Week of October 19 -- 25, 2026

This week Scion hardened workspace and git isolation: agents receive read-only git metadata and a private, credential-stripped .git/config, project .scion directories are mounted read-only in shared layouts, and git projects on Kubernetes that would share one repository across agents are refused at start and must be created as clone-per-agent. Project storage consolidated into a single server.project_storage block and layout authority that backs the Files tab and chat attachments, while WebDAV, project-level scion sync, the Hub project copy and GCS workspace sync were retired. Agent-bound delegation added in-memory credential exchange over ~/.scion/delegation.sock, lifecycle revocation, revoke-all endpoints and visible delegation attribution on messages, alongside project.chat_post for project thread posts and expanded User Access Token scopes for users, groups, roles, access boundaries and project creation. Across the web client, CLI and Runtime Brokers, API responses and static assets are compressed, the Agent Edit page replaced Configure, a single model channel feeds the harness --model argument, and scion reincarnate --broker <target> --force can move agents by recreating their workspace on another Runtime Broker.

Highlights

1. Read-only Git Metadata, Read-only Project `.scion` and Clone-per-Agent on Kubernetes

For worktree-per-agent and shared-workspace git projects, Scion mounts the repository’s git admin surface into the agent read-only — .git/hooks, .git/info, .git/objects/info, and other agents’ worktree admin directories — and gives each agent its own private, read-only copy of .git/config in place of the shared one. The private copy has credential-bearing settings stripped and is pre-seeded (branch upstream plus push.autoSetupRemote) so a bare git push exits 0 — without the pre-seed a bare push fails with “no upstream branch”. git push -u origin <branch> exits 0 and reaches the remote either way; git cannot persist the upstream (the private .git/config is read-only) and prints an error:, but the push still succeeds. Branch deletions and other packed-ref rewrites fail cleanly inside the agent, and personal git preferences go in the agent’s own writable global git config, not the repository config. On the Apple Container runtime agents read the repository’s git config directly, starts of agents whose repository config holds credential settings are refused, and a shared-workspace git project is refused there (the per-agent private .git/config cannot be bound); keep credentials out of repository git config (use a credential helper). On the host, provisioning clones, shared-workspace pulls and worktree operations run git with hooks, pagers, driver programs and the ext:: transport disabled and a scrubbed environment, and check repository config against a deny-by-default allow-list. See Workspaces.

On Kubernetes, git projects that share one repository across agents — worktree-per-agent, or a shared-workspace project on NFS — are not supported. Create such a project as clone-per-agent, where each agent gets its own clone of the repository, or run it on a local or Docker Runtime Broker. An agent whose project would share one repository is refused at start with a message naming the remedy.

In shared-workspace and related layouts, the project’s .scion configuration is mounted read-only into agents, and the Runtime Broker refuses later changes to the recorded state. On Docker and Podman, a project .scion that Scion mounts read-only — one in a registered outside-root checkout, one in a subdirectory of the workspace, or a nested .scion directory inside the agent’s own workspace (config-only agents) — must already contain an agents directory. The runtime masks .scion/agents in the container but does not create it under a read-only mount, so when it is missing the start is refused with a message naming the path. Create it once with mkdir <path>/.scion/agents (scion init lists .scion/agents/ in .gitignore) and start the agent again. A workspace in a subdirectory of a repository must be a registered git worktree of it; other subdirectory workspaces and unregistered workspaces outside the repository root are refused at start.

2. Unified Project Storage, Agent File Attachments and Retired Legacy Sync Paths

A single server.project_storage configuration block replaces workspace_storage, shared_dir_storage and home_storage. Legacy blocks are converted automatically with a warning, while per-profile, per-runtime and per-directory backend overrides are rejected with a message pointing to volumes:. The Files tab, archive, pull and resource import now resolve the workspace through the project storage layout, so files uploaded in the web UI land directly in the tree that agents mount, including shared directories on NFS-backed Hubs. With object storage configured, chat attachments use artifact transport by default and reach each recipient’s inbox, placing a copy in the project scratchpad only for project-wide topics. Agents can send attachments with scion message --attach and receive them as files in ~/.scion/inbox before the message text arrives, verified by the receiving Runtime Broker with a single-use per-recipient capability. The Hub project copy, GCS workspace upload and sync-back, the linked-project cache, the /dav/ WebDAV mount, and project-level scion sync (bare, push, pull and --force) are removed; agent-level scion sync is unchanged.

