Changelog

AI analysis existed behind the Zero Trust control drawer, but a user opening Cloud, Identity, Endpoint, Dev, or another Security Arm could see findings without any explanation layer beside them. The new shared advisory surface is now present on every scan-backed Arm.

• AI analysis and remediation plan appears on all 23 scan-backed Security Arm pages. It shows the summary, root-cause analysis, ordered remediation steps, provider/model, evidence counts, and honest clean or unavailable states.
• The Brain remains advisory. Deterministic controls, verdicts, scores, and remediation gates are never changed by generated prose.
• Liquid Glass is now the third persisted theme after Dark and Light. The final treatment uses neutral clear glass and slate accents rather than saturated blue or green.
• Brand assets match the theme. The clear-glass Enkstein icon is used by the portal, browser companion, and future macOS/Windows packaging builds.

Verification. Frontend ESLint, production build, node advisory wiring, and diff checks pass. This release changes presentation and advisory visibility; the Trust Fabric and deterministic assessment boundary remain unchanged.

The Channel Gateway and the Execution Channels were the last two record sets with no owner. They are also the highest-consequence pair in the product: one runs shell commands, drives browsers, brokers credentials and gates production, and the other is the unauthenticated ingress that feeds it. Any authenticated caller could read another tenant’s inbound messages, approve their pending execution, or list their credential broker entries.

• Execution requests, production gates and broker entries are scoped end to end — list, detail, approve, reject, execute, rollback, rotate and statistics. A foreign record answers 404 rather than 403, so an identifier cannot be used to probe what exists in another tenant, and an already-approved foreign request still refuses to run.
• Channel messages, identities and configs are scoped too. A channel config holds a webhook URL and a signing secret, so it was a credential surface listed to everyone. Outbound replies are now matched to a config in the message’s own tenant, which means one tenant’s response can no longer be delivered through another tenant’s webhook.
• Ingress cannot name its own tenant. Slack, Teams, webhook, email and CLI arrive unauthenticated, so ownership is taken from the channel config an operator registered rather than from the payload. A message on an unregistered channel stays unowned and visible only to an administrator, instead of defaulting into a tenant. A tenant_id supplied in an identity upsert no longer adopts or elevates an existing mapping.
• Two global uniqueness constraints were themselves the leak. A channel id and a credential name were unique across the whole install, so the first tenant to register a name locked every other tenant out of it and the insert conflict revealed the name existed somewhere else. Both are now per-tenant.
• Control Center counters stop mixing tenants. Channel volume, blocked traffic, pending replies and pending execution approvals were counted across the entire install.

Verification. Twelve new adversarial checks assert the foreign-record behaviour directly, including that an approved request of another tenant is still not executed. Migration 0011 was run on PostgreSQL 16 through a full upgrade → downgrade → upgrade cycle against a schema clone, resolving the existing constraint by inspection because its generated name differs between deployments. 1,303 backend tests pass.

The repository had newer commits than the latest downloadable release, and the macOS download button pointed to an asset that was not attached. This release aligns the application version, Git tag, release assets, and download links at v0.5.12.

• Windows startup waits for the actual Docker Linux engine. It now detects both system-wide and per-user Docker Desktop installations, waits for the named pipe to become usable, validates the engine again immediately before Compose, and retries container startup when Docker is still settling.
• Installer links point to this release. macOS and Windows buttons, the native installer documentation, the browser companion version, and package metadata all use v0.5.12.
• Failure messages are actionable. If Docker Desktop cannot become ready, Enkstein reports that directly and opens the launcher log instead of surfacing an opaque Compose pipe error.

Requirement. Docker Desktop remains required for this installer path. Enkstein starts it when installed, but Windows must still have Docker Desktop installed and allowed to run.

Running a node produced verdicts and a score, and stopped there. Reading which of 324 controls failed, working out which failures shared a cause, and deciding what to do first was left entirely to the operator. Not one of the 26 node scans reached a Brain — AI existed only as a cross-node correlation on a separate page.

• Explain this assessment now sits under the verdicts for every Security Arm. It reads the failing controls, the open findings, the remediations that can execute, and the ones that need a human, and returns a summary, the themes connecting the failures, and ordered remediation steps citing the control IDs they resolve.
• Controls that were never assessed are reported alongside the failures. A high pass rate over a third of a profile is not a good posture, and the summary is given the coverage gap so it cannot describe one as the other.
• The narration cannot change the assessment. Verdicts and scores stay deterministic, and the model only ever reads the finished result. Two reasons hold that line: a control that moves between pass and fail because a model phrased itself differently makes a compliance posture unauditable, and every finding string arrives from a third-party connector, so it is framed as untrusted data — a successful injection yields misleading prose rather than a forged pass.
• A clean node skips the model entirely rather than paying for a call to say nothing is wrong, and when no Brain is reachable the assessment is reported as complete and unaffected instead of showing an empty panel.

Found while building this. The summary was reading control rows from a key the evaluation service does not return, and remediation proposals from another. Left as it was, every node would have reported “no failing controls” no matter how many had failed. Both contracts are now pinned by tests.

Windows does not run the shell installer — it drives Docker Compose directly. Every fix made to the installer had therefore been missing Windows entirely, including the prebuilt images from the previous release.

• A port already in use no longer stops the launch. Ports 3000 and 8000 were claimed unconditionally, so anything else holding either one made startup abort with nothing on screen but “Container startup failed”. Both platforms now keep the familiar port when it is free and quietly move to the next one when it is not, and the browser opens on the port actually chosen. The two port settings were also absent from the environment file, so they were ignored even when set by hand.
• Windows generates its own owner password. It previously kept the placeholder from the example environment file, meaning every Windows installation shared the same known credential. Existing installations still holding the placeholder are given a fresh one.
• Windows downloads the runtime instead of compiling it, matching macOS, with the same fallback to building when the download is unavailable.
• A failed launch opens the log rather than printing a folder path and leaving you to find it.

Honest limitation. The port and version helpers were executed and verified, and the launcher parses cleanly, but this was developed without a Windows machine. The installer itself has not been run end to end on Windows.

Every new user was building the runtime on their own machine before they could see anything. The backend image is 3.47 GB, and 2.22 GB of that is Prowler’s dependency tree — that compile is what made first launch take minutes.

• Runtime images are now published for each release, built for both Apple silicon and x86, so installation is a download rather than a build.
• Building still works when the download cannot. An offline machine, an unreachable registry, or a source checkout falls back to building locally and says so. Set ENKSTEIN_FORCE_BUILD=true to always build.
• The download is time-bounded, and that is not a precaution. A pull against a tag that does not exist yet does not fail — it hangs indefinitely. Unbounded, that would have left first launch waiting forever with nothing on screen. It now gives up and builds instead.
• Published images exclude local development state. The build previously included the virtual environment and installed packages from the machine that built it, which bloats the image and risks carrying a local environment file into a public artifact.

