Week of October 12 -- 18, 2026

This week the CLI’s local-only mode was removed. Every agent command now goes through a Hub, which the CLI picks from a per-user list of named Hubs and a current context set with scion use. Async agent launch became the hub.async_agent_launch experiment, with per-step progress, typed failures and launches that survive Runtime Broker restarts. User access tokens now need a matching selector for chat, quota, agent and user-scope operations, and can now administer invitations, membership and schedules, create global skills and manage skill registries. scion ssh and scion vscode open shells and editors on agents, and the terminal workspace left its experiment.

Highlights

1. Every Agent Command Goes Through a Hub, Chosen by a Per-User Context

The CLI’s local-only mode is gone. With no Hub configured, every command that needs a Hub fails with a one-line No hub selected error that points to scion hub add, scion server start and scion use --hub, and the local code paths of create, delete, stop, suspend, attach, logs, look, keys, broadcast, message, list and harness-config install were removed. hub shadow and hub unshadow were removed in favor of scion use. In place of local mode, the CLI keeps a per-user list of Hubs and a current context. scion hub add|list|rename|remove manages Hubs with nicknames that --hub accepts. scion use (short for scion project use) sets the current Hub and project, searches every registered Hub, and shows a picker when a project name exists on more than one. By midweek the Hub list in context.yaml became the CLI’s only Hub configuration. The settings Hub keys are imported once and then no longer read, the global endpoint becomes a Hub entry, and linked projects become link entries. On the local workstation Hub, new agents in linked git repositories get a git worktree of the user’s checkout again.

2. Async Agent Launch Becomes an Experiment with Visible Progress

The server.hub.async_agent_launch setting was retired in favor of the hub.async_agent_launch experiment. Hubs that set the old key create synchronously until the experiment is enabled, and an admin PUT with the old key gets 422. Kubernetes launches now report each step (scheduling, awaiting capacity, image pull, container start, sync, startup gate) and fail with typed codes such as image_pull_failed. The CLI’s launch wait labels each step, and the web create form shows the current step and offers Delete and Create again when a create does not complete. Runtime Brokers journal accepted launches. After a restart they report what the old process left behind as broker_restarted and clean it up, and they answer 503 broker_draining on SIGTERM. A failed cleanup is retried on the next start for up to 5 attempts or 24 hours. A send whose outcome is unknown no longer ends the launch as not_launched. Cloud Run sandbox and, by the end of the week, Cloud Run Instances also create asynchronously.

3. User Access Tokens Need Matching Selectors and Can Do More

User access tokens are now held to selectors on more routes. Chat writes need inbox:write and reads of the caller’s own DMs need inbox:read. Quota administration needs the new quota:* selectors. Agent PATCH, workspace sync, stop-all, port registration and message mode need their matching agent:* selectors. Writes to the caller’s own user scope, such as /users/me/templates, need the matching selector on a Hub boundary. Lists return rows only when the token’s ceiling carries the list permission, and a new project:list selector covers project lists. At the same time, tokens can now manage invitations and the allow list, create, update and resume schedules, change project membership and ownership with project:manage, create global skills, manage skill registries and import global catalogs, and read roles, bindings, access constraints and the Hub audit log. Identity binding stays session-only. Streams opened with a token re-check it every 15 seconds and end when it is revoked, expires or loses the permission that admitted the stream. Terminals close with 4401 authz_expired.

4. SSH and VS Code into Agents

scion ssh <agent> runs the system ssh through scion tunnel, using the agent’s host key from the Hub, and scion ssh-config [--write] writes per-Hub include and known-hosts files. scion vscode <agent> opens VS Code Remote-SSH on an agent with a pinned host key, without editing ~/.ssh/config. scion tunnel, ssh and ssh-config follow the scion use context. Tunnel streams are re-checked with the same authorization as tunnel open and receive interval renewals. A tunnel to a stopped agent reports agent_not_running (409, exit 9) instead of forbidden.