3. Agent-Bound Delegation, Broader User Access Tokens and `project.chat_post`

sciontool can now exchange delegated credentials, keeping them in memory only and serving them through a peer-checked ~/.scion/delegation.sock proxy that re-exchanges before expiry. On the Hub, deleting, restoring, suspending or reincarnating an agent, its issuer or its project revokes its grants and credentials, and new POST /api/v1/users/me/delegations/revoke-all and POST /api/v1/agents/{agentId}/delegations/revoke-all endpoints revoke delegations in a single transaction. Messages sent with a delegated credential record their attribution and display "authorized by <user> via delegation <grant>" in the CLI and web. Posting in a project chat thread, or promoting an agent DM into one, now requires the project.chat_post permission (403 chat_post_denied otherwise, with a read-only notice in the web UI); built-in roles from project-member up receive it automatically on upgrade, while custom roles keep their existing permissions until updated. User Access Tokens gained selectors to update user status (user:suspend) and profiles (user:update), provision users (user:invite), administer groups (group:*), manage roles, role bindings and access boundaries with a Hub-bound token, and create, register or clone projects (project:create).

4. Faster Web Client, Consolidated Agent Edit Page, One Model Channel and Recreate Moves

The web client is significantly faster: JSON responses on /api/v1/ are gzipped when accepted (shrinking a 155-agent list from 154 KB to about 18 KB), static assets are served precompressed with brotli and gzip, the terminal workspace and CodeMirror language modes load on demand, boot requests run in parallel with early head flush and experiments in the boot payload, and list, log, detail and hidden-tab rendering do far less work. The Agent Edit page now covers every field from the former Configure page — grouped by function or tier with mutability indicators and phase-aware Save & Start and Save & Resume actions — and /agents/{id}/configure redirects to Edit. An agent’s effective model now flows through a single channel: SCION_MODEL (Hub-resolved or explicit) else the Runtime Broker config, and the same value feeds the harness --model argument so a harness-config default no longer overrides a project or Hub default. scion create gains --model and --thinking-level, and the web Create Agent form sends a harness-config only when you pick one. scion reincarnate --broker <target> --force can now move clone-per-agent and empty-per-agent agents across Runtime Brokers without a shared export by recreating the workspace on the target, with --force --dry-run previewing what is kept, recreated and lost.

