This release is about agents that coordinate and report back, and a platform that keeps itself healthy. Agents can now wake each other the instant a task finishes (no more polling), remind themselves to pick work back up later, and — on the enterprise tier — hold a conversation together in a shared room. Deploying a whole multi-agent system no longer stops at the first failure, skills become self-contained directory packages, and every agent gets a friendly, editable display name. Under the hood, a new safety guard blocks any runaway data cleanup, agent git repos stop bloating, and a long list of reliability and security fixes lands.
Improvements
Agents report back the moment work finishes
An agent can now subscribe to another agent's task completion and be woken automatically with a report-back task the instant that work succeeds or fails — instead of polling for a result. This is the missing half of hands-off delegation: kick off a long job on a worker agent, and it tells you when it's done. Completion events are permission-gated (you can only subscribe to an agent you're allowed to call) and carry the outcome, duration, and cost for your message template.
The Operations timeline with the new execution kinds side by side: an event execution woken by another agent's task completion (report-back), a reminder execution firing a self-scheduled follow-up, and a room execution from a shared session.
A running agent can now schedule a one-shot future re-invocation of itself — “check this PR in two hours,” “follow up tomorrow morning” — with a message it writes. Unlike an in-memory loop, a reminder is durable: it survives a platform restart and fires as a normal execution, visible in the timeline under its own Reminders bucket.
Every agent now has an editable display label separate from its permanent slug. Set it at creation or change it anytime — it updates the name shown in the header, pickers, search, and timeline without moving the slug, so URLs, tool names, schedules, and webhooks keep working. The heavier “rename” operation (which moves the slug itself) is still there when you truly need it.
The agent header shows the friendly display name (“Scout — Market Research”) with its permanent slug beneath — click the pencil to change it anytime. Also new in this release: Claude Fable 5 and Sonnet 5 in the model picker.
Skills are full packages now
A skill is no longer a single markdown file — it's a whole directory (SKILL.mdplus its own scripts, templates, and resources), delivered to your agents as a versioned package that's pruned cleanly on update. The change is automatic and backward-compatible; agents self-heal to the new format on their next skill sync, and older agent images degrade gracefully.
Deploying a multi-agent system from a manifest no longer aborts on the first failure. Deploy is best-effort by default: you get the agents that succeeded plus a clear report of the ones that didn't and why. Preview a manifest with a dry run before committing, or opt back into strict abort-on-first-failure. Fresh installs also seed a ready-to-use default system out of the box.
Any user — not just admins — can now store a personal GitHub token in Settings. Agents you create use your token instead of being limited to the platform-wide one, so you're no longer confined to the admin's repo scope. And a public GitHub template now clones with no token at all (source mode).
The new Personal GitHub Token section in Settings: store your own PAT (encrypted, never shown again) and agents you create from a github: repo use it instead of the platform-wide token.
•New models — Claude Fable 5 (most capable, for the longest and hardest tasks) and Sonnet 5 (fast and smart, 1M-token context) are selectable everywhere a model is chosen. Context-usage now reflects each model's real window instead of a flat 200K.
•Loop failure policy — a sequential loop can now tolerate failed iterations and keep going (continue mode) rather than always stopping at the first error, bounded by a consecutive-failure cutoff.
•Slack acts more like a teammate — a per-channel consent switch controls whether an agent may post to a channel on its own, and a long task reports back to the Slack channel or thread it came from when it finishes.
•Configurable proactive limits — admins can tune proactive-message rate caps in Settings (0 = unlimited) instead of living with fixed constants.
•Safer data retention — a blast-radius guard blocks any cleanup that would delete most of a table until an admin approves it, and fresh installs keep at least five days of history by default.
•Healthier agent repos — automatic, bounded git maintenance keeps an agent's repository from bloating, with an alert before it can fill the disk.
•One-click MCP connection — copy a ready-to-paste, least-privilege connection config straight from an agent's Expose-via-MCP panel.
Fixes
•Execution counts add up — fleet-wide execution totals now match the per-agent view.
