> ## Documentation Index
> Fetch the complete documentation index at: https://ara-90a60a07.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud

> Changes to the browser workspace and cloud agent experience.

For the visual release feed, see [ara.so/news](https://ara.so/news).

## August 15, 2026: Actionable session machine restart notice

* Replaced the passive retry control on disconnected session surfaces with an actionable Restart button wired to session runtime restarts.
* Unified hover details, icon spinning indicators, and accessibility labels across panel notices and navigation machine status pills.

## August 15, 2026: Multi-repo workspace sessions and status-first session list

* Sessions now operate as workspace-centric conversations in `/work` rather than single-repository containers, allowing agents to clone or attach connected repositories dynamically and open pull requests against explicit target repositories without session restarts or sub-session splits.
* Harmonized device and repository attachment guidance across cloud runtime prompts so multi-repo and repository-neutral workspaces use consistent workspace delivery.
* The session navigation sidebar now supports dynamic repository grouping with multi-repo projection across all touched repositories, connected workspace repositories with case-insensitive filtering in the submenu, zero-repo scratch organization under General, and status/people grouping.

## August 15, 2026: Sandbox execution and credential hardening

* Package installs in the cloud sandbox now skip lifecycle scripts by default (`npm_config_ignore_scripts`, `YARN_ENABLE_SCRIPTS=false`), so untrusted repository content can no longer trigger install-time code execution.
* The repository clone URL exported into the sandbox no longer embeds the source-control credential; authentication flows through the git credential helper instead, keeping the token out of environment dumps.
* Session steering messages now emit a caller-identity audit event, attributing each follow-up that continues a run to the user or API key that sent it.

## August 15, 2026: Consolidated high-throughput CI/CD pipeline

* Consolidated CI shards into a unified 2-shard execution model running concurrent Vite builds, typechecks, and 978 unit tests on 16 vCPUs.
* Direct test IPC and temporary state to Linux in-memory filesystems (`TMPDIR=/dev/shm`), cutting PR gate wall-clock down to sub-40 seconds.
* Standardized shallow Git checkouts across all build and test jobs.

## August 15, 2026: Accelerated production builds and streamlined API container image

* Streamlined the backend API container image to run directly from source with Bun, cutting redundant frontend bundling and typechecking from API service deployments.
* Parallelized web application and component preview builds to run concurrently, reducing frontend deployment and preview build times.
* Optimized replica draining windows and asset compression checks for faster rollouts across staging and production.

## August 15, 2026: Sandbox egress proxy routing and destination allowlist policies

* MicroVM sandboxes now support platform egress proxy routing, enforcing that sandbox outbound traffic routes through the platform relay and preventing workspace secret overrides.
* Introduced destination allowlist policy filtering covering developer package registries, SCM hosts, and curated connector endpoints in observe and enforce modes.
* Added support for brokered secret exposure modes, withholding credentials from the sandbox environment while retaining host-side tool access.

## August 15, 2026: Guarded pull request creation and chat privacy

* Interactive web chat sessions no longer automatically open unsolicited backstop pull requests when reviewing code or exploring branches.
* Workspace finalization now tracks per-turn commits, pushing branches only when new commits were explicitly authored during that turn.
* Code review, bug audit, and informational questions now remain strictly inside the Ara chat thread by default and never mirror conversational analysis onto GitHub pull requests or issues.

## August 15, 2026: Accelerated web application type compilation and localization loader

* Optimized localization catalog dynamic loaders to stream locale definitions on demand, accelerating frontend compilation and type checking.

## August 15, 2026: Database connection pool scaling and claim backpressure

* Raised default production and development database connection pool capacities to prevent connection slot starvation under high concurrency.
* Worker queue dispatch now debounces transient database waiter spikes before pausing worker claims, keeping background agent scheduling responsive during bursty traffic.

## August 15, 2026: Mobile session source logos stay contained

* MCP client logos in the mobile session sidebar now stay inside their 12px origin badge instead of expanding over nearby session titles.

## August 15, 2026: Production Pulse has a native always-on view

* The six production reliability graphs are available across
  [ara.engineer/production](https://ara.engineer/production) and
  [ara.engineer/prod2](https://ara.engineer/prod2), protected by the same
  one-time-code access as the founder dashboard.
* Every graph keeps a compact color-to-series key visible inside the graph frame
  without hovering, refreshes every 60 seconds, and connects sparse samples
  across missing buckets like Grafana's always-on null handling. Telemetry
  freshness remains an explicit independent signal. User latency stays pinned
  to a stable 0–10 second axis so a slowdown cannot visually rescale itself away.
  The message, run, and inference volume graphs scale tightly to the maximum
  observed in the selected window, making their full dynamic range visible.
* Each wall's window switch moves its graphs together between the last 72, 24,
  6, or 1 hour and requests an appropriately sampled snapshot for that window.
  Short views now expose 1–5 minute inference, queue, latency-component, and
  production-pressure detail instead of stretching 15–60 minute buckets.
* The always-on view uses a slimmer utility bar with only the `ara.so` wordmark,
  range controls, refresh, and sign-out actions, leaving more room for telemetry.
* The production wall is now split for multi-screen monitoring:
  [ara.engineer/production](https://ara.engineer/production) keeps panels 01–04
  in a fixed 2×2 grid, while [ara.engineer/prod2](https://ara.engineer/prod2)
  stacks constraint pressure and canary health as two full-width rows.
* Both walls preserve a 1920×1080 logical canvas and scale proportionally—equivalent
  to 50% browser zoom on a 960×540 monitor—instead of collapsing their grids.

## August 14, 2026: Fast isolated test execution

* Test execution across backend and frontend suites now runs through a native
  TypeScript worker pool with longest-processing-time (LPT) scheduling,
  eliminating process fork overhead and core tail starvation while preserving
  per-file isolation.
* Test-mode backoff and retry sleeps are truncated across all internal relay,
  API, and gateway drivers, and frontend test suites are partitioned to fan
  out across available worker cores concurrently.

## August 14, 2026: Production recovery is standardized

* Ara's release process now separates immediate traffic restoration from the
  durable source fix, so a known-good frontend or API deployment can restore
  service without waiting for a rebuild.
* Rollback checks now preserve later commits and already-applied migration
  history, verify the exact affected customer path, and prevent ordinary code
  regressions from triggering an unsafe database restore.
* A protected-main incident workflow can now collect the live frontend/API
  identities, retained pre-change candidates, migration and later-commit risk,
  plus current canary evidence into one `#alerts` recommendation. It can prepare
  a draft source-revert PR when explicitly requested, but cannot merge, deploy,
  switch traffic, or touch data.

## August 14, 2026: Site failures can be reproduced from the affected network

* Production monitoring now compares independent recursive DNS providers and
  retains cross-region TLS-certificate and TCP-path history, making a
  resolver-, ISP-, or CDN-specific failure distinguishable from a global
  outage.
* A failed cloud-browser run now preserves its available logs, trace,
  screenshot, video, report, and network diagnostics with the scheduled run
  instead of leaving only a red check.
* Support can give an affected Mac a no-install capture that tests every current
  JavaScript and stylesheet, or temporarily run the same browser and HTTP test
  through that exact network. The temporary probe key and location are removed
  after the incident.

## August 14, 2026: Continuous production-path verification

* Ara now continuously checks the same production path a real authenticated
  session uses: API access, a warm reply, cold start, inference settlement,
  cloud-machine tools, and a connected GitHub repository read. Each check
  verifies the exact result as well as its latency instead of treating an HTTP
  success as proof that the product works.
* Queue age, database waiting, event-loop responsiveness, active-run pressure,
  machine quota, host limits, and user-visible latency now share one 72-hour
  operational view. Repeated failures, exhausted latency headroom, or missing
  check telemetry alert independently so a silent observer cannot look green.
* That operational view now renders as six always-on Grafana graphs backed by
  Ara's production telemetry, with every colored series, latest value, maximum
  value, and 80%/100% canary reference line visible without hovering.
* The daily reliability run now also completes exact direct-answer and
  cloud-tool sessions through the ordinary production API, attaches a
  deterministic 24-hour summary of queueing, latency, host pressure, database
  waiting, and sandbox headroom, and reports through an independent heartbeat.
* Manual canary runs now execute only from the reviewed `main` branch, so an
  arbitrary branch cannot receive the production observer's Infisical token.
* Production runtime, public user-path, pull-request review, and model-response
  probes now run only in one dedicated `canary-box` workspace. Their reusable
  history and alerts are scoped to that workspace. Staging toolbelt and
  compaction probes stay isolated on the synthetic `ara-staging` database and
  stable staging API, and cannot resolve production or customer rows. Shared
  target guards and CI contract tests reject an accidental customer-org or
  cross-environment override before a probe starts.

## August 14, 2026: Landing-page asset recovery is deployment-safe

* Generated JavaScript filenames now include the deployment identity whenever
  their bytes contain deployment-pinned imports, preventing two releases from
  publishing different module graphs under one cached pathname.
* Browser caches now revalidate generated assets instead of retaining a
  transient missing-file response as immutable. Ara still retries failed
  bootstrap files and displays a self-contained recovery screen if the network
  remains unavailable.
* The daily reliability suite now fault-injects every required bootstrap script
  and stylesheet, while CI verifies the complete emitted dependency graph carries
  one consistent deployment pin.

## August 14, 2026: Product analytics returned to PostHog

* PostHog is again Ara's single product-analytics destination across the web
  client and API. Events now include environment, service, release, workspace
  grouping, and retry-safe billing identifiers while operational telemetry
  remains on its separate reliability path.
* The Revenue dashboard now centers the current cash-backed MRR split, its
  seven-day history, and the current paying-customer table. Older revenue
  dashboards remain recoverable but have been archived out of the active list.
* Ara's founder-only revenue surface is now a read-only duplicate of the
  canonical PostHog Revenue dashboard. The TV surface now strips away the pie,
  cards, borders, metadata, and explanatory copy so only the current MRR and its
  full-width history line remain, refreshed automatically.

## August 14, 2026: Retired experimental iMessage and applicant scoring paths

* The unreleased iMessage connection flow and its Photon runtime have been
  removed. Ara's supported messaging integration remains Slack.
* Career applications are still recorded and sent to the hiring team, but Ara
  no longer assigns automated candidate scores or exposes repair tooling for
  those scores.

## August 14, 2026: Repository Wiki is retired

* The retired AutoWiki and DeepWiki pages, settings, background-agent option,
  marketing page, and internal app endpoints have been removed.
* Existing Wiki links continue to open Codebases so old bookmarks do not strand
  users. Repository-native runbooks and organization memory remain the supported
  sources of durable context.

## August 14, 2026: Free is the full product, subscriptions start immediately

* Every Ara feature is now available on Free when you connect your own model
  provider. A first workspace also receives a one-time \$5 Ara-hosted inference
  balance, shown in the left sidebar.
* Ara Pro is a straightforward $20 monthly subscription with $20 of hosted
  inference spend. It is charged immediately; free subscription periods and
  free-month promotions have been removed.
* Billing now speaks in dollars throughout. Paid workspaces can configure an
  automatic reload amount and monthly cap, while exhausted Free workspaces see
  a direct Ara Pro card instead of a trial offer.

## August 14, 2026: Cloud machines clear space before they run out, not after

* A machine now clears its old process logs once it crosses 90% file usage,
  instead of waiting until it is completely full. Recovering an already-full
  machine buys back only enough room to start a single process, so acting early
  is what gives the real cleanup room to work.
* Every cleanup pass now reports how full the machine was, so pressure building
  on a machine is visible as a trend rather than only becoming apparent once
  sessions on it start failing.

## August 14, 2026: Daily cross-region landing-page verification

* Ara now discovers the landing page's current JavaScript and stylesheet files
  every day at 6:07 AM Pacific and verifies their status, type, cache policy,
  deployment pin, DNS, and TLS from independent probes around the world. The
  check follows each deployment's live asset names instead of relying on hashes
  that go stale after the next release.
* Real browsers also load the home, pricing, and contact pages, verify that every
  application script and stylesheet succeeds, and confirm that the final page is
  styled rather than merely returning HTTP 200. The same core check runs after
  frontend deployments, while the lightweight worldwide DNS and HTTPS check
  continues every ten minutes.
* The ten-minute check now deliberately samples consumer ISP networks as well
  as datacenters, matching failures that affect only one resolver or access
  network. A pre-application sentinel and browser Network Error Logging also
  preserve evidence when required page files fail before Ara's normal analytics
  can start.
* Every site check now enters through `www.ara.so`, verifies its DNS, TLS, and
  canonical redirect before validating the resulting page and assets, and uses
  a Checkly heartbeat to alert if the scheduled daily suite itself stops running.
* The browser check now resolves one Playwright runtime consistently in both
  scheduled CI and Checkly-enabled development installs, preventing the monitor
  itself from failing before it tests the public pages.

## August 14, 2026: Product analytics telemetry cutover to Mixpanel

* Internal product analytics telemetry across the web client and API server has been migrated to Mixpanel.
* Browser session replay is configured with strict client-side masking for credentials, secrets, and authorization fields.

## August 14, 2026: Staging sign-in previews stay inside staging

* Staging branch previews now send sign-in callbacks and client telemetry only
  to non-production APIs. Relative fallback requests also stay in staging, while
  each API and sign-in callback keeps an exact inbound origin allowlist, so
  preview traffic cannot fall through to production.

## August 14, 2026: Clearer error when a macOS or Windows machine can't start

* Starting a macOS or Windows cloud machine could fail with an unrelated-looking
  error when its underlying runtime was misconfigured, instead of saying what
  was actually wrong.
* The machine now checks that its runtime is reachable before attempting to
  start, and reports plainly when it is not, rather than failing partway
  through with an opaque error.

## August 13, 2026: Cloud sessions wait safely at dependency limits

* The cloud worker now pauses new session claims when its foreground database
  pool has a waiter or reaches 80% utilization. Sessions already running keep
  going, while new work stays durably queued until database headroom returns.
* If the sandbox fleet reaches its account-wide machine quota, a session now
  returns to the durable queue and retries after a spread delay instead of
  ending as Interrupted. A rejected sandbox admission does not consume a run
  recovery attempt.
* A completed inference stream now releases its per-session concurrency slot
  immediately, even if the upstream provider leaves the connection open. This
  prevents the session's own recovery attempt from being rejected behind an
  already-finished request.
* Operators receive an immediate alert when the sandbox fleet limit causes a
  requeue, alongside the existing database-pool and fleet-headroom warnings.

## August 13, 2026: A full cloud machine can now clean itself up

* A machine that filled up could not recover on its own. Cleaning up finished
  workspaces requires starting a process, starting a process requires writing a
  log file, and a full machine cannot write one, so cleanup failed and the
  machine stayed full. Every session assigned to it then failed within about a
  second.
* Cleanup now clears the machine's own process logs first, using a path that
  does not need to start a process, which frees just enough room to run the real
  cleanup that reclaims the space.
* This only ever removes logs of processes that already finished. Your work is
  never touched, and if the space cannot be freed the machine is reported as
  still full rather than reported as cleaned.

## August 13, 2026: Cloud machines keep reclaiming space after a machine is recycled

* Recycling a machine could leave its per-session workspaces marked as still
  needing cleanup forever. The cleanup sweep checked that the machine was alive,
  the recycle then removed it, and the cleanup failed against a machine that was
  already gone, so it retried the same workspace on every later pass.
* A workspace on a machine that is confirmably gone is now retired, because the
  workspace went with it. A machine that is merely unreachable for the moment is
  left alone and retried, so a temporary blip can never make a live machine's
  workspace look reclaimed.

