Week of August 24 -- 30, 2026

This week marked a transformative period for the Scion platform, highlighted by the rollout of the Permissions Foundation refactor (Phases 1 and 2), which introduces a comprehensive, fine-grained access control system across both APIs and the Web UI. Deployments and runtimes saw major progress with the launch of the Cloud Run Instances runtime and a single-node sandbox tier, alongside significant security and credential-placement upgrades for the GKE Helm Chart. Finally, the messaging system received end-to-end per-agent authorization controls (D1–D10) as part of an ongoing multi-tranche migration to the new conversation model.

Highlights

1. Fine-Grained Permissions Foundation (Phases 1 & 2)

The Permissions Foundation refactor shipped end-to-end, converting the platform from a binary admin === true check to a deterministic, declarative, role-based access control (RBAC) system. Phase 1 introduced the core permissions registry, declarative route guards via UnifiedAuthMiddleware, role/binding schemas, and dynamic credential revocation. Phase 2 completed the journey by deprecating legacy admin bypasses across 70+ handler endpoints, introducing a comprehensive advisory-locked quota and resource limit system, and providing administrative Web UI management screens for roles, bindings, and project limits. Additionally, the non-functional Visibility project field was eradicated in favor of active, membership-based access policies.

2. Individual and Single-Node Cloud Run Runtimes

Scion expanded its execution layer with two new serverless runtime architectures on Google Cloud. The Cloud Run Instances runtime dispatches and manages each agent as an independent Cloud Run service, mounting NFS-backed workspaces, injecting Secrets, and streaming stdout/stderr directly to Cloud Logging, backed by an IAP-secured WebSocket exec connector. For rapid, cost-effective deployments, the new Single-Node Cloud Run Sandbox tier provides a cheaper, single-command sandbox environment where every dispatched agent executes within a shared filesystem on a single Cloud Run Instance.

3. End-to-End Per-Agent Messaging Authorization (D1–D10)

To secure inter-agent communications and notifications, a robust per-agent messaging authorization system (D1–D10 message modes) has been implemented, complete with a delivery/validation library and an admin UI showing active reachability and mode controls. Under the hood, the migration to the new conversation model advanced through tranches C4–C6, introducing dual-write conversation stamping, SSE publish guards, webchat topic mapping, and a revamped CLI conversation-reference grammar. The release also hardens messaging security by validating DM key ownership at all ingress points, resolving cross-project injection vulnerabilities.

4. Advanced GKE Helm Chart Phases 1–3

The GKE Helm chart underwent significant security and operational hardening. Phase 1 launched read-only rendering of the Hub’s settings.yaml and introduced strict credential guards to prevent the smuggling of secrets via arbitrary environment variables. Phases 2 and 3 introduced a sidecar Cloud SQL Auth Proxy with IAM and password-based DSN construction, restricted session secret sourcing to dedicated Kubernetes Secrets, added a credential-placement scanner to prevent leakage, and implemented OAuth client credential hashing with redacted-projection checks.

🔒 Security & Hardening

Non-loopback dev-auth blocked (P0): Refuses the developmental auto-login middleware on any non-loopback interface (such as 0.0.0.0), eliminating a critical unauthenticated admin exposure in hosted mode.
Broker-scoped handler validation: Added explicit caller identity verification to the getRuntimeBroker, handleBrokerHeartbeat, and getBrokerProjects handlers, closing potential cross-tenant authorization gaps.
Credential leak prevention: Redacted environment variables and arguments from sandbox error logs, removed access tokens from curl commands within deployment scripts, and transitioned container initialization to fetch secrets directly from the Hub on startup.
DM injection vulnerabilities closed: Enforced DM key ownership validation at all message ingress points, ensuring agents can only write to DM conversations they are authorized to access, and rejected malformed keys with immediate 400 errors.
Broadcast authorization hardened: Restricted broadcast dispatching to authorized project members, verified sender identities server-side, and derived DM conversation keys from authenticated caller metadata rather than arbitrary payloads.

🚀 Runtimes & Deployment

Cloud Run Instances runtime: Enabled launching and managing individual agents as discrete Cloud Run services, featuring integrated NFS workspaces, Secret Manager secret mapping, Cloud Logging streams, and WebSockets-over-IAP console attachment.
Single-node sandbox deployment: Packaged a simplified, cost-effective deployment mode running all agents within a single shared-filesystem Cloud Run sandbox, deployable via a single unified shell script.
GKE Helm chart Phase 1–3: Delivered robust GKE packaging with a sidecar Cloud SQL proxy, read-only settings.yaml configuration mounts, credential-placement scanners, and secure OAuth client credential hashing.
Full-depth git clone support: Changed the Depth configuration type to *int to allow a depth of 0 to correctly signify an unrestricted, full-depth git repository clone.
Default template hydration: Solved an issue where broker agents lost home-directory files by automatically hydrating embedded default templates to disk when missing.

💬 Messaging & Conversation

Per-agent message mode authorization: Introduced a per-agent message mode framework (D1–D10) that governs delivery rules, supports reachability checks, and renders intuitive status badges in the Web UI.
Conversation model migration: Advanced the backend migration (Tranches C4–C6) by enabling dual-write conversation stamping across twelve messaging entry points, ensuring SSE publishes are gated on persistence, and mapping webchat topics to the unified model.
Server backfill CLI & resume fix: Shipped a new scion server backfill administrative command for message reconciliation. Additionally, fixed a critical data-loss defect (DEF-81) by transitioning the resume cursor to use compound (created, id) keyset page offsets.
Divergence diagnostics board: Added a read-only admin endpoint displaying message model divergence counters annotated with five detailed system Caveats.

🛠️ Harnesses & SDKs

Grok-build harness bundle: Introduced a native harness for xAI’s grok CLI, featuring full authentication, 11 interactive lifecycle hooks, TOML-to-MCP configuration translations, and multi-architecture Docker builds.
Vertex AI grok support: Wired native Google Vertex AI Model Garden endpoints into grok-build using GCP identity tokens, GCP region overrides, and custom model entries.
Antigravity API key auth: Added standard GEMINI_API_KEY configuration options to the antigravity harness alongside Google Cloud ADC and regional service accounts.

🖥️ Permissions & Web UI

Permission-gated administrative UI: Dynamically disabled navigation and settings tabs based on caller credentials, preventing users from seeing tabs (such as Templates or Quotas) for which they lack permissions.
User and group pickers: Added reusable principal pickers and detailed view-permissions modals to ease role binding assignments for admins.
Scheduler access controls: Enforced owner-based permission boundaries on scheduled events and schedules, backed by 7 new fine-grained permissions.