⚠️ Breaking Changes

A Hub is always required (#3423, #3542, #3510, #3746): With no Hub configured, every command that needs a Hub fails with a No hub selected error, before any image-registry check. A project that still has local-mode agents gets a migration notice instead. See Local-only mode removal. --no-hub, hub enable and hub disable are hidden and print an error, and scion templates no longer falls back to local. scion logs --follow is dropped, and scion sync <agent> now requires a direction. A project’s Hub project ID comes only from its own settings. hub shadow and hub unshadow are removed in favor of scion use; existing shadow directories still resolve with a notice.
The Hub list is the only CLI Hub configuration (#3654): The CLI imports the settings Hub keys into context.yaml once and stops reading them. Nothing in the CLI writes hub.endpoint, and scion login no longer makes a Hub current. Server and Runtime Broker processes read no context.yaml apart from resolving a --hub nickname.
--project <slug> binds to the Hub project (#3778): --project <slug> uses the existing Hub project instead of creating a directory named after the current directory, and a missing explicit project path is refused. A leftover <cwd>/<slug> directory still wins, so delete it.
Async launch is an experiment (#3620): server.hub.async_agent_launch and its env var are ignored. Hubs that set them create synchronously until hub.async_agent_launch is enabled.
Token selectors for chat, quota, agent and user-scope operations (#3550, #3475, #3473, #3509): User access tokens need inbox:*, quota:* and agent:* selectors, and writes to the caller’s own user scope need the matching selector (for example template:* for /users/me/templates). Runtime Broker settings writes are authorized by the keys they change.
Runtime Broker material uses broker permissions (#3727): Runtime Broker env vars, secrets and the user heartbeat are checked on broker permissions, and the separate runtime_broker pair is removed. Reading env vars or secret metadata needs broker.read plus ownership or broker.update. Material writes, update and deregistration need a sign-in, and image pull and removal check broker.dispatch first.
Templates describe the job, not the environment (#3339, #3558, #3516, #3608): Telemetry, Hub, image, resources, Kubernetes, volumes and reserved env keys in a template are ignored with a warning, and admin validate-resources lists templates that set them. Template create and PUT reject a config body (400 template_config_in_file) and an image (400 template_image_not_supported), and PUT is metadata-only. The Hub no longer copies a template’s image, env or telemetry into an agent’s inline config. No env key listed in a harness-config’s auth metadata is filled from template env.
Blocking messages index migration (#3725): A new (project_id, created, id) index speeds up project message pages. On Postgres it is built with a plain CREATE INDEX, which blocks writes to messages until the startup migration commits, including writes from other Hub instances during a rolling deploy.
One server environment mapping (#3782): A single table derived from the settings registry maps SCION_SERVER_* and SCION_SEED_* variables, with one canonical spelling per key and earlier spellings kept as aliases. Some spellings that were ignored now take effect, so remove leftover variables before upgrading. An unparseable value for a setting outside the main configuration tree now fails config loading.
Test Hubs (#3467, #3785): --test-mode=off|member|admin|super-admin replaces the three test-identity startup flags and is refused with --production. Any level other than off refuses to start with hub_id_not_pinned unless server.hub.hub_id is set to the Hub’s current ID.
expose and unexpose move to scion (#3419): sciontool expose and sciontool unexpose print where the command moved and exit 1. Use scion expose / scion unexpose, which are available in agent mode.
Agents need --self to remove themselves (#3533): Inside an agent container, scion delete and scion stop --rm refuse to remove the current agent without --self, and scion stop --all --rm skips it.
Project delete refused while agents remain (#3538): Project delete answers 409 and lists the agents whose runtime deletion is not confirmed. Use ?force=true or scion hub projects delete --force.
Pinned placement is enforced (#3645, #3634): Operations on a pinned agent with an inconsistent saved placement answer 409 (runtime_target_pin_stale, runtime_target_mismatch, runtime_broker_missing) instead of acting through another Runtime Broker. A reservation on one Runtime Broker no longer satisfies a request on another (409 broker_reservation_scope_conflict).
Harness auth resolution (#3486, #3321, #3403, #3328): Every harness resolves the Vertex AI location as GOOGLE_CLOUD_LOCATION, then GOOGLE_CLOUD_REGION, then CLOUD_ML_REGION, and Claude’s Vertex AI inference now requires a region. For harnesses whose default auth type is api-key (claude, gemini-cli, grok-build, hermes), an API key env credential now wins over a gcloud-adc file credential.
Workstation defaults (#3410, #3440, #3587): In workstation mode --host moves only the Hub and web listeners, and the Runtime Broker stays on 127.0.0.1 unless server.broker.host is set. On macOS, runtime auto-detection prefers Podman, then Docker, then Apple container. Mutating /api/v1/system/* workstation routes require a Hub admin (Contributor: Stephen Ierodiaconou).
Last-admin check on removal (#3382): Removing a role binding or project member that would leave a scope with no active access-constraint admin answers 409 constraint_admin_lockout.
Runtime Broker IDs must be a single path element (#3771): An ID that is empty, ., or contains .., a path separator or NUL is refused on credential save, join and every hub.brokerId write, and the server refuses to start with one.
Retired inputs (#3639, #3383, #3315, #3434): SCION_SHARED_WORKSPACE is removed; SCION_WORKSPACE_MODE and SCION_WORKSPACE_GIT are the only inputs. The legacy grove-id marker is no longer read. Telegram webhook mode fails startup without webhook_secret, and the standalone env fallbacks for the webhook URL and credential are removed.
Cloud Run Instances restart policy (#3713): The runtime no longer sets the restart-policy annotation, which the API rejected, so instance creates work again. An agent that exits 0 may not be restarted under the platform default.
Agent stats return 501 (#3559): Agent stats answer 501 stats_not_implemented instead of zeros, and Runtime Brokers report WebPTY only for runtimes whose web terminal works.

