Kernel v0.15.0 · TUI/Portal v0.10.0

New features and improvements

1. 01

   A cockpit that shows where the tokens go

   TUI/Portal v0.10.0 brings token and context telemetry into the places operators already look — the home view and the per-round API-call footer — instead of hiding it behind a metadata dump.

   • API-call group footers now show current-round token usage — input, cache miss, output, and cache rate — so the price of a turn is visible right where the call is (#441).
   • The home view bottom row shows current-session token telemetry plus a compact context-percentage bar, so a session's budget is legible at a glance (#441).
   • Ctrl+O replay hides the bulky _meta envelope by default and points to /notification when full metadata is actually wanted (#440).

   Why it matters:You cannot trim what you cannot see; putting per-round token cost and session context in the default view is the first step toward an operator noticing a session that is quietly burning budget.

2. 02

   Telemetry copy and layout, made legible (#442–#447)

   New telemetry is only useful if it reads cleanly, so the home telemetry work was followed by a focused copy-and-layout pass that kept the footer, fixed the layout, and made the status hints bilingual and correct.

   • The footer is preserved while session telemetry is shown (#442), and session telemetry no longer requires Ctrl+O to appear (#443).
   • The home telemetry context row layout is fixed (#444), and the home status hint and zh telemetry copy are cleaned up (#445).
   • The home status hint is corrected to say "expand" (#446) and then localized so it speaks the operator's language (#447, the TUI candidate head).

   Why it matters:A telemetry row that overflows, hides the footer, or shows an English-only hint to a Chinese operator undoes the value of the data; this pass is what turns a feature into something readable by default.

3. 03

   Richer session observability and faster loading

   Beyond the home row, session and kanban detail panels carry more cached per-session stats, keyed to molt windows so a refresh stops drifting, and session events now load from a SQLite index instead of re-scanning files.

   • Session/kanban detail panels show richer cached per-session stats — API call stats, expanded token breakdowns, and agent paths — keyed to molt windows so refreshes stop drifting (#428, #430, #432, #433, #438, #439).
   • Session events load from the SQLite index instead of re-scanning event files, so opening a long session is faster (#435).
   • The markdown viewer renders YAML front matter (name / description / version) instead of silently stripping it (#426).

   Why it matters:Observability that drifts on every refresh or pays a full re-scan to open a session is observability operators stop trusting; pinning stats to molt windows and reading from the index keeps it both correct and fast.

4. 04

   Bash results and the token ledger tell the truth

   Kernel v0.15.0 makes two of the runtime's most-trusted signals harder to misread: a completed bash command now reports whether its inner command actually succeeded, and the token ledger is indexed with an explicit reporting scope.

   • Completed bash commands carry additive, model-visible ok / command_status / warning fields, so a nonzero inner exit or a Python traceback no longer hides under status: ok; the status field keeps its old meaning for compatibility.
   • The token ledger is indexed in SQLite, and sum_token_ledger gains an explicit scope — main_agent excludes daemon rows, all includes them — with parent/child double-count semantics documented and tested.
   • Tool-result top-list metadata is trimmed and the latest agent-meta payload is slimmed, so the model spends fewer tokens on its own bookkeeping (#490, #516).

   Why it matters:An agent that reads `status: ok` as success when the inner command failed, or that cannot say whether a token total includes its daemons, makes confidently wrong decisions; these changes make the signal match reality.

5. 05

   Secret redaction, source drift, and daemon artifacts

   Several kernel changes harden the seams where a long-running fleet is most exposed: a separate-process event log that could leak secrets, source that silently drifts from the running runtime, and daemon runs that were expensive to inspect.

   • The relaunch/refresh watcher subprocess now routes events.jsonl writes through the kernel redactor (key-aware, fail-open with a diagnosable redaction_unavailable marker), closing a separate-process gap where stderr tails, cmdlines, or errors could persist secret-shaped values.
   • Startup runtime fingerprints (git HEAD + source digest) land in .status.json; agents emit source_drift nudges when on-disk source diverges from the running runtime, and lingtai-doctor reports them — skipped in dev runtimes (closes #178).
   • Each daemon run writes a metadata-only artifacts.json, so daemon(action="check") can surface path, size, mtime, and role without scanning the run directory, with safe fallback for older runs.

   Why it matters:These are exactly the failure modes a fleet hits only after hours of unattended work — a secret persisted by a side process, an agent acting on stale source, a daemon too costly to audit; fixing them keeps long autonomy trustworthy.

6. 06

   Codex summarize guidance, framed as an investment ratio

   The Codex adapter's summarize guidance was reframed from stale wait/countdown fields into an investment ratio, and then its thresholds were tuned — the newest functional change in this release window.

   • _meta.agent_meta.adapter_comment now reports full / incremental counts, a full_to_incremental_ratio, a target of 1:10, and dynamic summarize_economy maintenance hints instead of stale wait/countdown fields (#518).
   • The summarize guidance thresholds were then tuned so the hint fires at the right moment rather than over- or under-prompting (#519) — the newest functional change before the version bump.
   • Supporting Codex work decouples continuation from transport, makes session identity molt-aware, rotates and allows overriding the endpoint pool at molt boundaries, and surfaces the WebSocket cache ledger (#486, #495, #498, #502, #504, #517).

   Why it matters:Summarization is a tax on every long session; framing it as a maintainable ratio with tuned thresholds turns a vague "summarize soon" nag into guidance an agent can actually budget against.

7. 07

   Release hygiene, validation, and contributors

   The paired versions were re-targeted to TUI/Portal v0.10.0 and kernel v0.15.0 (kernel bump PR #521) and validated from clean release worktrees before any publish step.

   • Kernel gates at the v0.15.0 bump commit c365eec (on base 0797e93): compileall clean; full pytest 2935 passed, 4 skipped; python -m build produced sdist + wheel; twine check PASSED on both.
   • TUI/Portal gates at candidate head 37be28b (= origin/main, build version injected via make ... VERSION=v0.10.0, no source bump): git diff --check clean apart from the known generated docs/stars/stars.csv CRLF caveat; full TUI and Portal Go tests passed; portal/web npm ci && npm run build passed; make build produced lingtai-tui v0.10.0 and lingtai-portal v0.10.0.
   • Noted, non-blocking: the portal/web npm-audit advisories affect dev-only tooling, not the embedded web/dist the Go binary ships; the locally built kernel wheel is macOS-arm64 platform-tagged, so the portable sdist is the artifact for PyPI unless per-platform wheels are intended.
   • Contributors in this window: @huangzesen (lead, scope and validation owner), @ktwu01 (TUI preset refactor), @9s5bz2jvd2-lang (TUI beginner work-manual rewrite), and @TZZheng (kernel runtime source-drift nudge and MCP inbox latency diagnostics).
   • Issue reporters whose reports drove shipped/completed work this window: @lin-du (kernel #301 → shipped as PR #488 "Expose Telegram rich formatting options", plus #300 completed) and @888yzbt888 (TUI #401 preset bugs; Bug 1 fixed by in-window kernel PR #479, closed COMPLETED).
   • Thanks also to @BrianLiubr (TUI #429/#431) and @xczics (TUI #437) for in-window bug reports still under triage — noted here, not yet shipped fixes.

   Why it matters:A version bump still deserves full gate evidence and an honest contributor list; recording that the publish artifacts and tags are cut from these exact validated commits is part of shipping responsibly.