## August 13, 2026: Landing pages recover from interrupted asset downloads

* If a required landing-page script or stylesheet is interrupted, Ara now retries
  that exact version before attempting a bounded page reload.
* If the browser still cannot retrieve the files, the homepage stays readable and
  shows a clear **Try again** action instead of a blank page.
* Terminal failures now alert the team with the deployment and exact asset path,
  while transient failures and successful recoveries remain queryable.

## August 13, 2026: Worldwide landing-page reachability monitoring

* Ara now checks `www.ara.so` DNS resolution and HTTPS reachability every ten
  minutes from independent probes around the world. A missing successful check
  also alerts the team, so a failed monitoring provider cannot silently remove
  regional coverage.
* Every browser bootstrap now has one recovery-safe load identifier. Interrupted
  assets, successful recovery, exhausted recovery, the exact deployment, and the
  eventual page load can be measured as one sequence instead of unrelated error
  counts.
* Recovered loads are linked to PostHog sessions when analytics becomes
  available, while pre-application failures continue reporting independently of
  the application bundle.

## August 12, 2026: A warm workspace is reused only by the person who left it

* Ara keeps a member's cloud workspace warm so a follow-up starts fast instead of
  cloning again. Reuse matched on the workspace, the repository and the machine's
  state, but not on who the earlier session belonged to. A follow-up sent by a
  different member of the same workspace could therefore start inside a machine
  another member had been working in, and see the files left there.
* Reuse now also requires the same person. A follow-up from someone else starts a
  fresh workspace, which is slower for that one start and sees nothing of the
  other session's work.
* The check refuses whenever it cannot confirm both sides belong to the same
  person, so an incomplete record costs a cold start rather than granting access.
* Nothing about your own follow-ups changes.

## August 12, 2026: Lighter marketing-page image loading

* The marketing homepage no longer downloads every inactive product-carousel
  screenshot as soon as the page starts. The currently shown screenshot still
  loads immediately, while later slides load when the carousel reaches them.

## August 12, 2026: Stable mobile navigation height

* The mobile app bar now keeps its full navigation height instead of compressing in constrained viewport layouts.

## August 12, 2026: A persistent badge for goal-driven sessions

* Sessions started with `@goal` now show a persistent **Goal** badge on the
  message that started them, so you can tell later which sessions are
  goal-driven even after `@goal` itself has been stripped out of what's shown.

## August 12, 2026: Faster answers when many sessions start together

* Concurrent scratch sessions now share identical startup lookups instead of
  repeating them for every session, and persistence work that is not required
  for the first answer runs after the agent finishes.
* In a controlled 50-session staging comparison, median send-to-first-answer
  latency fell from 8.8 seconds to 6.2 seconds and p90 fell from 17.6 seconds
  to 12.4 seconds. All 50 sessions completed in both runs.
* Dispatch now emits one structured timing event with each database-backed
  startup stage, so future regressions can be attributed without adding logs
  throughout the latency-sensitive path.

## August 12, 2026: A machine could be out of space while the panel read healthy

* The machine panel now reports **Files** alongside Storage. A machine's
  filesystem has two independent limits, total bytes and total files, and either
  one running out stops it writing. Showing only bytes meant a machine sitting at
  57% storage but 90% files looked completely healthy right up to the point every
  session on it began failing in about a second.
* The Files row uses the same colour thresholds as the others, so file-count
  pressure turns amber and then red on its own instead of staying invisible until
  it is fatal.
* The machine capacity response gained an `inodes` object (`total`, `used`,
  `available`, `usage_percent`). Where a machine's platform cannot report it the
  values are null, and the storage figures are unaffected.

## August 12, 2026: Session pages load without jumping

* Opening an uncached session now shows a shimmer shaped like the final header,
  transcript, and message composer instead of a centered loading mark.
* Review details, changed files, and workspace files now reserve their final
  layout while they load. Session information that is already available stays
  visible rather than flashing back to a placeholder.

## August 12, 2026: PR-review interruptions retain their real cause

* PR Review no longer collapses unavailable proposers, incomplete proposer
  coverage, diff-fetch trouble, and posting trouble into one generic diagnostic
  reason. Interrupted attempts now retain the exact stage and cause so a
  continuation or operator can act on what actually stopped.
* Historical review attempts remain intact. Where the old stored message only
  says the review swarm stopped, Ara labels it as a legacy swarm interruption
  instead of guessing a more specific cause.

## August 12, 2026: Late repository discovery stays in the same Session

* A repository-neutral coding Session now attaches the exact connected
  repository and continues the original task in the same chat. It no longer
  reports success by creating and linking a second Session.
* When a fresh checkout is required, Ara uses a successor execution only after
  the original execution has securely stopped. The transition preserves the
  original input and attachments, model and reasoning settings, connector
  thread, and visible Session identity.
* Live output keeps a distinct internal stream key for each execution even
  while both are presented under the stable Session ID, so output from the
  repository-neutral and repository-backed executions cannot be combined.
* Generic Session creation is no longer available to a live run. Explicit,
  bounded subagents remain available for genuinely independent parallel work;
  discovering or attaching a repository is not delegation.

## August 12, 2026: Session context expands from the top bar

* Session status now appears as compact tabs for queued messages, plan progress,
  subagents, changed files, and recent edits. Opening a tab expands the existing
  top bar in place, so context stays aligned with the conversation instead of
  covering the composer. A desktop pointer previews a tab on hover and collapses
  it on leaving the bar; touch screens continue to open tabs with a tap.
* The `@` mention browser now uses that same expanding surface, with categories
  and matching results side by side. The composer's add button opens the same
  browser, while file attachments remain available at the bottom of the list.
* Skills are discoverable through `@` alongside repositories, devices, files,
  plugins, secrets, automations, and sessions; `/` remains focused on commands.

## August 12, 2026: A safer foundation for sessions with multiple resources

* Ara now has an additive internal data foundation that separates a durable
  Session from its requests and execution attempts. Repository context is
  represented as attachable Resources, while working and delivery targets stay
  task-local and separate from access authority.
* The foundation also defines exact, short-lived Capability records for later
  point-of-effect enforcement. It does not change existing sessions, APIs,
  worker claiming, or repository behavior yet; runtime dual-writing, measured
  backfill, and reader cutover ship as separately verified changes.
* The target contract treats a repository discovered after work starts as a
  continuation of the same Session and Turn. The current execution Attempt
  continues when safe; otherwise a successor Attempt resumes after teardown.
  A separate Session is reserved for explicit independent delegation. Runtime
  behavior changes only after the attachment service and regression gates land.

## August 12, 2026: Measure session recovery before automating it

* Ara now measures how often Interrupted sessions are continued, how often the
  continuation eventually reaches Done, how long recovery takes, and its added
  cost. The measurement follows the full continuation chain and does not add
  work to message delivery or session startup.
* This does not automatically retry Interrupted sessions. The data establishes
  which narrowly defined infrastructure interruptions benefit from recovery
  without repeating expensive or user-actionable failures.
* Sessions blocked by a missing GitHub App installation now appear as **Needs
  input** and are excluded from the Interrupted recovery funnel.

## August 12, 2026: Sessions can inspect and repair pull-request failures

* Coding sessions can now read the complete state of their pull request,
  including commits, checks, reviews, inline comments, discussion, and every
  changed-file patch through bounded pages that also support very large PRs.
* When CI fails, a session can inspect the exact check output, annotations,
  failed GitHub Actions step, and a bounded redacted log excerpt, then push a
  repair and re-check the pull request instead of stopping at the aggregate
  required-check name.

## August 12, 2026: Automation catalog removes redundant trigger label

* The Automations page no longer shows the visible “Last triggered” label above the automation list.

## August 12, 2026: Mintlify docs navigation

* Ara docs are now available through Mintlify at
  [ara.so/docs](https://ara.so/docs) and [docs.ara.so](https://docs.ara.so),
  with one compact top bar for **Documentation**, **API reference**, and
  **Changelog**.

## August 12, 2026: Sidebar attention states use clearer wording

* Session rows that require a response now say **Needs input** instead of
  **Needs you**, making the next action explicit.

## August 11, 2026 — Stable conversation history loading

* Sessions now identify when earlier messages are still loading, keep the latest exchange usable, and insert the completed history without moving the reader’s visible message. A compact retry state preserves the current conversation when older history cannot be fetched.

## August 12, 2026: Session actions stay above the sidebar

* Opening a session's three-dot actions menu now keeps the full menu above
  neighboring session titles and status details, including in project-grouped
  views.

## August 12, 2026: A repository-name case mismatch could silence an automation

* A GitHub automation (including PR Review) matched an incoming webhook's
  repository name against its trigger with an exact, case-sensitive
  comparison, so `Owner/repo` and `owner/repo` were treated as different
  repositories even though GitHub itself treats them as the same one. An
  automation configured this way never ran, with no error surfaced anywhere.
  Matching is now case-insensitive.

## August 12, 2026: Preview chat images before downloading them

* Clicking an image attached to a chat message now opens the in-app preview
  instead of allowing the browser to download it immediately. Download remains
  available as an explicit action in the preview.

## August 11, 2026: Run PR Review on your connected ChatGPT subscription

* The **PR Review** automation's Provider control now offers a connected
  ChatGPT Plus/Pro subscription alongside Anthropic, OpenAI (API key),
  Google, and GitHub Copilot.

## August 12, 2026: Earlier cloud-capacity warnings

* Ara Cloud now measures the agent worker's CPU, memory, process, and concurrent
  session headroom every minute and warns operators before the shared service
  reaches its cloud compute limits. This does not change session admission
  or impose a new customer concurrency limit; it gives the team time to protect
  active sessions and add capacity before resource pressure becomes a user-
  visible queue or failure.
* CPU is now reported both as a share of the full cloud-compute allowance and as
  actual core-equivalents. Separate event-loop warnings detect when the shared
  Bun process becomes slow even though its multi-core host percentage still
  appears low.
* Separate fleet warnings now track the external sandbox-provider quota. This
  catches the boundary where new cloud machines would be rejected even though
  the shared worker still has ample CPU and memory.
* The worker now admits at most 50 simultaneous sessions per replica, the
  highest staging band that completed without a runtime failure. Additional
  sessions remain durably queued instead of amplifying database and Device
  pressure into failed runs.

## August 11, 2026: Transcripts stop masking ordinary configuration values

* Every workspace secret's value was masked as `***` wherever it appeared in a
  session transcript, streamed output, error log, or pull-request body. When a
  secret held a deployment value rather than a credential, that masked ordinary
  words: a workspace with `NODE_ENV=production` saw every mention of
  `production` replaced, and one with a branch or port stored as a secret lost
  those too.
* Masking now skips values shorter than eight characters, which cannot hold a
  credential, and skips values whose variable name shows it is not one:
  framework-published names (`NEXT_PUBLIC_*`, `VITE_*`, `REACT_APP_*`,
  `EXPO_PUBLIC_*`, `PUBLIC_*`) and deployment coordinates (`NODE_ENV`, `PORT`,
  `*_REGION`, `*_PORT`).
* A name that still indicates a credential keeps its masking even with a
  published prefix, so `NEXT_PUBLIC_STRIPE_SECRET_KEY` is unchanged, while
  `NEXT_PUBLIC_SUPABASE_ANON_KEY` is not masked.
* Credential detection by shape is unchanged: provider tokens, API keys, JWTs,
  private-key blocks, credentialed URLs, and any long opaque token are still
  masked whatever they are named. Storage is unchanged too. Every workspace
  secret stays encrypted at rest and reaches the session exactly as before, and
  there is nothing to configure.

## August 11, 2026: Sessions no longer end in a failed state

* Sessions are durable conversations you can continue, so an attempt that stops
  unexpectedly is now **Interrupted**, not **Failed**. Continue the session to
  resume from the work and context already there.
* Session status filters now use one consistent set of states: **Working**,
  **Done**, **Needs you**, **Interrupted**, and **Stopped**. The exact cause stays
  attached as a diagnostic reason and remains available in Logs.
* Existing historical failed attempts automatically appear as **Interrupted**;
  no session history or recoverable work is removed.

## August 11, 2026: Execution-target controls use product language

* The internal session endpoint and web component that report whether work is
  running in Ara Cloud or on an Ara Device now use the product-domain name
  **execution target**.
* Existing browser deployments remain compatible during rollout; this naming
  change does not alter where work runs or how target handoff is authorized.

## August 11, 2026: Runtime errors use plain language

* Session startup and failure messages now describe what happened and what to do
  next without exposing internal runtime names or diagnostic identifiers. Raw
  technical details remain available in Logs for troubleshooting.

## August 11, 2026: Control how much the review bot filters away

* The **PR Review** automation's detail page now has a **Sensitivity**
  control: Low posts every finding (higher recall), High posts only the most
  severe (higher precision), and Medium is balanced. Previously this was a
  single platform-wide setting with no way to adjust it per workspace.

## August 11, 2026: A simpler Ara home

* The signed-out Ara home brings together Google sign-in, email verification,
  CLI installation, plans, and docs links in one compact surface.
* The CLI command is always visible and copyable. Product and footer links lead
  to customer-facing documentation rather than separate marketing pages.

## August 11, 2026: Review bot findings now default to high severity and above

* Workspaces that haven't set an explicit Sensitivity now default to **High**
  instead of Medium. A benchmark sweep showed High more than triples precision
  over Medium (26.7% -> 52.2%) for less than double the recall cost, so it's
  the new out-of-the-box setting; switch to Medium or Low on the automation's
  detail page for more findings.

## August 11, 2026: See the instruction a one-click action sent on your behalf

* Some buttons send the agent a longer, more specific instruction than the short
  line that appears in the chat. The Review panel's fix actions work this way, so
  a row could read **Make ready: fix conflicts** while the agent received several
  paragraphs of detail.
* Those messages now carry a **View instruction** toggle that expands to show
  exactly what was sent. Nothing new is recorded to make this work; the full text
  was always part of the message and simply was not shown.
* Ordinary messages you type yourself are unchanged and show no toggle.

## August 11, 2026: Live machine capacity in session actions

* Open a cloud session's actions menu to see a live snapshot of its storage,
  memory, and CPU use, plus its operating system, architecture, provider, and
  CPU count.
* The snapshot refreshes while the menu is open. A warm machine refreshes less
  often. Retained sandboxes are checked before being shown as offline, so a
  reachable machine reports **Warm** even after its run has ended. If the
  retained sandbox is gone, the card settles on the offline state instead of
  presenting a capacity error.
* Storage and memory bars call out elevated use at 75% and critical use at 90%,
  making capacity pressure visible before a repository operation runs out of
  room. On macOS, available memory includes reclaimable purgeable pages. The
  probe is on demand and never runs in the message or cold-start path.

## August 11, 2026: Start a goal-driven session with @goal

* Typing `@goal` when you start a session, or picking **Goal** from the `@`
  menu, keeps the agent working until the task is verifiably done rather than
  until the model decides it has finished. Your message becomes the objective.
* An independent reviewer, which reads your changes but cannot edit or run
  anything, writes the acceptance criteria from that objective and judges each
  one against the evidence in the diff. The checklist decides when the session
  is complete, so a criterion that later work breaks goes back to unmet.
* The `@goal` token is not sent to the agent: it configures the session, and
  the objective is the rest of your message.
* Available where your workspace has goal mode enabled, and offered when
  starting a session rather than on a reply, because a follow-up turn continues
  the existing run instead of opening a new goal.

## August 11, 2026: Track how often @goal is actually used

* Starting a session with `@goal` now records that the directive was used,
  separately from ordinary sessions that happen to be long-running. This is
  internal usage measurement only and changes nothing about how a session
  behaves.

## August 11, 2026: Review bot uses your own connected model provider

* The PR review bot now prefers a provider your workspace has connected at
  **Settings → Models** (Anthropic, OpenAI, Google, or GitHub Copilot) over
  Ara's own model, when one is connected. It falls back to Ara only when
  nothing is connected.
* The **PR Review** automation's detail page now shows which model is
  actually in use, and lets you explicitly pick a connected provider (or
  Ara) instead of the automatic choice.