⚠️ Breaking Changes

Repository git metadata mounted read-only and host-side git hardened (#4160, #4072): In worktree-per-agent and shared-workspace git projects, .git/hooks, .git/info, .git/objects/info and sibling worktree admin directories are mounted read-only, and bind-mount runtimes give each agent a private, read-only .git/config with credential keys stripped and branch upstream plus push.autoSetupRemote pre-seeded. Branch deletions and other packed-ref rewrites fail cleanly inside the agent. The Apple Container runtime reads the repository’s .git/config directly, refuses starts whose repository config holds credential settings, and refuses git-backed shared-workspace projects. A workspace in a subdirectory of a repository must be a registered git worktree, and unregistered workspaces outside the repository root are refused. Host-side git clones, pulls and worktree operations run with hooks, pagers, driver programs and the ext:: transport disabled, a scrubbed environment, and a deny-by-default repository config allow-list.
Kubernetes git projects require clone-per-agent (#4160): Git projects on Kubernetes that share one repository across agents (worktree-per-agent, or a shared-workspace project on NFS) are refused at start. Create the project as clone-per-agent, or run it on a local or Docker Runtime Broker. Commit and push work from Kubernetes agents in git projects on NFS shared workspaces before upgrading.
Read-only project .scion and required .scion/agents directory (#4045, #4037, #4064, #4160): In shared-workspace and related layouts, the project’s .scion directory is mounted read-only into agents, the Runtime Broker refuses later changes to the recorded workspace state, the mount layout is derived only from paths the Runtime Broker knows, and a git common directory outside the project is refused. Docker and Podman always mask .scion/agents in plain workspaces, and any project .scion mounted read-only on Docker or Podman must already contain an agents directory (mkdir <path>/.scion/agents).
One server.project_storage block (#4177): server.project_storage replaces workspace_storage, shared_dir_storage and home_storage. Legacy blocks are converted automatically with a warning, but per-profile, per-runtime and per-directory backend overrides are rejected with a message pointing to volumes:. The Hub refuses shared-mode dispatch to a Runtime Broker whose storage layout disagrees, and refuses to start if two NFS blocks name different shares or subpath roots.
WebDAV, project-level scion sync, Hub project copy and GCS workspace sync removed (#3989, #4091): /dav/ returns 404, and bare scion sync, push, pull and --force at project level exit with a usage error pointing to git or the workspace file API (agent sync is unchanged). The Hub project copy, GCS workspace upload and sync-back, and the linked-project cache are removed in favor of the project storage layout.
Start inputs come only from the Runtime Broker and Hub (#4029): The Runtime Broker takes an agent’s profile, harness-config and runtime from its own image-provenance record and the Hub’s start and restart requests, never from files in the agent home. Older agents with neither a record nor a Hub-sent profile are refused with a re-provision error.
project.chat_post permission required for project thread posts (#4023): Posting in a project chat thread, or promoting an agent DM into one, requires project.chat_post (reading still uses project.read). Built-in roles from project-member up receive it on upgrade, but custom roles are not modified. Add project.chat_post to any custom role that should keep posting, and include project:chat_post on User Access Tokens that grant roles holding it through project:manage.
Stored template config and image columns dropped (#3863): An irreversible, idempotent post-migration step drops the stored template config and image columns on Postgres and SQLite and removes the legacy no-tiers telemetry path. Back up before upgrading if you might need to roll back.
Server base URL, settings location, SCION_HUB_PROJECT_ID and strict SCION_SERVER_* values (#3849, #4014, #3846, #3788, #4190): On a server running the Hub, --base-url outranks SCION_SERVER_HUB_ENDPOINT, SCION_SERVER_BASE_URL and server.hub.public_url from the global settings.yaml. The OIDC issuer, transport audience defaults, OAuth redirect base, cookie Secure flag and browser config resolve once at startup from those operator inputs, never from the settings database, and an http base URL on a non-loopback listener is refused. Server startup settings load from the global directory only. server.hub.gcp_project_id is now settings-file only (settings.yaml at startup); the server-config API refuses it and GET hides it, and database-backed saves that change telemetry.cloud.cloud_logging fail with 422. SCION_HUB_PROJECT_ID outranks the project-id file and hub.project_id in settings. Server startup rejects unparseable boolean or number values in SCION_SERVER_* and names the variable.
Settings saves send only changes, null deletes, and image_registry order (#3984, #4018, #3786, #3793): Admin settings pages and federation send only edited fields, file-mode saves keep omitted keys, and clearing a stored value sends null to delete the key. A project defaultThinkingLevel must be 1–100 (null clears; 0 or out-of-range returns 422, and a stored 0 reads as inherit), and a null federation value is refused. One resolver serves image_registry in the order Runtime Broker node env (SCION_IMAGE_REGISTRY), Hub-stored, settings file, default, with profile beating top-level within each layer.
Non-interactive starts need --send-env and dev credentials stay on loopback (#4111, #4035): When the Hub asks for environment values during scion start or scion resume and no prompt can be shown, the CLI sends local values only with --send-env and otherwise fails naming the keys and flag. Explicit SCION_DEV_TOKEN and SCION_DEV_TOKEN_FILE credentials are sent only to loopback Hubs.
Metadata block mode refused under host networking on cloud hosts (#4124): With Docker or Podman host networking, metadata block mode follows the Runtime Broker setting SCION_HOST_NETWORK_BLOCK_POLICY. When unset or auto, starts are refused on detected cloud hosts; strict (or any unrecognized value) always refuses, and allow starts with a warning.
Runtime Broker host service account actAs and user delete blockers (#3929, #4157): Setting a Runtime Broker host service account through the update API requires actAs on it (403 before any write) and uses compare-and-set (409 on concurrent change). Deleting a user with blockers returns 409 user_delete_blocked with details.agents (including deletionState) and details.edges for active delegations, which GET /api/v1/users/{id}/delete-blockers and the admin delete dialog also list.
CLI JSON shapes, template sync paths and REST API responses (#3905, #3903, #4056, #4082): scion config list and get share one resolver and report each value’s source with secrets masked, changing their JSON output, and the legacy CLI settings loader is retired. scion doctor --format json moves to formatVersion 2 with generatedAt, a hub block and platformHealth reason codes. Integration update by ID accepts only GET (405 otherwise), and malformed or unknown list cursors or page tokens return 400 invalid_cursor.