🔐 Security & Access Control

User access tokens for administration (#3818, #3815, #3811, #3696, #3577): Within their boundary and the holder’s live authority, tokens can manage invitations (user:invite), schedules (scheduled_event:create/update, carrying the creating credential’s limits), project membership (project:manage), create global skills (skill:create_global) and manage skill registries, and read governance data and the Hub audit log.
Streams end with their token (#3806): Agent log and message streams, the project message-log stream and terminals re-check their user access token every 15 seconds and end on revocation, expiry, user suspension or lost permission.
Token ceilings on lists (#3804): A token lists rows only when its ceiling carries the list’s permission for its boundary kind, and a project token lists only its own project.
Uniform refusals (#3563, #3420, #3809): Every refused agent token gets the same 401 body, with the cause only in the server log, and agent-token checks read less and throttle last_seen_at writes. The credential-issuing endpoint gives callers without an interactive session or dev credential one fixed refusal, decided before the body is read.
Last-admin and sign-in audit (#3435, #3407, #3457, #3443, #3468, #3337): The last-admin check covers binding replacement, nested groups and scheduled constraints. Sign-in refusals on the web, proxy and resolver paths are audited, and identity resolution returns store errors instead of provisioning on a failed lookup. Scope re-issue compares its edge guard as an instant.
Membership and audit integrity (#3386, #3690, #3686, #3694): Project membership counts only role bindings inside their validity window. Group create, member removal and delete write their audit records in the same transaction, and agent row removal deactivates delegation edges and service account assignments in the same transaction.
Agents read their descendants’ status (#3529): An agent can read the status of any of its descendants.
Server secrets and credentials (#3584, #3512, #3574, #3437, #3367, #3706): SESSION_SECRET is deprecated in favor of SCION_SERVER_SESSION_SECRET. Server secrets stay out of agent env passthrough, and scion server start prints the dev token file path instead of the token. Agent credential files and agent-info.json are read with no-follow, size-bounded reads. Hub URLs are shown without user info, and URLs with user info are never saved.
Event and error scoping (#3588, #3767, #3756, #3697, #3748): Image-build output is published only to the requesting user. Legacy chat attachment downloads apply the message read rule to user access tokens. Skill resolve errors return a fixed reason with a correlation ID, and declared skill references are logged in redacted form.