## August 11, 2026: One set of actions for a pull request that cannot merge

* The Review panel had two separate ways of offering to fix an unmergeable pull
  request: one that appeared from the pull request's state before you clicked
  merge, and one that appeared after a merge was refused. They used different
  wording and gave the agent different instructions for the same problem.
* They are now one. Whether a problem is spotted up front or reported by GitHub
  or GitLab after a refused merge, the panel names it the same way and hands the
  agent the same instruction.
* The action now says what it will do — **Fix conflicts**, **Fix checks**,
  **Resolve review**, **Mark ready for review** — instead of a single generic
  label. Conflict instructions still match your chosen merge method, so a squash
  or rebase pull request is rebased and a merge-commit pull request has the base
  merged in.
* Every one of these actions now sends its instruction straight into the session
  chat. Previously some filled in the message box and waited for you to press
  enter, and others sent it immediately.

## August 11, 2026: A draft pull request offers Mark ready for review instead of a merge that cannot succeed

* A draft pull request can never be merged, but the Review panel still showed an
  enabled merge button. Merging returned a provider error, and the failure was
  reported as a generic problem whose only offered action was **Retry merge** —
  which re-sent the identical request and failed again. This was the single most
  common merge failure.
* The Review panel now recognises a draft. Instead of the merge button it shows
  **Mark ready for review**, which marks the pull request ready in place, in one
  click. The merge button returns once the pull request is out of draft.
* A draft is also refused before the request reaches GitHub or GitLab, and it is
  now reported as its own condition rather than as an unknown failure, so the
  agent gets the same accurate reason a person does.
* A draft PR that also has conflicts leads with the draft, because resolving the
  conflict alone would still not allow a merge.

## August 11, 2026: Review panel actions are measured, including why a merge was refused

* Every action button in the Review panel is now recorded: merge, the merge
  method you pick, changing the base branch, creating a pull request, **Make
  ready**, and the actions offered when a merge is refused. Previously only the
  merge button was counted, so there was no way to tell which of the others
  people actually reach for.
* Each action also records how it resolved. A refused merge now carries a
  classified reason, such as a conflict with the base branch or a required
  check that is still failing, rather than only the fact that a button was
  pressed.
* What is recorded is the action, the repository and pull request it applied
  to, the merge method, and the pull request's mergeability and check state at
  the moment of the click. Reasons are recorded as fixed codes, never as raw
  provider error text.
* No change to how any of these buttons behave.

## August 11, 2026: Review bot findings default to medium severity and above

* The PR review bot now keeps findings at medium severity and above by
  default, so routine style and naming remarks no longer show up alongside
  correctness and security findings.

## August 10, 2026: Goal sessions stop failing on criteria nobody could check

* A long-running session in goal mode is judged against acceptance criteria
  written by an independent reviewer. That reviewer reads your changes but
  cannot run anything, so criteria like "the test suite passes" could never be
  satisfied and held back sessions whose work was actually finished.
* Criteria are now written in terms the reviewer can decide from the changes in
  front of it, such as which cases the tests cover, rather than results that
  would require running the code. Where a command's output is available to the
  reviewer, it can still require that command to pass.
* Criteria are also no longer written for committing or opening a pull request.
  Those happen after the session finishes, so they were never true while the
  work was being judged, and a single one could deny an otherwise complete task.

## August 10, 2026: Goal-session criteria stay out of diagnostics

* Long-running sessions running in goal mode derive acceptance criteria from
  your prompt. That wording is now kept out of platform diagnostics by default,
  because criteria are model-generated from your own text and a prompt carrying
  a credential could otherwise have it repeated back into a log line.
* The number of criteria and how many are met are still recorded, so progress
  and adoption remain measurable. Only the wording is withheld, and it travels
  only when an operator explicitly enables it for a measurement window.
* No change to how any session behaves or to what a goal session accepts.

## August 10, 2026: The Developers page install command is copyable again

* The `curl` install command on the Developers page now has a copy button, so
  the recommended way to install Ara CLI takes one click.
* "Download Ara" now explains what to do with the saved file. Browsers save the
  installer without the execute bit, so opening it returned only
  `permission denied`. The page now says to run it with bash, and how.

## August 10, 2026: Cloud machine resets now replace the machine

Session actions include a guarded **Reset machine** escape hatch for cloud sessions. Resetting now advances the machine identity before Ara creates the linked session, so the replacement cannot reconnect to the same unhealthy persistent machine. The old machine drains only after every active session has left it. Worktree cleanup also safely fences legacy sessions that do not yet carry generation metadata.

* The transcript and pushed branch or pull-request context move to the replacement. Uncommitted or unpushed files remain on the old machine.
* Completed persistent worktrees are removed after their inspection window, including both the directory and Git's worktree/ref metadata. Cleanup and new session startup use an exclusive lease so they cannot race on the same branch.
* Resetting a cloud session refreshes the session list before opening the fresh linked session. Local-device sessions continue to use their existing device controls.

## August 10, 2026: More precise run timing under the hood

* Ara now measures each stage of a session's startup and wrap-up (workspace
  attach, tool readiness, and the moment a queued follow-up can begin)
  individually instead of as one total. Nothing changes in how sessions run;
  this is the measurement groundwork for upcoming latency improvements to
  session startup and queued follow-up turns.

## August 10, 2026: Mention pills in the composer

* `@` mentions typed into the session composer (repositories, files, skills,
  plugins, sessions, secrets, automations) now render as a rounded pill with
  their icon leading the label, instead of plain colored text.
* Repository mentions show the repository's actual GitHub or GitLab mark.
* Session mentions use the same pencil glyph as "New chat" elsewhere in the
  product, and the "New side chat" action uses it too.

## August 10, 2026: Staged files survive leaving the composer

* Files attached to a message but not yet sent are now kept with the draft
  text, so navigating away from a session and back restores both instead of
  only the typing.
* A draft made of attachments alone, with no text yet, is now kept as well.
* Drafts stay per workspace and session, and are still held only in the
  browser. A very large attachment that will not fit in browser storage is
  dropped so the typed text is kept.

## August 10, 2026: A calmer Merge Bot policy page

* The Merge Bot merge policy now folds into a single accordion stack: Risk
  tolerance, Safeguards, Maximum change size, Protected paths, Merge
  guidelines, plus the Always-on safeguards and Under the hood reference
  sections, all collapsed by default.
* Sections whose values differ across connected repositories show a Mixed
  badge on the folded header, so cross-repository drift stays visible without
  opening anything.
* The "How it decides" overview now reads as four one-line steps, with the
  full runtime explanation moved into Under the hood.

## August 10, 2026: Reordered the session actions menu

* Rename, Send feedback, Jump to, and Copy session ID now lead the session
  actions menu, ahead of the branch, execution device, and context window
  details.
* Copying the session's branch name now swaps its icon to a checkmark, the
  same feedback Copy session ID already gives, instead of a separate text
  notice.
* Model usage and Runtime are now shown together on one line instead of two.

## August 10, 2026: Secrets move into workspace settings

* Secrets now have a dedicated **Settings -> Secrets** page instead of living
  inside each repository page.
* Workspace secrets are available across the workspace, not stored per
  repository. An optional note gives Ara and teammates usage context; include a
  repository name there when a secret is intended for one codebase.
* Secret values remain masked and write-only. Owners and admins can manage
  them, while other workspace members can see names, notes, and whether a value
  is configured.

## August 10, 2026: A calmer session handoff

* Opening a session now holds the content pane with a centered Ara-logo shimmer
  until the session snapshot is ready, instead of briefly showing an empty or
  partially stale chat frame.
* The loading mark follows the active theme and becomes a quiet static mark
  when reduced motion is enabled.
* The session title is now the actions-menu trigger. It uses the same faded
  title and rotating chevron treatment as More/Less, replacing the separate
  three-dot button; title and chevron share one divider-free hover highlight.
* A new-chat icon beside the session title returns directly to the empty
  workspace composer, without opening the sidebar first.
* Mobile navigation remains available during the loading handoff without being
  announced as loading status, and assistive technology reads the visible
  session title as the heading and menu trigger.

## August 10, 2026: Search inside every session

* Command-palette session search now searches the full workspace session
  history, including archived sessions and transcript text beyond the recent
  sidebar window.
* Matches come only from customer-visible session titles, user messages, and
  assistant answers. System prompts, reasoning, tool calls and tool output stay
  outside search results.
* Ordinary assistant answers are searchable whether or not their stored message
  carries optional delivery metadata.
* Search runs on the organization-scoped API with a short input debounce and
  partial database indexes for visible conversation rows, keeping hundreds of
  sessions responsive without downloading every transcript to the browser.

## August 10, 2026: New chat controls stay in the composer

* New chat now keeps the model and thinking controls inside the composer,
  matching their placement in an active chat instead of showing a detached row
  beneath the input.
* The former Dashboard destination is now named **Settings**, uses the settings
  gear, and sits last in the sidebar shortcut picker. Devices and Developers now
  use their dedicated Central Devices and Code Brackets icons.

## August 10, 2026: Tool call trace polish

* The expanded list of individual calls inside a grouped tool row (e.g. "Read
  a file and searched files, used browser") is now spaced tighter, so a long
  trace reads as one list instead of loosely separated rows.
* The browser tool's icon now matches the sizing of every other tool icon in
  the trace; it previously rendered from a different icon set at a visibly
  smaller size.
* A tool call's `+N -N` line-count badge no longer appears for plain command
  output that merely resembles a diff (e.g. `--- section ---` log banners or
  a package manager's `+ name@version` install listing). It now only shows
  for an actual unified diff.

## August 10, 2026: Settings account page reorganized

* The Settings account panel drops the Legal (Privacy Policy /
  Terms of Service) and Devices sections, and the display-language subtext
  under Language.
* Feedback is renamed Notifications.
* Profile is followed by the workspace photo, name, and ID controls directly
  on Settings. The redundant General page and its localhost plan switch are
  removed; old General links return to Settings.
* Preference sections stay open instead of behaving like accordions. Appearance
  shows the active light or dark icon, Notifications uses a bell, and the
  redundant System-theme explanation is removed.
* Audit Log remains its own workspace page with the full searchable,
  filterable, monthly-grouped activity feed instead of being folded into the
  Settings accordion.

## August 10, 2026: Developer setup in one place

* **Ara CLI** is now **Developers** in the workspace navigation, with a compact
  setup page for downloading the CLI, connecting Ara MCP, and installing the
  shared Ara Agent Skill.
* `ara mcp` handles both the MCP connection and the skill installation for
  detected supported coding clients. The page also provides
  target-specific commands and keeps API-key management below the setup guide.
* Developers and the other workspace settings pages share the same compact
  title treatment and a content column capped at 750px.
* Ara Devices now starts with the workspace's managed sandbox and any connected
  Macs, followed by the direct Terminal setup for adding a Mac. Developers stays
  focused on CLI, MCP, skills, and API keys; the redundant "Copy Ara CLI setup"
  prompt actions are removed.

## August 10, 2026: One customizable workspace sidebar

* The main sidebar keeps **Plugins** and **Automations** at the top. **More**
  expands **Memory**, **Repositories**, and the workspace shortcuts, with
  **Settings** kept last, so the default list stays focused while
  every destination remains directly reachable. Hovering **More** opens the
  sidebar picker: checked destinations stay pinned above it, and the choice is
  remembered on that browser. Selected shortcuts use compact black checkbox
  markers, and the picker waits briefly on hover so clicking **More** or
  **Less** never competes with it.
* Only the **New chat** row now stays pinned at the top of the sidebar. The
  rest of the navigation and the session list below it scroll together as one
  region, so a long or expanded session list no longer squeezes the
  navigation into its own separately scrolling box.
* The Workspace shortcuts now match **New chat** in label size, row height,
  horizontal alignment, and the full-width hover or selected highlight. The
  two sections also meet without an extra gap, reading as one continuous list;
  expanding **More** uses the same quick unfold treatment as Ara's selects.
* The account row at the bottom of the sidebar now opens a compact menu instead
  of navigating immediately. It shows the signed-in email, then keeps
  **Settings**, the region-labeled **Language** picker, **Community**, plan
  upgrades, the changelog, and log out together. Settings opens the account page
  and reveals the existing **More** section, while the active interface language
  stays checked.
* **Settings**, **Billing**, **Audit Log**, and the other former
  Settings destinations now open in the main workspace without replacing the
  sidebar. The same workspace navigation, width, projects, and recent chats
  remain visible while moving between them.

## August 10, 2026: Ara's own mark shows in Models & Model router

* The **Models** list and **Model router** in Models & credentials now show
  Ara's logo next to Ara's own models, matching the mark already shown on the
  Providers row above them. Both surfaces previously fell back to a blank dot
  for Ara specifically.
* Hitting a run with no inference connected now opens **Models & credentials**
  instead of the upgrade checkout page, since that's the section that can
  actually fix it (subscribe to Ara or connect a provider).

## August 9, 2026: Dashboard's Connect buttons skip the Plugins page

* **Connect** on the Dashboard's getting-started checklist now opens GitHub's
  or Slack's own authorization screen directly. It previously routed through
  the **Plugins** page first, adding an extra click before the actual
  connection step.

## August 9, 2026: A heads-up before a restricted subscription sign-in

* When a provider's terms don't allow using its subscription outside its own
  apps, connecting that subscription in **Models & credentials** now shows a
  brief notice with a link to the provider's policy, so it's an informed choice.
  Providers without such a restriction are unaffected.

## August 9, 2026: Pooled subscriptions fail over when one runs out

* When a workspace has connected more than one account of the same provider, a
  run now falls over to the next account if the active one hits its usage limit
  mid-request, instead of failing. It's a transparent retry on the next pooled
  subscription before any output is produced; once a response has started
  streaming, that attempt is kept as-is.

## August 9, 2026: Connecting a Git provider lands on the Plugins section

* Opening **Plugins** from a workspace with no Git provider connected now opens
  the **Plugins** section, where the GitHub and GitLab rows live. It previously
  opened **Installed** whenever any built-in skill was enabled, which is the
  default for a new workspace, so the connect rows stayed collapsed.
* Plugins accepts a `?section=` link (`installed`, `plugins`, or `skills`) to
  open a specific section on arrival. The composer's **Connect Git provider**
  link uses it.
* **Connect GitLab** during setup now opens GitLab's authorization page. It
  previously reported that it was opening and then did nothing.

## August 9, 2026: No stray warning while a session continues a turn

* Continuing a turn onto a new run no longer flashes a "no assistant text"
  warning in the transcript. The reply streams on the continuation run, so the
  turn it belongs to is no longer reported as silent.
* Session messages always name Ara rather than an internal runtime identifier.
* **Copy session ID** now copies the session id shown in the address bar for
  every session, including one that has continued onto later runs. It
  previously copied the most recent continuation run, which did not match the
  session URL.

## August 9, 2026: Docs open the Ara Discord

* The docs header and footer support link is now a **Discord** mark pointing at
  the [Ara Discord](https://discord.gg/HvZqTfZ55P) instead of X DMs, matching the
  button at the bottom of the app sidebar.

## August 9, 2026: Persistent cloud workspaces are available to every workspace

* Eligible cloud sessions now reuse a private persistent workspace across
  runs in every organization, while each concurrent session keeps its own Git
  worktree, branch, development port, and processes.
* A production canary outside the original early-access workspaces completed a
  dependency install, build, real framework-server lifecycle, push, and open
  pull request on the general-availability path.
* Runtime telemetry now distinguishes local plan and control tools from
  physical Brain and Hands dispatches, preserves that classification across
  worker recovery, and avoids false tool-rejection signals.