🔐 Security & Access Control

Agent-bound delegation (#4167, #4166, #4169, #4182, #4185): sciontool exchanges delegated credentials in memory and serves them through a peer-checked ~/.scion/delegation.sock proxy that re-exchanges before expiry. Deleting, restoring, suspending or reincarnating an agent, its issuer or its project revokes its grants and credentials, and POST /api/v1/users/me/delegations/revoke-all and POST /api/v1/agents/{agentId}/delegations/revoke-all revoke delegations in one transaction. Messages sent with a delegated credential record attribution and show "authorized by <user> via delegation <grant>" in the CLI and web.
User Access Tokens for users, groups, roles, access boundaries and projects (#3838, #3816, #3783, #3910, #3909, #3928, #4178): Within the holder’s live authority and delegation limits, tokens can update another user’s status (user:suspend) or profile (user:update), provision users via POST /api/v1/users (user:invite, plus user:read for the detailed replay view; audited as user_provision and refused for dev auth), administer groups (group:*), manage roles, role bindings and access boundaries with a Hub-bound token, and create, register or clone projects with the Hub-only project:create selector. Invited users’ memberships and role bindings take effect at first sign-in.
Active accounts, run-minted agent tokens and origin-bound credentials (#3942, #4083, #4077, #3996): Every credential check, including the development user, requires an active account. Create, provision and finalize-env dispatches give an agent only the token the Hub mints for its run, and a Runtime Broker offers its dev token only to an agent bound to the co-located Hub at an operator-derived endpoint. The API client sends Hub and transport credentials only when the request’s scheme, host and port match the Hub, stripping Authorization, proxy credential and X-Scion-* headers on cross-origin redirects.
Signing ring for Hub-signed values (#4139): Capability URLs, artifact view links, list cursors and attachment deliveries are signed with the active signing-ring generation while older configured generations continue to verify, and an unusable ring refuses instead of falling back.
Verified uploads, scoped template clones and agent home confinement (#4143, #4176, #4144, #4024, #4073): CLI uploads and Hub resource bootstrap/import read each file through its collection root and verify its size and hash before finalizing. Remote GitHub template cache clones authenticate through the scoped credential helper over plain https URLs with host-side git. Every Runtime Broker start-path write and removal under the agent home uses a confined handle that never follows links, and Docker/Podman starts fail closed if the .scion/agents mask mount point cannot be created or is not a real directory.
Schedule, group and thread-message authority (#4048, #3962, #3972): Updating or resuming a schedule re-records the caller’s attribution and frozen ceiling; agent callers list and manage only schedules they hold authority for and cannot edit schedule definitions. Removing members from or deleting a group that is the subject of an access boundary requires an interactive session. Thread-keyed agent message posts (thread_id only) verify the sender before any write.
Redaction, static serving and compression guards (#3865, #3850, #3890, #3860, #3979, #4016, #4043, #4068, #4034, #4115, #3873, #3881): Routes carrying credentials, signed object-store URLs or artifact capabilities are never gzip-compressed. Agent responses hide MCP server env/headers and service env from callers without attach. Error attributes, create and start failure logs, clone URLs, tunnel endpoints, template sources and skill discovery URIs redact credentials, credential-named query, fragment and path parameters, and user info (including one level of nested URL). The Hub no longer serves directory listings, dot-path files outside /.well-known/, or source maps.

