v0.3.0-preview.6

Released on 2026-11-06 (v0.3.0-preview.5..v0.3.0-preview.6, changes since v0.3.0-preview.5).

v0.3.0-preview.6 hardens the Hub–Runtime Broker boundary and workspace isolation: Hub–Runtime Broker traffic requires TLS off loopback (server.trusted_proxies), multi-replica Helm installs default conduit.internalTls to auto, host-side git runs without host credentials through the guarded entry point, and Runtime Brokers enforce single-component template and harness-config names, confine NFS mounts (nosuid,nodev) to each agent’s scope, and disable Kubernetes API token automounting on agent pods. Asynchronous agent start (hub.async_agent_start) defaults on, Cloud Run agents gain per-agent NFS workspaces, provisioned Agent homes, in-memory staged Hub credentials and pre-checked CPU/memory limits, and shared NFS project storage consolidates deletion, readiness and state-directory provisioning on the Hub alongside Hub-signed workspace bootstrap URLs. Single-node Hubs add confirmed downgrades (409 downgrade_requires_confirmation) with database snapshots, boot-failure rollback and atomic Runtime Broker plugin updates, while the CLI and web UI add scion hub settings, project-defaults, experiments, scion project settings, scion artifact comments, Hub-boundary access tokens, per-schedule time zones, Unlimited count limits (0), an opt-in pi harness, and experimental chat retention (hub.chat_retention), artifact .zip archives (hub.artifact_archive) and port view links (hub.port_view).

Highlights

1. Hardened Hub–Runtime Broker TLS, Host Git and Workspace Confinement

Hub and Runtime Broker endpoints refuse non-loopback plaintext traffic, minting secrets and join tokens only over TLS or from the same host and trusting forwarded headers only from server.trusted_proxies (127.0.0.1, ::1 when unset), while Helm defaults conduit.internalTls to auto above one replica. Host-side git runs with LC_ALL=C through the guarded entry point without host credentials, offering a project git secret only to the recorded remote (https, ssh or git URLs). Runtime Brokers require .scion inside explicit project paths (409 project_path_not_initialized), confine template files (up to 4 MiB), declarative harness files and skills without following symlinks, enforce single-component template and harness-config names, mount NFS with nosuid,nodev (503 nfs_unavailable otherwise) scoped to the agent’s tree, and set automountServiceAccountToken: false on Kubernetes agent pods.

2. Default-On Async Start, Cloud Run Workspaces and Consolidated NFS Storage

hub.async_agent_start is on by default where the Runtime Broker and all live Hub instances support it. On cloudrun, clone-per-agent agents get per-agent NFS workspaces, provisioned Agent homes on the share, in-memory staged Hub credentials, pre-checked CPU/memory limits (400 validation_error when refused) and OS Login SSH keys signed for the instance’s service account. Shared server.project_storage places clone-per-agent and empty-per-agent workspaces on the share for Docker, Podman and Apple container runtimes (and mounts NFS inline on Kubernetes without shares[0].pv_name), keeps provisioning state in the project’s state directory, checks the NFS share on Hub /readyz with Hub-only project tree deletion, and bootstraps workspaces via Hub-signed URLs. Count limits (max_turns, max_model_calls) treat 0 as Unlimited, cleared resources sub-fields apply at the next start (clearedResourceSubfields), and stopped/suspended agents free their max_agents_per_project slot.

3. Confirmed Downgrades, Expanded Hub & Project CLI, Chat Retention and Artifact Stewardship

Single-node Hubs support confirmed downgrades (409 downgrade_requires_confirmation) with five DB snapshots and settings copies, a deploy.sh boot-failure rollback guard, and atomic Runtime Broker plugin updates (~/.scion/plugins/broker), while release binaries are stamped with their built tag and Runtime Broker health reports control_channel status per Hub. The CLI adds scion hub settings, project-defaults, experiments, scion project settings, scion artifact comments and scion hub token --boundary project|hub, plus per-schedule IANA time zones and an opt-in pi harness (1.3.0). Behind hub.chat_retention, Hub admins gain messages_retention_days and deleted_conversation_grace_days (default 30) with previews and manual sweeps; agent-created artifacts record the delegating user as steward, grant marks-only access to new artifacts, and support .zip downloads (hub.artifact_archive) and a unified Manage access dialog (web.artifact_manage_access).

