Skip to content
Scion

Week of August 17 -- 23, 2026

This week brought major advancements to the Scion platform, focusing heavily on security hardening, closing the native web chat feature gap, and stabilizing High Availability deployments. A critical security sweep patched multiple P0 permission escalations and authorization bypasses, while the web chat gained everything from rich agent outputs and thread pinning to clickable file links. Under the hood, the Phase 0 Helm chart for GKE was released alongside end-to-end support for user-scoped templates and secrets.

Highlights

Section titled “Highlights”

1. Major Security Sweep & Encryption at Rest

Section titled “1. Major Security Sweep & Encryption at Rest”

A critical security push closed 22 authorization bypasses across the hub API and patched three P0 permission escalation defects, establishing fail-closed authorization helpers and enforcing least-privilege for empty agent roles. The local secret backend also received a significant upgrade, now featuring AES-256-GCM encryption at rest with domain-separated key derivation to transparently secure sensitive credentials.

2. Web Chat Feature Gap Eliminated

Section titled “2. Web Chat Feature Gap Eliminated”

The native web chat feature gap program advanced through Phases 0-5, introducing dozens of quality-of-life improvements. Users can now enjoy thread pinning, conversation mute, markdown attachment rendering, and rich agent output rendering (diffs, JSON, test results). A new expand popover handles truncated agent-agent messages, clickable file-path links can seamlessly open a file viewer dialog, and direct agent DM conversations can now be promoted to shared space threads.

3. GKE Helm Chart & High Availability

Section titled “3. GKE Helm Chart & High Availability”

The Phase 0 Scion Helm chart shipped, enabling deployments of the Scion hub to GKE with install-time validation, readiness probes, and stable hub IDs across upgrades. Supporting this effort, hosted High Availability deployments were decoupled from IAP prerequisites, and a new Helm CI workflow was added to ensure robust chart template validation.

4. User-Scoped Configuration & Default Harness

Section titled “4. User-Scoped Configuration & Default Harness”

User-scoped configuration was significantly expanded. Templates now fully support user scoping end-to-end – from the backend schema to the web UI profile page. The capture auth flow similarly gained user vs. project scope selection, supported by fixes to secret precedence resolution. In a major shift for new installations, the default agent harness configuration switched from Claude to Antigravity (featuring a bump to Gemini 3.7 Flash).

Security & Authorization

Section titled “Security & Authorization”
  • Authorization Enforcement: Patched 22 authorization bypass sites across the hub API, utilizing fail-closed helpers and enforcing 404-before-403 isolation. An authz-guard regression check was added to CI.
  • Permission Escalation Fixes: Resolved three P0 vulnerabilities regarding empty agent roles defaulting to least-privilege (AgentRoleNone), strict requireAdmin checks, and safe group creation.
  • Secret Encryption: The local secret backend now uses AES-256-GCM encryption at rest, with transparent re-encryption for legacy plaintext values.
  • Policy Protection: Fixed an issue where intentionally deleted seeded policies (hub-member-read-all, hub-member-create-projects) were improperly resurrected upon server restart.

Web Chat & UX

Section titled “Web Chat & UX”
  • Rich Interaction: Added an expand popover for full-screen markdown rendering of truncated messages, deep links from agent messages, and rich agent output rendering.
  • Workflow & Navigation: Introduced thread pinning, drag-and-drop custom space ordering, message permalinks, and preserved project context when toggling between dashboard and chat.
  • Notifications & Unread: Added browser notifications for mentions and DMs with mute-aware suppression, along with an unread divider with a watermark.
  • File Management: Enabled paste-to-upload, broadened the attachment allow-list (later switched to an executable deny-list), and fixed immediate SSE attachment preview rendering.
  • Resilience: The SSE feed now properly stays alive across backgrounded mobile tabs to prevent dropped connections.

Hub, Agents & Infrastructure

Section titled “Hub, Agents & Infrastructure”
  • Template & Secret Scoping: Fixed three independent scope precedence inversion bugs in secret resolution, ensuring the correct runtime_broker < hub < project < user order. Exempted git credentials (GITHUB_TOKEN) from NoAuth suppression to restore clone-per-agent workspaces.
  • Default Agent Configs: The default harness was changed from claude to antigravity, and the medium model bumped to Gemini 3.7 Flash. applyHubAgentDefaults now correctly stamps the default model and thinking level onto agents.
  • GKE Bootstrapping: The server now warns if IAP audiences look like synthetic bootstrap placeholders, and the gke-shared-volume backend is correctly handled in readiness checks and project paths.
  • Agent Skill Progeny: User-scoped injected skills and env vars gained an AllowProgeny flag, ensuring correct propagation to child agents.

CLI & Tooling

Section titled “CLI & Tooling”
  • Shell Script Gate: Added a shellcheck gate to CI, clearing 85 findings across 10,073 lines of shell scripts in the repository.
  • Sciontool Improvements: Capped assistant replies in the hub’s unit (runes) instead of bytes to prevent silent dropping of long messages, and accepted repeated values for string-slice flags with stricter validation.
  • Proxy Redirection: Fixed raw JSON 401 errors for browser users on proxy routes by correctly redirecting them to the login flow.