Neural Labs v0.3.0 release record

• Release date: 2026-09-03
• Version transition: 0.2.0 → 0.3.0
• Release type: minor version jump
• Theme: personal Alshival accounts, graphical workflow building, and stronger authenticated collaboration

Release intent

This release separates interactive AI identity from system automation identity. Each teammate can connect their own ChatGPT account for private Alshival and for the Team Chat turns they author, while the administrator-configured workspace account remains stable for unattended work. It also completes the graphical Skill Builder, live rendered instructions, automation drafts, and passkey enrollment work that turns reusable workflows into a collaborative desktop surface rather than a collection of hidden Markdown files.

User experience changes

Personal Alshival account

Settings → Personalization now includes Your ChatGPT account. Connect starts OpenClaw's supported device-code flow and shows the short-lived verification URL and one-time code. The card polls while login is active and then reports credential and model readiness. Pause removes personal Alshival access without deleting the credential; Resume restores it when the sign-in remains valid.

An unlinked user receives an actionable Alshival error and cannot fall back to the workspace account. The separate Settings → Workspace OpenAI pairing remains the service connection for automations, heartbeats, and background tasks.

Author-owned Team Chat runs

A $Alshival message now carries its immutable author ID from the durable PostgreSQL run record to the internal workspace runner. The runner selects that author's personal OpenClaw agent. Another participant's connected account and the automation service account are never substituted.

Completed Team Chat turns show the same compact, collapsed work timeline as private Alshival. Plans, commands, file changes, tool actions, bounded output, status, duration, and exit codes are projected from OpenClaw history. Known credential shapes are redacted and raw reasoning is replaced with a generic label. These public work details are stored with the run and included in the bounded shared transcript supplied to later Team Chat turns.

Graphical Skill Builder and automation drafts

Skills is the canonical reusable-workflow app. Creating or editing a personal or team skill opens a full-window graphical builder with metadata, canonical SKILL.md, OpenAI agent metadata, references, scripts, assets, invocation policy, icons, MCP dependencies, validation, explicit publication, and collaborative Yjs editing. Draft access is owner-selected, with administrator oversight and unpublished Alshival test sessions.

The Instructions pane now fetches and renders the actual allowlisted Markdown source for installed skills and automations in a bounded scroll area. Live OpenClaw status stays on the Gateway WebSocket; authenticated static Markdown does not depend on the optional skill-card.md endpoint that caused the old permanent Loading state.

Automations has a graphical draft flow with a first-class Run a skill action and canonical $skill-name invocation. Regular users can inspect redacted automation state and history; scheduler mutation and unredacted configuration remain administrator-only.

Authentication and desktop continuity

Microsoft-bootstrapped passkey enrollment and discoverable, user-verifying passkey login are available to approved accounts. Desktop state restoration no longer forces Terminal open if a user deliberately saved a desktop without a Terminal window.

The sign-in flow now introduces identity first and presents the available password, passkey, and Microsoft methods as a clear second step. Sign-up, pending access, initial setup, and administrator pages share the same responsive paper-and-spectrum visual system and compact deployment footer.

Architecture and data changes

Per-user OpenClaw agents

Neural Labs derives a stable, non-secret agent ID from each immutable user UUID and provisions a unique OpenClaw agent/auth directory pointed at the shared workspace. A matching named Gateway role allowlists exactly that agent and sets sessions.others to none. The default unlinked role has an empty agent allowlist. The browser learns only its own agent ID in /api/session and keeps the existing direct, authenticated Gateway WebSocket.

The workspace generates a random Gateway password on every start for the Gateway process and its loopback-only role-management client. It is not written to OpenClaw configuration or inherited by agent-run child processes. Team Chat uses embedded --local personal agent mode. Public traffic continues to authenticate through Nginx and OpenClaw trusted-proxy identity. No host port, public route, container privilege, host mount, or socket mount is added. OpenClaw's broader trusted-proxy loopback opt-in remains disabled: local processes cannot impersonate browser identities with forwarded headers.

Database migrations 5 and 6

Migration 5 adds team_agent_runs.activities jsonb NOT NULL DEFAULT '[]'. The control plane validates kind/state enums, caps the activity count and every text field, redacts credential patterns again at persistence, and correlates the projection with Alshival messages. No OpenAI credential or device-code secret is stored in PostgreSQL.

Migration 6 adds passkey public-key metadata, signature counters, and bounded one-time ceremony challenges. It stores no authenticator private key or OpenAI credential. The live upgraded database reports schema version 6.

One-time development migration

On the first upgraded workspace start, