Changelog
What changed, newest first. Entries are never edited once published.
An agent answer of several steps carries a receipt for the whole run
A receipt used to name one enclave call, so an agent answer assembled from several — every tool round is one — could carry none. It now carries a run receipt: one link per model call, each committing to exactly what that call sent and received and naming the enclave’s own per-call receipt, with the run’s mode fixed at its weakest link. The drawer under the answer shows the chain and the same Verify button checks it in your tab; the same signing key and the same in-tab check as every other receipt. When the enclave could not prove one of the calls, the answer is still served and badged unproven, and says which call.
Four more models earn the sealed label, and two that earned it are not offered
The probe that decides which models are labelled sealed now runs the same full check every answer’s receipt gets — the enclave’s quote, the pinned measurement, the receipt bound to the exchange — instead of a lighter one. On the models page, GPT OSS 120B stays sealed and Muse Glimmer 30B, Nemotron 3.5 Lightning, GPT OSS 20B and Qwen 2.5 7B are sealed on that evidence; nineteen models the gateway calls enclave-hosted still fail our check and stay labelled as such. Two models passed the check and are not offered at all: Qwen 3.8 27B and GLM 5.3 cost more per answer than the free plan carries, and a sealed model is never put behind a paid plan, because privacy is not what a plan buys. Four models that no longer answer on the gateway are gone from the page.
The agent’s receipts can be checked where they appear, and its default model now earns one
Two things about the agent page. First, a one-step answer’s receipt now opens under the answer with the same Verify button the chat has, checked in your tab against the address we publish; the line beside the badge says whether a receipt is there, and the note under the box no longer calls every agent answer unproven, since one-step answers are not. Second, the model the agent picks by default runs in an enclave whose receipts name the model without its vendor prefix, and our check had been refusing every one of them as if they named a different model. It now accepts the bare name only when the receipt’s own routing record ties it to the full one, and refuses anything else; the receipt’s model field, the request and response commitments, the enclave measurement and the signature are checked exactly as before.
Agent answers that needed no tool carry a receipt
An answer on the agent page was always unproven, even when the run made one model call and touched no tool — which is one prompt and one response from one enclave, the very thing a receipt describes. Such a run now carries the same receipt the chat issues, signed the same way and checkable with the same Verify button; the enclave it names is the one our own attestation check named when it signed. A run of several calls, or one that used a tool, stays unproven and says which of the two it was.
Formulas written with single dollars render, and wide ones scroll
Models mostly write inline mathematics as $x + y = z$, and that was showing on screen with its dollar signs, because treating every $…$ as a formula had turned “$1,200 a year against $110 a month” into italics — a fix measured and refused earlier. A narrower rule now applies: a span becomes a formula only when it looks like mathematics and cannot be an amount of money; that sentence still reads exactly as written. Separately, a formula wider than a phone scrolls inside its own box, as tables and code already did, instead of running out of the answer.
The attestation line says which of four things it means
The line at the bottom of the rail read “not attested” for three different situations: nobody had asked the enclave anything yet, it had been checked once but not recently, or a check had failed. On a freshly started server the first page said it beside an answer that verified a second later. It now asks once when it does not know — the same bounded check the chat’s default model already made — and says one of four things: live, not checked yet, stale, or failed. “Live” still means exactly what “yes” means on the limits page, because both come from one computation.
Answers stream on the default path
With tools available — the default in chat — an answer used to arrive all at once when the run ended, however long it thought. The words now appear as the model writes them, the same as they do with tools off. Nothing about what is sent or kept has changed; only when you see it.
A first answer carries its receipt again
Chat runs every message with tools available, and until today that alone made every answer unproven — the drawer said a receipt is not issued for a tool-enabled run, even when the run made one model call and used no tool at all. That run is one prompt and one response from one enclave, which is exactly what a receipt describes, so it now gets one: the same receipt, signed the same way, checkable with the same Verify button. An answer that took several model calls, or used a tool, is still unproven, and the reason now says which of the two it was. “Prove first” still asks for the receipt before any text shows.