## August 9, 2026: A repository page of Secrets and Runbook

* The **Environment variables** section on a repository is now called
  **Secrets**, matching the name used everywhere else Ara stores credentials.
  The editor, its import pill, and its messages all follow the same wording.
  Stored values are unchanged.
* The repository page no longer repeats a **Plugins** section. Plugin
  connections are shared by the workspace and are managed in
  **Skills & Plugins**, so a repository now shows just **Secrets** and
  **Runbook**.

## August 9, 2026: Ara is marked in the Providers card

* The **Models & credentials** Providers card now places Ara's own mark beside
  the included Ara inference row, matching the provider marks used for
  connected model providers.

## August 9, 2026: Collaboration tools are available to every workspace

* **Presence**, **side chats**, and bounded read-only **subagents** are now
  available in eligible cloud sessions across Ara workspaces.
* **Organization memory** is available in **Settings → Memory** for every
  workspace. Teams can disable memory use or automatic generation whenever
  they choose.

## August 9, 2026: Concurrent sessions get separate development ports

* Each persistent cloud session now receives a product-assigned
  `ARA_DEV_PORT`. The assignment is protected by a shared lease and skips ports
  that are already listening, so parallel agents can run repository servers in
  one workspace without all choosing the same default port.
* A finished session releases its lease only after the port is actually free.
  If a server is still listening, Ara retains the lease so a later session
  cannot collide with that process.
* Bash already starts inside the session's isolated Git worktree. Agent guidance
  now tells it to use that current directory rather than retrying commands with
  a guessed or redacted checkout path.
* The linked worktree now checks out the session's real `ara/agent/...` branch
  instead of an internal filesystem key, so push and pull-request creation use
  the same branch without a compensating second push.
* Long-running Bash commands now keep the secure Hands connection alive with a
  protocol heartbeat. Repository builds and server checks can run past the
  preview edge's idle window without disconnecting and retrying the command.

## August 9, 2026: Side chats are full session tabs

* Select **New side chat** from a session's side-panel **+** menu to start a
  focused conversation alongside the parent. Each side chat has its own run,
  transcript, composer, tools, and planning workflow rather than acting as a
  restricted subagent.
* Side chats inherit the parent session's workspace, branch, pull-request lane,
  harness profile, and execution settings. Their tabs remain mounted while you
  move between conversations, so returning to one preserves its live context.
* Parent and side-chat composers now share the same aligned footprint. A new
  side chat starts with a compact, fixed system notification instead of an
  expandable prompt bubble.

## August 9, 2026: Bash-ready sessions no longer wait for a browser

* Ara now opens the Hands REPL socket immediately and starts its headless browser
  only when a session first uses REPL. Normal replies and Bash-only work no
  longer pay the browser launch cost, while the first REPL call still receives
  the same isolated browser, context, page, and persistent session state.

## August 9, 2026: Persistent cloud sessions can push their branches

* Git credentials and commit identity now remain available to each isolated
  session process after its persistent workspace is prepared. Concurrent cloud
  sessions can commit, push their own branches, and open pull requests without
  writing credentials into the shared repository or global Git configuration.

## August 9, 2026: Concurrent sessions keep their shared workspace alive

* Finishing or failing one session no longer deletes a persistent cloud
  workspace that other sessions are still using. Each session stops only its
  own Hands processes; the shared workspace remains available to sibling
  sessions and their isolated Git worktrees.

## August 9, 2026: "Cost by provider" no longer lumps most spend under "Other"

* **Usage & analytics → Usage by member** attributed a large share of every
  member's spend to a provider called **Other**, often the largest row on the
  breakdown. It was not a real provider: it was OpenAI and Anthropic usage that
  failed to resolve.
* A run records its model as a bare name (`gpt-5.6-sol`, `claude-opus-4`) rather
  than a vendor-qualified id (`openai/gpt-5.6-sol`), and only the qualified form
  carried a vendor Ara could read. The same model could therefore appear as
  **OpenAI** on one row and **Other** on another.
* Bare model names now resolve to the vendor they belong to, so each provider's
  real dollar cost is shown. **Other** is now limited to usage with no model
  recorded at all.

## August 9, 2026: Revert and Dream now move next to Open session

* **Revert** and **Dream now** are now pill-shaped buttons next to **Open
  session** on a memory history entry, instead of living in the sidebar's
  History list.
* A changed file's diff now uses the same corner rounding as a memory file's
  own preview, instead of the accordion's larger default rounding.

## August 9, 2026: Faster first commands in persistent workspaces

* Ara now starts the secure Hands relay while it prepares the repository instead
  of waiting for checkout to finish first. Bash and REPL become available sooner
  without changing the workspace or tool security model.
* Session titles no longer compete with the first answer for the run's inference
  lane, removing an avoidable retry from Ara-hosted models.
* A first Bash or REPL call in a persistent workspace now waits for its already
  warming Hands connection instead of returning early and making the agent retry.

## August 9, 2026: Memory's sidebar is a single Settings/History/Files accordion

* **Settings**, **History**, and **Files** are now one accordion in the
  Memory sidebar instead of three separate rows plus a full History panel.
  Only one section is open at a time, and **Files** is open by default.
* Opening **History** lists past runs right there in the sidebar; picking
  one shows its diff in the main area, which is now full width.
* The session list in the main sidebar (Projects, recent runs) now stays
  visible while on the Memory page, matching every other primary page.

## August 9, 2026: Memory History skips empty runs and folds diffs into an accordion

* **Memory History** no longer lists runs that produced nothing — a dreaming
  pass that had no new facts to promote, or a failed run, is skipped instead
  of cluttering the feed.
* The separator lines under the panel heading and the selected entry's title
  are gone.
* A run's changed files now expand and collapse as an accordion, matching
  the rest of the app, instead of separate bordered boxes.

## August 9, 2026: Persistent workspaces provision and prepare repositories again

* The persistent per-repository workspace could not be created at all: the
  identifier sent to the sandbox provider was built from the workspace and user
  identifiers verbatim, which exceeds the provider's 64-character limit for every
  workspace. Every attempt failed immediately, before any work started.
* The identifier is now the same short, stable digest already used to name the
  workspace, so provisioning succeeds.
* Repository setup now keeps its internal per-session Git ref separate from the
  optional public API start ref. An empty start ref can no longer erase the
  fetched commit before Ara creates the session worktree.
* Persistent sessions now offer Bash and REPL while Hands is still attaching.
  Calls wait behind the same bounded startup gate, so a short tool-required task
  no longer finishes by claiming the workspace is unavailable moments before it
  becomes ready.
* The sandbox device now shuts Hands down before the session becomes terminal. Its
  completion can no longer be fenced by the finished session and turn an
  otherwise successful run into a forced persistent-workspace deletion.

## August 9, 2026: The sidebar support button opens the Ara Discord

* The button at the bottom of the sidebar is now a **Discord** icon and links
  straight to the [Ara Discord](https://discord.gg/HvZqTfZ55P) instead of opening
  a menu with **Feedback** and **@aradotso · X DMs**.
* Feedback is still available inside a session by typing `/feedback` in the
  composer.

## August 9, 2026: Runtime notices are visible in the transcript

* When a session's workspace finishes starting mid-answer, Ara tells the agent
  so it can stop saying it has no way to run commands. That message was only
  ever sent to the agent, so the transcript showed a reply to something the
  reader could not see ("Noted — the workspace is up...").
* These runtime notices now appear as a collapsed **System Notification** row,
  the same one a finished subagent's report uses. Expand it to read the exact
  text the agent received, or copy it.

## August 9, 2026: Memory moves to the home screen, with a real History panel and Revert

* **Memory** now lives on the home screen next to **Skills & Plugins** instead
  of under Settings, since it is a shared, organization-wide surface rather
  than per-workspace configuration.
* **Memory History** is now its own full panel: a list of past extraction and
  dreaming runs on the left, and the selected run's file-by-file diff on the
  right.
* History entries can be reverted. **Revert** undoes that run's recorded
  changes on top of the file's current content, and records the undo as its
  own history entry.
* The Memory icon changed from a lightbulb to a head-with-spark glyph.

## August 9, 2026: Pool multiple provider subscriptions, and a smoother sign-in

* **Models & credentials** now lets a workspace connect more than one account of
  the same provider. Connect a second subscription and it appears as its own row
  alongside the first; the account is identified from the credential itself, so
  re-connecting the same subscription updates it in place instead of adding a
  duplicate.
* Subscription sign-in is scoped to a single supported provider for now. Other
  providers remain available by API key.
* Connecting a subscription opens the provider's sign-in page automatically, and
  the device code has a one-click copy button. The device-code flow completes on
  its own once you approve, with no callback URL to paste back.

## August 9, 2026: Analytics no longer lists a model name as a provider

* The **cost by provider** breakdown under *Usage by member* could show a model
  name (such as `gpt-5.6-sol`) as if it were its own provider. Usage that does
  not identify a provider now rolls up under **Other**, and named providers are
  unaffected.

## August 9, 2026: One Ara control plane, with Hands only when connected

* Ara's Brain and external MCP clients now use the same scoped `ara_*` catalogue,
  the same `/mcp/ara` transport, and the same audited handlers. A run-bound token
  changes authorization, not the tool contract.
* Before Hands connects, a session has its scoped Ara controls plus planning and
  delegation. When Hands is ready, exactly `bash` and `repl` appear; disconnecting
  Hands removes both. Legacy `local_*` relay operations remain internal and are
  never advertised.
* Repository setup now lives in `.ara/runbook.md`, and repository secrets are
  identified by connected repository, provider, and name. The old customer-facing
  environment, recipe, image-build, and snapshot controls have been retired.

## August 9, 2026: The Analytics time range applies to the whole page, and member usage breaks down by provider

* The **30 days / 7 days / 24 hours** control moved out of the *Activity over
  time* card and into the page header, next to the member/team selector. It now
  filters the whole page, so **Usage by member** changes with the selected
  window instead of always showing lifetime totals.
* Each member row now also shows **PRs shipped** and **agent minutes** for that
  window, plus a **cost by provider** breakdown of their spend across Anthropic,
  OpenAI, Google, and the other models Ara routes to.

## August 9, 2026: See usage broken down by member on the Analytics page

* The **Usage & Analytics** settings page now has a scope selector (all
  members, a configured team, or one member) and a **Usage by member**
  section showing each member's lifetime token usage and real dollar cost.
  Available to workspace owners and admins.
* Copy across the app that referred to **change requests** now says **pull
  requests**, matching the term used everywhere else in Ara.

## August 9, 2026: The sidebar's hover preview stays open while other parts of the page scroll

* The floating chat preview that opens when you hover a session row was wired
  to close on any scroll event anywhere on the page, including the session chat
  pane auto-scrolling while a run streams. With almost always something
  streaming somewhere, the preview would vanish out from under the pointer
  seconds after opening even though you never moved the mouse or touched the
  sidebar.
* It now only closes on a scroll or resize that could actually move it: the
  window itself, or this sidebar's own row list. Everything else is ignored.

## August 9, 2026: Skills & Plugins opens every category up front

* Opening **Plugins** used to expand only the first category (Git providers)
  and leave every other one - Communication platforms, Task management,
  Databases, Observability, and the rest - collapsed, even though they're
  short, scannable grids with nothing to hide. They now all open by default.
* Searching used to have the same problem: if your query matched entries in
  more than one category, only the first matching category expanded. Every
  category with a match now stays open at once.

## August 9, 2026: A subagent's transcript is its own conversation

* Opening a subagent now shows **its** opening instruction. The child view was
  reusing the parent session's first message, so every subagent appeared to have
  been asked whatever you asked the main agent.
* A finished subagent's report now appears inside that subagent's own thread,
  where it is the answer, instead of the thread ending on its last tool call with
  nothing to read.
* The header carries the same agent pill the chat does - lit mark, quieter label -
  and the session title beside it is the way back to the main thread, so the
  separate back arrow is gone.
* The message box stays where it is while you read a subagent, but sending is
  declined with an explanation: only a subagent's parent session can steer it.
* Plan updates carry the same check mark as the plan itself rather than a generic
  tool icon.

## August 9, 2026: The model picker's trigger shows its provider logo

* The composer's model selector already showed each provider's logo inside its
  dropdown; the closed button (e.g. "Claude Fable 5") only showed the model
  name. It now repeats the same provider mark on the button itself, so the
  active model reads with its provider at a glance without opening the menu.

## August 9, 2026: The review composer follows you down the thread

* The comment box in **Overview** now sticks to the bottom of the panel as the
  discussion scrolls beneath it, so replying never means scrolling to the end
  first. It also picks up the session input bar's shape and surface, so the two
  places you type in Ara look like the same control.
* The merge button is a pill, matching the other actions in the review header.
* The checks indicator is a progress ring rather than a filled dot - the same
  meter the composer uses for the context window - so it fills in as checks
  finish reporting instead of only changing color.

## August 9, 2026: Persistent workspaces (early access)

* A new workspace model, enabled per organization, keeps one cloud machine per
  person and repository instead of building a fresh one for every session. It
  sleeps when idle and wakes in well under a second, so starting a new session on
  a repository you already use skips the clone and setup entirely. Each session
  still runs in its own isolated checkout inside that machine. Off by default
  while it is validated on a dedicated org.

## August 9, 2026: The sidebar's hover highlight stays where your pointer is

* The sidebar session list refreshes its relative timestamps ("3 minutes ago")
  every second, and that refresh could snap the row-hover highlight back to
  your open session if you rested on another row for more than about a
  second. The row itself and its preview still tracked the mouse correctly,
  but the highlight visibly jumped, making hover feel broken on a slow,
  deliberate pass down the list.
* The highlight now stays under the pointer regardless of how often the list
  around it re-renders.

## August 8, 2026: The agent can see which machines and repositories you have connected

* A session can now ask what machines you have paired with Ara, and gets back
  each one's name, operating system and hardware, whether it is reachable right
  now, which folders you granted it, and what that machine is able to do. This
  is how the agent learns it has a choice at all, rather than assuming there is
  only the workspace it happens to be running in.
* It is read-only, and it changes nothing about where work happens: a session
  still runs entirely in its own workspace, and the agent still cannot reach
  another machine. Filesystem paths are never included, and only your own
  machines are ever listed.
* A session can also now list the repositories connected to the workspace, which
  are the ones Ara can act on. Previously an agent could work in a repository
  without being able to check which others existed, so it had to guess at names
  it had only seen written down. It reads the workspace's own connection list
  rather than asking GitHub, so it stays fast and costs no API quota.

## August 8, 2026: A finished subagent's report reads as a system notification

* When a subagent finished, its report arrived on the transcript as a bare grey
  box in the browser's default control styling, which read as a rendering fault
  rather than a message.
* It now takes the shape of the message it sits beside: the same bubble and
  right-hand alignment as your own messages, captioned **System Notification**
  and marked with the subagent's own pointer instead of your avatar, so it is
  clear a subagent wrote it and not you.
* The full report is still one click away. Hovering the notification reveals a
  toggle that expands the raw text, and a copy button.

## August 8, 2026: Merge Bot gets its own page

* Merge Bot is a decision pipeline, not a prompt-shaped automation, and its
  page now says so: it opens with a four-step "How it decides" walkthrough
  (change opened, signals settle, risk report and gates, merge or hold), puts
  the merge policy front and center, and folds the assessment prompt behind a
  toggle instead of leading with it.
* The repository list on the page grows with its content instead of scrolling
  inside a small box, which also fixes the page trapping the mouse wheel and
  refusing to scroll to the bottom.
* The always-on safeguards (human vetoes, the contributor guard, fail-closed
  behavior) have their own section, separate from the configurable policy.