⚠️ Breaking Changes

Hub–Runtime Broker TLS and server.trusted_proxies (#4384, #4404): Endpoints refuse non-loopback plaintext connections and mint Runtime Broker secrets and join tokens only over TLS or from the same host; forwarded headers and the relay public listener trust only server.trusted_proxies (127.0.0.1, ::1 with a startup warning when unset; explicit lists including [] apply verbatim), reported in 403 details, logs, health and scion doctor.
Helm TLS on the inter-Hub relay hop (#4304, #4489): conduit.internalTls defaults to auto above one replica, requiring conduit.internalTls.existingSecret (kubernetes.io/tls) or conduit.internalTls.enabled: false and Hub image nightly-20261029 / v0.3.0-preview.5 or later; render guards refuse non-loopback plaintext relay listeners.
Host-side git uses no host credentials (#4376, #4352, #4387): Hub and Runtime Broker git remote operations (including backstop and agent-start clones) never use host credential helpers, askpass, ~/.netrc, TLS client certs, Kerberos or SSH identities; without a project git secret they run anonymously, with one only that secret goes to the recorded remote, and SSH URLs require a project secret.
Asynchronous agent start on by default (#4548): hub.async_agent_start defaults on where the Runtime Broker and all live Hub instances support it (scion start and resume wait for launch); keep it off during multi-node upgrades from versions without the Hub instance registry until all nodes are upgraded, and before a downgrade turn it off and wait the launch timeout plus 15s.
Single-component names, .scion paths and template file confinement (#4542, #4528, #4401, #4400): Template and harness-config names cannot contain a separator or .., be absolute, start with : or contain ://; agent create, scheduled dispatch_agent and default templates must use a template name or ID. Explicit project paths require an internal .scion directory or marker (409 project_path_not_initialized). Template agent_instructions and system_prompt files must be regular files up to 4 MiB inside the template directory without symlinks (single-line relative paths; multi-line inline text).
NFS readiness, nosuid,nodev, inline NFS and per-agent shared workspaces (#4458, #4377, #4342, #4354, #4533): On nfs project storage, the Hub is the sole remover of deleted project trees and workspace_storage readiness checks the share (project_storage_tree retired for nfs), returning 503 on /readyz, unhealthy on /healthz, and 200 with storageKept on delete when missing while Runtime Brokers keep their directory while agents remain (409). Runtime Broker NFS mounts require nosuid,nodev (503 nfs_unavailable otherwise). Without shares[0].pv_name, Kubernetes pods mount NFS directly (writable Runtime Broker mount at mount_root/<share id>, no NFS Agent homes). On shared NFS storage for Docker, Podman and Apple container, clone-per-agent and empty-per-agent workspaces live on the share scoped to the starting agent.
Kubernetes token automount, placement checks, App tokens and held-agent sends (#4362, #4487, #4415, #4397, #4507): Kubernetes agent pods set automountServiceAccountToken: false in all GCP identity modes, legacy Kubernetes Runtime Brokers enforce operator placement policy at start/restart, and saving runtimes and profiles checks placement in one guarded transaction (422 on new problems, warning on stored ones, 409 on conflict). The Hub mints GitHub App tokens only for the agent’s own project, and the agent hold check refuses every message send path to a held target before wake, store write or dispatch.
max_turns: 0 Unlimited, settings error envelope, live authorized_domains and root session checks (#4356, #4442, #4424, #4374): Count limits (max_turns, max_model_calls) treat 0 as Unlimited (unset inherits, positive caps, 422 without unlimitedCountLimits). Settings writes return 422 validation_error (details.errors), 409 revision_conflict on stale revisions, and 400 on unreadable bodies. Saved server.auth.authorized_domains applies live and at startup (SCION_SERVER_AUTH_AUTHORIZEDDOMAINS, saved, then settings.yaml, refusing self-blocking saves with 422). Only web/public/ files skip the root-level web session check (others redirect browsers or return 401, including /robots.txt).