Running entirely without Docker, and a Docker-free installer variant, remain under consideration; this release makes the existing path fast rather than replacing it.

The previous release page listed enkstein-0.5.7.tar.gz beside three wheels named for the predecessor project, which reads like two unrelated downloads.

• Renamed to enkstein-cli, enkstein-core, and enkstein-mcp, with matching import names and an enkstein console command. None were published to a package index, so no existing installation is affected.
• Fixed the references that would have broken the build. The release workflow builds the core package by directory name, and the packaging check watches that path; both still pointed at the old directory.

Verification. All three were built and installed into a clean virtual environment: from enkstein_core import ... imports and enkstein --help runs, which is exactly what the documentation now instructs.

The project is now wcoreiron-rgb/enkstein, and the leftover names were doing real damage rather than merely looking untidy.

• “Check for Updates” would have stopped working. The macOS app reads its repository out of Info.plist and queries the GitHub releases API with it. That value still named the old repository, so every installed copy would have failed to find a release — quietly. It now names the current repository, and the app still accepts the old package filename so existing installs can update to this build.
• The build badge was showing another repository’s status. Its link had been repointed but the badge image had not, so the README reported a different project’s build result as though it were this one.
• Downloads carry the product name. Self-hosted bundles were still marcellus-VERSION; they are now enkstein-VERSION, along with the macOS packaging path that consumes that directory.
• The documentation site is published at its own address and no longer borrows the predecessor project’s. Old links continue to resolve.

Deliberately unchanged. Anything a rename would break for an existing install stays as it is: the API route segments, the Brain Bridge and external-agent request headers, the Compose project and database names, and the application support directory holding your database and bridge secret. Renaming those would orphan working installations for no visible benefit.

Three things were quietly making Enkstein untestable by anyone who had not cloned the repository.

• The companion is now a download, not a Finder reveal. The button opened a folder inside a local checkout, so anyone running the notarized package had no way to obtain the extension files. Brain Connections now serves the extension as a zip, resolved from the packaged layout or a source checkout, with dotfiles omitted because Chrome rejects an unpacked load that contains them. The instructions on the page name each step: unzip, open Extensions, enable Developer mode, Load unpacked, then Pair browser.
• The Windows installer now bundles the companion too. It had never been copied into the Windows runtime, which would have made the fix macOS-only.
• A missing Authenticode certificate no longer kills the Windows build. Signing was a hard gate on a repository with no signing secrets, so every Windows artifact failed before it was produced. It now warns and publishes unsigned, and still fails loudly if signing is configured and genuinely breaks. The resulting SmartScreen prompt is documented rather than left as a surprise.
• New Testing Guide. Which connectors work without a paid account, what a passing connector test does and does not prove, how to distinguish live findings from demonstration data, and the known gaps — written for someone evaluating this for the first time.

Verification. A real browser click downloaded the zip and it passed an integrity check with every extension file present. The Windows packaging script and release workflow were both validated by their own parsers.

The Brain picker in Chat and Cowork listed three near-identical Ollama rows and offered only three Claude models.

• Internal profiles no longer appear as operator choices. Cowork file authoring and workspace scanning are pinned by the runtime, not chosen; they rendered as extra “Ollama” rows that behaved differently from the general local Brain. Routing and policy are unchanged.
• The label reflects what is actually selectable. It named one model when the whole installed set is available, and named the wrong one when the profile’s configured default was not installed — showing gemma2:9b for a profile configured as qwen2.5:14b-instruct, purely because gemma2 sorted first. Providers offering a live choice now show their count.
• Claude offers the models this account is entitled to, read from Claude Code’s own state rather than three hardcoded aliases that never changed with your plan. The aliases remain available, and remain the fallback if that state cannot be read.

Verification. Measured against the running console and the real Claude session: three Ollama rows became one reading “9 models”, and Claude went from 3 models to 8.

Every provider read “Unknown” — including the Mock backend that cannot fail, and a local Ollama that was running with nine models installed. The internal status map was declared and read, but nothing ever wrote to it.

• Providers are probed rather than assumed. Ollama is checked for real reachability and reports its installed model count; cloud providers report whether a usable credential exists.
• Readiness matches what a routed call would actually do, so the strip cannot show healthy where the call would fail on a missing key. Azure requires both an endpoint and a key, since either one missing fails the request.
• Keys added through the Connector Marketplace count. Reading only environment variables reported providers as unconfigured while their routed calls succeeded.
• Each status explains itself, so “No key” names the connector to configure instead of leaving you to guess.

Verification. Measured against the running stack, not asserted from source. This surfaces a real gap the old display hid: Public, Internal and Confidential currently route to providers with no credential configured.

Claude Subscription showed “Needs setup” on hosts where claude auth status reports a live session, and Brain Connections printed model lists as one long run of text.

• Claude now detects your real login. Enkstein runs vendor CLIs under a deliberately minimal environment, and that environment omitted USER. The Claude CLI resolves its session through your Keychain and needs it, so under the bridge it genuinely saw a signed-out machine. It is now passed, and nothing else about the environment changed.
• Model lists collapse behind a count and open on demand, so Codex’s 44 models no longer make one card taller than the other seven combined.
• API providers show their model names instead of only a number with no way to see what is behind it.
• Counts come from live discovery where it returned anything, rather than a static catalogue that disagreed with it, and the Discovered Models tile now includes subscription models instead of ignoring all 47.

Verification. Measured against the real Claude session and the running console, not asserted from the source. Claude moved from authenticated=false to Ready, and all nine installed Ollama models render.

Two live Entra findings — any user can create tenants, any user can register applications — were open in the console while Identity and Privileged Access both reported 100% passing. Four faults had to line up for that, and all four are fixed.

• A control created from a finding now inherits an evaluator from the connector that produced it. Without one it read as advisory forever, so a live violation could never fail its own control.
• Controls created before this fix are repaired in place on the next scan, instead of needing the catalog rebuilt by hand.
• A re-scan that changes nothing still commits catalog repairs. The commit was gated on new or updated findings, so an unchanged scan silently rolled the repair back and the control never gained its evaluator.
• Nodes that share an adapter now both see the shared control. Identity and Access share the Entra collector, so the control was visible only to whichever node registered it first and passed silently on the other.

Verification. Measured against the running stack with real Entra credentials. Identity and Privileged Access each moved from a reported 100% to 50%, with both genuine violations failing on both nodes.

Zero Trust Control Coverage shipped with dark slate colours written directly into the markup rather than read from the theme, so it stayed dark and washed-out when the rest of the console was in light mode.