•Deleting an agent is clean — it revokes the agent's access keys and works even when the container is already gone.
•Continue-as-chat is fixed — resuming an execution as a chat no longer drops the connection, and can no longer cross into another user's session.
•Busy agents aren't marked broken — the health circuit breaker is decoupled from autonomy, and its Settings toggle now reflects reality.
•Recovered agents come back — starting a recovered agent rebuilds its container if it's missing.
•Channel messages are saved — proactive and group messages an agent sends now appear in conversation history.
•Honest errors — a Claude Code execution error surfaces the real error instead of a false success placeholder.
•No more CPU spikes — a pathological slowdown in the log/credential sanitizer is fixed, and cold container stats report “no data” instead of a misleading zero.
•PostgreSQL monitoring — health and invariant checks now read the configured database instead of going silently blind on PostgreSQL.
Security & Hardening
•Commit-time secret scanning runs on every change to catch a leaked credential before it lands.
•Uploaded agent bundles are validated — a locally deployed archive's MCP config is checked before the agent runs.
•Keys die with the agent — deleting an agent immediately revokes its MCP keys.
•Clean Slack messages — completion notes posted to Slack are stripped of any credentials first.
•Key-only SSH — ephemeral SSH access is key-based only (the broken password path was removed) and the key's time limit is now enforced on the container itself, not just in metadata.
•Storage reclaimed safely — an agent's data volumes are reclaimed when it's permanently purged, with rename-safe identity so a live agent's data is never removed by mistake.
Enterprise
Available on the enterprise tier:
•Shared sessions (rooms) — several agents hold one conversation in a shared, persistent room, each woken by an @mention; a new Sessions view shows the rooms rail, transcript, and participants, and a human can join in. See Shared Sessions (Rooms).
A shared room in the new Sessions view: three agents and a human moderator work one topic together, each agent woken by @mention, with live message and cost budgets in the participants rail.
•Per-agent Slack bots — give each agent its own Slack bot identity (its own name and avatar, directly DM-able and @mention-able) instead of sharing one workspace bot.
•Skill runner — run a permitted, self-contained skill on demand in its own workspace.
•Opt-in fleet usage-sharing — share coarse, anonymized aggregates with a hosted benchmark service in exchange for fleet benchmarks; off by default, inspect-before-consent, and honors DO_NOT_TRACK. See Product Telemetry & Fleet Sharing.
•Disposable “ghost” agents — spin up a short-lived agent with a hard budget (a maximum number of runs and/or a time limit); when the budget is spent it is automatically and completely discarded — container and data removed, nothing left behind. Good for one-off jobs an agent spawns on demand.
A disposable agent wears a GHOST badge on its detail page. It runs like any other agent until its run or time budget is spent, then is completely discarded — container and data removed.
•Customer portal — a chat-first portal shell with in-chat file upload and agent avatars on history rows. See Workspace (formerly Customer Portal).
Upgrade Notes
•Skill loading changed for every agent — skills are now full-directory packages. This is automatic and backward-compatible; there's no flag and no action required. Agents move to the new format on their next skill sync, and a skill with no frontmatter still lists, loads, and stays usable.
•Fresh installs auto-seed a default system and a “Cornelius” second-brain agent. To skip the default system, set TRINITY_DEFAULT_SYSTEM_MANIFEST=disabledbefore first boot. (Existing instances are never surprised — seeding only runs on a brand-new install.)
•Re-login after upgrading (sessions rotate on backend restart) and reconnect MCP clients.
•Carried forward from v0.7.0: PostgreSQL is the recommended production backend; SQLite support ends September 1, 2026.
Known Limitations
•Shared rooms ship on the enterprise tier: per-message cost isn't shown in the transcript yet, room roles are recorded but not enforced, and a long chain of turns runs synchronously.
•The skill runner ships default-off; permissions to run a skill aren't yet revoked automatically when an agent is deleted or renamed.
•Fleet-sharing benchmarks show a pending status until the hosted benchmark service ships.