## August 8, 2026: Configure Merge Bot's policy from the automation page

* The built-in Merge Bot page gains a Merge policy card: risk tolerance
  (zero to high), the required gates (passing checks, Ara verification,
  Ara-authored only, no blocking findings, human approval for protected
  paths), a maximum change size, branch cleanup, an editable protected-paths
  list, and the merge guidelines the risk assessment reads as trusted
  repository configuration.
* The policy applies to every repository Merge Bot is enabled for. When
  repositories currently disagree on a value, the control shows a Mixed badge
  and the next change aligns them.
* Members see the policy read-only; changing it stays owner/admin only, and
  the page now also explains what the bot does at run time.

## August 8, 2026: Merge Bot's risk assessment is back online

* The merge-risk assessment runs again, now on Ara's own inference lane with a
  short-lived, run-bound grant (the same mechanism that powers PR reviews).
  Since the earlier model retirement every audit had been forced to a
  conservative HIGH-risk hold; unattended merging works again for repositories
  that enabled it.
* The assessment always uses Ara's platform model, never a workspace's own
  BYOK or subscription credentials, and every failure mode (no lane, denied
  grant, unparseable output) still fails closed to a hold with a visible
  failed execution in the Automations activity feed.

## August 8, 2026: Merge Bot gains protected paths, a size limit, and branch cleanup

* The migration gate is now a configurable protected-paths list
  (`auto_merge_protected_paths`, newline-separated globs, case-insensitive,
  rename sources included). Any change touching a matching path requires a
  standing human approval before an unattended merge. The default list keeps
  covering database migration directories, so existing behavior is unchanged.
* A new size limit (`auto_merge_max_changed_lines`) holds any pull request
  whose total changed lines exceed it. 0, the default, disables the limit.
* `auto_merge_delete_branch` deletes the source branch after an unattended
  merge. Fork branches and branches that other open pull requests target are
  never deleted. On GitLab the branch is removed atomically with the merge.
* The changed-file list is now treated as merge-critical evidence: a failed
  read retries, and a provider-truncated list counts as touching protected
  paths instead of silently passing.
* All three knobs are settable per repository via the admin CLI and the
  guardrails API today; workspace settings UI ships separately.

## August 8, 2026: Merge Bot honors human vetoes and demands real CI evidence

* A standing human "request changes" review now always holds the pull request,
  no matter what the risk assessment or the repository's merge settings say. A
  later approval or a dismissed review lifts the hold.
* Adding a `do-not-merge` label (also `dnm`, `no-merge`, `dont-merge`,
  `hold-merge`, or any `do-not-merge/...` scoped label, in any casing) vetoes
  unattended merging. Remove the label and push a new commit, or merge manually.
* A repository with no CI checks at all no longer counts as "green". Merge Bot
  waits up to 45 minutes for a first check to register, then holds with a clear
  reason. Repositories that genuinely run no CI can disable the green-CI
  requirement for the repo to keep unattended merges.
* Immediately before merging, Merge Bot now re-reads the pull request and its
  reviews. A head that moved during the assessment aborts the merge (the new
  commit is assessed fresh), and a veto that arrived mid-assessment is honored.

## August 9, 2026: Review is two surfaces, and the conversation is one of them

* Review used to spread a change across four tabs. It now has two: **Overview**
  is the conversation - demos, description, and the discussion thread - and
  **Code** is the file diff together with the commits that produced it. Sections
  with nothing in them collapse instead of showing a placeholder.
* The discussion composer is always open at the bottom of Overview, so leaving a
  comment no longer starts with finding a button. **Reply** on any comment aims
  the composer at that person, and the reply posts with that attribution.
* Checks collapsed from a status card into a single dot beside the merge button.
  Hovering it lists every check, and each one can be copied or opened on GitHub.

## August 8, 2026: Session headers lead with the session, not the repository

* A session header used to read `owner/repo / Session title`. A session can span
  several repositories, or none at all, so leading with one repository described
  it inaccurately. The header now shows only the session title.
* The same repository line is gone from the session preview opened from the
  sessions list. Repository context is still available on the session itself.

## August 9, 2026: Sessions get their hands sooner

* The machinery that lets the agent run commands used to be set up strictly
  after the workspace was cloned, adding a fixed delay to every session start.
  The half of it that does not need the repository (installing and enrolling the
  in-machine worker) now runs while the clone is still in progress, so the
  agent's first command is available seconds earlier on every cold session.

## August 9, 2026: Concurrent canary sessions keep their workspace work isolated

* Persistent-workspace canaries now assign every session its own worktree,
  public pull-request branch, and development port even when several sessions
  share one machine. A session releases only the port and processes it owns.
* Long quiet commands keep their command channel alive, so a build or server
  probe running past a network idle window does not reconnect halfway through.
* Bash calls also tolerate bounded wrapper hints produced by supported models;
  execution limits remain product-owned, while unknown fields still fail
  closed.

## August 8, 2026: A session picks its tools up the moment its workspace is ready

* An agent that started before its workspace was ready did not get the ability
  to run commands back until its next message, even though the workspace often
  arrived seconds into the first one. For the rest of that answer it had no way
  to run anything, so it reported the task as impossible instead of doing it.
  The workspace's tools now reach the answer already in progress.
* The agent is also told, in the moment, that its workspace is ready, so it
  stops working from an earlier conclusion that it had no way to run commands.

## August 8, 2026: Session machines sleep the moment your run ends

* A session's cloud machine now suspends as soon as its run finishes, instead of
  being held awake by background helpers (the preview supervisor, the terminal
  bridge, the recording and browser processes). Only the run's own worker keeps
  the machine active, and it is bounded by the run's time budget, so a machine
  can no longer stay hot after the work is done.
* Nothing you see changes: previews, the terminal, and the file browser wake the
  machine transparently on the next request (well under a second), and
  long-lived helpers survive the sleep and resume where they left off.
* Follow-up: the process that carries a live run's commands now also counts as
  "the run is active", so a machine can never doze off in the middle of a long
  model turn; it still sleeps the moment the run actually ends.
* The platform now audits the whole machine fleet every few minutes and flags
  any machine that is awake with no session using it, so a machine that fails
  to fall asleep is caught by monitoring instead of by a bill.

## August 8, 2026: The model picker keeps up with the pointer

* Moving between providers in the model picker used to leave the previous
  provider's models on screen for a moment before the new ones appeared. The
  options panel now swaps as soon as you move, so the list always matches the
  provider you are pointing at.
* The provider list scrolls under the **Settings** link rather than pushing it
  off the panel, so the route to Models & credentials stays in place however
  many providers a workspace connects.

## August 8, 2026: A roomier model picker, and a branch that stays under the composer

* The model picker is wider, drops the rule under its search field, shows each
  model's provider logo beside the model name (not just on the provider row),
  and ends with a **Settings** link for connecting more providers.
* The branch under the composer no longer hangs past the left edge of the input
  on a long branch name. It now truncates instead, so the device and context
  ring stay put.

## August 8, 2026: Branch and device act like the controls they are, and providers show their logos

* Under the composer, the branch and the execution target now read as pills with
  the same hover and focus treatment as the model and thinking selects beside
  them, instead of looking like plain text. Clicking the branch still copies it;
  clicking the execution target still moves the session to another workspace.
* The model picker's provider list now shows each provider's logo in front of
  its name, the same marks the Providers settings card uses.

## August 8, 2026: See when a session's model, provider, or thinking level changes

* Changing the model partway through a session used to be invisible: later turns
  looked identical to earlier ones even though they ran on different settings.
  The transcript now marks the switch inline, between the turns it separates, with
  a note such as **Model changed from GPT-5.6 Sol to GPT-5.6 Terra**. The same note
  appears when the provider changes or when the thinking level changes, so it is
  clear which settings produced which answer when you look back at a session.
  This holds for a switch made between turns, which starts a new run behind the
  scenes: the note still appears above the first turn that used the new setting.
  Model names in the note match the model picker exactly, so a switch to GPT-5.5
  reads as **GPT-5.5** rather than splitting the version off the family name.

## August 8, 2026: The agent says something before it starts working

* On a new session the agent now answers you first and picks up its tools on the
  next step, instead of running a planning step before it has said anything. That
  planning step was costing about seven seconds of silence on a typical first
  message, and nothing was on screen until it finished.
* Sessions whose workspace is already warm are unaffected: the agent has its full
  toolset from the first message, as before.

## August 8, 2026: The branch and execution target are visible again under the composer

* The row beneath the message box lists the session's branch, where it runs
  (Cloud or a connected device) and how much of the context window is spent.
  The branch and execution target were being painted over by the composer's own
  backdrop, leaving that part of the row blank. They now render again.

## August 8, 2026: A session no longer claims it cannot do something while its workspace is still starting

* A workspace takes several seconds to come up, and a command run in that window
  did not execute. The agent now retries once the workspace lands instead of
  reporting the capability as unavailable, so a question like "what time is it in
  India" gets a real answer rather than an apology.

## August 8, 2026: Subagents wait for their workspace before answering

* A subagent could finish before its workspace finished starting and report
  that it had no way to run commands. Subagents now start with their full tool
  set and wait for the workspace instead of answering without it.

## August 8, 2026: Subagents start correctly in enabled workspaces

* Delegating to subagents failed immediately in every workspace where it was
  turned on. The lookup that enforces how many subagents may run at once was
  querying a table that does not exist, so the request errored before any
  subagent started. Delegation now works, and the same fix covers cancelling a
  parent's subagents when the parent stops.

## August 8, 2026: See what a compacted session's follow-ups will inherit

* When a finished session has been compacted, the session's **···** menu now shows a **Context summary** section with the summary your next follow-up will start from (plus a short tail of the most recent turn), and when it was generated. Long summaries are collapsed by default with a **Show full summary** toggle.

## August 8, 2026: Skills & Plugins now stays compact while you browse

* **Skills & Plugins** puts connected tools in an open **Installed** section
  before the plugin catalog, then groups every remaining plugin category into
  the same spring-open sections used across Ara settings. Open the group you
  need and the previous one folds away; the scope choice and search continue to
  apply. Plugin rows keep their generous click target, but hover now stays on
  their controls and icon instead of tinting the entire row. The two-option
  scope choice uses the same segmented control as Automations.
* Skills remain their own sibling catalog section, without the old collection
  cards or visual divider system.
* Added skills now sit with connected plugins in the open **Installed**
  section, using the same compact icon grid and name-on-hover treatment. The
  old skills.sh collection browser has been removed; searching now shows public
  skill results directly in the same responsive two-column rows as plugins.
* The Installed skills strip stays to one compact row; its **+N** tile expands
  the remaining skill icons inline.
* While searching **Skills & Plugins**, every top-level section with a match
  opens together; sections without a match stay folded.
* The page now uses the same high workspace header as **Automations**: compact
  search and activity controls live beside the scope and type pills, and
  repository-authored skills appear in the workspace catalog instead of behind
  a repository filter. **Skills & Plugins activity** records actual skill reads
  and connected plugin tool calls, linking back to the session without showing
  tool arguments or results.
* Two-option choices on **Automations** and **Skills & Plugins** now use the
  rounded-square segmented control.
* Opening a skill now uses Ara's normal session-style Files sidepanel: the
  selected `SKILL.md` is a closable file tab instead of a separate properties
  view. Curated MCP setup pages now use the same spring-open sections for
  connection, credentials, endpoint, and skills; connection actions use the
  shared status badge, switch, and pill buttons.
* Organization-authored skills now carry the workspace avatar (or its initial
  fallback) in the Skills grid. Ara-provided skills carry a small neutral Ara
  source mark. Their `SKILL.md` file panel includes copy-reference, copy-path,
  and direct Pierre editing actions while the normal view remains rendered Markdown.
* Organization memory files now use that same rendered Markdown viewer and
  direct editor instead of a separate raw-text textarea.

## August 8, 2026: Images and videos the agent touches now appear in chat automatically

* When a command the agent runs saves or references an image or video in its
  workspace, that file now appears inline in the session chat automatically,
  the same way a file you attach yourself renders. There is nothing to ask
  for: a screenshot taken, a chart generated, a diagram written to disk all
  surface the moment the agent's command output points at them.
* This is a repair, not a new feature: it restores behavior that was live
  before the runtime change in early August and had gone quiet since.

## August 8, 2026: The agent replies first when its sandbox is still starting

* While a repository is still being cloned, the agent is no longer offered the
  commands it cannot yet run. It answers you with what it knows, and the
  commands become available the moment the sandbox is ready. Previously it
  reached for a command, was told the sandbox was still starting, and tried
  again, so nothing appeared on screen until the setup had finished.
* Sessions whose sandbox is already warm, including most follow-up messages, are
  unchanged: the commands are there from the first message as before.

## August 8, 2026: Cleaner results from self-verifying sessions

* Sessions that run the experimental self-verification loop no longer show the
  loop's internal completion marker at the end of the final answer or the
  session summary. The marker is coordination between the agent and its
  verifier, not part of the result.
* No change for ordinary sessions.

## August 8, 2026: Ephemeral preview environments can run full agent sessions

* A cloned preview deployment of the platform (an environment named
  `preview-*`) now routes model-inference grant redemption to its own API
  origin instead of the shared production endpoint, so agent chats in a
  preview environment complete end to end against that environment's own
  isolated database. Production and staging routing are unchanged, and a
  preview origin is only ever the deployment's own platform-provided domain.

## August 8, 2026: The queue only appears when messages are actually stacking

* A message sent while the agent is working now goes straight to the agent when
  nothing else is waiting, and appears in the conversation like any other
  message. The queue was holding every mid-run message, so a single reply sat
  above the message box with Steer and remove controls around it, waiting for a
  step to finish, before dropping into the chat seconds later.
* The queue still does its job the moment it has one: send a second message
  while the first is still on its way and it waits, in order, one per finished
  step. Steer still jumps a waiting message to the front, and removing one
  before the agent reaches it still takes it out entirely.
* Releasing, cancelling, or reordering a queued message now updates every open
  view of the session immediately. Those changes were previously only recorded,
  so a browser could keep showing a message as queued after it had already gone
  to the agent.

## August 8, 2026: The sidebar follows the page you opened

* Opening a saved session keeps that session selected in the sidebar. Moving
  back to **New Task** or to a top-level page such as **Repositories** or
  **Automations** transfers the shared highlight to that destination instead.
* The previous resting highlight can no longer remain on **New Task** after you
  open a session, so the sidebar now always reflects the page currently open.

## August 8, 2026: `/compact` always works, including on finished sessions

* Compacting a session no longer requires a live run. On a finished session, `/compact` now summarizes the whole conversation in the background, and your next follow-up starts from that summary instead of only the tail of the last turn. Triggering it again when nothing new has happened answers "already compact" instead of showing a red error card.
* The toast reports what actually happened - requested for the next model step, queued for a run that has not started, running in the background, already compact, or out of credit - instead of announcing "Context compacted" before anything had run.
* A compaction request made while a run was starting up used to be silently dropped after the toast said it was accepted; it now applies at the run's first opportunity, and a request that arrives just as a run finishes says so in the transcript instead of vanishing.
* The transcript now shows a "Context compaction" row while a summary is being generated and when it completes.
* On workspaces that bring their own model keys, Ara never starts model calls on your credentials: `/compact` on a finished session answers "already compact" there, and follow-ups still start from a compact summary of the prior turn.

## August 8, 2026: Compact context from the composer's slash menu

* The session composer's `/` menu now lists **Compact context** as a dedicated entry beside your skills. Picking it summarizes the older part of the conversation to free up context, exactly like typing `/compact`, and the entry only appears while the session has a live run that can be compacted.

## August 8, 2026: Sessions can move between a cloud workspace and your Mac again

* The "Continue on" picker in a session works again. Choosing a new location used to fail with a raw `harness1_target_handoff_required` error for every session; picking a fresh cloud workspace or one of your paired devices now continues the session there. The moved session keeps its conversation context, model settings, and pull request, starts from the session's branch, and the picker's promise holds: a cloud move lands in a genuinely fresh sandbox, never a reused one. Only pushed work travels; the original session is stopped once the new one is safely queued.