• Surfaces, text, borders and hover states now read from the shared theme variables the other pages already use, so the page switches with the console instead of ignoring it.
• Card corners, toolbar buttons and table rows match the surrounding design system, rather than using their own slightly different radius and treatment.
• Verdict and pillar accent colours were re-picked for contrast on a light background, so pass, fail and recommendation stay legible either way.

Verification. Rendered and inspected in both light and dark mode against the running console, not asserted from the stylesheet.

Enkstein could list what was wrong. It could not say what was right, which meant it could not answer the question an operator actually asks: how many controls do I have, and how many are failing? This release adds the control catalog, the profiles that make coverage meaningful, and the verdicts that make a score honest.

• 1,426 controls, from three sources. The NIST SP 800-53 Rev 5 OSCAL catalog (324), Prowler's check catalog for AWS, Azure, GCP, Kubernetes and GitHub (1,038), and Enkstein's own node objectives, TerraClaw rules and ArcClaw patterns (64). Only factual fields are imported — identifier, severity, service, remediation reference — never framework prose.
• Every Security Arm gets its own denominator. A catalog is not a profile. Showing all 1,426 controls under every node would claim Identity Security is accountable for physical facility access. Each Arm now declares the NIST families it can plausibly produce evidence for and inherits only those, so coverage means something.
• A control only passes when something looked at it. Silence is never success: PASS requires a collector to have actually run and returned no violation. Demonstration data can no longer produce a compliance verdict, and evidence older than seven days downgrades to NOT ASSESSED rather than standing as a stale pass. The pass rate is scored only over controls that were genuinely assessed; the rest are reported as the coverage gap they are.
• Failing controls propose the fix they declare. A control that can only report FAIL is an alert. Failing controls now route their declared remediation through the existing governed engine, which keeps its own risk classification and approval gate — a medium-risk action still waits for a human. Enkstein never infers a destructive action from a finding's text, and an executed action is not treated as proof the control now passes; verification is a fresh evaluation after a rescan.
• Prowler is a real dependency now, not a plan. It ships in the backend image in its own virtual environment so its dependency tree cannot collide with the backend's, and it runs read-only: no shell, allowlisted executables, credentials passed through the child environment rather than argv, bounded timeouts and capped output. A non-zero exit without parseable results is a failure, never a clean scan. When it is absent, readiness says so.
• Saved state stopped freezing shipped capabilities. A persisted model profile replaced its built-in wholesale, so a policy change in a release never reached a deployment that already had state on disk. Operator-tunable fields are still restored from disk; the policy allow-lists are owned by the code again.

Verification. Confirmed against the running stack rather than by reading code. All five Prowler providers execute and fail closed with genuine credential errors instead of reporting a clean scan. A live finding drove the full loop end to end: FAIL verdict, actionable proposal, a governed force_mfa_reset correctly held at pending approval, and re-verification. Cross-node AI analysis ran over 40 findings from 14 Security Arms on the local Brain with no cloud key configured, and a Swarm investigation across 8 Arms returned a critical verdict at 0.88 confidence, correctly requiring approval. 1,225 backend tests pass.

Every Microsoft connector reported “did not accept these credentials” after a successful sign-in. The credentials were fine; the test was wrong, and it was wrong in a way that hid two separate defects.

• A connector was tested by asking it for findings. That conflates three different outcomes — a rejected credential, a healthy tenant with nothing to report, and a token missing one optional scope — and reports all three as a credential failure. A Microsoft sign-in is now verified against an identity endpoint covered by the base scope every sign-in grants, so an empty tenant tests as connected. The probe is matched to the audience the connector actually signed in for, because a Microsoft Graph token cannot verify an Azure Resource Manager connector and the reverse is equally untrue.
• Entra ID read only Identity Protection. That endpoint needs an Entra ID P2 licence and an additional scope, so a correctly connected tenant without one produced no findings at all — which the test above then read as a bad credential. Entra now also reads directory defaults and standing privileged-role membership, each degrading on its own, so a licensed tenant gains checks rather than losing them.
• The Configure form and six adapters disagreed on field names. Okta stored domain while its adapter read org_url, so a correctly filled form failed before it ever reached Okta. Splunk, CrowdStrike, GCP and AWS had the same drift. Stored credentials are now reconciled through an alias layer, so connectors configured before this release keep working without being re-entered, and the fields those adapters genuinely need were added to the form.
• An unreachable host was reported as a rejected credential. A network failure, a provider that returned nothing, and a refused token now read as three different messages, because they call for three different fixes.

Verification. Confirmed against a live Microsoft tenant, not by reading code: Entra ID and Sentinel now pass their connector test and Entra returns real findings on the directory's default user permissions. A new contract test asserts that every field a hand-written adapter reads is either on the Configure form or derived from it, and that a provider returning no findings tests as connected rather than as a failure — so this class of mismatch cannot return silently. 1,158 backend tests pass.

Four paths reported real-looking results for work that never executed. Each is now honest about what happened.

• Remediation recorded success for actions it never ran. With no credentials configured, a shared helper returned success=true with a “Simulated:” message, so the engine marked the action completed and wrote a matching audit event. An operator reviewing the queue saw a disabled account or an isolated host that had never been touched, and the audit trail agreed with them. All twenty call sites across identity, cloud, endpoint, code and ticketing now fail with provider_not_configured instead.
• Agent runs returned a fixed scenario per Capability Node. The AI Security agent always “found” one prompt injection and one DLP violation whether or not a connector existed, and parked approval actions for targets that were not real. A run now executes the node's own governed scan — the same path the console uses — and reports the findings that scan actually persisted, including none. Remediation is proposed only for connector-backed findings, so the approval queue cannot contain an action against demonstration data.
• Workflow gates approved everything. A policy check returned PASS unconditionally with a “(simulated)” note, so a workflow's guardrail waved through every branch it was asked about. Gates now evaluate against real workflow context, and a gate that cannot be evaluated fails rather than passing. An agent step whose agent did not exist reported completed; it now fails, and steps without a bespoke intel path run the node's real scan.
• Two Capability Nodes reported unconfigured providers as successful scans. Cloud and Endpoint returned status: success alongside simulated: true, and omitted the mode field that callers use to tell demonstration data from a connector result.

Production data policy. A new REQUIRE_LIVE_DATA setting makes every Capability Node return nothing rather than demonstration findings, so everything on screen came from an authenticated connector. It defaults to off, which keeps a fresh install explorable; set it to true for a real deployment.

Verification. Confirmed against a running stack, not by reading code: an agent run that previously invented two findings now reports an honest zero, and with the policy enabled Cloud and Identity return mode: empty with an explanation instead of a fabricated estate. One existing test asserted that a Jira ticket “completed” without any Jira credential; it now asserts the failure. 1,084 backend tests pass and all twenty-nine console surfaces still load.