🔐 Security & Access Control

Host-side git door and clone URL schemes (#4378, #4381, #4379, #4358, #4414, #4398, #4531): Host git refuses empty or option-leading arguments, pins discovery to the resolved directory (including after-run checks), runs with LC_ALL=C, routes the workspace probe, shared-workspace pull/clone fallback, and worktree/branch lookups through the host git door, and clones only https, ssh or git URLs.
NFS mount scope, Agent home confinement and symlink-free skill installs (#4450, #4463, #4455, #4395, #4554, #4429, #4491): Runtimes refuse NFS mounts of the export root, parent directories or another agent’s/project’s tree; declarative harness files use an Agent home handle refusing outside paths and directory symlinks; skills install through one writer skipping symlinks, special files and hard links within entry/size/depth limits; sciontool harness provision requires a separator boundary; and attachment deletes validate IDs and use a store-root handle.
Keyring relay signing, sealed secrets, key verification and encryption-policy fence (#4355, #4470, #4465, #4535, #4523, #4573): Conduit relay admission tokens and peer signatures use the versioned signing ring with key IDs, and separate relays hear grant key changes immediately. Without a keyring file, JWTs require an absent or legacy key ID; in keyring mode the Hub drops the legacy signing entry requirement and seals no-backend GitHub App and chat secrets. scion server keys verify checks secret authentication and Hub backups, and under an encryption policy the secret store refuses writes leaving a row without a value or secret reference.
Tokens, federation allowed_domains, Cloud Run SSH keys, port proxy and CSP (#4365, #4443, #4439, #4438, #4383, #4484, #4532, #4564, #4579, #4347, #4454, #4552, #4512, #4388, #4393, #4472): User access tokens support user:promote (member/viewer) and user:delete, user reads require user.read, constraint preview tokens apply only to their own constraint, constraint window changes require relaxation authority, and token-created agents receive secret.deliver, env_var.deliver, skill_injection.deliver and secret.use intrinsically. Trusted issuer allowed_domains applies on federation-token auth, and cross-project GitHub App tokens (via token-source label) require no installation on the agent’s project and re-verify source installation and agent-create permission on every mint. Cloud Run exec signs OS Login keys for the instance’s service account and drops cached keys on cleanup; deleting a Runtime Broker deletes its HMAC secret and join token; GET /runtime-brokers?projectId=X hides LocalPath from non-readers; runtimes drop inherited SCION_HUB_TOKEN_STAGED markers with stricter iat parsing; credential stores validate names on load/delete; hubclient escapes URL path parameters; the port proxy strips internal Hub auth headers; and CSP reports answer 204 with rate limiting (20 req/s, burst 200, 100 reports/req).

