. Brokers now recover their ID from the database on restart and re-assign orphaned agents, preventing UUID regeneration from silently losing live agent state. Three GKE hosted broker dispatch fixes unblocked deployments: skipping local ImageExists checks for non-local runtimes, correctly scanning all profiles for cloudrun type, and deriving hub endpoints from IAP audience URLs rather than hardcoding. OIDC transport auth shipped for IAP-protected hubs via the new pkg/transportauth package, completing a multi-phase workstream — with a follow-up fix decoupling the transport oidc_audience from the hub endpoint for proper independent resolution.

3. Hub Admin Settings: Seed/Managed Config Layering

A new hub admin settings subsystem introduces SCION_SEED_* environment variable providers with a three-layer bootstrap merge (SEED → yaml → SERVER). Settings can be seeded for managed deployments, and the admin UI now shows which values are seeded versus actively managed — with deprecation detection to flag stale config. This is the foundational infrastructure for fleet-managed Scion deployments where operators need to inject immutable defaults without forking config files, and it shipped alongside a related fix for the plugin config deadlock where fresh installs couldn’t save the config needed to activate a plugin.

4. Thinking-Level Control Across the Agent Stack

First-class thinking-level support landed end-to-end. scion start now accepts a --thinking-level flag (0–100) that is injected into agent containers as SCION_THINKING_LEVEL, following the same pattern as SCION_MODEL. Codex maps this to its reasoning_effort parameter; Antigravity harness reads it with a 4-tier mapping and backward-compat fallback from the legacy AGY_THINKING_LEVEL variable. The default OOB harness was also migrated from Gemini to Antigravity, consolidating the thinking-level path.

📡 Chat Integrations

Telegram V2 default: V2 broker is now the default broker; V1 remains accessible via the SCION_TELEGRAM_V1=1 env var.
Position-aware @mention routing: New TypeMention message type enables mention-triggered agent dispatch with positional metadata, replacing the old approach of injecting mentioned agents as group recipients.
Discord per-thread default agents: New thread_defaults table with two-tier resolution and thread-aware /setup, /default, /status slash commands, mirroring Telegram’s topic_defaults pattern.
Discord inbound attachments: Downloads Discord message attachments to the agent workspace with path-traversal sanitization and resource-leak guards.
Telegram audio/video downloads: Agents now receive audio and video files in addition to photos and documents; configurable downloads_path with graceful sticker/animation skipping.
Workstation Telegram QR code: Client-side QR generated via the qrcode package on the onboarding verification step, updating dynamically as the code is entered.
Native @mention rendering (Discord & Slack): Outbound agent messages replace raw email references with platform-native mention syntax, with duplicate-email handling and cached user lookups.
Discord observed message identity: Relayed messages now display under the actual sender’s webhook identity and avatar, with gray-sidebar embed styling to distinguish them visually.
Auto-enable message broker: Server automatically enables the message broker when broker plugins are configured, preventing the silent “bot configured but never starts” failure mode.
Telegram admin UI & delivery errors: Config fields and bot token UX improvements; 5xx delivery errors now propagated back to the hub and CLI caller instead of being silently swallowed.
Mention routing fallback guard: Default agent target is restored when body-mention filtering empties the target list, with guards against human-mention and slash-command messages.

🏗️ HA & Multi-Node

Stateless env-gather finalize: DispatchFinalizeEnv rewritten to be replay-safe — rebuilds the full create request from scratch via buildCreateRequest, eliminating 404s when finalize-env hits a different broker replica in an HA cluster.
Broker ID recovery on restart: Brokers recover their ID from the database and re-assign orphaned agents on startup, preventing UUID regeneration from orphaning live workloads when settings are lost.
OIDC transport auth for IAP hubs: New pkg/transportauth package provides shared OIDC transport infrastructure; broker OIDC transport auth for IAP-protected hubs completes Phase 3 of the HA Cloud Run OIDC workstream.
GKE hosted broker dispatch fixes: Skips local ImageExists checks for non-local runtimes (resolves docker.io lookup errors on GKE), scans all profiles for cloudrun type rather than relying on active_profile, and derives hub endpoints from IAP audience URLs; follow-up decouples oidc_audience from hub endpoint for independent resolution.
Broker runtime hot-swap: SwapRuntime swaps the runtime client and agent manager in-place when the container engine changes, fixing CLI/broker mismatch after the onboarding wizard changes the engine.
WebSocket payload limit: MaxMessageSize raised from 64KB to 1MB with a pre-send size guard, unblocking large RemoteCreateAgentRequest payloads carrying inline config and base64-encoded bodies.
Control channel async dispatch: Control channel dispatch made async to prevent head-of-line blocking — a slow dispatch no longer stalls all subsequent agent operations.
Broker fanout on plugin activation: Hub replays fanout subscriptions onto spokes added via AddSpoke, fixing dead inbound messages after PUT /config activates a plugin.
Attachment path resolution: Broker resolves attachment paths to host-side paths for host-process brokers, fixing container-internal /scion-volumes/ paths being passed to Telegram/Discord plugins where they don’t exist.