A wallet you can attach, for one purpose
The account page has a Wallet section. You can attach one Ethereum address to your identity, see it back in checksummed form, and remove it whenever you like. It exists so that tokens you have earned here can be sent somewhere, if and when there are any. It is not a login, it is not a payment method, nothing reads its balance, and attaching one changes nothing about your plan. One wallet per identity: a second identity claiming the same address is refused, whatever spelling it uses. Your data export lists it beside your email, deleting your account deletes it, and the privacy notice now names it — which is why that notice carries today’s date.
Stop now stops a first message too
On the first message of a session an identity is issued before the request is sent, and a Stop pressed in that moment used to stop nothing: the request went out afterwards, the answer streamed into a bubble you had just stopped, and the Stop button was already gone. Stop now ends the send wherever it is. If nothing had been sent yet, the bubble says “Stopped before the answer started” and offers no retry, because a stop is a choice, not a failure. A stop after text has arrived still keeps that text, as before.
Every page now carries a security policy
Every page is served with a Content-Security-Policy and the headers beside it: no framing by other sites, no requests to other origins from the page, no plugins, a strict referrer. One thing needed care. Code the agent runs in your browser executes inside a sandboxed worker with no network and no page access, and a policy that forbids evaluating code forbids the sandbox too. The sandbox is now loaded from its own address with its own policy — evaluation allowed, everything else forbidden — so the page stays strict and the browser enforces the sandbox’s walls as well as our code does. Nothing about what the agent may do has changed.
“Verify it yourself” is a button now
The drawer under every sealed answer has said “verify it yourself, offline” since it shipped, beside an export button and nothing else. It now has a Verify button that runs the check in your tab — the body is hashed and compared to the digest, and the signature is checked against the address we publish — with no request made while it runs. The result says what it found, including the reason when it fails. The same button sits on the specimen receipt on the API page, so you can verify a real one before you have asked us anything. What has not changed: the one-command verifier package is not published yet, and the API page still says so.
Invite links that work
The invite programme was complete and unusable: your account page showed a code, and there was no way for the person you gave it to to use it. There is a link now, with a copy button. Someone who follows it and sends their first message is counted as yours. The rules did not move: following your own link earns nothing, an identity can be referred once, and nobody is paid until the person you invited pays for something — a signup costs us nothing to fake, which is why it earns nothing.
Compared with Venice, line by line, with sources
A new page, /compare/venice. Both products name the same four privacy modes and attest against the same enclave provider, and the prices are the same four numbers. The page says what is the same, what is different, and — in its own section — where Venice is ahead. Every claim about them links to the page of theirs it was read from, with the date. Two things on our side are labelled as not shipped, because they are not.
Formulas rendered as formulas, and answers that fit the screen
A formula in an answer was being printed as raw LaTeX — every formula, every model. It renders now. The fix that would have broken money amounts (“$1,200 a year against $110 a month” becoming italic mathematics) was measured and refused before it shipped. Separately, an answer containing a wide table was pushing every sentence around it off the edge of a phone screen, on the chat and on the agent; the table scrolls inside its own box now and the prose stays put. Checklists no longer carry a bullet as well as a checkbox, and the dividers between sections are visible.
An answer that never arrives says so
If the service closed the connection without sending anything, the answer sat on “Waiting for the answer…” forever, with no way to cancel. It now says the service sent nothing back, and offers a retry. Stopping an answer before it started says it was stopped, with no retry — you chose that. And a reply that arrived without an answer in it used to take the whole page down; it is one sentence now, and your question is still in the box.
Answers were arriving with the formatting still in them
A model writes in markdown, and the transcript was printing it as plain text — so a bold line arrived as **asterisks around it**, lists arrived as hyphens, and code arrived with backticks. It reads properly now: bold, italics, lists, quotations, tables and code all render. One deliberate exception — raw HTML in an answer stays visible as text rather than being rendered, because an answer is not something we will let write markup into the page you are reading.
