Changelog

Bami phase one​

• Bami documents diagnose, correct, and verify.
• Phase one tests target an existing deployment ID. Bami never creates deployments and cannot change routing.
• Publish, activate, delete, and deprecate stay disabled in Bami. Phase two enables only activate, delete, and deprecate. Publication waits for phase three.
• Bami model usage is platform-paid. Labelled tenant tests remain tenant-charged.
• The phase one handoff includes a minimal REST example, request ID capture, and recovery when audit rows are missing.
• Bami cannot touch your machine. It proposes local changes and verifies Pantheon-side results.
• The proposed Data handling retention sentence stays in source, marked pending counsel review, and is not published.

8 September 2026​

Documentation fixes from the first external builder's dogfood report:

• Documented side_effect values, defaults, accepted confirmation values, and application approval gating.
• Corrected ToolResponse examples and deployment binding to latest_definition.id.
• Limited tool version requests to accepted fields and documented rejected name and display_name fields.
• Corrected the quickstart model to deepseek/deepseek-v4-flash and directed builders to GET /v1/models.
• Clarified list response envelopes and pagination in the API summary tables.
• Added exact-name tool lookup and recovery from 409 idempotency_conflict using tool_id.
• Documented 32-character hex run ids in responses and stream events.

12 September 2026​

An agent can now authenticate to something.

• Workspace secrets. Store a credential for your workspace at POST /v1/secrets, then name it on a session so it reaches that session's sandbox and no other. Until now the only way to give an agent a token was to paste it into a prompt or a file, and the platform-wide environment variables are operator-only and shared by every workspace.
• The value is written once and never returned. There is no route that reads it back, so list and read answer with the name, the description, who set it, and a fingerprint that tells two values apart without revealing either. It is encrypted at rest, and it never appears in an event, a log line, a stored record, or anything sent to the model provider.
• Said plainly, because finding it out later is worse: the agent has a shell in its own sandbox, so it can read its own environment and its own files and print the credential into its own output. Store narrow, short lived credentials and revoke them at the source when the work ends.
• Delivery is by environment variable, by file, or by both, because command line tools are split between the two. A file is written with mode 600 before the first run. A session's new env field sets plain non-secret variables alongside, for the tools that want a directory named by one.
• Two new scopes, secrets:read and secrets:write. Neither can read a stored value. Naming secrets on a session needs sessions:write and secrets:read together.
• Four audit actions: secret.created, secret.updated, secret.deleted and secret.attached. Each names the entry and never its value.
• Both SDKs gained the five calls and the two session options.
• Fixed on the way: the sandbox provisioning path production actually takes created every sandbox with an empty configuration, so an environment's settings reached the provider only on the fallback paths.
• Self-hosting now needs PANTHEON_SECRETS_ENCRYPTION_KEY. See Self-host.

11 September 2026​

Breaking, and deliberately so: an agent's declared tools now govern what it can do.

• An agent's tools list is enforced at run time. A built-in tool the agent does not declare is not attached, and a call to one is refused before it runs. The supported names are web_search, web_fetch, publish_artifact and list_session_artifacts. Until now the list was stored and returned but never read, so an agent that declared nothing still had web access.
• The list does not govern the sandbox, and you should not read it as a full lockdown. While requires_sandbox is true the agent still has a shell (execute) and the file tools, and the sandbox can reach the network, so an agent that declares no web tools can still fetch a URL from the shell. Set requires_sandbox to false to remove all three together.
• The frozen agent revision a deployment pinned is what governs a run, so editing an agent no longer changes what a running deployment may do.
• Agents that existed before this change are not affected. They report tool_policy.mode as unrestricted and keep every built-in tool. Writing tools on one governs it from that revision onward. Agents created after this change are governed from their first revision, so an omitted tools list means no built-in tools.
• Every run opens with a tool.policy event naming what was granted and what was withheld, with a reason for each. A call to an ungranted tool arrives as tool.refused, not tool.failed.
• mcp_servers is removed from CreateAgentRequest, UpdateAgentRequest and AgentResponse. Nothing ever dispatched it. Sending it is ignored rather than rejected.
• environment_id now provisions the sandbox it selects. It used to be validated and then ignored. EnvironmentConfig keeps only the fields provisioning honours, and the response no longer echoes the rest.
• Agent memory is now scoped to one end user. A session created with user_id shares memory across that person's sessions; a session created without one keeps memory inside that single session. Before this, sessions without a user_id shared one memory per workspace, so notes an agent kept about one end user could be read in another end user's conversation. Existing shared memory has been moved out of reach rather than reassigned, so an affected agent starts from an empty memory. Memory that was already scoped to a user_id is unchanged.
• GET and DELETE /v1/users/{user_id}/memory and /v1/sessions/{session_id}/memory report what an agent holds and erase it. Deleting a session or a tenant user now erases the memory scoped to it. See Agent memory and Data handling.
• The TypeScript SDK's createSession and PantheonChat component now accept userId, which previously could not be set from that SDK at all. The Python PantheonChat accepts user_id.
• The seeded memory template now tells the agent to keep preferences and working context only, and lists what not to record.
• Erasing memory now appears in your audit log as memory.erased, whether you called DELETE yourself or it followed from deleting the session or the end user. The record names the scope and the number of entries removed, never their text.
• To be plain about what runs today, and about how far the defect above actually went: an agent's memory files live with the session sandbox, so they do not survive it. Durable cross-session memory is wired but not switched on, which means the durable store is written to by one thing only, the seeder, which copies a fixed template once per scope. No note an agent wrote has ever been placed there, so the shared bucket held template copies and nothing about anyone. The scope fix above applies to the durable store, so the sharing cannot return when it is switched on.
• Compacting a long conversation does not make an agent forget. History is summarised; memory is re-sent in full on every call. An agent's declared tools list does not govern memory either, since memory is reached through the harness file tools rather than the built-in catalog.

9 September 2026​

• Both SDKs reconnect with backoff when stream.resync repeats within seconds of connecting; hand-rolled clients should do the same (see Handle stream.resync). This is SDK 0.1.1 in the repository, unreleased pending publication; the published packages remain 0.1.0.

7 September 2026​

• Dashboard shows field-level validation reasons; sign up checks the password length before sending.

6 September 2026​

• Dashboard Agents, Tools, and Sessions pages manage agents, tool versions, deployments, and sessions.
• Usage and limits documents GET /v1/usage and the three per-tenant rate limits.
• The status page reports component health.
• Deployment rollback selects an active deployment for new slug sessions.
• Per-operation tool result schemas support top-level oneOf and anyOf branches.
• SDKs published: @alethi/pantheon-chat 0.1.0 on npm, pantheon-chat 0.1.0 on PyPI.
• Email verification and password reset.
• Build on Pantheon page.
• llms.txt.

4 September 2026​

• Slug sessions now prefer the newest published deployment.
• Tool lifecycle events now share one tool_call_id.

3 September 2026​

• Session streams now deliver live ephemeral deltas with event_deltas=true.
• SESSION_BUSY now includes the active run and recovery routes.
• Run cancellation now releases a busy session.
• Sandbox failures now return HTTP 503 with a safe message.
• Agents can opt out of sandbox creation.
• Sessions now report sandbox_status.
• Application tool waits now default to 30 minutes.
• Run claims now use owner tokens, leases, and reconciliation.

Contract hardening​

• The checked-in OpenAPI contract now covers every served route.
• Contract tests now require exact route parity.
• Worker tests can limit claims to one tenant.

Open​

See Known issues for current impact and workarounds.

Pitfalls​