🤖 Agent Lifecycle & Workspaces

Cloud Run workspaces, Agent home, resources and reliable restarts (#4453, #4433, #4545, #4537, #4518, #4578, #4604, #4500): On cloudrun, clone-per-agent agents get per-agent NFS workspaces, provisioned Agent homes copied onto the shared-volume home at start without following links, staged harness secrets and Hub credentials in an in-memory volume (scion doctor checks actAs), pre-checked CPU/memory limits (400 validation_error or async container_config when refused), run-scoped instance reuse, and bounded 24h/20s log reads.
Consolidated project storage provisioning, Hub-signed bootstrap and NFS cleanup (#4607, #4394, #4459, #4495, #4503, #4602): Provisioning state lives only in the project’s state directory through one provisioner (promoting old markers and clearing stale locks at Hub start), Runtime Brokers without GCP credentials bootstrap workspaces via short-lived GET-only Hub-signed URLs, remote scion start collects local git-less files from the workspace root and removes the agent if upload fails, agent delete and failed Cloud Run starts clean up NFS agent directories and partial mkdir trees, and Kubernetes starts fail fast with volume_mount_failed on NFS mount errors.
Unlimited count limits, cleared resources, quotas and harnesses (#4356, #4419, #4457, #4411, #4441, #4353, #4367, #4558, #4566, #4584, #4549): Count limits (max_turns, max_model_calls) support 0 as Unlimited (null clears; negative refused), cleared resources sub-fields apply at the next start (clearedResourceSubfields), and stopped/suspended agents free their max_agents_per_project slot. An opt-in pi harness (1.3.0) preserves colons in model IDs while stripping pi thinking suffixes, Claude provisioning writes real Vertex AI project/region values and applies them on Cloud Run, Copilot no-auth mode runs without a session bus or keyring, and the # Placeholder system prompt counts as empty.
Git config keys at start, secret warnings, delegation grants and sciontool init (#4543, #4527, #4534, #4520, #4357, #4575, #4606, #4601, #4380, #4434, #4456, #4511, #4570, #4587): Agent start carries grep.threads, branch.<name>.vscode-merge-base, remote.<name>.promisor and remote.<name>.partialclonefilter into .git/config, omits command/hook keys on Docker/Podman with a notice, and reports refused keys by file (git_config_refused). Starts list store-skipped secret names in warnings, suspend revokes only the suspended run’s grants, start claims release on launch success, replaced-run status reports during restart are ignored, sciontool init writes credential state outside /run/scion, Kubernetes NFS homes record provision status before outputs exist, hubHas[].scope follows shared precedence, placement refusals keep their 409 code on delete, invalid local shared-dir names are skipped with a warning, time zone read errors return 503, and empty template names resolve to the default template.

💬 Chat & Messaging

Send receipts, sender time zones, failed-message retention and Telegram replies (#4462, #4460, #4474, #4427, #4444, #4337, #4583, #4410, #4346, #4510): Send responses include conversation_id, human sender messages carry sender_timezone, agent-to-user DM responses return the stored message_id and timestamp, soft-deleted targets are treated as unknown, and agents without project:artifact:read get 404 attachment_artifacts_unavailable and fall back to legacy attachments. messaging.failed_message_retention_days (default 7, min 1) controls the chunked failed-message purge (up to 500 rows). Telegram group-chat error replies send as threaded plain text, the chat members sidebar folds People/Agents sections, and chat banners use dark-theme tokens.

☁️ Runtime Brokers, Settings & Operations

Confirmed downgrades, Runtime Broker plugin updates and command-path health (#4371, #4440, #4609, #4420, #4471, #4417, #4445, #4399, #4426, #4363, #4519, #4482): Single-node Hubs support confirmed downgrades (409 downgrade_requires_confirmation; refused below the downgrade floor or on non-SQLite stores), keeping five DB snapshots and settings copies, a deploy.sh boot-failure rollback guard, atomic Runtime Broker plugin updates (~/.scion/plugins/broker), and tag-stamped release binaries. Runtime Broker health reports control_channel status per Hub (in Hub health, scion doctor and scion runtime-broker status), update-binary and rebuild-server warn on unset settings like server.trusted_proxies, Runtime Brokers connect before checking non-active profile runtimes (503 when missing), preserve profiles on empty embedded re-register, receive connected first with connection-scoped PTY frames, and use a 180s request limit (210s write, 4m CLI create). scion doctor recommends a namespaced Kubernetes Role and checks the shared-dir PVC storage class, and the Helm chart sets hub.terminationGracePeriodSeconds (default 45).
Storage validation, per-schedule time zones and starter Hub defaults (#4340, #4467, #4364, #4585, #4486, #4514, #4494, #4586, #4452, #4446, #4431): Project storage settings validate in one place (422 storage_invalid), recurring schedules accept an IANA time zone (UTC in API) and pause with creator_deleted on user delete, starter Hubs default image_registry to localhost/scion (IMAGE_REGISTRY / SCION_IMAGE_REGISTRY), Server Config saves changed sections by revision and shows startup-set running values, settings.yaml validates the GCP identity pair, restarts skip re-saving current key backups, cloud_logging degrades on a failure ratio, conduit ingress counts pending placements, v1 runtime keys mark unversioned settings.yaml as v1, and cloned project identities align only within the same project.