All twenty-nine navigation entries were walked against a running backend rather than reviewed by reading code. Four were broken.

• Findings returned a server error on any upgraded install. Startup creates missing tables but cannot alter existing ones, so a column added to a model after first run was simply absent from the database while the migration revision still read as current — and the first query selecting it failed. Because a local database outlives every upgrade, this would have hit every existing operator. Startup now reconciles additive column drift before anything queries it, adding only columns the models declare and never dropping, renaming or retyping.
• Mission Control was taken down by one stale row. The listing decrypted each objective inline, so a single mission written under a previous runtime key raised and returned a server error for the entire page. Unreadable rows are now listed and labelled as such, which keeps the page working and makes the bad row visible enough to remove.
• Remediation could not reach the backend from the packaged app. It bypassed the shared API client and called an absolute localhost:8000 URL with no bearer token, so requests were blocked cross-origin. It now uses the same-origin proxy and the operator's session. Approvals also posted a hardcoded admin identity; the backend already derives the approver from the token, and the client no longer claims otherwise.
• The connector list fetched vendor logos from a third-party CDN. Every render told an outside service which connectors an operator was viewing, and eleven brands had been removed upstream so those requests 404'd permanently. Seventeen marks are now bundled locally and the rest use the existing initials badge. Nothing about the connector inventory leaves the machine.

Verification. A new end-to-end sweep walks all twenty-nine routes and fails on a server error, a render crash, or an uncaught exception. Running it against deliberately truncated responses found four more pages that would white-screen on a payload from a version-skewed backend; those now degrade or report an error instead. 1,076 backend tests pass, including new coverage for schema reconciliation and unreadable encrypted rows.

Two things that looked finished but were not.

• Microsoft browser sign-in could never have worked. Every Microsoft connector offered “Sign in with your browser,” which borrowed the Azure CLI public client and sent it a loopback callback path that client does not register — so Entra rejected the request with AADSTS50011 before any consent screen appeared. Browser auth is no longer offered for Microsoft; the device-code flow, which needs no registered redirect, now covers all nine Microsoft connector types including Purview and Azure Resource Manager. GitHub, GitLab, Okta and the rest keep browser sign-in unchanged.
• An agent run recorded a tally, not a result. A completed run stored how many findings it had produced but not the findings themselves, so the only way to see what an agent actually found was to correlate the Events feed by run id. The run log now carries each finding, and the run history panel lists them by severity. Separately, a run parked in “Awaiting Approval” had no way to be approved or rejected — the endpoint and the client call both existed but nothing in the console used them. Each pending action now shows its type and target with Approve and Reject beside it.

Verification. Agent runs had no test coverage at all, which is how the missing output survived; two now assert that a completed run records what it found and that a parked action carries enough detail to decide on. The Microsoft change is covered by an assertion that all nine connector types decline browser auth and name a device provider instead. 1,072 backend tests pass.

Known limitation. Built-in agents still run scenario data rather than querying a live tenant. The plumbing above is what surfaces a result once real scan logic is attached.

0.4.1 stopped the workspace grabbing the first project in the list, but two other paths still decided where you landed.

• A plain open is a fresh start. Both the workspace and the blade restored the last remembered project from local storage, and the workspace then loaded the most recent conversation and rewrote the URL to point at it — so there was no way to reach an empty page. Opening /marcellus/chat or /marcellus/cowork now stays put with nothing selected. Deep links to a specific project or conversation resolve exactly as before, and earlier threads remain one click away in the blade.
• The file panel appears only when it has something to show. Cowork rendered its right-hand rail on every open, including when no project was bound, spending roughly a third of the width on an empty “No project selected” placeholder. It now appears once a project is actually bound, and the composer takes the full width until then.
• Mission Control is reachable from the navigation. It renders at the top of the Security workspace but had no entry in the blade, so it could only be found by switching modes. It is now the first item under Cortex & Hearts.

Verification. The end-to-end test that previously asserted a base route would adopt a conversation now asserts the opposite — that the route stays clean, no file panel renders without a project, and a deep link still resolves to its exact conversation. 1,070 backend tests pass; the workspace suite is 14 of 15 with the one failure a pre-existing flake that passes in isolation.

The sign-in screen showed no version, so confirming which build was actually installed meant unlocking the console first. The running version now appears quietly beneath the sign-in card, read from the same unauthenticated runtime endpoint the console sidebar uses — the locked screen cannot report a different build than the application behind it. When the runtime is unreachable it says so rather than showing a stale or assumed number.

Three things that made the workspace feel like it was deciding for you.

• No project is selected on open. Both the workspace and the sidebar fell back to the first project in the list when nothing was remembered, silently scoping everything to a folder you never chose and hiding every conversation outside it. Both now rest on no selection, so a fresh open shows all threads including unfiled ones. Cowork no longer refuses to start a conversation without a project either — file writes are project-scoped and the backend already skips them when a conversation has none, so thinking through a problem before binding a folder is a supported path rather than a blocked one.
• Claude subscription readiness was structurally unable to work. The native bridge treated a zero exit code from claude auth status as proof of sign-in, but that command exits 0 whether or not a session exists — a signed-out host returns success with {"loggedIn": false}. No amount of re-authenticating in a terminal could have changed the result. Readiness now reads the reported login flag, with a text fallback for older builds that do not emit JSON.
• Local Brains are named. Several profiles share the Ollama provider — a general, an authoring and a scanner profile — and all three rendered as an identical “Ollama” row in both the Brain picker and the swarm builder, with no way to tell which engine you were choosing. Each row now carries its model, so the choice reads as Ollama · qwen2.5:14b-instruct rather than three indistinguishable entries.

Verification. 1,070 backend tests pass, including a new guard that fails if Claude readiness regresses to an exit-code check. The workspace suite is 14 of 15, with the one failure a pre-existing flake that passes in isolation. Four end-to-end tests encoded the old auto-selection behaviour and were updated to select a project explicitly.

Red was doing two contradictory jobs. It marked critical findings, failed checks and destructive actions — but it also coloured the Send button, folder icons, the Brain Connections header, the login password field and the “Agent tools” toggle. In a security console that trade is a bad one: when ordinary chrome shouts as loudly as a critical CVE, the eye learns to stop listening, and the loudest signal is spent before anything is actually wrong.

• Severity keeps red. Open findings, KEV badges, failure icons, blocked actions, policy denials and destructive-intent controls are unchanged. The Codex “Approve once” control also stays red, because authorising an agent action genuinely is consequential.
• Brand chrome moves to its own token. A new --rc-brand pair carries navigation icons, primary actions and product marks. It is tuned to the octopus logo rather than fighting it, so the workspace reads as one product instead of a permanent alert state.
• Two more undefined tokens fixed. --rc-accent-violet was referenced eleven times in Custom Capability and never defined, so those chips and buttons rendered with no colour at all — the same class of defect as the --rc-bg gap closed in 0.4.1. Two Release Governance controls also paired an indigo background with red text. Both now resolve.
• Consistent across both themes. The new tokens are defined for light and dark, so primary actions, the sidebar and Cowork no longer drift apart when the theme changes.