Plans, and one thing they were selling that we cannot do
There are three paid plans now — Pro, Pro+ and Max — and unused credits roll forward rather than expiring at the end of the month. What has not changed, and will not: the sealed tier, the receipts and the encryption are on every plan including the free one. Privacy is not a plan. What a plan buys is topic freedom and volume. We also have to correct something we published on that page: it listed image, video and music generation among the things a subscription buys, and none of those are live — there is no provider connected. The plans say so now, and nothing bills you for them.
Some models in the menu could not be reached
Picking certain models produced "the model could not be reached" instead of an answer. The catalogue was built by asking the gateway which models exist and believing it, and only the ones claiming to run in an enclave were ever actually sent a request — so a model that had gone away could sit in the menu looking perfectly available. Every model is asked whether it answers before it is published now, and the ones that do not are left out rather than listed.
For a while, new visitors could not use this at all
A first-time visitor with an empty cookie jar could open the chat, type, press Send, and be told "no session". Every route that acts on your behalf needs an identity, and nothing in the interface ever issued one — so the product worked for anyone who already had a cookie and was broken for everyone else. It is fixed, and sending is what issues the identity. We are telling you because the alternative is a changelog that only reports good news, and a counter now exists for that refusal so the same silence cannot happen twice.
End-to-end encryption
On a sealed model you can tick "Encrypt on this device". Your prompt is encrypted in your browser to a key published inside the enclave's attested keyset, and we relay it without being able to open it. The honest consequences: on that path we cannot moderate what you send, we do not store the conversation, and we cannot finish verifying the answer for you — the enclave's receipt commits to the DECRYPTED request, so only your browser holds what is needed to check it. It does that itself, and the badge will not claim the mode unless that check passed.
An identity that outlives the browser
You can now put an email and password on the identity you already have, sign in from another device, and sign out — which revokes the session rather than only forgetting it here. Until today there was no way to do any of that: everything you made lived behind one cookie and died with it. Adding credentials changes nothing about what we can see.
Characters can actually be used
You could write a character, publish it and browse other people's — and there was no way to talk to one. There is now, which also means the Feed's ranking and creator earnings can show a number for the first time: they rank readings that previously had no way to happen.
Onboarding described two things we never built
It offered a passphrase that encrypted your synced history, and a recovery code to go with it. Neither existed anywhere in the product. The text has been replaced with the choices that are real, and each step now names the part of the app that implements it so a claim cannot outlive its feature.
Honest limits page
Published what our privacy does not cover, generated from the running system rather than written by hand. If the code stops providing a guarantee, this page says so on its own.
Uncensored is the paywall
Free is unlimited moderated chat. Paid unlocks topic freedom. Privacy is not the paywall — the sealed tier is available on free, because selling privacy would contradict having no toggle.
Credits ledger is append-only, enforced by the database
UPDATE, DELETE and TRUNCATE against the ledger raise an error rather than silently doing nothing, and a balance can never go negative. Enforced by triggers, not by convention.
Model traits
Ask for `default` or `most_uncensored` instead of a model id, and your integration keeps working when the model behind it is replaced.
Receipts you can check without us
Every answer carries a signed receipt, committed to your prompt with a salt only you hold, so filing one discloses nothing about what you asked. THE VERIFIER IS NOT PUBLISHED YET — `npx @untold/verify` does not resolve and this repository is private — so today you would have to ask us for the tool, which is the dependence it exists to remove. When you have it, it makes no network calls: run it disconnected.
Fail-closed sealed tier
A request for the sealed tier that cannot obtain a verified attestation FAILS. It is never quietly downgraded. This entry used to end 'today no provider can attest, so sealable models are not offered at all' — which stopped being true the day attestation went live and stayed on the page for weeks, because a changelog is written once and nothing checks it. See /limits for what is true right now; that page is computed.