🤖 Agent Lifecycle & Workspaces

One model channel and scion create --model (#3976, #3980, #3965): An agent’s effective model is SCION_MODEL (Hub-resolved from request, project default, template, then Hub default, or explicit --env) else the Runtime Broker config, and the same value feeds the harness --model argument. Unresolved size aliases resolve through the harness-config’s model_aliases or the harness’s built-in table. scion create gains --model and --thinking-level.
Recreate moves with scion reincarnate --force (#3897, #3952, #3956, #3955, #4010, #4105, #4113, #4181): scion reincarnate --broker <target> --force moves clone-per-agent and empty-per-agent agents whose workspace cannot travel through a shared export by recreating the workspace on the target, with --force --dry-run reporting what is kept, recreated and lost. A refused or failed move leaves the source Runtime Broker’s reservation untouched, restores the replaced service-account assignment, carries the new handoff forward, and checks rollback markers by agent ID and Hub project key. The running-container check is scoped to the agent’s project.
Async launch across existing starts, chat and A2A (#3924, #3803, #3801, #3882, #3759, #3763, #3762): Starting an existing agent with the async launch fields runs asynchronously, and a stop, delete or newer start cancels it with 409 start_cancelled. The chat app’s /create and /thread and the A2A Protocol Bridge’s auto-provisioning use async create by default and wait for launching agents before sending. Failed dispatches end with dispatch_failed, failed reports record their launch step, and server.broker.state_dir (SCION_SERVER_RUNTIMEBROKER_STATEDIR) persists the launch journal, dispatch attempts and pending env-gather across Runtime Broker restarts.
Provision-time file refresh, executable bits and v2 content hashes (#4011, #4028, #4118, #4150): When the system prompt, agent instructions, skills or services change, the Hub tells supporting Runtime Brokers to re-render those files at the next start. A v2 content hash for templates and harness configs covers file paths and modes so rename-only and chmod-only changes are detected. Hub-hosted templates, harness configs and gh:// skills preserve executable bits (normalized to 0755 or 0644 for gh:// skills, with subdirectories included, symlinks skipped, and clear errors for submodules, unsafe paths, truncated trees or skills over 1000 files).
Agent credential refresh in sciontool (#3915, #3939): sciontool init checks its credential file every 5 seconds and adopts a valid new credential within about 6 seconds without a reset signal, and sciontool doctor checks init’s credential state against the token file and fails with reload advice when it is expired or refused.
Accurate phases, exit fields and status hooks (#3854, #3844, #3853, #3885, #3879, #3947, #3884, #4191, #3821, #4013, #4007, #4059, #3719, #4001, #4000): Kubernetes Pending pods report as starting until the container starts and fail as error when start fails; gracefully preempted or evicted agents enter halted with a signaled exit reason; and node-join exec dial errors during home placement are retried. The first running report clears the previous run’s exit code and reason (Contributor: MA), reincarnation and synchronous starts also clear stale exit fields and launch errors, and reincarnation preserves the start response’s template, runtime and container fields. Cloud Run Instances map instance state to agent phases, reuse running instances and report stopped ones accurately; cloudrun-sandbox removes the sandbox on Hub delete of a running agent, attaches exit watchers on restore, and no longer mistakes generic errors for a missing sandbox. sciontool hooks preserve terminal status and sub-agent waits, count failed or interrupted tools accurately, and stop logging a skip warning per platform skill.
Worktrees, shared workspaces and delete cleanup (#3823, #3845, #3894, #3966, #4074, #4100, #4020, #4058, #4158, #4159): Worktree lookup, partial-worktree cleanup and agent delete remove only the agent’s own worktree entry, and deleting a hosted agent removes its sharer registry entry and (for the last sharer) the shared worktree in order. Deleting an agent where the Runtime Broker holds an older run of that agent (or any run under --force) removes that run and then the agent. Kubernetes workspace syncs and NFS-shared checkouts keep .scion/agents out of the shared view, web uploads to shared directories on NFS Hubs land in the project’s shared tree, and shared-workspace agents in git-backed projects can resume after the project is re-linked under a new ID.