How this was checked. Brain Connections and Cowork were rendered and inspected rather than assumed. A diff of the severity surfaces — Findings, Threat Intelligence and the shared stat card — confirms no colour changes landed there at all. Typecheck, lint and the 66-route build pass; the workspace suite is 14 of 15, with the one failure being a pre-existing flake that passes in isolation.

Previous releases established that the platform's parts existed. This one drives them: every node, connector, platform route and execution control is executed against the running application, and three real defects surfaced that no amount of code review had caught.

• SSRF guard was bypassable. The connector URL check blocked 127.0.0.1 but allowed localhost, and never resolved hostnames at all — so any attacker-controlled domain pointing at the cloud metadata address passed straight through. Hostnames are now resolved and rejected when they land on loopback, private, link-local, reserved, multicast or unspecified space. This guard protects every self-hosted connector URL and the entire Custom Capability surface.
• Authenticated fetches were not tagged. Twenty connectors returned findings without a data-origin stamp, leaving the console unable to distinguish tenant data from demonstration data. Provenance is now applied where authentication actually happens, so no call site can emit untagged results.
• One malformed row killed an entire connector. Parsers written against documented vendor shapes crashed on real-world deviations, discarding every valid row alongside the bad one. Row parsing is now contained, and a summarizer failure raises a named error identifying the endpoint.
• Execution channels were never exercised end to end. The shell, browser, credential and production channels opened their own session for the policy call, so every test attempt failed closed at 503 and the real decision path went unverified. It is now driven directly: production shell commands are held for approval, destructive commands are not auto-approved, a self-asserted caller_role cannot escalate a decision, and Trust Fabric evaluates and flags every request.
• Complete node surface. Custom Capability gained the /findings and /providers routes it was missing, so all 26 nodes expose an identical contract. The four collapsed sidebar arms now open by default, making every node visible on load rather than only the nine under Protection.
• AWS Security Hub is honest about its limits. It was registered as a native adapter but could not sign requests, returning an empty list indistinguishable from a clean account. It now raises with an explanation.
• Workspace UI. The --rc-bg token was referenced in eleven places and never defined, so Cowork inputs and search fields rendered with no background — the root cause of that surface looking unfinished next to Chat and Security. Panel headers, hover states, file-tree density, context selection and the active-conversation indicator now follow one shared vocabulary in both light and dark themes.

What is verified and what is not. 26 of 26 nodes answer every operator call, 57 of 57 connectors complete a full fetch and correctly reject bad credentials, 189 platform routes load on an empty tenant, and 98 adversarial checks hold. Connectors are still exercised against responses shaped like vendor documentation; GitHub, VirusTotal and CISA KEV remain the only three confirmed against a live tenant.

Security mode previously had twelve provider names that could be configured but had no adapter behind them. That is now a build-breaking condition rather than a hidden product gap.

• All declared provider types are live-capable. Veracode, Orca, Jenkins, Code42, DTEX, Fortinet, OneTrust, Transcend, Google Workspace, Salesforce, Exabeam, and Securonix now have read-only adapters with matching configure forms, bounded outbound calls, Trust Fabric-gated credentials, provenance tagging, and explicit failure states.
• No partial Capability Nodes. Application Security, Attack Path Analysis, Security Automation, Insider Risk, Network Security, Privacy Governance, SaaS Security, and User Risk no longer contain a provider that silently has no execution path. A coverage test now rejects any mapped provider without an adapter.
• Special nodes scan what they actually own. Identity Security now uses the shared live connector scan path. AI Security aggregates governed AI-event telemetry. Release Governance evaluates the tenant deployment posture and control catalog. Custom Capability has a bounded root scan across configured definitions, with SSRF validation on every custom endpoint.
• Adapter failures are honest. The registry no longer converts an adapter error into a false successful empty response. Failed calls are reported as failures and the node keeps clearly labelled demonstration data instead of claiming a clean live scan.

Operational validation still matters. The adapters are complete in the product contract, but a vendor can change endpoint details or response envelopes. Enkstein fails closed to labelled demo data when that happens. The next production step is tenant-by-tenant connector verification through the now-real credential test rather than accepting a generic reachability result.

Auditing every connector's authentication path surfaced a contradiction: a connector could offer “Sign in with Microsoft” and still show Client ID and Client Secret fields directly underneath, which makes signing in look pointless.

• The credential form is now the fallback. Where browser sign-in is available the key fields collapse behind “Or enter API credentials manually”, and say plainly that they are only needed when you cannot sign in — an unattended service principal, for example. Connectors with no sign-in path are unchanged.
• Snyk and PagerDuty gain browser sign-in, bringing the total to 18 of 63 connectors: 6 that need no setup at all, and 12 that need a one-time OAuth client ID.

Why the remaining 45 stay key-based. Tenable, Qualys, CrowdStrike, Splunk, Wiz and the rest publish no OAuth authorization endpoint; their documented integration path is an API token. Converting a logged-in browser session into API access would mean reading session cookies or driving the vendor's pages, which breaks on any UI change and is the wrong trade for a tool holding production credentials. When those vendors ship OAuth, adding them is a table entry.

Interactive sign-in previously reached four connectors, because it used the device grant (RFC 8628) and few vendors publish a device endpoint. Enkstein is a desktop application, so it now uses the flow desktop applications are actually meant to use: an OAuth authorization code grant with PKCE, redirected to a loopback address only this machine can receive.

• Approve in a browser, no app registration. Microsoft connectors — Entra ID, Azure, Defender, Sentinel, Purview — sign in with one approval and no client secret, because Azure CLI publishes a loopback-registered public client. GitHub, GitLab, Google Cloud, Okta, Slack, Jira, ServiceNow, Auth0, and Datadog are supported once a client ID is supplied.
• You do not copy a code. Enkstein listens on 127.0.0.1 for the provider's redirect, so approving in the browser completes the connection. The listener starts only while a sign-in is in flight and never logs the authorization code.
• A connector says what it needs. Vendors that publish no shared public client ask for a one-time OAuth client ID and show the exact redirect URI to register. A connector with no OAuth endpoint at all does not offer a button that could only fail.
• Tokens keep working. Refresh tokens renew transparently through the same path adapters already use, so a scheduled scan does not stop an hour after sign-in.

