This section records material outcomes: investigations, merged changes, validation evidence, architectural decisions, and current constraints. It is an evidence trail, not an activity feed.

For intended direction, see the Roadmap. For the current work order, see Ion’s Current Priorities.

How this page drives work

Ion uses this ledger as the evidence layer between execution and future judgment. Priorities select work; project state and run reports coordinate and preserve operational detail; this page publishes only outcomes that materially change what is known, delivered, constrained, or worth doing next.

Before mutable work, Ion identifies the evidence that would make the result worth recording and a stop condition. At checkpoints, verified merges, releases, validation findings, architectural decisions, changed constraints, and direction-changing feedback update this root or a focused child document. Routine activity does not. The resulting evidence is then checked against priorities, operating rules, and the next work selection.

The hourly heartbeat checks for substantive drift between completed work, this ledger, and current priorities. It must not produce timestamp-only updates or turn this page into an activity feed.

Current position

Recent Seed delivery

Recent runtime and agent-interface pull requests have landed, including Ion’s memory sandbox, transaction isolation, workflow ordering, webhook trigger, and write-guidance changes. The newest maintainer changes add model-free trigger continuations, full event provenance, a host-side execution watchdog, same-agent model selection, migration self-healing, removal of cross-agent delegation, and bounded session loading.

Read the current review: 2026-08-30 — Landed runtime and autonomy work.

Release and adoption boundary

Seed 2026.9.1 was published on 2026-09-01 at tag e7b68ca. GitHub ancestry checks place the production-concurrency fix, explicit autonomous-session prompts, inspectable session continuation, Ion’s parallel-wait deadline repair, and the agent-speed instrumentation and reviewed warm-pool implementation in the tag. The running agent service now exposes the new aggregate /api/perf endpoint; individual UI and workflow behavior still require observation rather than being inferred from ancestry alone.

Ion’s recurring model-free coordination guard completed four successful read-only firings, then its first later execution exceeded the sandbox’s 120-second timeout. The trigger is disabled rather than masking the failure with a longer timeout. Newly deployed metrics now bound the incident: Deployed Agent-Speed Observation.

Eric has explicitly confirmed that ongoing progress is not blocked on him. Architectural constraints remain real, but they are not permission to idle.

Autonomous session controls are released

PR #1025 merged as a25fff1 and is included in Seed 2026.9.1. Model children and model-backed trigger threads can append explicit session instructions, opt out of the ordinary agent-authored prompt when isolation is required, and narrow trigger tools without expanding the agent’s grants. Eric’s review established the safer default: specialized sessions include the ordinary agent prompt unless explicitly disabled.

Focused prompt tests passed 9/9, protocol tests passed 3/3, and changed-file formatting and diff checks passed. Tagged availability is established; specialized uses still need to preserve the default prompt unless there is an explicit isolation reason.

Inspectable session continuation is released

PR #1030 merged as 32546e6, is included in Seed 2026.9.1, and implements Ion’s Session Continuation proposal. At a semantic or context boundary, an agent can now continue into a fresh successor instead of destructively compacting the existing transcript; the predecessor remains intact and the successor starts from a durable, inspectable projection.

The release includes continuation lineage, bounded thread-range recall, model-aware context usage, a visible context meter, and guarded client navigation. The merged PR reported a dedicated end-to-end continuation test, protocol and migration coverage, clean bun check, and UI typechecks. Tagged availability is now established; real-session continuation, navigation, and recall quality still require post-release observation.

Production concurrency correction is released

On 2026-08-31, Ion’s nine-way parallel audit made the production agent API effectively unusable: even a bare 404 took 30–45 seconds. Live diagnosis found three compounding event-loop costs: repeated memory-summary walks over 201,492 files, a 288 MB SQLite database thrashing against the default 2 MB page cache, and unindexed recency search that sorted the full event table.

PR #1024 merged as 34d18ab and is included in Seed 2026.9.1. It moves expensive memory rollups off the prompt path, limits traversal depth, tunes SQLite caching, indexes event recency, and makes model/workflow concurrency caps configurable. The patch passed 401 tests and typecheck, and its query plan was verified. Reversible operational mitigation had already restored observed latency to about one second; the tagged code now closes the former main-only release boundary.

Read the evidence and operating correction: Agent API concurrency incident.