## August 8, 2026: Workspace controls now follow one interaction system

* Settings, Automations, Templates, analytics, the command palette, Ara API,
  and Review now use the same compact animated controls: two-option mode
  choices use a segmented squircle; peer views and filters use a pill tab
  group with one moving active surface. The Review's **Overview**,
  **Discussion**, and **Commits** group sits in the Review header, above the
  divider that separates it from the checks and changed files.
* Settings and automation lists share one resting hover/selection surface
  across grouped rows. Repository and automation configuration now use the
  same spring-open sections, while non-expandable groups use the matching
  quiet rounded surface rather than a one-off card treatment.
* Choosing a model and thinking level when starting a task is now two explicit
  controls below the message box. Trigger selection follows the same nested
  source-to-event menu pattern, so dependent options appear beside the choice
  that revealed them.
* The model control now picks a **provider** first and then its available
  model, so connected providers can grow without turning the composer into one
  flat mixed list. Opening it starts with the provider categories; the model
  panel unfolds only after you choose or focus a provider. If a saved provider
  model becomes unavailable, it stays visibly named as the current selection
  until you choose a replacement rather than being represented as a different
  Ara model. In an existing session, its
  branch and where it is running remain visible on the left below the composer
  while the model controls stay on the right.
* Opening a repository or an automation now uses the same compact navigator as
  a session: its source, a `/`, and the item title sit in the top rail. The
  existing edit, run, save, and more actions remain exactly where they were.
* The redundant session-summary icon has been removed from the session rail;
  the session menu and panel control remain available there.
* The composer summary pill now groups plan progress, changed files, and active
  subagents in one row, with `|` dividers and an independent action for each
  segment. Its active-agent segment opens the full subagent list rather than
  choosing one worker arbitrarily.

## August 8, 2026: The agent can ask for a missing plugin or secret right in the chat

* When the agent hits a service it cannot reach (an unconnected plugin, or a
  missing API key), it can now surface an inline card in the session chat:
  **Connect** adds a plugin with one-click OAuth, and **Add secret** takes the
  value without it ever appearing in the conversation. This restores a
  capability that had been dark since the runtime cutover in early August.
* The cards never block the run. The agent keeps working on what it can, a
  saved secret is injected into the live sandbox for the agent's next turn, and
  a newly connected plugin takes effect on the next session.
* A secret the agent asks for also appears immediately as a to-fill row in the
  repository's Environment tab, so you can add it from there instead if you
  prefer.

## August 8, 2026: Bring your own model server as a provider

* **Settings -> Models** gains a **Custom endpoint** provider: point it at any
  OpenAI-compatible server you host yourself (vLLM, SGLang, Ollama behind a
  proxy, a LiteLLM gateway) with a base URL and an API key, and its models
  appear in the session composer's model picker alongside the other providers
  you have connected.
* On connect, Ara asks the server for its model list automatically; if your
  server does not expose one, list the model IDs yourself in the form. The wire
  format defaults to OpenAI Chat Completions, with OpenAI Responses and
  Anthropic Messages available for servers that speak those instead.
* Runs on these models call your server directly and are billed by nobody: like
  other connected providers, usage happens on your own infrastructure and never
  spends Ara credits. The base URL must be a public https address; keys are
  stored encrypted and are never shown back.

## August 8, 2026: Queued messages start their turn the moment the agent answers

* A queued message now begins its turn immediately when the agent finishes the
  previous one, in the same live session. Before, the message released from the
  queue could miss the closing run and restart the agent from scratch, which
  showed up as the message sitting in the queue for several seconds before it
  entered the chat.
* The session now also waits for a message that is mid-delivery before wrapping
  up, so a reply sent in the instant the agent finishes is picked up live
  instead of restarting it.

## August 8, 2026: Mid-run messages queue up and go in one per finished step

* Sending a message while the agent is working now adds it to a queue instead of interrupting the current step. The agent finishes what it is doing, and Ara hands it exactly one queued message each time it settles a step, so a burst of thoughts arrives as a sequence of clean instructions rather than all at once mid-task. Previously every mid-run message was injected at the next turn boundary regardless of what else was waiting.
* The queue sits above the message box, and each entry can be reordered by dragging, edited (which returns it to the message box), or removed before the agent ever sees it.
* **Steer** on a queued message is the override: it skips the queue and goes into the agent's very next turn boundary, the way every mid-run message behaved before.
* The queue now lives with the session rather than in your browser, so queued messages survive a reload, are visible to everyone watching the session, and are never lost if you close the tab. If the run finishes while messages are still queued, they start a continuation run instead of being dropped.

## August 8, 2026: More credential types are masked in what an agent writes out

* Pull request titles, issue titles, and issue comments written by an agent are
  checked for the run's own secret values before they leave for GitHub or GitLab.
  That check now also covers connector credentials and workspace MCP server
  secrets, not just the secrets you set under Secrets and Environment.
* Redaction is also more resilient: if one source cannot be read, the others are
  still masked, where previously a single failure fell back to pattern matching
  alone.

## August 8, 2026: Agents answer without waiting for their sandbox

* An agent now replies as soon as it has something to say, whether or not its
  sandbox has finished starting. Previously, if the agent reached for a command
  before the sandbox was ready, the whole reply waited behind repository cloning
  and toolchain setup, so a question that needed no commands at all could sit
  silent for a minute.
* If the agent does run a command before the sandbox exists, it now waits a
  couple of seconds and is then told the sandbox is still starting, rather than
  blocking indefinitely. Nothing is executed and nothing changes on disk, so the
  agent answers with what it knows and picks the command back up once the
  sandbox is there.

## August 8, 2026: The same secret name can differ per workspace

* If you belong to several workspaces you can now save a secret under the same
  name in each one, holding a different value per workspace. Until now the name
  had to be unique across your whole account, which was the last piece of making
  personal secrets workspace-scoped.
* Nothing changes for a single workspace, and no existing secret is affected.

## August 8, 2026: Screenshot and recording links serve verified media only

* Images and recordings attached to a pull request by an agent are now checked in
  full before Ara serves them, and Ara serves the checked bytes rather than
  redirecting to the stored file. Previously only the first few bytes were
  inspected, which was not enough to tell a real screenshot from another kind of
  file wearing an image header.
* Comment and metadata segments are removed from what gets served. Those sections
  exist to hold arbitrary text, so a picture can look perfectly valid and still
  carry something in them. Real captures are unaffected apart from the encoder's
  own padding.
* Anything that does not parse as a complete image or video is not served at all.
  A capture that failed to upload cleanly now returns not-found instead of a
  broken file.

## August 8, 2026: Credit held for a model request that failed is always given back

* When a model request failed before the provider reported anything about it, the credit reserved for that request could stay held indefinitely: the workspace's available credit was lower than its balance implied, and nothing was ever charged for the failed request. Those holds are now released within minutes of the failure, and a failed request that can never be priced is never billed. The holds that had already been stranded before this change have been returned as well.

## August 8, 2026: Your personal secrets belong to one workspace

* A secret you save under **Secrets** is now scoped to the workspace you saved it
  in. Previously a personal secret was attached to your account, so if you belonged
  to more than one workspace it was injected into every run you started in **any**
  of them.
* If you work in a single workspace nothing changes: the same secrets, in the same
  place, behaving the same way.
* If you belong to several workspaces, each one now keeps its own set. You can hold
  a different value under the same name per workspace, and adding or removing one no
  longer affects the others. Existing secrets were moved to their owner's workspace,
  so nothing was lost.
* Every other kind of secret in Ara (project secrets, connectors, MCP servers, API
  keys) was already scoped this way; personal secrets were the exception.

## August 7, 2026: The command palette opens instantly, and dragging stays smooth

* Opening the command palette with <kbd>Cmd/Ctrl</kbd>+<kbd>K</kbd> no longer plays an entrance animation. The palette is there on the next frame, so typing immediately can never race the surface sliding in; only the backdrop still fades so the page behind it does not hard-cut.
* Swiping the mobile sidebar open, and sweeping the pointer down a list of sessions, automations, repositories, or settings entries, now stay smooth under load. Both used to move their highlight and their drawer by changing layout on every frame of the gesture.
* On touch devices, cards and buttons that lift when a mouse hovers no longer stay stuck in the lifted state after a tap. Their color, border, and shadow feedback is unchanged, on touch and with a mouse alike.
* The pointer and highlight the agent draws while it works in a browser no longer force the page it is working in to relayout as they move between elements.

## August 7, 2026: Scheduled automation runs start again

* A run started by a schedule failed a couple of seconds after it began, without doing any work, and its history showed a billing error even though the workspace had credit and minutes available. Only scheduled runs were affected; runs you started yourself, and runs triggered from GitHub, were not. Scheduled runs now start normally, and no billed minutes were consumed by the failed attempts.

## August 7, 2026: `/compact` now compacts short conversations, and says so when there is nothing to compact

* Typing `/compact` in a session summarized earlier history only once the conversation had grown past the automatic keep-recent budget; below that it silently did nothing. A manual request now summarizes the older half of the conversation and keeps the recent half, so it does visible work at any length.
* When a request genuinely has nothing to fold, or the summary could not be produced, the session says so in the transcript instead of leaving you guessing.

## August 7, 2026: Secrets are masked in run error messages, and API-key expiry fails loudly

* When a run fails, the error shown on the session, sent in notifications, and carried
  into the next turn is now redacted before it is stored. A failed `git clone` used to
  be able to surface the credentialed URL Ara clones with; that value is masked now.
  Ordinary failures are unchanged and stay fully readable.
* Redaction also recognizes Ara's own credential formats (Ara API keys, per-run agent
  tokens) and GitHub fine-grained and GitLab tokens, so those are masked anywhere Ara
  shows agent output.
* Creating an API key with an unsupported expiry now returns a clear error instead of
  quietly creating a key that **never expires**. The supported values are unchanged --
  never, 30 days, 90 days, and 1 year -- so the picker in Settings behaves exactly as
  before; this only affects scripted calls that passed some other number.

## August 7, 2026: Follow-up messages start much faster

* Replying to a session no longer rebuilds the workspace from scratch. When the previous turn's sandbox is still warm, the follow-up reattaches to it and reuses the repository that is already checked out, instead of provisioning a new machine and re-cloning. On a large repository that removes the great majority of the wait before the agent starts working, and the saving grows with repository size.
* A follow-up only reuses a workspace belonging to the same repository, and only after confirming the checkout is intact. Anything else falls back to the ordinary fresh setup, which behaves exactly as before.
* The speed-up holds for the whole conversation, not just the first reply. A warm workspace is now held from the most recent turn that used it, so a long back-and-forth keeps reusing it instead of losing it partway through and rebuilding.
* Separately, an internal network self-check that ran before every session now runs alongside the setup work instead of ahead of it, removing a few seconds of waiting from every session start, including the first one.

## August 7, 2026: Opening a session puts the caret in the message box

* Opening a session now focuses its message box immediately, so you can start typing your next instruction without clicking into it first. The sessions list already behaved this way; the session page now matches. Session previews and embedded thumbnails still leave focus where it is.

## August 7, 2026: Fixing a failed payment is now one click, from the email or the banner

* The "Update payment method" link in a failed-payment email, and the same action in the paused-workspace banner, now open Stripe's payment-method flow directly instead of leaving you on the billing settings page to find it. If the workspace is signed out, you sign in first and then land in the same flow.
* Re-buying the package a workspace already sits on no longer reports a portal error before it succeeds. The purchase behaved correctly either way; only the reporting was wrong.
* Trial card verification no longer fails on a card whose bank asks for extra confirmation. Verification could not complete for those cards at all, and the trial now proceeds as it does whenever verification cannot reach a verdict.

## August 7, 2026: Motion polish across lists, tabs, settings, and async buttons

* Hovering a list now moves one shared highlight that glides between rows instead of each row lighting up on its own. This applies to the session list in the sidebar, the built-in and custom automation lists, the repository list under Codebase, the settings navigation, and every dropdown/picker menu built on the shared select.
* Tab strips (execution history, codebase sections, dashboard activity, the Ara CLI setup targets) animate one indicator between tabs rather than switching instantly.
* Async actions give live feedback: Connect/Save on MCP server setup, Create automation, and the billing spend-limit Save now show a spinner while working and morph back when done, instead of appearing to do nothing.
* The team spend-limit dialog on Billing smoothly resizes between limit types instead of jumping.
* Audit Log groups each month into a rounded, spring-animated collapsible section; the newest month starts open.
* Personal Preferences now groups collapsed sections into quiet rounded surfaces; opening one setting separates it with the same spring motion, without changing any existing controls.
* Counters (execution history stats), status badges, checkboxes (API key scopes), and toggles (MCP enable, memory enable) animate their state changes. All motion respects the reduced-motion system preference.

## August 7, 2026: Ara subscription inference now runs on a single provider gateway

* Every model in your Ara subscription is now served through one inference gateway instead of two. The selectable models, their context and output limits, your published per-model prices, and workspace credit behavior are unchanged.
* Your charge is still computed from Ara's published price for the model you picked, independently of what the gateway costs Ara. A request that cannot produce authoritative evidence of what it served holds its exposure and reconciles rather than creating a guessed charge.
* A request stays bound to one route and one price for its whole lifetime, and models are withdrawn or restored one at a time, so an operational change never affects a generation already in flight.
* This lane covers subscription usage only; supplying your own provider API keys is not part of it.

## August 7, 2026: Tool activity shows the real command that ran, and memory search results are now clickable

* A repl or bash tool call's activity row now always shows the real, verbatim command or code that ran, as its own line — immediately once the call starts, not only once it finishes. Previously, some calls (particularly file search and Ara capability calls like memory or skills) either paraphrased this into a generic label or, for a narrow but real class of calls, showed the raw JSON payload the tool actually received instead of the code itself.
* That command line now reads at full text strength, while its result stays at the activity pane's normal muted tone — the same contrast a terminal keeps between a live command and dimmed scrollback.
* A completed call's Success or Failed badge now shows next to the pane's header for every kind that has one, not only shell commands.
* `ara.memory.search` results render as a real list of matches (title and snippet) instead of raw JSON, and each match links directly to that file on the organization's Memory settings page.

## August 7, 2026: The provider list is now visible on Model settings

* Model settings now shows the providers Ara's agent runtime can authenticate, under Ara's own row. Providers are grouped by whether you would connect them with an existing subscription or with an API key.
* Connecting your own provider is still not available, so the entries are shown but not selectable and the reason is stated inline. No credential is requested or stored, and nothing about billing or model selection changes.

## August 7, 2026: A session no longer fails because its own title was being generated

* A new session names itself with a short model call while the environment starts. That call shared the session's single model channel with the agent's first reply, so the two could collide and the whole session failed immediately with a message about a reached AI usage budget — even on workspaces with their full budget available.
* The naming call now yields the channel on a deadline, and a first reply that arrives during naming waits its turn instead of failing.
* If a collision ever does surface, the session now says the model channel was briefly busy and to retry, instead of pointing at a budget that was never involved.

## August 7, 2026: Short model answers no longer fail on the second inference route

* A request with a small output budget, such as the one that names a new session, asked for reasoning it could never fit and failed outright on the newly staged route. Those requests now run without extended thinking instead of failing, so session titles and other short answers come back as expected.

## August 7, 2026: Model settings show which providers Ara's runtime can talk to

* The Providers card under Model settings now lists the providers Ara's agent runtime can authenticate, grouped by whether you would connect them with an existing subscription or with an API key. The list comes from the runtime itself, so it stays accurate as the runtime adds providers.
* Ara stays first in that list and is included with your workspace, exactly as before. Nothing about how your sessions are billed or which models you can pick has changed.
* Connecting your own provider is not available yet. The list is there so you can see what is coming; no credential is requested or stored.