What this is not. No cookies are read, no page is driven, and no vendor session is reused. Enkstein opens the provider's own consent screen; the grant is visible and revocable there. PKCE means no client secret is embedded in the distributed application. Sign-in passes the same Trust Fabric gate as manual credential configuration, a sign-in request is single-use, and a code issued for one connector cannot be redeemed into another.

A marketplace of 56 connectors is only worth having if a stranger can configure one and trust what it tells them. This release closes the three gaps between "the connector is listed" and "the connector works".

• Connected now means the credential was accepted. Previously most connectors were tested by reachability, so an unauthenticated 200 from a vendor's login page reported success and told an operator nothing. Every connector is now verified by calling the provider with the stored credential through the connector's own adapter. Local Terraform tooling is the one honest exception, and it says so.
• The configure form asks for the right fields. Security Hub and Defender for Cloud were asking for a bare API key that no AWS or Azure credential can satisfy. Adapter requirements and form fields are now reconciled, and a test fails the build if a connector ever requires a field the form does not collect.
• Vendor Risk is no longer inert. It was the one Capability Node where every provider it referenced lacked an adapter, so it could only ever show demonstration data. SecurityScorecard, Bitsight, and UpGuard adapters are added, and a test now asserts that no Capability Node is left without a live path.
• CISA KEV works with no credential at all. Threat Intelligence referenced the Known Exploited Vulnerabilities catalog but had no adapter for it. It is a free public feed, verified here against the live catalog: 1,653 real exploited vulnerabilities parsing correctly. ThreatFox and MISP adapters are added alongside it.
• Provider pills say when a credential would not help. A provider with no adapter used to look merely unconfigured, so an operator could connect a key and reasonably conclude the product was broken when the node kept showing sample data. Those providers now read "no live adapter yet" and are visually distinct from ones that are simply not connected. The pill was duplicated across 21 Capability Node pages and is now one shared component.

Honest limitation. The declarative adapters are written from vendor API documentation, not verified against live tenants. Some endpoint paths and field names will be wrong on first contact. The framework fails safe: a provider error falls back to clearly labelled demonstration data rather than inventing findings. GitHub, VirusTotal, and CISA KEV are the connectors confirmed against real responses so far.

Several Capability Nodes shipped with working provider adapters that their own scan route never called, and connecting a connector could make a module look broken. Both are fixed, and Microsoft connectors gain one-approval sign-in.

• Adapters are actually invoked. Privileged Access now calls its Entra and Okta adapters and Security Telemetry calls Splunk, taking the platform from five connector-backed Capability Nodes to seven. Nineteen nodes now share one scan path so behaviour cannot drift apart again.
• A configured connector no longer empties a module. Previously, connecting a credential to a node with no live adapter hid its demonstration findings and showed nothing, which reads as a broken scan. Those nodes now keep showing clearly labelled demonstration data and say why: "Connector configured, but no live adapter is available yet." A connector that errors keeps its demonstration data too, and reports the failure rather than silently showing an empty list.
• Interactive sign-in for Microsoft. Entra ID, Azure, Defender, and Sentinel connectors can be connected with the OAuth device grant: Enkstein shows a code, you approve once in a browser, and it receives a refresh token. No app registration and no client secret. This is a documented provider flow — no cookies, page automation, or vendor session tokens are involved, and the grant is revocable from the provider's own consent screen. Device sign-in passes the same Trust Fabric gate as manual credential configuration.
• Tokens refresh on their own. Adapters accept a device-code token in place of client credentials and renew it transparently when it expires, so scheduled scans do not quietly stop after an hour. GitHub device sign-in is present but stays disabled until a deployment supplies its own OAuth client ID, because GitHub offers no first-party public client; PAT configuration is unaffected.

The blocker for beta testing Security mode was that a tenant with one live connector still saw hundreds of demonstration findings with no way to tell them apart. Findings now carry a data origin.

• Origin on every finding. A new data_origin field records live, simulated, or unknown, alongside source_connector naming the connector behind a live result. Provider adapters tag their own output: the authenticated path reports live, the fallback path reports simulated.
• Fails toward honesty. The finding pipeline constrains whatever an adapter sends to a known vocabulary and defaults to unknown rather than live, so an untagged or unrecognised adapter can never be presented as verified customer data. A rescan that omits the origin cannot downgrade a finding already confirmed live.
• Filter and see it. The findings console gains a data-origin filter, a per-row badge, a live-of-total count in the stats bar, and connector attribution in the detail drawer. The API accepts ?data_origin= and /findings/stats returns a by_origin breakdown.
• Migration 0004. Adds both columns and an origin index. Existing rows backfill to unknown, never live, so nothing already stored can be mistaken for real estate data.

Three gaps closed ahead of release, each with regression coverage.

• LLM02 — binary output handling. Provider-generated downloads introduced in v0.3.38 were opaque bytes, so a credential inside a generated script or workbook could reach the project folder unexamined. Downloads are now unpacked (including compressed OOXML/ZIP members) and DLP-scanned before they can become a governed change; a sensitive file is dropped and named in the reply instead of written.
• LLM04 — AI denial of service. Governed turn, streaming, and research endpoints are rate limited per authenticated identity. The key is the identity rather than the client IP, because every desktop request arrives from the same loopback address and an IP bucket would let one runaway conversation throttle the whole tenant. Tunable via AI_RATE_LIMIT_WINDOW_SECONDS and AI_RATE_LIMIT_MAX_REQUESTS.
• LLM09 — overreliance. Lowering a detected data classification is the direction that can route restricted content to a cloud provider, so it now requires an explicit override_reason. The audit entry retains both the detected and the asserted level. Raising a classification stays frictionless, so operators are not nudged into leaving it unset.

When a provider runs its own tooling it produces a genuine document, spreadsheet, or archive — better than anything reconstructed from prose. Enkstein now asks for those files first, collects them from the visible completed turn, and writes them into the project folder byte for byte. Local rendering remains the automatic fallback.

• Downloads are read in the provider page's own session; no cookie, token, or credential is read, copied, or forwarded, and nothing is persisted to the broker journal.
• A provider file supersedes any text-derived change with the same filename, and inherits the directory the response chose, so it lands beside its siblings rather than at the project root.
• Attachments are bounded and re-validated at every boundary — extension, native broker, and backend — for name shape, count, and decoded size; traversal names and malformed payloads are rejected.
• Plain-text files (code, config, markdown) continue through the normal governed manifest, so a turn mixing scripts and documents applies completely.

A Brain can only return text, so a requested .docx or .pptx previously reached the folder as markdown under an Office extension — a file Word and PowerPoint refuse to open. Enkstein now renders the real Office binary locally from the Brain's markdown and mirrors that through the same governed write boundary.