💬 Chat & Messaging

Project thread groups graduate (#3970): The hub.chat_thread_groups experiment is retired; thread-group routes and the personal-group migration always run, and the chat rail always shows project thread groups.
Agent file attachments and artifact transport (#3937, #4092, #3954): Agents send attachments with scion message --attach and receive them as files in ~/.scion/inbox before the message text arrives, verified by the receiving Runtime Broker with a single-use per-recipient capability. With object storage configured, chat attachments use artifact transport by default and reach each recipient’s inbox, placing a copy in the project scratchpad only for project-wide topics. Live agent message attachments display their preview immediately.
Chat UI, participants and unread divider (#3944, #3949, #3946, #4022, #4161, #4135, #4149): Opening a conversation with unread messages lands at the New messages divider, and the unread count reads only spaces the user belongs to. The chat quick switcher is pinned to the bottom of the rails, the palette’s People group loads recent users and searches the Hub as you type, the conversation panel survives switching to the mobile layout, and message linkification runs over text nodes only. Suspended users are hidden from the members list, soft-deleted agents cannot be added to groups, and promoting a DM requires a live agent and stores the agent slug as the thread default. Behind web.chat_starred_messages (experimental), users can privately star project thread messages and jump to them from the conversation header.
Notifications, DM dispatch and Telegram (#4080, #3704, #3503): Notifications for suspended subscriber agents are parked, retried with backoff and expired with a recorded reason instead of failing on every sweep. Persisted agent DM dispatches keep running when the caller disconnects, capped at 30 seconds. Telegram v2 handlers finish on their own configuration’s client after a reconfigure and keep the poll offset per bot.

☁️ Runtime Brokers, Settings & Operations

Schedule health and automatic pause on agent delete (#3877, #3899, #3875, #3679, #4004): When the agent that a recurring schedule runs under is deleted, the Hub pauses the schedule with status reason creator_deleted (shown in the API, CLI and web) instead of failing every fire, and cancels only pending scheduled events without duplicate timer errors. The Health dashboard lists schedules whose last run failed (with run and error counts and an error excerpt) and Hub-paused schedules, filtered to schedules the caller can read.
Locked atomic settings writes, conflict reports and effective values (#3852, #3861, #3974, #4165, #4032, #3987, #4141, #4190, #4188): Every whole-file settings.yaml rewrite holds a cross-process lock and writes atomically. Conflicting Server Config saves report which keys were applied, saved for after a restart or skipped; operational settings updates follow a stored revision; and the Server Config page shows the effective environment value when a key is overridden by SCION_SERVER_*. telemetry.cloud.cloud_logging reaches the agent config, telemetry cert and key merge as a pair, template-field warnings come only from the template chain, and YAML decoder panics become parse errors.
Graceful co-located shutdown and Runtime Broker records (#3744, #3888, #4163, #3842, #3900): One shutdown budget bounds co-located teardown: /readyz reports 503 and new work is refused first, and the HTTP listener closes before the Runtime Broker and control channel. Re-registration preserves admin-set GCP host service account, project and labels (and update emits audit events); heartbeats no longer overwrite a concurrent re-registration’s profile set; deleting a Runtime Broker releases its reservations immediately; and new projects link every auto_provide Runtime Broker, not just the newest 50. deregister --purge-local verifies every local entry against its expected root before removing any, and transport auth token reads keep the previous value during file replacement.
Cross-project GCP service accounts and single-node VM deploys (#3893, #3867, #4172): Registering a GCP service account from another project warns with the gcloud grant command when the Hub cannot read that project, and a refused assignment check names the project, the Hub’s service account and roles/iam.securityReviewer. Fresh single-node VM deploy.sh installs bind the bootstrap Hub to loopback until the https base URL is written.
Usage analytics, telemetry labels and weekly preview releases (#4086, #4095, #4188, #4123, #4126, #4120, #3790, #3977, #4075, #4103, #4162): sciontool emits normalized agent.usage events with durable deduplicated delivery, a telemetry.health event and usage delivery/completeness counters, and gen_ai.api.calls shares scion_* identity labels with scion.usage.tokens. A Friday workflow fast-forwards the newest release/vX.Y branch to the latest green nightly and tags vX.Y.0-preview.N, and release SHA256SUMS no longer lists itself with an empty hash. Workstation logins are recorded while unset login timestamps are omitted (Contributor: MA), scion doctor reports the development credential source only when sent, the Hub logs far fewer DEBUG lines for status events and per-request auth, upload handlers clean up multipart temporary files on all paths, and Secret Manager responses without a payload return an error instead of panicking in the chat app.