## August 7, 2026: Memory, skill, and plugin activity icons now cover the raw tool-call path too

* A memory, skill, or plugin call now shows its dedicated icon in session activity even when the model reaches it through the generic tool-call bridge (`ara_memory_manage`, `ara_skill_manage`, `ara_plugin_call`, `ara_plugin_tools`, `ara_plugin_list`) instead of the shortcut method. Previously only the shortcut form got the specific icon; the raw form fell back to a generic badge.

## August 7, 2026: MCP servers and merge guardrails are owner/admin settings

* Installing, editing, connecting, or removing a workspace **MCP server** now
  requires the owner or admin role. An MCP server is workspace-wide execution
  config: it runs inside every agent run in the workspace, including runs other
  people start. Members still see the installed list and the marketplace, and
  the controls now say so instead of failing when used.
* Changing a repository's **Merge Bot guardrails** — enabling auto-merge and its
  "CI green", "Ara verify", and "no blocking findings" requirements — likewise
  requires owner or admin. These decide whether agent-authored pull requests can
  reach your default branch unreviewed.
* Both settings were already owner/admin-only through the public API; the web
  app now matches. Nothing changes for owners and admins.

## August 7, 2026: Sessions are named by the agent, and session actions moved onto the title

* A new session is now named by a short call to the same harness that runs it, so the title describes what you asked for instead of repeating the first line of your message. Naming happens while the environment is still starting, so it never delays the first reply, and an unusable answer falls back to the previous behavior. Renaming a session yourself always wins, and follow-up turns never re-name a session you already named.
* The session header now leads with that title, and the ⋯ menu sits beside it rather than off in the top-right controls.
* That menu gains **Send feedback**, **Copy session ID**, **Archive**, and **Delete** alongside **Rename**, and still shows the session's model usage and runtime. Delete asks for confirmation and cannot be undone.
* Workspaces that paused title generation under **Automations** are unaffected: their sessions keep the name derived from your message.

## August 7, 2026: A second inference route can be staged behind the same spend controls

* Ara's inference plane can now hold more than one aggregation route per model. A route is staged disabled, enabled per model by an operator, and disabled again to roll back; the enabled route keeps serving in the meantime. Model choice, pricing, and workspace credit behavior are unchanged.
* A request is bound to one route for its whole lifetime, so a route change never affects a generation already in flight.
* Whichever route serves a request, the customer charge is still computed from Ara's published model price. A route that cannot produce authoritative evidence of what it served holds its exposure and reconciles instead of creating a guessed charge.

## August 7, 2026: Replies are plain prose, and quoted or tabular text is never rendered faded

* Ara's replies no longer use markdown tables or emoji. Content that used to land in a table now reads as plain prose with inline references and hyperlinks instead.
* Text inside a blockquote or a markdown table (for older messages, or content a connected tool returns) no longer renders in a dimmed secondary color — it matches the same text color as the rest of the answer.

## August 7, 2026: Reasoning reads at full strength and can show its own headline

* Reasoning text in the live work history no longer renders at a dimmed, secondary text color once expanded — it now matches the full-strength text tool rows already use when opened, and its left indent (which did not align with any icon) is removed.
* When a model's reasoning arrives as a short headline followed by a detailed paragraph, Ara now shows that headline as the row's label instead of the generic word "Thinking". Reasoning that has no distinct headline keeps the previous "Thinking" label.

## August 7, 2026: Organization memory adds AGENTS.md and SOUL.md, and session activity shows real icons for memory, skill, and plugin calls

* Organization memory's always-loaded L1 briefings now include `AGENTS.md` and `SOUL.md` alongside `USER.md` and `MEMORY.md` for hard operating rules and persona/tone.
* Session chat activity rows for `ara.memory.*`, `ara.skills.*`, and `ara.plugins.*` calls now show a dedicated icon per capability instead of a generic tool glyph: a memory mark for memory calls, the same skill mark used in the `/` composer menu for skill calls, and the connected plugin's own favicon for plugin calls (falling back to a generic plug mark for unrecognized plugins).

## August 7, 2026: Follow-up messages always get picked up

* Replying to a session whose previous turn had already finished could leave the new message waiting forever, showing a spinner that never resolved. The queue entry those replies create was routed to a retired runtime lane with nothing left to pick it up. That lane is removed, and follow-ups are now claimed by the ordinary session worker like any other work.
* Queue ordering, per-workspace concurrency limits, and change-request serialization are unchanged. Starting a brand new session was never affected.

## August 6, 2026: Security hardening for IP allowlists, label triggers, and webhooks

* An organization's IP allowlist now applies to the web application, not only the public API. Previously a workspace that restricted access to specific IPs was still reachable from any address through the web app; the same allowlist is now enforced on both surfaces.
* Starting an agent run by applying a trigger label to an issue now requires the person who applied the label to have write access to the repository, matching the existing rule for "@ara" mention requests. Someone who can only apply labels (for example a triage role or an outside collaborator) can no longer kick off a run.
* Repeated (replayed) GitHub and Linear webhook deliveries are now detected and ignored, so a captured delivery cannot be replayed to trigger duplicate work.

## August 6, 2026: The unified capability plane is the only MCP surface for sessions

* The legacy connector gateway route is retired after a week of zero usage. Sessions reach Ara capabilities and connected plugins through the single unified endpoint, and the temporary migration shim is removed rather than left dormant.
* No connected integration changes; existing connections keep working through the unified plane.

## August 6, 2026: Complete skill bundles, not just SKILL.md

* On-demand skill fetches now include the whole bundle: companion references, scripts, and assets beside SKILL.md travel with it, each with its own digest and a bundle-level digest over the set. Bundles with unsafe paths, symlinks, or excess files or bytes are refused rather than served partially.

## August 6, 2026: Read-only review runs can call provably read-only plugin tools

* A review run no longer needs write-capable plugin authority for a tool that is provably safe: a call proceeds only when the provider's own negotiated tool annotations mark it read-only AND the tool is named in Ara's curated per-plugin allowlist. Anything unannotated, destructive-marked, or unlisted still requires write authority, and every decision is recorded in telemetry.
* Provider annotations alone never grant access: they are untrusted data until Ara's own policy agrees.

## August 6, 2026: Skill adherence is judged, not assumed

* A run that was offered a skill is now evaluated on whether the agent actually read the skill before doing other tool work. Only a dedicated read operation counts — mentioning the path does not. Delivery, read, and behavior are separate evidence: the run log records which skill files reached the sandbox, which bodies were fetched, and a deterministic oracle judges the ordering on the real trajectory.
* This is verification tooling. Session behavior is unchanged.

## August 6, 2026: Package-bundled skills are readable on demand

* Plugin skills whose bodies ship inside the sandbox image are no longer read-only names in the catalog: when a skill carries a pinned package source, Ara fetches its full instructions on demand through the capability plane, with the same host allowlist and size guards used at image-build time. The response reports where the body came from and whether it was served from the short-lived read cache.
* A skill with no resolvable source still says so plainly instead of pretending to be readable, and a failed fetch returns a typed error rather than a fabricated body.

## August 6, 2026: The agent runtime gains a zero-cost end-to-end proof lane

* Ara's agent runtime can now be exercised end to end, from run claim through sandbox tool execution to the final transcript, against a deterministic scripted model instead of live inference. Deploys of the runtime are verifiable without spending model credits and without depending on provider availability.
* The runtime's sandbox tool layer (shell and browser REPL) is now also proven in continuous integration on every commit, using the exact production code paths rather than stand-ins.
* This release adds test and operator tooling only. The proof lane is disabled by default, has no user-facing controls, and does not change how ordinary sessions run.
* Follow-up: the internal session surface now accepts the proof lane's sentinel model for explicitly allowlisted internal workspaces, so operators can start a proof run at all, and the sentinel survives enqueue-time model resolution instead of silently falling back to the workspace default. The public API and every ordinary workspace continue to reject it.

## August 6, 2026: The Ara plugin now speaks the Agent Plugins standard

* Ara's self-authored plugin now ships a standard root `plugin.json` and `mcp.json` in the vendor-neutral Agent Plugins 1.0.0 layout, so any compatible agent client can discover its skill and connect to Ara's capability plane over Streamable HTTP. Existing supported client installations continue to work through their native manifest.
* A conformance test now validates the package against the published schemas on every change, so the layout cannot silently drift.
* This changes packaging only. No session, connector, or API behavior changes.

## August 6, 2026: One skill catalog across personal, workspace, plugin, and built-in skills

* Ara's skill listing is now a unified, metadata-only catalog spanning your personal skills, workspace skills, plugin-bundled skills, and built-ins. Every entry carries a stable qualified id, its source, a content digest, and its activation keywords, and the full body is fetched on demand by id instead of occupying the prompt.
* Name collisions no longer resolve silently: the catalog reports which entry won and why, and equal-priority ties return explicit choices.
* Skills whose bodies ship inside the sandbox image are now listed with an honest availability state instead of disappearing from view.
* No existing skill management behavior changes; create, update, and delete work exactly as before.

## August 6, 2026: A published security contact for reporting vulnerabilities

* Ara now publishes a security contact at [ara.so/.well-known/security.txt](https://ara.so/.well-known/security.txt), the standard location security researchers check. Reports go to [security@ara.so](mailto:security@ara.so), which is a monitored address. Previously the reporting policy lived only in a private repository, so there was no way for someone outside the company to find out how to reach us.

## August 6, 2026: Connector plugins gain a repeatable acceptance proof

* The new provider-acceptance contract makes a connected plugin prove discovery, returned-schema use, exactly one provider dispatch, duplicate refusal through invocation identity, and matching run evidence before it graduates beyond the current rollout boundary.
* Context7's resolver is the reference fixture. Production proof remains a human-visible session transcript plus exact-run observability; the repository script only prints the contract and runs the deterministic test fixture.
* This release adds test and operator tooling only. It does not change production capability gates or connector behavior.

## August 6, 2026: Repository secret values are owner/admin only

* Viewing, exporting, editing, or removing a repository's stored secret values (the reveal, the ".env" export, and Save/delete on the Environment page) now requires the org owner or admin role. Members still see which secrets are configured (their names), just not the values, and can no longer overwrite a value they cannot see.
* Every reveal and export is now recorded in the organization audit log, so a bulk disclosure of repository credentials is always attributable to one person.

## August 6, 2026: Messages sent mid-run now steer the working agent

* Sending a chat message while the agent is working now delivers it into the live run: the agent picks it up at its next turn boundary, without abandoning the work in progress. The transcript acknowledges the message as queued and then confirms "Steered into the active turn." once the agent has seen it. Previously the composer held mid-run messages locally and they only reached the agent as a fresh follow-up run after the current one finished, which is why follow-ups always felt like cold starts.
* Several messages sent in quick succession are delivered together at the same turn boundary instead of one per turn, so a burst of corrections lands as one update.
* Attachments on a mid-run message now reach the agent too. Files are staged into the run's workspace and the agent is told their exact paths; previously a screenshot pasted mid-run was silently dropped.
* A message that arrives too late to join the current run, or that hits a run being cancelled, is rerouted into a continuation run automatically, and its acknowledgement explains that instead of claiming delivery.
* Holding messages in the composer while the agent works remains available as an opt-in behavior.

## August 6, 2026: Reasoning appears before the first tool call

* Provider-generated reasoning summaries now stream inside the session's live work history as soon as they arrive. Previously Ara kept them behind a plain "Thinking" row until the agent used a tool, which made the same reasoning appear or disappear depending on what the agent did next.
* The live work history stays open while the agent is active and collapses after the turn finishes, alongside its tool calls. Completed reasoning starts collapsed at both the outer work rail and its nested disclosure. Models that do not provide a reasoning summary continue to show the ordinary "Thinking" placeholder until visible work begins.
* Once a reasoning summary is visible, Ara also stops measuring that turn as placeholder-only thinking, including during the brief handoff where the original placeholder can still coexist with streamed reasoning.

## August 6, 2026: Session read-file rows use an open-book icon

* When Ara reads a file during a session, the transcript chip and tool row now use an open-book icon instead of a closed book, so read actions read more clearly as looking something up.

## August 6, 2026: Workspace switching works everywhere and creating a workspace is one step

* The workspace menu's flyout no longer disappears under the page on settings screens. It previously opened clipped to a sliver at the sidebar's edge, leaving the workspace list unusable there; it now pops out over the content on every surface and follows its trigger while the rail scrolls or the window resizes.
* The menu rows are now named for what they do: "Switch workspace" and "Create new workspace", matching the Workspace naming used everywhere else, instead of the old "Switch account" and "Create new account".
* Creating a workspace is a single step: pick a name and optionally invite people. The repository-access step is gone; the new workspace's onboarding offers repository connection right after creation, so nothing is lost by removing the fork.
* The create dialog submits from the keyboard: Cmd+Enter (Ctrl+Enter on Windows and Linux) anywhere in the dialog, or plain Enter from the name field. Enter in the invites box still adds a newline, and confirming text through an input method never creates a workspace.

## August 6, 2026: A failed payment is now visible everywhere in the workspace

* When a workspace's subscription payment fails, every page now shows a banner explaining that cloud agents are paused, with a direct path to update the payment method. Previously the only signals were a message when a run was refused and a single line on the billing settings page, so a workspace could sit paused without anyone understanding why.
* The banner disappears on its own once the updated card's payment goes through.

## August 6, 2026: Inference route failures raise an alert instead of passing quietly

* Ara's model catalog now exposes only the reviewed current model families;
  retired provider choices are removed from new tasks and saved preferences.
* The inference database now rejects direct or operator attempts to re-enable a retired model or one of its routes, while retaining historical prices solely for settlement reconciliation.
* A model route whose gateway credential is missing or unusable now pages Ara's operators. That condition returns an error for every request on the affected model, and until now nothing alerted on it.
* Requests that lose their provider cost report, and grants bound to a route the model registry no longer recognizes, now alert as well, so a settlement gap is caught at the time it happens rather than found later during reconciliation.
* Routes that ship disabled on purpose, ahead of being switched on, no longer register as tripped safety breakers. A real trip stays visible instead of being buried under a permanent alert for an intended state.

## August 6, 2026: Legacy inference cleanup preserves workspace credits

* Ara now records every remaining ambiguous request from the retired inference
  broker in an append-only reconciliation journal before deleting that old
  authority. Those amounts were internal provider-exposure controls, not
  workspace-credit charges, so reconciliation never creates a retroactive debit
  or blanket credit.
* Cleanup runs in small operator-confirmed batches and records only aggregate telemetry. A missing or inconsistent row blocks deletion, while a retry cannot charge or reconcile the same request twice.

## August 6, 2026: Curated model catalog

* GLM 4.7 and Qwen3 Coder are no longer offered in the new-task model picker or Models settings. Existing saved selections fall back to the default Ara model instead of attempting a disabled route.
* Ara now admits only reviewed models through its managed inference service.
  Database guards prevent retired model identities, legacy providers, or
  unapproved routes from being re-enabled, while historical pricing and
  settlement records remain available for reconciliation.

## August 6, 2026: The Browser tab keeps working after a session finishes

* A session's sandbox is now held for a short window after the run ends instead of being torn down within seconds of it, so the Browser (Preview), Terminal and Display tabs still work on what the session just produced. Previously the machine was released almost immediately and those tabs went blank the moment the work finished, which is exactly when there is something to look at.
* The hold applies whether the session succeeded or failed. A run that went wrong is often when you most want to open the preview and see what the dev server is doing.
* It is a short window, not a reservation: the sandbox is still released promptly, and sending another message continues the session as before.

## August 6, 2026: Queued messages match the composer width

* The bar that stacks above the session composer, used for queued messages and run setup, no longer stretches most of the page. It sits a little narrower than the composer it stacks on, as intended.
* Opening or closing the session summary now slides the transcript to and from its side position instead of jumping.

