Week of July 19 -- 25, 2026

This week brought substantial improvements to Discord’s multi-server capabilities, a complete skill system expansion with private-repo support and multi-scope auto-injection, and critical correctness fixes across the dispatch pipeline. The agent lineage graph visualization debuted for complex project debugging, and relative workspace paths now resolve correctly through the entire orchestration stack.

⭐ Highlights

1. Discord Multi-Server Support

Discord evolved from single-guild to full multi-server deployment with end-to-end changes spanning command registration, admin UI, and lifecycle management. The new Config.GuildIDs array replaced the singular GuildID, enabling concurrent slash command registration across multiple servers. Guild-removal cleanup now tracks guild_name and deactivates links when the bot is removed from a server. The admin UI exposes comma-separated guild_ids input with a “Global — all servers” placeholder and generates OAuth2 bot invite links with correct permission bitmasks. The agent cache TTL was reduced from 5 minutes to 30 seconds to eliminate stale /default listings, and /default gained autocomplete for large projects with case-insensitive slug validation. Multi-server setup documentation covers the trust model, invite flow, and operational considerations.

2. Skills Expansion: Private Repos, Multi-Scope Injection, and URI Validation

The skill system matured into a production-ready subsystem with three major pillars. First, private-repo resolution via gh:// URIs: skill resolver now injects GitHub tokens from project git credentials, supports per-URI credential selection through ?token=SECRET_NAME query params, validates cache authorization, and eliminates the unauthenticated double-download bug that caused 404s on private repos. Second, multi-scope auto-injection: new project_skill and user_skill Ent schemas enable skill management at project and user scopes with CLI commands and automatic injection into agent provisioning based on scope resolution. Third, skill URI input validation and auto-transform: NormalizeSkillURI converts GitHub tree/blob URLs to canonical gh:// form, rejects scion:// with clear errors, and validates gh:// shorthand structure — applied at hub (422 on invalid) and CLI (stderr notice on auto-convert).

3. Agent Lineage Graph Visualization

A new graph view mode shipped for the web UI to visualize complex agent parent/child relationships. The initial implementation renders agents as a zoomable, pannable forest with HTML card nodes, SVG cubic-curve edges, spawn-direction arrowheads, pan/zoom/fit-to-view controls, and collapse pruning. A same-week refactor extracted the graph into a shared <scion-agent-tree-view> component rendered inline with grid/list modes so status and label filters apply automatically. The view is now available on both agents and project-detail pages, providing a third visualization mode alongside the existing grid and list layouts.

4. GKE & IAP Hardening for Hosted Brokers

GKE-hosted broker dispatch received multiple rounds of targeted fixes. Hub endpoint derivation now pulls from IAP audience URLs instead of hardcoded values, broker auth token flow was corrected, and transport oidc_audience was decoupled from hub endpoint for independent resolution. Transport auth is now resolved before app-token gates in attach to unblock IAP mode, and GFE proxy health check interception is handled gracefully — detecting non-JSON 2xx responses from reverse proxies and falling back to /health with descriptive error messages. K8s runtime improvements, plugin hub client adjustments, and Discord/Telegram broker registration updates completed the hardening work. End-to-end GCP setup documentation now covers Cloud Run Hub + Discord + GKE Autopilot deployments with infrastructure, IAM, dispatch verification, and maintenance.

📡 Discord & Chat Integrations

Multi-guild command registration: Config.GuildIDs replaces singular GuildID, with concurrent registration across guilds and backward-compat fallback; handleGuildDelete deactivates links when bot is removed from a server, with guild_name tracking populated from session cache.
Admin UI multi-server controls: guild_ids config exposed with comma-separated input and “Global — all servers” placeholder; bot invite link button constructs OAuth2 authorize URL with permissions bitmask when Application ID is populated.
Agent cache TTL reduction: Reduced from 5 minutes to 30 seconds to prevent new agents from being invisible in /default listings and mention resolution.
Autocomplete on /default: Agent parameter gains autocomplete for large projects with case-insensitive slug validation.
State notifications default to off: New channel links no longer spam by default.
@Mention routing correctness: Body @mentions now route as TypeMention messages instead of injecting mentioned agents as group recipients, fixing incorrect multi-agent dispatch; default agent target restored when body-mention filtering empties the target list, with guards against human-mention and slash-command messages.
Observed message identity: Messages now display under the actual sender’s webhook identity and avatar instead of the topic agent’s, with gray-sidebar embed styling to distinguish relayed messages and duplicate text content removed.
Observe mode filter fail-closed: Rewritten using resolveChannelLink with proper thread-to-parent channel link resolution — previous implementation looked up thread IDs directly against the store but channel links are only persisted against parent channels.