🧠 Model & Thinking-Level

--thinking-level CLI flag: scion start accepts a 0–100 thinking level injected into containers as SCION_THINKING_LEVEL, following the same pattern as SCION_MODEL.
Codex reasoning_effort mapping: Codex harness maps the 0–100 thinking level to its reasoning_effort parameter.
Antigravity thinking-level support: Reads SCION_THINKING_LEVEL with a 4-tier mapping and backward-compat fallback from AGY_THINKING_LEVEL; default OOB harness migrated from Gemini to Antigravity.
Fable model alias: Claude extra-large model alias changed from opus to fable.
Hermes Vertex AI auth: Vertex AI auth support added with region fallback chain and cached _build_vertex_env result.

⚙️ Harness & Provisioning

Skills as individual files: Claude harness now installs skills to .claude/skills/ as individual files, with include_skills=False passed to project_instructions() so Claude Code discovers them natively instead of ingesting a large concatenated CLAUDE.md. The include_skills default was inverted globally and all harnesses audited.
Workspace skill overlay removed: The injectWorkspaceSkills() provisioning step, root skills/ directory, and associated tests deleted — superseded by embedded platform skills.
Copilot improvements: Auth.json credential file capture, auth type naming fix (auth-file instead of config-file), instructions now write to ~/.github/ instead of workspace, hook support via ~/.copilot/hooks/scion.json, and relative path fixes for config_dir/skills_dir/instructions_file.
OpenCode improvements: auth.json file secret capture, no-auth login command, --model flag passthrough when model is configured, and capture_auth ordering fix.
gcloud ADC user opt-in: Auto-injection of gcloud Application Default Credentials is now gated behind an explicit user setting and onboarding wizard toggle, preventing unexpected credential exposure. ADC is auto-detected in workstation mode.
Cloud Run Docker skip: Broker skips Docker runtime initialization when docker binary is unavailable, falling back to cloudrun runtime when K_SERVICE is set; Docker heartbeat also skipped in this state.

🛠️ Hub & Plugin Lifecycle

Plugin config deadlock fix: PUT /config falls back to settings.yaml for installed-but-unloaded plugins, resolving the chicken-and-egg problem on fresh installs where config couldn’t be saved without loading a plugin that required that config. After save, the plugin activates via LoadOne with full resolved config; config_file path stored immutably so PUT /config can always find it.
Plugin lifecycle robustness: Plugin install/reconfigure errors surface in HTTP responses with sanitized messages; integrations show as Available when plugin binary is on $PATH (fixes Homebrew installs where SCION_MAINTENANCE_REPO_PATH is unset); registered-but-not-active plugins accepted in HasPlugin and ListPlugins.
Harness config UI improvements: Validation errors surfaced in harness config import UI (previously silent HTTP 200); harness configs sorted alphabetically by displayName; dropdown used on server config page; image re-parsed from config.yaml on save/upload; local image state shown in workstation/podman mode.
Image registry routing: image_registry now applied when dispatching agents to remote brokers.
Dispatch failure surfacing: dispatch_failure_reason exposed in CLI and API responses for failed messages, with participant-privacy integration tests.
Agent name conflict errors: User-friendly 409 response returned at runtime, broker, and hub layers when an agent name is already in use (Docker, Podman, and Apple Container).
Hub credential reconstruction: getPluginHubCreds() rebuilds hub_url, broker_id, hmac_key, and project_slug_map from authoritative live sources instead of relying on an empty plugin manager cache.

🐛 Bug Fixes & Stability

Postgres idempotence: Schema.Create now skips 42P07 (duplicate table) errors; skipExistingRelations hook gated to Postgres only.
Web UX polish: Password-style font in secret textareas; multi-line support for file-type secret intake; syntax highlighting for JSON and YAML in workspace file viewer; project templates sorted before global templates in the template list; QR code favicon added.
Broker profile fixes: Profiles filtered by detected runtime (not hosted flag), with a fallback default profile when all configured profiles are filtered out; configured profiles enumerated in the broker info endpoint.
Config compatibility: camelCase koanf field support for SCION_SERVER_ env vars; v1-shaped runtime field detection when schema_version is missing; cloudrun added to V1 schema runtime type validation.
Provision cleanup: Root-owned __pycache__ directories no longer persist after agent delete.
Build compatibility: Empty array expansions guarded under set -u for bash < 4.4 compatibility across three image-build scripts.