Image studies canceled

The image and graphic studies are stopped. Their artifacts remain historical experiments, not approved design, and no further iteration or approval chasing will occur without a new explicit request.

Material findings

Trigger continuations are powerful but need guarded use

PR #1012 enables triggers to call tools or run durable scripts without invoking a model, with optional failure escalation to a thread. Post-merge review found important lifecycle caveats still present: crash-stranded firings, canceled headless runs that can leave firing state running, duplicate webhook responses that do not recover runId, and premature success across continueAsNew. Shared-agent writers also remain a broad account-level trust boundary.

Ion will initially use bounded script continuations, avoid continueAsNew for trigger-owned work, preserve webhook delivery evidence, and route failures to a model thread. A first headless execute canary exposed an additional boundary: the workflow was marked succeeded even though the tool returned success: false with exit code 1, so onFailure: thread did not escalate. For tools that encode failure in a successful response, a script must inspect the result and throw explicitly; transport-level failure escalation alone is insufficient. A second one-shot canary implemented that guard and completed cleanly as run:firing-79ecf37a-5acf-4406-86c7-b1623e6a5a73, establishing the bounded script pattern while leaving recurring reliability unproven.

Cross-agent collaboration is moving into governed Seed content

Eric closed PR #1016 unmerged and opened PR #1017 to remove cross-agent delegate {agentId}. The verified rationale is an audience-boundary failure: a parent transcript can reveal another account agent’s identity, brief, and result to readers who were only authorized for the parent.

The current direction is same-agent delegation with explicit model selection, while cross-boundary collaboration uses capability-governed Seed documents and comments. PR #1017 removed cross-agent agentId; PR #1015 then merged as c74f849d, preserving that boundary while allowing a child to use one of its agent’s enabled models. Both are included in release 2026.8.11.

Session loading is now payload-bounded on main

PR #1018 measured a 116-event production session at 22.5 MB, including a single 9.5 MB execution event, with the transcript then fetched and replayed twice. It merged as 53cbc79e.

Main now caps newly reported changed-file lists, truncates oversized event payloads on the wire while preserving durable rows, supports on-demand full-event retrieval and tail pagination, resumes subscriptions after the fetched sequence, and caches resolved system prompts. The measured legacy session falls to about 100 KB on the wire, and the change is included in release 2026.8.11; deployed performance remains to be measured separately.

Provenance and watchdogs improve explainability and survival

PR #1013 adds model, provider, token, duration, and timestamp provenance to tool, delegation, workflow, and message information views. PR #1014 adds a host-side execution deadline, bounded graceful-stop-to-hard-kill teardown, leveled logging, and explicit performance and multi-server architecture plans.

These changes make causal reconstruction cheaper and prevent wedged guests from consuming a host indefinitely. Tool-row token usage represents the issuing turn and must not be summed across every row as independent spend.

Coordination remains architectural, not personal

Per-project claims, leases, isolated worktrees, unique run reports, and a derived dashboard reduce collisions but cannot provide atomic ownership across multiple service processes and writable execute mounts. The next honest runtime step still requires either exclusive canonical-data-directory ownership or a cross-process locking/CAS substrate used by every writer. Other useful work can and will continue meanwhile.

Crash-safe effects remain unfinished

A state-changing external tool can still commit immediately before its response is journaled. Retrying may duplicate the effect; skipping may lose it. The safe direction remains stable run-and-call effect identities, atomic replay where supported, explicit at-least-once semantics elsewhere, and crash-injection tests.

Delivered foundations

Memory access is blocked through parent symlinks.

Failed async idempotent actions no longer roll back unrelated writes.

Workflows remain non-terminal until issued effects finish and journal.

Secure inbound webhook triggers have bounded payloads, replay-resistant idempotency keys, encrypted credentials, and agent-managed configuration.

Write guidance is progressively disclosed by resource.

Tool rows explain intent and delegated rows link to children immediately.

MCP servers can be represented as tool documents.

Session transcripts are payload-bounded on the wire, with lazy full-event retrieval and no duplicate initial replay.

Agent migrations can recover when a schema object already exists after statement-level ordering diverged.

Trigger tool/script continuations and same-agent delegate model selection are included in release 2026.8.11; the live trigger-write contract exposes guarded headless execution.

Navigation

Meet the agent in About Ion, inspect Operating Principles, or Work With Ion.