🤖 Agent Lifecycle

Async launch progress and resilience (#3429, #3590, #3379, #3600, #3524, #3603, #3381, #3699, #3633, #3616, #3623, #3689, #3416, #3741, #3805, #3800): Launch steps and typed failures reach the API, CLI and web, including runtime refusal causes (runtime_forbidden, runtime_unauthorized). Successful launches apply the Runtime Broker’s resolved image and harness config. Discord /scion thread uses async create through the new hubclient.WaitForLaunch helper. scion start and resume follow the Hub’s reported resume phase.
New halted phase (#3643): Agents whose run the platform ended (preempted, evicted, OOM-killed or container missing) enter a terminal halted phase, and scion list shows halted (<reason>). The creator gets a HALTED notification, lifecycle hooks gain a halted trigger, and scion start resumes a halted agent as a fresh start.
Unknown outcomes no longer lose agents (#3657, #3599, #3530, #3398): A create whose dispatch outcome is unknown is no longer rolled back while the Runtime Broker may still be starting it. Slow Kubernetes cold starts no longer lose their pod. scion start no longer deletes an agent whose start outcome is unknown, and a launcher’s lasting 404 is no longer reported as a deletion.
Worktrees (#3481, #3678, #3770): New agents in git repositories linked to the local workstation Hub get a git worktree of the user’s checkout again. Agent delete and provisioning remove only the agent’s own worktree entry instead of running a repository-wide git worktree prune. A branch held by another worktree gives a clear error.
Agent state files (#3446, #3375, #3389, #3469, #3385, #3494, #3711, #3672, #3637, #3471): Writes to agent-info.json take an advisory lock, keep unknown keys and are synced to disk around rename. A failed start is recorded in the host-owned host-state.json, so scion list no longer shows the agent as starting forever. Clear and compact keep sticky states. The host no longer writes agent-info.json while the container runs, the files-owner run ID moves to host-state.json, and stale directory cleanup keeps directories whose workspace may hold work.
Retained files cleaned up (#3636, #3426, #3602): Once the soft-delete window passes, the Hub asks the agent’s Runtime Broker to remove its retained files before purging the record, retrying offline Runtime Brokers for up to 30 days.
Starts and dispatch (#3650, #3601, #3427, #3396, #3595, #3392, #3794, #3356, #3294): Hub agent_defaults limits apply on every start and restart. A Runtime Broker 409 is relayed as 409 instead of 502. Kubernetes workspace-provision failures show their log tail, and a resume whose pod-local home was lost falls back to a fresh start. A not_launched end leaves the start claim to its holder, superseded starts are awaited before name-addressed work, and the Hub adopts the run an async launch report names. Shared-workspace Hub-managed projects accept starts again, and shared-workspace agents resume after a project re-link.
Status hooks (#3483, #3432, #3369, #3360, #3343, #3267, #3609, #3540, #3534): Claude and Codex sub-agent events and questions no longer overwrite a parent’s held status, and a parent Notification no longer overwrites limits_exceeded or crashed. Claude treats a failed tool call as tool end, and Codex registers session and sub-agent hooks.
Claude folder-trust dialog (#3395): The provision manifest records the in-container workspace path, so Claude Code no longer blocks on its folder-trust dialog. (Contributor: Stephen Ierodiaconou)

🧩 Harnesses, Skills & Agent Plugins

Agent Plugins, experimental (#3698, #3735, #3726, #3730, #3780): Behind hub.agent_plugins (default off), harnesses install native Agent Plugins: Codex end to end, copilot and muse-code from Scion’s bundle mirror, and claude into ~/.claude/skills/ with validated MCP servers. Plugin support lives in a harnesses/<h>/agent-plugins.yaml sidecar, so older Hubs, Runtime Brokers and CLIs accept harness-config installs again.
Declarative ready and delivery (#3520, #3583, #3619): Harness configs gain ready and delivery blocks. Readiness gating and message submission follow each harness’s spec instead of a hard-coded table.
Skills (#3638, #3675, #3640): An optional skill that fails to install is skipped with a warning, and a failed required skill is named as skill_resolution_failed. Public gh:// skills retry without credentials when GitHub rejects the user’s credential. Templates imported from private repositories can be reimported with their scope’s repository credential.
GitHub credentials for imports (#3484, #3618): Template and harness-config imports, skill discovery, scion harness-config install and scion templates import use the GH_{OWNER}__{REPO} / GH_{OWNER} credential cascade at project, Hub and user scope.
Harness-config storage (#3669): Harness configs get a single commit path, reimport by ID and compare-and-swap writes that answer 409, which the CLI retries once.
Harness provisioning (#3380, #3393, #3478, #3312): An undecodable Copilot config is replaced instead of failing the start, and malformed staged config files fail with an error naming the file. Settings- and profile-derived env values are no longer persisted into agent config. The Runtime Broker image pull now covers every bundled harness, including grok-build and muse-code.
Antigravity model sizes (#3761): large and extra-large now map to Gemini 4 Argon at Medium and High effort.

💬 Chat & Messaging

Mentions reach the agent (#3709, #3716): The CLI and the Hub rewrite recipient-form mentions such as @agent:hub-ops to @hub-ops, so the named agent gets the mention.
Default agent for group posts (#3476, #3372, #3357): An agent’s group post with no @mention goes to the conversation’s default agent, as a human post does. scion whoami --full and conversation views show message modes, and Project Messages lists each message once.
Notification delivery (#3480, #3624, #3497, #3566, #3656): Failed agent notification deliveries are retried for up to 24 hours, with an attempt count and outcome recorded. With a Runtime Broker set, user notifications go through it only, so they no longer arrive twice. A concurrent retry no longer leaves a delivered notification marked for redelivery.
Project thread groups, experimental (#3373, #3513, #3576, #3579, #3514): Behind hub.chat_thread_groups: a project-scoped thread-groups store, a /api/v1/thread-groups API, chat rail groups, scion conversation group commands and a migration of personal thread groups.
Web-chat attachments as artifacts, experimental (#3658): Behind hub.attachment_artifacts (default off), files uploaded in web chat become message-scoped artifacts that are retired with the message.
Telegram reconfigure (#3466, #3445, #3500): Changing the inbound mode or configuration retires the previous webhook, poll loop, store and send queue.

