Inazuma

稲妻 — lightning.

INAZUMA

The sky cracks white and we move as one.

There is a moment after the blade has been polished when it is no longer the blade that needs attention.

It is the storm.

Inazuma is that storm

Following Kiyome’s cleansing, Inazuma turns its attention toward the places where LunarWing’s machinery can still be deceived, stalled, or left wandering in circles. Tool results are brought behind stronger boundaries. Engine V2 gains the discipline to stop waiting, stop blocking, and stop retrying what cannot be repaired. Relays learn to remember what happened during the silence. Tenants gain a safer path to knowledge. And the system becomes more willing to fail closed when something important goes wrong.

One flash of consolidation across the codebase

Then the rain

Then the thunder

And then…

Lightning

Highlights

  • The blade now guards the hand that holds it. Tool output is bounded before security scanning, failures receive the same protection as successful results, and ChatML-family role tokens are neutralized before they can become instructions. Engine V2 carries this defense through structured results, action history, memory, skills, system prompts, and other LLM-bound paths.

  • The watchman knows when the gate is closed. Self-repair no longer hammers endlessly at terminal ManualRequired failures. Such failures are surfaced once per boot and removed from the retry cycle. Repair counters begin anew after restart, healthy built-in tools can verify themselves, and successful execution clears stale failure state.

  • Engine V2 moves like lightning, not a procession. Independent gateway threads can run concurrently, with bounded queues and explicit busy responses when the system is full. Same-thread work remains serialized, preserving order where it matters. Deferred tool and LLM futures now have a 300-second boundary, while foreground threads honor the configured tool-iteration limit.

  • The gatekeeper checks the seal before opening the gate. Engine V2 now exposes actions according to the active capability leases of each thread. Restricted mission threads no longer receive administrative actions such as create_job when their leases do not permit them.

  • A samurai’s report is not the battle itself. The orchestrator no longer accepts a model’s claim that memory or tool work was completed when no action actually occurred. Fabricated success reports are challenged, provider-mangled FINAL(...) pseudo-actions are intercepted, and an empty FINAL can no longer transform itself into a victorious “Task completed.”

  • WeeChat remembers through the rain. During relay outages, outbound input is placed in a bounded queue rather than disappearing. Messages accepted while disconnected are recovered after reconnect, recovery state survives adapter restarts, and the relay exposes its disconnect and reconnect state for operators to see.

  • A new house receives its first scrolls. New tenants created with add-tenant --with-study-mcp can seed their private knowledge store from the synchronized Study Notes corpus. Provenance and lifecycle metadata are preserved, while existing tenants remain untouched. Once the seed is complete, it does not return on the next boot.

  • The SSH gate is finally guarded. Host and key-management routes now require a bearer token and are not mounted at all when the credential is absent. Key rotation fails closed when an upload or readiness check fails, rather than silently continuing with an old signing key. The webhook server also binds to loopback by default.

  • The village watchtower gets a clearer view. Fresh tenant allocations now warn about occupied ports, mt-admin doctor detects duplicate registry assignments, OpenRC services report their actual state, and channel health reflects real delivery failures rather than merely the presence of a registered wrapper.

  • Even the path beneath the feet is steadier. Workspace normalization now contains .. traversal at the virtual root, concurrent writes to the same workspace document are serialized, memory search returns usable document paths, and workspace guidance now makes the safe memory_write replacement semantics explicit.

Upgrading

Inazuma brings no new SQL migration and no port-registry migration. V26 and port-registry v16 remain current.

Rebuild the daemon, WASM channels, and relevant worker images through the normal deployment path. The WeeChat relay should also be redeployed to receive its new reconnect and recovery machinery.

A few changes are worth carrying with you:

  • Existing tenants are not automatically seeded with Study Notes. The one-shot seed is armed only for new tenants created with add-tenant --with-study-mcp.
  • SSH host and key-management integrations now require Authorization: Bearer <SSH_API_TOKEN>.
  • The webhook server now binds to 127.0.0.1 by default. Set HTTP_HOST explicitly when external access is intentional.
  • Tool output may now be truncated, wrapped, redacted, or role-token-neutralized. Integrations should not rely on raw tool errors remaining byte-for-byte identical.
  • Engine V2 deferred tool and LLM operations now have a default timeout of 300 seconds.

Kiyome washed the blade clean.

Inazuma puts it back into the storm.

The sky cracks white.

And for one brief instant, every edge of the system is visible.

For full release notes, check the repository as always.