🧪 Experiments & Groundwork

Conduit relay bridge, proxied ingress and singleton relays (#3733, #3820, #3841, #3847, #3857, #3927, #3876, #3896, #3898, #3895, #3911, #3918, #3916, #3930, #3938, #3953, #3926, #3739, #3932, #4096, #4137): Behind hub.conduit, tunnels, PTY and port forwarding route across relays over an authenticated relay-peer bridge, and server.hub.conduit.ingress: proxy reverse-proxies dials to a selected relay with a trusted lifetime cap and SIGTERM draining. Under server.hub.conduit.target_stream_deadlines, Hub-held and relay-held streams renew and re-check deadlines (requiring renewal-capable agents in external relay mode via 409 agent_upgrade_required). A live conduit session counts as Runtime Broker presence, superseded sessions close with 4409 without resetting open user tunnels, and server.relay.singleton: true runs a single non-HA relay for Cloud Run.
Flat Runtime Brokers UI and capacity (#3948, #3720, #3934, #3754, #4099): Behind hub.flat_runtime_brokers, a new Runtime Brokers area shows kind, runtime target, capacity and health with detail tabs, and flat instances publish their runtime target configuration with credentials withheld. Capacity accounting and the flat instance planner handle refused starts, launch-end release, ambiguous restarts and slug reservation release on early create failures.
Async start for existing agents (#3775, #4015): Behind hub.async_agent_start (with hub.async_agent_launch), start, resume and restart of an existing agent return as soon as the Runtime Broker accepts, once every Hub instance supports it.
Project visitors (#3819, #3908, #4189): Behind federation.project_visitors, project settings gain a Visitors tab to list, add, extend and revoke visitor grants and domain rules, with a per-issuer allow_visitor_grants switch, and visitors can list and read agents and their own grants and DMs on their admitted routes.
Artifacts and Markdown review editor (#4012, #4006, #4187): Behind hub.artifacts, the Artifacts page adds New artifact with a project picker, Owner deleted badges, expiry dates, custodian Delete and a Retention view. Behind web.artifact_review_editor, Review renders Markdown artifacts with inline review marks, records edits as CriticMarkup suggestions, and supports comments.
Test Hubs (#3791, #3848, #3887): Workload issuer delegations allow issuing admin (issue-admin, agent mode only) and offline member (scion server test-infra delegate) test identities, and scion server test-infra mark requires a pinned, matching Hub ID.
Groundwork (#3981, #3750, #3935, #4017, #4019, #4039, #4067, #4009, #3963, #4128): Read-only scion server preflight and settings.profiles checks, Kubernetes runtime build records, delegated project read and agent_delegation_policy, a versioned scion-analytics envelope, browser event-stream metrics, boundary update history and Runtime Broker lifecycle audit envelopes, a maintenance migration marking legacy agent rows in group conversations as left, and a versioned secret cipher with database encryption policy write fencing.

