---
title: "Changes"
summary: "Every change that reaches hypervibe.app, newest first, in words a reader can use."
standing: "planned"
release: "No public release yet"
verified: "2026-11-09"
---

# Changes

Every change that reaches hypervibe.app, newest first, in words a reader can use.

> Standing: Planned. An approved future concept. Not available to install or run. Release: No public release yet.
>
> Hypervibe has no public release yet. Until one exists, no page here is Qualified and nothing can be installed from these docs. Every page states its standing, so you can tell an approved plan from something you can run.
>
> This is the Markdown copy of https://hypervibe.app/docs/releases/changes/

This page lists each change to hypervibe.app, newest first, in words a reader can use. The site is rebuilt with every entry. An entry is not a product release: [Releases](https://hypervibe.app/docs/releases/) lists those.

## Recorded changes

### 2026-11-10

- A request on the native inference route is recorded durably, with a digest of its payload, before it is dispatched, on both the local and the remote path; if the remote record cannot be written, the request stops instead of running unrecorded.
- Native team budget checks run against the durable record store, so a budget hold is committed before a request is admitted.
- The Throttle product page follows the current Throttle requirements, and the documentation's ownership and hosting are settled.

### 2026-11-10

- When a hard spending cap applies, an overflow request reserves its worst-case cost before it is sent, and a soft daily budget settles exactly against what each request really cost.
- Every deployment is packaged from its own roots, declares the stores it owns, and has each of its shipped feature sets compiled on its own.
- An update is verified against the installation's trusted root before it is installed.
- Agent sessions keep their state in a durable store that records how each write was made durable.
- A client can queue turns with a time limit, and a turn that expires or cannot be queued is refused with a reason.
- Usage is added up per session while the session runs, and an amount that is not known stays unknown instead of reading as zero.
- Streaming Markdown is rendered in bounded steps, and terminal links stay bounded.
- Terminal themes include base16 palettes with contrast checks, and the client says when a terminal lacks a capability it needs.
- A result's Accept action is offered only while a passing verdict is current.
- Conversation checkpoints record what they cover, the facts needed to replay them and any state still unresolved.
- In an approval, Edit opens the proposed words and Enter sends them; A approves a decision.
- A mention in a message is a typed reference rather than free text.
- Extension refusal reasons are spelled one way throughout, and script extensions can contribute only through the compatibility adapter.
- Hooks on a node run through one executor, and a child process can be given a higher open-file limit.
- The supervisor releases its instance lock as soon as its owner exits, so a restart is not refused.
- A third-party licence audit covers the client's dependencies, and a benchmark manifest defines how performance is measured.
- The documentation site publishes a Markdown copy of each page and a card for each refusal.

### 2026-11-10

- The control service's store runs on PostgreSQL as well as SQLite, with paired migrations, an ordered journal and a change feed other components can read.
- Each store has an owner epoch: a writer from an older generation is fenced, and released records are pruned only after every reader has moved past them.
- A headless host can sign in with a device code, and an unused invitation can be revoked.
- Person sessions are bound to the workstation key, so pausing or revoking a device ends its sessions.
- One shared verifier checks proof-of-possession tokens for every service that accepts them.
- Updates can roll back to the previous generation when its stores are compatible, and refuse when they are not.
- A remote client can sign its own requests, keep its identity locally and be admitted by binary.
- A team server enforces a daily team budget and says so when a request would exceed it.
- The agent serves the terminal's bridge protocol directly.
- Model streams can report that no event is ready yet, so a session waits instead of ending early.

### 2026-11-10

- Thread and turn identifiers are bounded, and an attempt's context has one encoding.
- Work records one kind of verdict, including a not-passed outcome, and every decision carries a deadline.

### 2026-11-10

- The agent composes one engine session with real command execution and resume, and runs the shell and its polling tool within fixed bounds.
- The agent records its intent durably before any effect, so a stopped session never repeats or loses an action.
- The terminal's requirements record the Lanes rulings of 10 November.
- Specifications for the second wave of agent packages are published for review.

### 2026-11-10

- Every command has one plain label, and the exec command takes a goal with an optional session, line-delimited JSON output and an output schema.
- Setup, update and status can print their outcome and the installation receipt as one JSON document, and each names the exit codes it can return.
- Only one place in the code may start a child process, and the merge gate refuses a new one anywhere else.
- Work records verdicts and dispositions, inference runs are recorded with their attempts, and native reads require their generation, thread and turn.
- Jobs gain a reconciling state, and a failed job names one of eighteen causes.
- The owner of the service's control store can run its migrations, with a probe that checks the journal writer first.
- Refusals carry an owner code, and service records carry a revision.
- The shell tool tells an input or output failure apart from a sandbox that cannot run.
- Inference refusals say whether a retry can succeed, and the interrupt key is spelled Ctrl+C.
- Team settings follow the inference runtime's descriptor rules, and team members carry a role.
- The workspace lists its packages explicitly, and the observatory capture is built only when asked for.
- The iOS app's Swift types are generated from the shared schemas.
- The service documents how capabilities are qualified, the states a generation passes through, and package state scoped to one run.
- The plugin plan routes requests first and then adds a QuickJS compatibility adapter.
- The documentation site uses the updated design tokens.

### 2026-11-10

- The merge gate now checks Rust formatting, so unformatted code can no longer reach the integration branch.
- Every command's output can be requested as one JSON document, with a shared, versioned shape for success, refusal and warnings.
- Child processes started by the build client and the source checks begin from an empty environment plus a short allowlist, so no ambient credential reaches them.
- The server setup refuses a donor database migration above the v1 ceiling, and the inference store's ceiling comes from what the release declares.
- File tools report a failed read or write that is not a permission problem as its own failure word instead of calling it permission denied.
- Policy decisions explain themselves in plain words, without internal prefixes.
- A Bazel build graph is generated from the Cargo workspace and checked for drift; a change that only adds a documentation page is never drift.
- Team inference gains its remote path, durable native ingress and typed refusals for the native route.
- Setup documentation and the uninstall command are wired to the installer's activation owner.
- Native pure reads run through Work with their attempt context, and the shell and web fetch tools are served behind the execution port with their ending facts.
- One operation id type, one shared DPoP verifier, local control ownership, an explicit path-ownership map and the public documentation site arrive from earlier trains.
- Decision A25 now says exactly which reserved credential names are removed from child processes, and the plan pages follow the latest rulings.

## Where to go next

- [Releases](https://hypervibe.app/docs/releases/) lists product releases and the records the first one needs.
- [Standings](https://hypervibe.app/docs/reference/standings/) explains how a page's standing changes.
- [Docs home](https://hypervibe.app/docs/) starts from what you need to do.