🧪 Experiments & Groundwork

Chat retention, artifact archives & stewardship, port view and flat Cloud Run (#4385, #4476, #4526, #4610, #4555, #4571, #4574, #4525, #4348, #4388, #4403, #4580, #4581, #4515, #4547): Behind hub.chat_retention, chat_retention settings (messages_retention_days, deleted_conversation_grace_days default 30) and a paced sweeper purge old messages, soft-deleted conversations and unreferenced attachment bytes with retained-history markers, [no longer available] replies, dry-run previews, manual runs and run history. Behind hub.artifact_archive, an artifact’s Files tab adds Download all (.zip) via GET /api/v1/artifacts/{id}/versions/{seq}/archive; agent-created artifacts record the delegating user as steward and grant active delegating users marks-only access to new artifacts; and behind web.artifact_manage_access, one Manage access dialog manages sharing, review access, retention and share links. Behind hub.port_view, forwarded ports open through a short-lived page link over conduit or the port-forward tunnel; behind hub.flat_cloudrun_target, flat Runtime Brokers accept cloudrun as a runtime_target type; and scion runtime-broker convert --plan prints a redacted move-to-flat plan (hub.flat_runtime_brokers).
Held edits, lifecycle analytics, key status, delegated agent list and image_tag (#4409, #4432, #4423, #4451, #4603, #4599): Held edits re-check saver permission at start (hub.agent_edit_held, 503 if undecided), hub.lifecycle_events emits agent.lifecycle events via a transactional outbox, server.secret_rotation adds GET /api/v1/admin/keys/status and scion server keys status|check, delegated agent credentials list agents on sealed cursors, and hub.image_tag_setting adds image_tag (SCION_IMAGE_TAG) and build-release-images.sh.

💻 CLI

Hub/project settings, artifact comments, token boundaries, conversation IDs and IAP login (#4437, #4449, #4569, #4577, #4563, #4538, #4522, #4499, #4488, #4493): scion hub settings get/set/unset/schema (with revision compare-and-set and --dry-run), scion hub project-defaults get/set/unset, scion hub experiments list/enable/disable/reset and scion project settings get/set/unset manage Hub and project settings (scion hub token --help lists required scopes). scion artifact comments lists structured review marks for <id> or <id>@<seq>, scion hub token list/scopes/create support --boundary project|hub and a BOUNDARY column, project-scoped token errors name missing project:read / project:list scopes, scion conversation list and get print full IDs (conv:<id>), and IAP-fronted Hub logins fail with a clear message.

🎨 Web UI

Kubernetes runtime editor, Hub-boundary tokens, Server Config and artifact review UI (#4339, #4373, #4497, #4496, #4567, #4502, #4501, #4413, #4406, #4422, #4405, #4389): The admin Runtimes editor edits Kubernetes placement and identity fields, Project Settings edits the per-profile default GCP service account map and labels Hub fallbacks, the access tokens page creates Hub-boundary tokens with purpose and up to 8 labels (403 scope_violation on refusal), and Server Config edits the maintenance message and agent start timing, clears Kubernetes shared-dir defaults on a switch to Cloud Run, and shows env-override badges on Federation, Harness Configs and scratchpad settings. In graphical review view, clicking your own comment badge edits or removes it, Cmd/Ctrl-click or middle click opens links in a new tab, Refresh reloads an artifact in place, the review toolbar stays pinned with a 44px phone Comment target, long sign-in return URLs store the path without query when needed, and opening a terminal pane dialog closes the Jump to agent palette.