🧩 Skills & Provisioning

Private-repo gh:// skill resolution: Injects GitHub token from project git credentials, supports ?token=SECRET_NAME query param for per-URI credential selection, validates cache authorization, and eliminates unauthenticated double-download causing 404s on private repos.
Multi-scope skill auto-injection: New project_skill and user_skill Ent schemas with CLI commands for managing project and user skills, automatic injection into agent provisioning based on scope resolution.
Skill URI validation and auto-transform: NormalizeSkillURI converts GitHub tree/blob URLs to canonical gh:// form, rejects scion:// with clear errors, validates gh:// shorthand structure; applied at hub (422 on invalid) and CLI (stderr notice on auto-convert).
Mandatory instruction preamble: Embedded mandatory_boilerplate/ FS prepended to every provisioned agent’s instructions regardless of template.

🧠 Model & Harness

Model alias resolution timing fix: Aliases now resolved before storing in AppliedConfig and SCION_MODEL — previously stored raw, causing harness provision scripts to receive unresolved tier names.
Harness model resolution fallback: Fixed in OpenCode, Hermes, and Gemini CLI — ctx.model_resolution is always empty because ProvisionManifest has no model_resolution field; now falls back to SCION_MODEL env var.
Gemini CLI improvements: Injected GEMINI_SYSTEM_MD env var for system prompt pickup, added single-letter model alias mappings (S/M/L), performs fallback alias resolution in provision.py; medium model alias updated to gemini-3.6-flash.
Claude harness config: Added deny list and disable flags to settings.json.
Fresh claude-code install: Forces @latest tag with npm cache clear to prevent stale packument from resolving to month-old versions.

🚀 Agent Lifecycle & Workspace

Relative workspace paths: Resolves subdirectory paths against project logical root with containment checks (traversal, symlink escape), preserves relative paths through the hub/dispatcher pipeline.
Workspace sharing mode env vars: SCION_WORKSPACE_MODE and SCION_WORKSPACE_GIT injected at both hub dispatch and broker start layers so agents can adapt behavior to exclusive/shared/git workspace configurations.
Agent/project list pagination: Raised limit from 50 to 500, fixed agent cursor pagination with CLI/hub/store tests and web UI pagination support.
Enhanced whoami: Typed WhoamiResult struct with Tier 1 env-var fields (project, template, harness, model, creator, etc.) and --full flag for Hub-enriched Tier 2 output (phase, ancestry, labels, taskSummary) with graceful degradation.

🏗️ Broker & Dispatch

Shared-reference mutation bug fix: Clone ResolvedEnv map before mutation in buildCreateRequest — shared reference allowed secret injection, storage env merge, and GitHub token writes to silently modify agent’s canonical config; also injects SCION_MODEL from AppliedConfig.Model in all three dispatch functions.
Plugin message broker routing: Plugin is now added to message_broker.types on web UI install — handleInstallIntegration() loaded the plugin but never added it to the types list, excluding it from message routing.
FanOut spoke wiring: Installed/restarted broker plugins now wired as FanOut spokes — without spoke wiring, plugins never received Subscribe() calls so startGateway() never fired until full hub restart.
Notification dispatch guard: Don’t silently mark notification dispatched when agent has no RuntimeBrokerID — was permanently losing notifications; now leaves them undelivered for future retry.

🌐 GKE & IAP

Hub endpoint derivation: Derive from IAP audience URL instead of hardcoding, with transport oidc_audience decoupled from hub endpoint for independent resolution.
Transport auth ordering: Resolve transport auth before app-token gate in attach to unblock IAP mode — auth was checked after the token gate, preventing IAP-authenticated connections.
GFE proxy health check handling: Detect non-JSON 2xx responses from reverse proxies and fall back to /health (hub) or return descriptive error naming likely cause (broker).
GKE hosted broker dispatch fixes: K8s runtime improvements, plugin hub client adjustments, Discord/Telegram broker registration updates.

🖥️ Web UI

Agent lineage graph view: Renders agents as parent/child forest with HTML card nodes, SVG cubic-curve edges, spawn-direction arrowheads, pan/zoom/fit-to-view, and collapse pruning; refactored into shared <scion-agent-tree-view> component used on both agents and project-detail pages.
Help button: Wired to open docs site in new tab.

🐛 Bug Fixes & Stability

Hermes arm64 build: Removed nodesource apt repo after nodejs install to fix “Cannot allocate memory” in QEMU emulated builds caused by stale InRelease file.
CLI help text: Updated scion message --attach help text with accurate path roots and failure mode; changed scion:// to skill:// in examples.
Skill resolver CI fix: Repaired ParseSkillURI grammar to handle edge cases and updated stale test fixtures.
Discord gofmt cleanup: Unblocked main CI.
Test cleanup: Removed stale transport-audience-mismatch test case decoupled by earlier work.

📖 Docs

Discord multi-server setup: guild_ids config, trust model, invite flow, guild removal behavior, and operational notes.
GCP setup tutorial: End-to-end Cloud Run Hub + Discord + GKE Autopilot deployment guide covering infrastructure, IAM, dispatch verification, and maintenance.