• .docx, .pptx, and .xlsx are rendered in the backend; headings, bullets, page breaks, code blocks, and markdown/CSV tables are preserved, and each #/## heading starts a new slide.
• Binary content travels to the approved host root base64-encoded through the native broker, which applies the same containment, allowlist, and size checks as text writes.
• A document that cannot be rendered is skipped rather than written as broken text, so an unopenable file is never reported as applied.
• The Cowork project/review panel can be dragged wider (or maximized) up to 900px, with the width persisted; wide panels show full-height diffs and larger editor type for reading scripts before approval.

The governed Cowork execution contract now explicitly allows batching. When a change set is too large for a single response, the Brain delivers a coherent subset of complete files and names what remains, and Enkstein applies each governed batch as it arrives.

• The strict (smart) contract no longer implies emitting every file twice — file content is included once, inside the marcellus_changes array.
• Partial or truncated files are still never accepted; only complete files are applied, and the automatic recovery retry uses the same batch-friendly instruction.

The interface now renders in Inter — self-hosted at build time with native SF Pro, Segoe UI, and Roboto fallbacks — for higher-contrast, more readable UI and chat text.

• Assistant Markdown gets a taller body rhythm, clearer heading hierarchy (with an underlined H1 and small-caps H5/H6), and roomier list spacing.
• Tables use tabular figures, zebra striping, and cleaner row rules; fenced code renders slightly smaller in a dedicated monospace stack with ligatures disabled for exact alignment.

Completed Cowork turns now retain an expandable Files changed ledger beside their governed context and Brain provenance.

• Every row identifies the relative project path, create/update/delete operation, and actual applied, proposed, skipped, or blocked result.
• The ledger is content-free, tenant-scoped governance metadata and remains visible when a conversation is reopened.
• Assistant output continues to render as sanitized Markdown with readable tables, labeled copyable code blocks, and Mermaid diagram labeling.

Cowork now accepts an exact standalone marcellus_changes label followed by a JSON array even when a Browser Brain omits Markdown fences. The array is removed from chat, validated, and routed through the existing governed proposal or Auto-apply writer.

• Every operation and relative path still passes the existing schema, protected-directory, project-root, and Trust Fabric checks.
• Output DLP no longer mistakes JSON-escaped framework decorators such as \n@routes.route for email addresses; real email addresses remain redacted.

Once a browser task has started, transient host-bridge status failures no longer terminate the turn. Enkstein reports a reconnecting state and continues polling until the task completes or reaches the existing governed browser deadline.

• The 890-second Brain bound and 900-second workspace bound remain unchanged.
• A focused regression test covers status failure, reconnection, streaming, and successful completion.

Browser turns are now allowed to wait for the same bounded 15-minute deadline enforced by the governed backend. This prevents a desktop WebKit/proxy heartbeat gap from turning a still-running ChatGPT task into a false UI failure.

• Local and API turns retain the short 75-second dead-stream guard.
• Browser tasks remain bounded by Trust Fabric and the backend deadline; this does not create unbounded background execution.

ChatGPT streams by replacing text nodes inside an existing assistant container. The Companion now records text and descendant mutations against that assistant message, allowing the stable completed answer to be correlated and returned to Enkstein.

• Reloading the extension can recover a pending task from its session metadata without persisting prompts, responses, cookies, or account tokens.
• Browser task lifecycle remains visible as queued, submitted, streaming, and completed; provider DOM content is still never journaled.

The dedicated local Qwen file author now runs after a plan-only response from either a Browser Companion or a Hybrid/local profile. Cowork no longer treats an Ollama architecture answer as a reason to skip implementation.

• The author receives its configured Ollama output budget, avoiding the short default reply that cut multi-file manifests off mid-generation.
• Complete entries in a truncated ordinary JSON fence are recovered, validated, and governed; the incomplete trailing entry is discarded.
• Live verification used the installed qwen2.5:7b runtime to produce a parsed README.md, .env.example, and app.py manifest.

Browser Brains now act as advisors for Cowork implementation requests. When they return a plan rather than Enkstein’s governed file manifest, Cowork hands a bounded copy of that answer to the local Qwen file author.

• The local author produces a project-relative create/update/delete manifest, which is still checked by Trust Fabric and written only through the connected project-root bridge.
• Auto-apply writes each file individually; approval-first keeps the exact same changes reviewable. The live timeline now shows Browser plan handoff, local file author work, and each resulting write instead of presenting a plan as completed execution.
• Browser credentials, cookies, and sessions remain outside Enkstein. The local author receives only the user request and a bounded, redacted browser answer.

This release completes two provider compatibility paths that prevented the deterministic local writer from receiving an otherwise valid change request.

• Browser handoffs now use a bounded continuity capsule rather than inserting the full prior transcript into ChatGPT, avoiding contenteditable normalization failures on large conversations while preserving recent task context.
• Local-model JSON fences are normalized when they use common field names such as type and file_path, including JSON-encoded object entries. They still pass the exact same project-relative path, protected-directory, Trust Fabric, and approved-folder checks as Enkstein-native manifests.

Cowork previously accepted a browser response such as “the files were already staged” even when the response contained no file contents. That could leave a connected local project unchanged while the answer sounded as though implementation had happened.

• File requests now require complete project-relative file output in the current response. The provider is explicitly told not to substitute a plan or refer to an earlier answer.
• If no parseable files arrive, Cowork makes one bounded governed retry in the same Brain session for the actual file manifest. It only writes after the normal Trust Fabric and local-folder checks pass, and otherwise says plainly that no local files were created.

The installer copied the new runtime correctly, but its frontend image could not build because an unrelated lockfile dependency had been changed to a nonexistent registry release during version stamping. The lock now retains the package's real published version, and a clean install and production build were completed before this replacement installer was signed.

The generic Next.js API rewrite can buffer or end a long-lived SSE response even when the FastAPI backend is emitting regular heartbeats. That made Enkstein's 45-second client watchdog report a failed turn while the Browser Companion continued to stream and ultimately completed the provider answer.

• Cortex turns now use a dedicated Node.js streaming route with a 15-minute maximum duration and explicit no-buffer headers. Provider progress and backend heartbeats reach the desktop UI as they arrive.
• The desktop idle guard now allows 75 seconds for a genuine network or WebKit scheduling delay, while the backend remains responsible for the 15-minute governed browser-turn deadline.

Long browser generations now keep their Companion connection live for their entire observed lifecycle. Previously, the extension correctly reported a submitted or streaming task, but the native bridge only refreshed readiness when it was idle and polling for new work. After its 50-second idle threshold, Enkstein could wrongly say it could not reach ChatGPT while the same signed-in tab was still actively producing the requested answer.

• A successful prompt submission, live streaming update, or completed browser task now acts as a verified Companion heartbeat for that provider.
• Subsequent turns and Brain Connections status stay ready while a large ChatGPT/Claude/Gemini response is in progress, without creating a second browser task or weakening pairing boundaries.

