Use this page to track notable documentation, support, and community changes.
Major product or docs changes should appear here and be mirrored in Discord #announcements. Operational details, moderation notes, AutoMod alerts, and private follow-up belong in staff-only Discord channels.
Every SDK can now sign in through your browser: the SDK prints a short code,
you approve the request at https://dash.thalovant.com/activate, and the SDK
receives a scoped, revocable API token instead of handling your password.
Requires Python 0.4.22, Node.js 0.2.25, Go v0.3.3, Rust v0.2.20, or Kotlin,
Swift, and .NET 0.1.1.
Added the API Tokens page: create scoped, expiring
tokens for scripts, CI, and AI agents, copy the one-time secret, watch last
use, and revoke. Creating and approving tokens needs a paid workspace plan.
Every SDK also documents direct API token auth through its control-plane
constructor. See Sign In Without A Password.
MCP server 0.1.9 recommends a scoped THALOVANT_API_TOKEN for AI and CI
configs, and its config status tool reports the declared auth mode. See
MCP Server.
Source Scout no longer limits adult hubs to a topic allowlist. It accepts any
nonempty question as the final source-backed fallback after more specific
skills have had a chance to answer.
Runtime owners can explicitly protect audiences under 13, 16, 18, or 21. The
setting checks both questions and answers and fails closed when a protected
classification cannot complete.
The unrestricted default does not invoke age classification. Protected and
unrestricted responses use separate cache identities.
Source Scout preserves OVOS language, script, and region tags and is not
limited to English and French.
Hub creation and editing now offer Standard or Autoscaling capacity without
exposing Kubernetes settings.
Team includes one Autoscaling hub with two warm workers and a maximum of
eight. Enterprise capacity is contract-defined up to 32 workers per hub.
Billing reports autoscaling slot usage and each hub’s saved worker ceiling.
Existing hubs remain Standard. Autoscaling uses a deterministic skill-only
runtime and keeps each listener with its authoritative skill runtime while it
scales.
Thalovant Voice now reconnects automatically after a normal hub restart, a failed connection attempt, or a network ping timeout.
Every reconnect creates a fresh encrypted session and continues to enforce the pinned protocol-v3 server identity.
The macOS, Windows, and Linux downloads use the same reviewed client behavior as the production voice listener.
Existing paired clients can install the update without creating a new connection. If the app reports that the server identity changed, stop and confirm the change through support instead of bypassing the warning.
Go SDK v0.3.0 updates golang.org/x/net to its remediated release and therefore requires Go 1.25 or newer. It includes the v0.2.17 binary-frame allocation hardening and explicit read-only CI permissions.
Rust SDK v0.2.17 removes the vulnerable rustls-webpki 0.102 dependency path by using the operating system’s native TLS backend for MQTT. HTTPS and WSS remain on the fixed Rustls dependency line.
Both immutable registry releases passed their complete test and release pipelines plus clean public-registry consumer verification. A pinned critical/high dependency scan reports no remaining findings in either SDK.
Added the Private Beta Guide covering consent expectations, the first useful path, privacy-safe measurement, support, withdrawal, account export and deletion, and the warning to use test payment details only.
Private-beta release evidence uses random participant IDs and aggregate milestones; names, email addresses, prompts, replies, credentials, and payment details do not belong in repository evidence.
Go SDK v0.2.16 is available as a public Go module. Clean consumers can install it through the public Go module proxy without GitHub credentials or private-module configuration.
Updated the Go SDK guide with the immutable verified release command.
Added privacy-safe setup milestones for aggregate onboarding and time-to-first-value measurement. Prompts, replies, memory content, email addresses, tokens, credentials, and secret material are excluded from activation metadata.
Account deletion now erases linked product telemetry, activation milestones, analytics summaries and exports, and identity-linked audit traces before removing the account.
Added repeatable performance evidence for API reads and writes, public preview, direct SDK WSS, frontend bundle budgets, and MCP startup/tool discovery.
Updated Analytics and Audit with the user-visible privacy and deletion behavior.
Added Status Stream guidance for versioned condition events, PostgreSQL-backed sequence cursors, bounded replay, duplicate suppression, and snapshot recovery after an explicit cursor reset.
Clarified that the official SDKs do not yet wrap the control-plane status SSE endpoint.
Clarified that the public preview bridge releases independently, is compatibility-checked by the hub controller, and degrades browser preview without changing private/public visibility or normal hub reconciliation.
Simplified the docs home page so new readers see the smallest useful path first: learn the basics, build one setup, connect a client, or fix a visible problem.
Tightened first-read and high-friction pages so locked actions, limits, setup links, and first-heartbeat checks are easier to route.
Updated the docs style guide and page template to favor one clear promise, one clear first action, and fewer competing links.
Added Manage Updates as the plain-language owner for skill updates, runtime updates, hub updates, release policy targets, and Billing gates.
Refreshed Runtime, Skills, Hubs, Dashboard, Billing, and Known Limits so users can tell whether an update belongs to a skill package, runtime container target, hub container target, or plan check.
Documented that major docs and support changes should be mirrored in Discord #announcements.
Added support handoff language that warns readers not to share tokens, passwords, API keys, client secrets, connection files, private customer data, or sensitive screenshots.