📦 Artifacts (Experimental)

Stewards for agent-owned artifacts (#3776): Owners of the home project and the agent’s delegating user can give view and edit grants, create share links, change expiry and delete, but cannot give admin grants or move the artifact.
Decision log (#3743, #3740, #3777): A dedicated scion-artifacts Cloud Logging log records every publish, grant, link, move, expiry and delete decision, with reason codes for refusals. Review-grant refusals return distinct 403 codes.
CLI and sharing (#3586, #3570, #3490, #3485, #3502, #3508, #3611): New scion artifact view, list and grants. Share links gain lifetimes, the artifact page gains Move, refusal text is clearer, HTML bundles render in the chat preview through the sandboxed view, and agent starts warn when artifact scopes are dropped.
Review access (#3425, #3348, #3450, #3431): A review grant level, with a Grant review access action in the web. Version lists explain gaps, and senders are warned when a recipient may not be able to read a referenced artifact.

☁️ Runtime Brokers, Deployment & Operations

Cloud Run (#3731, #3742, #3798, #3799, #3792, #3687, #3661, #3653, #3499, #3553, #3460, #3458): Cloud Run instances are no longer killed and restarted about every 4 minutes, and a sciontool startup listener answers the startup probe. Hub delete removes the instance, an accepted Instances delete cut off by the cleanup budget counts as done, runtime labels are read under Cloud Run’s own keys, and a start on a workspace backend other than NFS is refused. Sandbox log retrieval, exec and probes no longer block past their timeout, sandbox state is safe under concurrency and survives null entries, and deleting an already-gone sandbox succeeds. A startup warning and docs cover CPU-always-allocated for Runtime Brokers on Cloud Run.
Co-located Hubs accept starts again (#3622, #3802, #3729, #3684): An empty stored runtime catalog no longer hides the settings file’s profiles, and built-in profiles that agents still reference keep resolving. An unresolvable saved profile logs its fallback once. A stateless co-located Runtime Broker is no longer marked offline about 5 minutes after a server restart.
Workstation server (#3324, #3336, #3441, #3374, #3491, #3455): scion server start waits until each listener answers /healthz, server stop --force kills a hung server, and server status probes the actual ports. The public URL saved in admin settings sets the Hub endpoint at startup, and the workstation Runtime Broker host is editable.
Settings (#3361, #3438, #3405, #3613, #3610, #3528, #3536, #3606, #3662, #3664, #3648): Duration settings are validated on save with a 422 naming the field path, and an unparseable SCION_SERVER_* or settings value in the main configuration tree falls back to its default per key. Save reports list keys saved but not applied, and admin settings report the source actually applied. Profiles edited in the admin UI and values cleared in Configure apply at the next start, SQLite included. File-mode telemetry saves keep omitted nested keys, telemetry.cloud.tls is validated on save, the admin view reports built-in defaults as their own source, and check-image looks in local image stores before the registry.
Telemetry (#3505, #3627, #3607, #3592, #3676, #3718): OTLP exports support client certificates with rotation. Server Config gains switches for the Hub’s own metrics and traces, labels follow the applied Hub name, and Cloud Logging groups errors for Error Reporting.
SQLite and maintenance (#3665, #3628, #3659, #3769, #3766, #3781, #3506, #3626): Every SQLite connection enforces foreign keys, orphaned rows are repaired before a migration, and the database is snapshotted before a reconcile. An upgraded SQLite Hub runs utc-timestamp-normalize once at start. Repair snapshots and completed scheduled events are purged after 7 days, and the TTL sweep log names the expired messages. Concurrent AutoMigrate calls no longer crash.
Health checks (#3456, #3712): scion doctor gains a Platform Health section and an inotify-limits check. Linux Docker and Podman Runtime Brokers warn when inotify limits are too low for 100 agents.
Project GCP identity defaults (#3370, #3358, #3448, #3359, #3442, #3710, #3760): scion project identity default show|set|unset [--profile] edits the resolution ladder, and a block default is accepted on Kubernetes-bound projects and offered in the pickers. GCP passthrough mode follows the runtime profile the agent resolves to, and the Hub records that profile.
Hub startup and shutdown (#3523, #3522, #3625, #3614, #3773, #3765, #3734): Off Google Cloud, the Hub skips GCP project ID auto-detection instead of waiting about 13 s (Contributor: Stephen Ierodiaconou). Shutdown waits for Runtime Broker work, a non-level level log attribute no longer panics the logger, long image-build log lines no longer wedge later builds, and single-node Hubs start their Conduit relay. Closing the Postgres event publisher no longer deadlocks with a concurrent unsubscribe, and a transport auth file replaced during a read is re-read.

