v1.0.0-beta ships, then the cleanup starts immediately

Today was a release day, but not a coast day. v1.0.0-beta went out — alpha language gone, capabilities refreshed (vision, real browsing, MCP in and out, the Allow/Ask/Deny gate, encrypted backup/restore, self-managing memory, places), a benchmark callout added, and the README rewritten to funnel to chalie.ai instead of trying to be the product’s documentation. The hero swapped from a screenshot to a dark illustration of the actual reasoning loop — perceive, remember, reason, then act behind the permission gate, looping quietly while you’re not looking. The tagline change matters more than it looks: “sees your entire digital life” became “it thinks while you’re not looking.” One is a surveillance pitch. The other is what the product actually does.

But shipping the tag was the easy part of the day. The moment it was out, three separate reliability problems that had been living in the shipped product got closed in quick succession.

The first was a thinking-model dispatch that could hang forever with no timeout — a real bug report, not a hypothetical. The fix went to the only place a wedged call can actually be killed: the socket boundary inside each provider’s own client. A single timeout constant now bounds every provider call at that boundary, and retry logic moved entirely out of the providers and into the message processor, which owns the decision to resend, respects cancellation, and gives up loudly after three attempts instead of hanging silently. On the frontend, every error surface in the app — a failed turn, a failed action card, a failed voice recording — now funnels into one themed toast instead of four different half-built error UIs. Fewer places for a failure to go unnoticed.

The second was a data-integrity bug in contacts. Contact profiles and inbox sender identities were being stored in the same bucket as general facts and traits, and reads used a top-N recall window that had no idea contacts needed their own space — so a contact synced minutes ago could get crowded out of the top five results by unrelated rows, come back empty, and the model would fill the gap from memory instead of saying “not found.” That’s a worse failure than an error: a wrong answer stated with confidence. Contacts now get their own dedicated lane in the data graph, reads are scoped to it exclusively, and old entries self-heal into the new lane the next time they sync.

The third was code execution. The sandbox that runs code on your behalf got rebuilt from a RestrictedPython + multiprocessing setup to a Deno subprocess — a single binary with zero permissions by default: no network, no filesystem, no ability to spawn anything else, gone the instant the script finishes. Fewer moving parts, a smaller attack surface, and about 40% less code to reason about.

Underneath all of that, the embedding and inference stack got simplified too — collapsed to one CPU execution path (no more juggling CUDA/ROCm/CoreML variants that only ever ran on one wheel anyway) and the embedding service became a proper singleton instead of a scattered set of module globals, which makes a double-boot race structurally impossible rather than something a test merely checks for.

None of this is glamorous work. But a release only means something if the day after it ships is spent making the thing underneath it more honest — fewer silent hangs, fewer confidently wrong answers, fewer places bugs can hide.

• Tagged v1.0.0-beta — README and capabilities refreshed, hero rebuilt around the actual perceive/remember/reason/act loop

• Every provider call now bounded at its own socket boundary; retries moved to the message processor with cancel-respecting resend and a loud failure after 3 attempts

• All frontend error surfaces collapsed into one themed toast

• Contacts isolated into their own memory lane so a synced card can never be crowded out and answered from a hallucinated guess

• Code execution rebuilt on a zero-permission Deno sandbox; embedding/inference runtime simplified to a single CPU path with a true singleton service