A request that legitimately took several minutes for a browser Brain to answer (for example, generating a full application scaffold) could still fail with "the governed turn stream stalled," even after the 0.3.20 timeout increase, and even though the browser session went on to complete the answer correctly. Root-caused by watching a real live 6-minute request: the governed turn's own request was being wrongly treated as disconnected by the client partway through, rolling the turn back before the Brain's answer could be persisted, while the browser task kept running to completion with nobody left to receive it.

• The turn stream previously checked request.is_disconnected() once per heartbeat (every 10s by default). That call internally reads the same raw ASGI receive channel uvicorn itself uses; polling it repeatedly for the several minutes a long browser generation can take is a known false-positive source, and it is what was silently tearing the connection down mid-turn.
• The stream now watches for a real client disconnect exactly once, in a single dedicated background task for the life of the turn, instead of repeatedly polling the same channel. Verified against a live 6-minute end-to-end reproduction through the real Docker/Next.js stack with no false disconnect and a clean completion.

Codex/Claude subscription and browser session detection could keep showing "needs setup" after a real, successful CLI login, and package updates could appear to install with no effect at all. The cause was not the detection logic -- it was that the native Brain Bridge (a separate always-on background process from the desktop app) could end up detached from launchd's supervision and never actually exit when the launcher tried to restart it. A brand new, correctly updated process would then repeatedly fail to bind its port behind the stuck old one and crash-loop forever, while the stale process from an earlier install kept answering every request with outdated code and stale Brain readiness.

• The Brain Bridge now installs real SIGTERM/SIGINT handlers, so a normal stop request always releases its port immediately instead of potentially being ignored.
• The launcher now verifies the port is actually free after asking the bridge to stop, force-killing whatever still holds it if it does not exit in time, and confirms a fresh process is genuinely listening before treating the restart as successful -- rather than assuming a requested stop/start always worked.
• The installer's postinstall step now also restarts the Brain Bridge service itself (previously it only relaunched the desktop app), so a package update takes effect immediately without requiring a manual process kill or reboot.

A large multi-file/full-app request could legitimately take a browser session (ChatGPT, Claude, Gemini) several minutes to generate. Every layer of the request budget -- the outer turn stream deadline, the per-Brain wait, the native bridge's own wait, and the bridge HTTP client's own timeout -- was sized for a normal chat answer, not a long generation, so the turn was silently abandoned partway through even though the provider tab went on to finish the answer.

• The outer streamed-turn deadline for browser sources raised from 210s to 900s (15 minutes).
• The per-Brain browser wait in the Cortex Gateway raised from 170s to 890s, staying inside the new outer deadline.
• The native Brain Bridge's own browser wait raised from 180s to 900s to match.
• The bridge's internal HTTP client timeout, previously fixed at 180s for every call, now accepts a per-call override so the (fallback) blocking browser invocation is no longer cut off underneath the bridge's own longer wait.

The native Brain Bridge already tracked real browser-session states (queued, leased, submitted, streaming) internally, but those states were discarded at the bridge boundary -- the backend only ever saw one final response after up to 170 seconds of silence. Cowork's file-apply step also only ever reported one summary count, never which files actually changed.

• The native bridge now exposes non-blocking /v1/browser-invoke/start and /v1/browser-invoke/status endpoints alongside the existing blocking call, so a ChatGPT/Claude/Gemini browser turn's real lifecycle state is polled and forwarded live instead of only surfacing after the fact. Older bridge builds without these endpoints fall back to the original blocking call automatically.
• Cowork's auto-apply writer now reports each file's write/delete outcome individually as it happens, instead of a single end-of-batch count.
• The in-flight activity feed is now a real two-layer execution timeline: Enkstein's own pipeline stages (context compiled, sent, files written) apply to every Brain, including a fully local Ollama turn that has nothing else to show; a separate Brain-native layer surfaces the answering Brain's own real states only when that source actually reports one -- a browser turn now genuinely shows "waiting for ChatGPT to respond" / "ChatGPT is streaming" rather than a single opaque "Cortex is working" badge, and nothing is invented for sources that have no native state.
• The browser companion extension's manifest version now tracks the desktop app version on every release (starting here at 0.3.19) instead of its own separate counter, and it ships the same octopus mark as the desktop app icon instead of the browser's default puzzle-piece icon.

Opening a conversation from a different Cowork project than whatever the sidebar's project picker had selected could leave the previous project's files showing in the right-hand file panel -- and selectable for a new turn -- because artifact loading was handled ad hoc in several different code paths, each only covering its own trigger.

• One project (the project of whichever conversation is actually open) now exclusively owns the file panel's contents, replacing the scattered per-action refreshes that could each individually forget to update.
• The file panel header now names the project it's showing, and the sidebar's own project selector is kept in lockstep with it, so the two blades can no longer disagree about which project is active.
• Creating a file, adding files, and syncing a local folder now always target the project that's actually open, not whatever the sidebar dropdown happens to show.

A Brain could correctly produce a full project scaffold (for example, a nested layout staged with .keep files), yet Cowork failed to create it locally.

• The native writer rejected any file whose extension was not on a fixed allowlist. Extensionless dev markers like .keep/.gitkeep and common source types such as .swift were refused, so an Apple-app scaffold could never be written. The writer now accepts these, matched by full name for extensionless files, while backend path validation still blocks secret files and protected directories.
• Agent-turn extraction silently capped at 10 changes, truncating larger scaffolds. The cap now matches the manual batch ceiling (100), so a real multi-directory layout is applied in full.

A browser turn could reach ChatGPT and produce a visible answer, yet Enkstein never captured it back — the companion waited on the provider's stop/streaming control to clear, and if that control lingered in the DOM or its selector drifted, the finished answer sat unread until the invoke timeout.

• The companion now accepts a completion when the visible answer has been non-empty and unchanged for a short stall window, even if the streaming indicator still reads active.
• The normal fast path (finish the instant streaming stops) is unchanged; this only adds a fallback so selector drift can no longer strand a rendered answer.
• Browser Companion bumped to 0.1.12 — reload it in your browser's extensions page to pick up the fix.

Cowork agent mode previously only wrote files when a Brain emitted a strict marcellus_changes JSON block, which browser chat models (ChatGPT/Gemini/Claude web) rarely produce — so "build me an app" gave structure in the reply but created nothing on disk.

• Structure modes: Smart (strict JSON protocol), Fast (scrape filename-labelled code fences), and Auto (try the protocol, fall back to code fences) — chosen from the Cowork composer.
• Auto-apply: when enabled and a local folder is connected, extracted changes write straight into the folder through the existing Trust Fabric path and become active file versions; with no folder connected it safely degrades to pending review.
• The Brain now receives format guidance it can actually follow, and the file tree refreshes automatically after applied changes.