🧪 Experiments & Groundwork

Flat Runtime Brokers, phases 2 and 3 (#3417, #3463, #3525, #3552, #3488, #3555, #3666, #3700): Behind hub.flat_runtime_brokers, a host can run several flat instances, each with its own identity, target, target infrastructure settings and settings policy, on Docker or Kubernetes.
Conduit (#3752, #3753, #3631): Behind hub.conduit, short Runtime Broker requests (logs, exec, image operations, project cleanup) go through the Conduit from any Hub instance, and scion server --role relay runs a standalone relay.
Federation (#3598, #3537, #3489, #3660, #3755): Peer-Hub federation tokens, a non-member project-visitor role, visitor grants by email and an accept_user_tokens trusted-issuer flag, all behind federation.project_visitors (default off).
Test Hubs (#3651, #3535, #3758, #3722, #3749, #3717, #3796, #3378, #3366, #3406, #3459, #3532): Admin and super-admin test identities with expiring grants, web sessions behind IAP, target-Hub profiles for test identities on another test Hub, and cleanup of what expired test identities created, by provenance stamp.
Groundwork (#3738, #3737, #3736, #3721): A Kubernetes placement-defaults library, store support for async start and restart, row-unique harness-config blob storage, and profile catalog checks for the coming rebuild preflight.

💻 CLI

Hub context (#3384, #3428, #3482, #3461, #3401, #3511, #3521, #3554, #3569): scion use searches every registered Hub and names Hubs it could not search. hub list --check verifies auth per Hub, and server and Runtime Broker commands accept --hub nicknames. An explicit --project beats SCION_PROJECT_ID. The server warns when its Hub endpoint comes from the CLI’s hub.endpoint.
scion ssh, ssh-config and vscode (#3371, #3399, #3411, #3562, #3495, #3568, #3594, #3728): Open SSH sessions and VS Code Remote-SSH on agents with host keys pinned from the Hub.
Fixes (#3572, #3605, #3692, #3646, #3644): Hub-mode create sends the --config file, uses that file’s branch when --branch is not given, and sends --workspace. A scion tunnel listener refusal no longer closes open tunnels. An unlinked Hub project is detected by status code, and whoami --full output is aligned (Contributor: Ruslan Semagin).
Init and delete (#3327, #3387, #3436, #3507, #3585, #3539): scion init reports a git ownership refusal, scion delete finds agents in the external layout, and a git project’s config is orphaned for prune only on positive evidence.
Utilities (#3663, #3667, #3668): Failed token file reads are retried, JSONC comment boundaries are preserved, and unrepresentable memory quantities are rejected. (Contributor: Ravshanbek Nazarov)

🎨 Web UI

Terminal workspace always on (#3641): The persistent terminal workspace graduated and the web.terminal_workspace experiment is retired. /agents/{id}/terminal links redirect to /terminals/{id}.
Admin (#3680, #3424, #3415): The Maintenance page gains a “Re-issue scopes” card with dry run and apply, shows failures as toasts and groups completed migrations.
Fixes (#3683, #3350, #3556): DM attachment uploads work, chat deep links resolve their project on a cold load, and the WebPTY tag reads the right capability field.
Forms and search (#3621, #3342): The new project form puts Name first, and a space in a palette query matches hyphens and underscores.

📖 Documentation

New guides (#3557, #3560, #3581, #3518, #3764, #3629): Working with several Hubs, Using Artifacts, Agent Plugins, and the Hub-always flow after local-mode removal.
Updated references (#3757, #3368, #3413, #3394, #3421, #3693, #3582, #3703): Settings precedence and template authoring for the files-as-source model, when harness-config changes reach agents and reincarnate workspace modes, Cloud Run async create, Helm notes on leftover RBAC objects, and sudo in the single-node VM deploy checks.