Weekly development log 2026‑W44: Session Security Hardening, WebSocket Liveness, DGX Model Alignment, and Knowledge Runtime 2.0

01

Full-history review and additions

Across 189 commits, releases 1.115.6 through 1.121.0 shipped. Delivers session security hardening under Audit PR-3 (token invalidation, real-time WS session revocation, refresh token reuse detection), WebSocket application-level ping/pong liveness with reconnect abort retry, DGX model ID and vLLM serving name alignment with Qwen 3.8 Flash Next profiles, 20-minute long-context LLM_TIMEOUT ceilings, self-hosted web fonts via Fontsource, and Knowledge Runtime 2.0 (space-isolated index Migration 006, actor-byok embedding key policies, space reindexing with automatic failed document re-ingest, and /api/health admin build metadata).

All reachable history of main cbf93635 was rechecked on 2026-10-24. Counts use committer dates from Monday 00:00 through Sunday 23:59:59 KST, including merges, releases and distinct parallel-branch commits. Commit counts are not feature counts. Tests and operational measurements below are historical source records, not evaluations rerun for this refresh.

02

What changed

• Completed authentication and session security hardening under Audit PR-3. Token revocation now triggers immediately upon logout or permission updates, active WebSocket sessions are revoked in real time, and detected refresh token reuse invalidates all related sessions (2b9e92d2).
• Overhauled WebSocket liveness detection and abort resiliency. An application-level ping/pong heartbeat detects stalled dead sockets from network disconnects and automatically resends pending abort requests upon reconnection. Compare-lane execution preserves Stop state across reconnects and binds directly to active stream identifiers (1239302a, d8f93a86, 16d9b2b8, 0b8c2ab1, bb84d236, e4b10098).
• Hardened agent task stability management and operational administration. Boot recovery strictly requires expired or self-owned leases before parking or closing pending orphan tasks (PR #1473), preventing workers from trampling active jobs. Administrative user tables sort by signup date, external docker-compose environment files are preserved during deployment, and local .worktrees are excluded from eslint rules (38566665, 241f4a1a, 103cf94b, 713e2478, 9b635c1b).
• Unified DGX model ID identification and enabled 20-minute long-context reasoning. Aligned DGX model IDs with actual vLLM serving names across the app and gateway, resolving legacy local IDs to canonical identifiers. Added calibrated profiles for qwen3.8-flash-next and synchronized deploy scripts with LiteLLM gateway configs. Removed the legacy 300-second fetch limit, raising LLM_TIMEOUT to 20 minutes (1200s) for deep-reasoning stability, and returning explicit 413 status codes on context overflows (9126e70c, a20b025b, 02344a8e, 968dcd2b, 2a0a6212, e00fc8a9, 01bbc038, 3df42264).
• Self-hosted web typography and improved development install markers. Eliminated Google Fonts CDN dependencies by bundling fontsource packages for offline and build reliability. Refined 'omk dev up' dependency and shared-package change detection against verified installation markers (9065bd59, 84b24036, 3cecdb7b, fc305260, f8736fce).
• Declared capability key policies and Actor-BYOK embedding slots. Declared text.embed under an actor-byok key policy, flagged provider key rejections (HttpCallError.keyRejected) to avoid unproductive retry loops, and added descriptive slot guidance for user-key execution (4323cf6d, 67bebdba, fd25a0ff, 28283302).
• Architected Knowledge Runtime 2.0 with space-isolated indices. Applied database migration 006 to anchor embedding indices per space, preserve request_params, and enforce unique ready indices. Worker collection pipelines pass actor keys and route missing or rejected keys into permanent failure states. Search operations query space-specific indices with the searcher's key, returning zero citations with explicit guidance when keys are absent. Retired global admin/reindex in favor of POST /spaces/:id/reindex with transaction locks against concurrent triggers, and automatically re-queued previously failed documents upon index transition (67f380e0, efb666b7, 8d93c9a4, 19745c20, 1c8ec75b, 346cb42f, 605caabf, 08b8a6e1, d51ed041, ad7d35eb, b51d4af5, 3a8ae95d, e8d3c880, b12cebe5).
• Enriched system health monitoring endpoints. Administrator queries to /api/health now include running application version strings and Git build identifiers, ensuring precise verification across deployments (19f9ed05).