## August 6, 2026: A redirect can no longer downgrade an outbound connection

* Every request Ara makes to a service outside itself — a connected MCP server, an integration, a webhook you configure — now stays encrypted for the whole chain of redirects, not just the address it started from. A server that answers with a redirect to a plain `http://` address, or to an address inside Ara's own network, is refused instead of followed, and credentials are dropped when a redirect crosses to another origin. A chain of more than five redirects is refused as well.
* This changes nothing for a server that redirects within `https`, which is followed as before, and nothing for the built-in MCP catalog.

## August 6, 2026: Session sandboxes are released on schedule

* A sandbox kept for a short while after a session ends, so a follow-up message can pick the workspace back up, is now released on Ara's own schedule. Previously nothing enforced that window and the only limit was the hosting provider's 24 hour cap, so those machines stayed reserved far longer than intended. The workspace still remains available for the same period you could already rely on.
* A sandbox left behind by an interrupted session is now cleaned up by the routine sweep instead of waiting for that same 24 hour cap.

## August 6, 2026: More permission checks on GitLab triggers and repo start-up scripts

* Starting an agent run from a GitLab issue (issue opened, or a trigger label applied) now requires the actor to have write access to the project, matching the rule already applied to "@ara" mentions and merge-request reviews. A user who can only open issues or apply labels can no longer kick off a run.
* Editing a repository's session-start or preview script (the repo-level environment blueprint) now requires the org owner or admin role, because those scripts run with the repository's secrets available. Members can still edit build-time setup that never sees secrets. Each secret-capable edit is recorded in the organization audit log.

## August 7, 2026: Further agent and workspace security hardening

* The agent can no longer read or post into another teammate's session, or create workspace-wide connectors, from inside a run: those actions are now restricted to your own sessions and to a real signed-in owner/admin, so a run driven by untrusted repo or issue content cannot reach a colleague's work.
* A repository's environment blueprint can no longer define reserved inference variable names (such as `OPENAI_API_KEY`), matching the rule already applied to stored secrets, and baked build values are scrubbed from stored build artifacts.
* The public avatar image link now only serves genuine avatar images, not arbitrary files.

## August 7, 2026: Defense-in-depth hardening across agent runs and workspace access

* Text an agent writes to a pull request, an issue, a comment, or a commit message now has secret-shaped values and any of the workspace's own stored secrets stripped out before it is published, so a run driven by untrusted repository or issue content cannot leak your credentials into a public artifact.
* Several internal safeguards were tightened with no change to normal use: session tokens now require a dedicated signing key and are only accepted where they are issued; a shared "open access" workspace grants read-only browsing rather than a write-capable role; the connector gateway enforces each agent's allowed-plugin list; and a preview feature that is off by default now refuses to turn on without its full access check in place.

## August 5, 2026: Live Preview finds your dev server again

* A repository that declares a dev server in its Blueprint (`preview:` with a command and a port) now has that server started and kept running for the session. Previously the declaration was read when the environment was built but never acted on during a session, so the server was stopped again as soon as the step that started it finished, and the Browser tab usually found nothing to show.
* The port list no longer offers Ara's own internal connection to the sandbox as though it were your dev server. Only servers you actually started are listed.
* When a session has finished, the Browser tab now explains that the sandbox was released along with the dev server, and that sending a message continues the session and starts a new one. It previously showed an internal error code, and showed it in red as though something had broken.
* The Browser tab no longer invites you to start a dev server in the same breath as telling you the sandbox is gone. It shows one status line rather than two that contradict each other.

## August 5, 2026: Custom MCP servers must be reachable at a public address

* Connecting a custom MCP server with OAuth now fails when the server URL, or an OAuth endpoint it advertises, resolves to a private or reserved address such as `localhost`, a `10.x` or `192.168.x` host, or a cloud metadata address. A server that is only reachable inside a private network could never have completed a connection anyway; attempting it now stops before any request is sent.
* OAuth discovery no longer follows redirects. A server that answers its `.well-known` discovery documents with a redirect will fail to connect instead of being followed to another origin. Every server in Ara's built-in MCP catalog serves those documents directly, so connections made through the catalog are unaffected.

## August 5, 2026: Session branch and target read below the composer

* The row showing a session's working branch and where it runs is no longer part of the composer card. The card ends at the input box and that row sits under it as plain text, so it reads as information about the session rather than a control inside the input.

## August 5, 2026: Groundwork for connector tools in cloud sessions

* Connector tools are **not yet available** in cloud sessions. This entry describes preparatory work only, and the behavior below is switched off by default.
* When it is switched on, Ara will reach a connected MCP server from its own backend rather than from inside the sandbox running your code. A connector's access token is applied server-side and is never written into that machine, so a session can use a connector without ever holding its credential.
* Connectors that run as a local process, such as the Postgres and Supabase servers, will keep running inside the session sandbox, where they stay isolated to your own workspace.
* Requests to a connected server are refused if its address resolves to a private or internal network, including cloud metadata addresses.

## August 5, 2026: Long sessions compact their context instead of failing

* A session whose conversation grows past the model's context window now summarizes its older history automatically and keeps working. The transcript shows "Compacted earlier context to stay within the model's window" when this happens. Previously the next model request failed outright once the window filled.
* The full conversation history is still kept for the transcript and for crash recovery; only what is sent to the model is condensed, and the summary work is billed and metered like any other model request.
* Typing `/compact` in the chat while a session is running now compacts that session's context on its next model step, instead of returning "capability unavailable". A finished session still declines: it compacts automatically on its next turn if needed.

## August 5, 2026: Uploads report their real staging outcome

* Once file staging finishes, the agent is now told exactly which uploaded files landed in its workspace, including any that could not be transferred (for example, files too large to stage). It stops waiting for a file that will never arrive and tells you it could not open the upload instead of guessing at its contents.

## August 5, 2026: Card verification when a free trial starts

* Starting a free trial now places a temporary \$1 authorization hold on the card, released immediately and never charged. A card the bank declines for that hold, or a prepaid card, can no longer start a trial: the subscription is cancelled at signup and the workspace returns to the Free plan, instead of the first invoice failing a week later. Cards that require additional authentication (3D Secure) are not affected by this check.
* A card that already redeemed a free trial under a different account now ends the new trial at the end of its period instead of only being flagged internally.

## August 5, 2026 — Safer, more reliable sessions

* Ara now uses one managed execution path with task-scoped access and workspace
  credit settlement. Provider credentials remain server-side and are never
  exposed to a session environment, transcript, artifact, browser, or command
  line.
* Session recovery, cleanup, and historical archiving now use fail-closed
  ownership checks. Active work and unresolved billing are preserved instead of
  being retired; completed history remains available.
* Operator maintenance reports expose only aggregate safety and billing counts,
  never session contents, identifiers, or secret values.

## August 5, 2026: Sessions run to completion instead of stopping after a minute

* Sessions started from Slack, GitHub events, and pull request reviews now hold their run authority for as long as the work takes. Previously a session of roughly 45 seconds or longer could stop mid-task with an authorization error, because only some of the ways a session can start kept renewing the permission that lets it reach the model.
* Recovery startup now rejects an incomplete process-lease handoff instead of silently replacing it, so deploy-skewed workers cannot bypass the same ownership checks.
* Every runner-owned lease heartbeat now emits its start marker, so production
  telemetry shows which worker is actively renewing a session before any lease
  loss or renewal failure. A telemetry sink failure cannot interrupt the session
  or its lease cleanup.
* A session whose worker hands it off during a deploy is now recorded as a planned handoff rather than an unexplained loss, so routine deploys are distinguishable from genuine lease failures.
* When a session is recovered after its worker is replaced, a model request that failed with a transient provider error is now retried instead of ending the session. Cancelling a session still stops it immediately.

## August 5, 2026 — Steadier session starts when many sessions recover at once

* When a batch of sessions recovers together, for example after a deploy or an unexpected restart, Ara now paces how many sandboxes it asks the provider to create at the same time instead of requesting all of them in one burst. Sessions that wait their turn start a moment later rather than failing outright.
* Provisioning retries now use a randomized delay, so a group of sessions recovering in lockstep no longer retries in lockstep and collides again on the same schedule.

## August 5, 2026 — One workspace credit limit

* Long tool-using sessions now renew their run-bound process lease from every
  production launch path, preventing a healthy session from being reclaimed and
  invalidating its own short-lived access grant.
* Model use now reserves directly from the workspace's shared credit balance.
  The temporary per-request, per-run, per-user/day, per-workspace/day, and
  global/day dollar caps are retired.
* Legacy per-group dollars/day settings are ignored and no longer returned by the Team page. Groups may still carry non-monetary daily run limits.
* Small remaining balances stay usable: Ara lowers the maximum output to the amount the workspace can afford, while exact token usage settles and releases the unused hold.
* Sandbox runtime leases each billable minute from that same balance before it starts, preventing simultaneous model and sandbox work from overspending workspace credits.
* System-credential fallback now trips the credential breaker, raw provider
  errors are sanitized, and service-owned inference secret names cannot be
  created, listed, exported, or injected into a sandbox.
* Token and cost settlements now appear in workspace model-usage history as soon
  as they debit the same shared credit balance.
* The retired inference broker's database authority now fails closed before archival: it can be sealed only when no live grant, open request, or dollar hold remains, and the operation never adjusts workspace credits.

## August 4, 2026 — Managed model execution

* Ara sessions use a task-scoped managed inference service. The API holds service
  credentials; sandboxes receive only a short-lived grant restricted to one
  session and model, and usage settles against the workspace credit balance.
* Usage settlement records the provider, model, credential type, input, cache,
  reasoning, output tokens, and cost. Provider or accounting failures remain
  visible and never use an unapproved fallback.
* Repository wiki generation is temporarily unavailable while that background
  job moves onto normal queued sessions.

## August 4, 2026 — Office address in the marketing footer

* The marketing footer now lists Ara's office address, Gaustadalléen 21, 0349 Oslo, Norway, alongside the copyright line. It reads the same in every language, as postal addresses should.

## August 3, 2026 — Cancelling a past-due subscription stops collection immediately

* Cancelling a subscription whose renewal payment has failed now voids the outstanding invoice and ends the plan right away, so automatic payment retries can no longer charge your card after you cancel.

## August 3, 2026 — Clear usage budget messaging

* A run that stops because an Ara AI usage budget is used up now says so: the chat shows a dedicated "AI usage budget reached" card explaining that one retry is worth attempting and that a repeat failure means the daily budget, which resets at midnight UTC, instead of a raw "429 Too Many Requests" error.
* The Founding Engineer listing no longer states a San Francisco, in-person location or a monthly rate, on both the Careers index and the role page.
* Hovering the "N files changed" segment of the composer plan pill now opens a card listing each changed file with its own additions and deletions. The compact summary uses the same muted text treatment as the other session tabs, while clicking the segment still opens Review.

## August 2, 2026 — Safer cloud execution rollout

* A staged rollout verified the normal workspace, authentication, session list,
  composer, and chat surfaces under the updated execution service before
  promotion.
* Model requests start while the sandbox, repository, uploads, and browser tools
  are prepared. Tool calls wait for verified sandbox readiness before they can
  execute.
* The rollout gates fail closed on authentication, ordering, reconnection,
  cleanup, and ownership failures. A failed gate retains the previous serving
  version instead of silently bypassing safety controls.
* Recovery preserves the existing session history and replays only safe pending
  work. It retries bounded transient infrastructure failures, respects
  cancellation, and never creates a duplicate execution target.

## August 8, 2026: Local chat follows the running API port

* When the local development launcher selects a different API port because its
  default is already occupied, secure model requests now follow that selected
  port. Local sessions no longer fail inference by sending their grants to an
  unrelated process on the default port.

## August 2, 2026 — Faster composer actions

* Ara web and docs now use Helvetica Now Display throughout, with Geist Mono for code and file references and medium-weight links and mentions in chat.
* The composer `+` menu now opens searchable Skills, Plugins, and Shortcuts sidecars in both full and compact session composers. Each shows up to five results, with connected plugins first, while Attach file keeps the existing multi-file picker behavior.
* Device references in the composer now use the same blue treatment as skill references, showing a device icon and name instead of the raw quoted `@` token. Device, plugin, and skill labels all render at medium weight.
* The model sidecar now hugs short lists instead of leaving empty space below the available models.
* Models & credentials now lists the three included Ara models and keeps availability guidance as a single note below the roster.
* Error notifications now inherit the active light or dark theme and keep their dismiss control in the top-right corner.
* Pending repository setup is now highlighted in orange, and its copy-prompt dialog explains cloud setup more directly.
* Session turn rails are slimmer at rest while keeping their full hover expansion.
* New Ara runs can initialize connected GitHub repositories with no commits, then continue through the normal branch and pull-request flow.
* The project picker now offers Empty project for an explicit repo-less scratch workspace instead of sending New project clicks to GitHub.
* Retrying a completed or failed task now preserves its original instructions, and tasks can continue after a local tool returns a structurally bounded static PNG without weakening the block on provider-hosted media or remote fetches.
* Immediate follow-ups keep the same visible session context when it is safe, so chat stays on **Thinking** instead of returning to **Preparing Hands**. Ara deliberately starts a fresh workspace when it cannot prove the active run lease or cleanup.
* The composer now states its run context in two places. Above a new task, one row holds the repository, the branch it will start from, and the location — Cloud, or Cloud plus one of your connected devices — and each control drops its icon once it holds a value. Plugins moved into the `+` menu. Beneath the input in a session, a separate row names the session's own work branch (click to copy it), whether it is computing in the cloud or on your device, and how much of the model's context is spent, with the token and cost detail on hover.
* The location control keeps naming the device an unsent draft targets even after that device becomes unreachable or the page reloads, and the location menu shows the attached device as the current selection rather than implying the task will run in the cloud.
* A session can now continue somewhere else. The location chip in the session status row opens **Continue on**, offering a fresh Ara Cloud sandbox or a folder on one of your connected devices. Ara starts a linked session at the destination from the session's branch and stops the original, so only committed work travels. Choosing a device checks the branch out into the folder you picked, reusing an existing checkout instead of cloning again. Devices that are offline or running an older Ara release stay listed but unselectable, with the reason shown and a link to **Settings → Devices**.

## August 1, 2026 — Workspace picker in the sidebar

* The sidebar top-left now holds a workspace picker instead of the Ara wordmark. Its menu shows the current organization and member count, opens Settings or Invite members in one click, and lists your other workspaces under "Switch account" alongside Create new account and Log out.
* Sidebar highlights are lighter: the picker matches the height of a navigation item, and session rows keep a gap so a hovered row no longer merges into the one next to it.
* Dialog footer buttons are now pills and stay legible on the dark theme.

## July 31, 2026 — Cleaner workspace navigation

* Updated GPT-5.6 Luna and Terra usage metering to their latest lower provider rates, so the same Ara credit balance now covers more model usage.
* "Add repositories" in the composer project menu now opens the Ara GitHub App's repository-access settings instead of the read-only Codebase list, and Codebase carries the same action in its heading.
* Selected Automation, Codebase, and Customize options now use a compact pill, while inactive options stay as muted text.
* Notifications now match session turn previews, stay centered at the top on phones, and the turn rail sits clear of the workspace sidebar.
* Component previews now stay pinned to one production deployment during releases, avoiding mixed frontend bundles.

## July 7, 2026 — Cloud coding agent

* Added the cloud coding agent flow for managing repository work from the web.
* Added scoped sessions from connected repositories.
* Added live progress in the workspace.
* Added pull request and diff review without leaving Ara.

## August 6, 2026 — Workspace-scoped harness profiles

* Internal runtime experiments can now be selected by an operator-managed workspace profile instead of a separate hostname.
* Ara persists the profile version and digest on each run so retries and continuations remain reproducible.