💻 CLI

Batch user invitations (#3986): scion hub users invite invites addresses from arguments, a file or stdin, with an optional note and repeatable --project PROJECT=ROLE.
Settings, templates and environment visibility (#3905, #4146, #4148): scion config unset is new and cli.mode is settable. scion templates sync and push accept a template directory path (., .., an absolute path, or any argument containing /), defaulting the Hub name to the directory base name (--name overrides). When scion start or scion resume sends environment values to the Hub without an interactive prompt, the CLI prints the sorted key names (never values) on stderr.
SSH, tunnels and login context (#4025, #4040, #4033): scion ssh forwards SIGHUP and SIGTERM; scion tunnel, ssh and ssh-config honor --project with --global; scion tunnel status lists open local listeners; and the first successful scion hub auth login makes that Hub current.
Template imports, transfers, API client and whoami (#3810, #3807, #3751, #3795, #3812, #3813, #3745, #3814, #3914, #3913, #3925, #3917, #3919, #3747, #4057, #4060, #4053, #4164, #4134, #3674): Template import errors are returned, native templates survive forced self-imports, imported names are validated before writing, front matter delimiters match whole lines, and harness detection matches full directory names. Transfers avoid temporary file collisions, normalize UTF-8 across sample boundaries, skip special files and reject non-2xx responses with bounded error bodies, and non-finite CPU quantities are rejected (Contributor: Ravshanbek Nazarov). Remote fetches that time out report timeout, and pkg/util builds on Windows again. scion whoami writes slug and JSON output to the command’s output stream (Contributor: Ruslan Semagin).

🎨 Web UI

Compressed responses, precompressed assets and faster boot (#3837, #3835, #3828, #3826, #3858, #3830, #3831, #3827, #3829, #3832, #3866, #3868, #3834, #3880, #3892, #3870, #3902, #4065): JSON responses on /api/v1/ are gzipped when accepted (shrinking a 155-agent list from 154 KB to about 18 KB; streams are never compressed), static assets are served precompressed (brotli, then gzip) with strong per-variant ETags and 1-year immutable caching for fingerprinted files, and stale chunks are no longer carried into embedded Hub builds. The terminal workspace and CodeMirror languages load on demand, shrinking main.js from 370 KB to 217 KB raw and halving the core editor chunk. Boot requests and the route chunk run in parallel with early head flush, modulepreload hints, shared public-settings reads and experiments shipped in the boot payload. Agents and projects lists use keyed rows, log viewers batch per-frame insertions in place, agent detail re-renders only for its own agent, chat and notification refetches coalesce, and render timers and network pollers pause in hidden tabs.
Consolidated Agent Edit page (#4008): The Edit page now includes every former Configure field, grouped by function or tier with a mutability indicator on each field and phase-aware Save & Start and Save & Resume actions. /agents/{id}/configure redirects to Edit.
Create form, mobile terminal, port forwarding and base-path navigation (#3980, #3945, #3682, #3975, #4093, #3968, #3973, #3995): The Create Agent form sends a harness-config only when selected (showing the inherited default as its placeholder), lists every notification trigger in the “notify me” hint, and matches the Hub’s default subscription triggers. On mobile, the terminal workspace gives the screen to the terminal while the on-screen keyboard is up. Full-page navigations use a base-path-aware helper so reloads work under a proxy prefix, bare port-forwarding URLs redirect to their trailing-slash form with plain-text explanations for failed sub-requests, and a new scion-web-serving platform skill guides agents using scion expose. Behind web.agent_badges and web.sse_hidden_tab_close, agent views show harness vendor and model size badges, and SSE streams close after 60 seconds in hidden tabs with jittered first reconnects.

📖 Documentation

Settings precedence, Discord probes and tunnel runbook (#3784, #3548, #4042): Dropped stale local-mode qualifiers from the image, profile and template precedence ladders, documented the gRPC health probe for scion-discord on Cloud Run, and updated the tunnel runbook to use in-agent scion expose and scion unexpose.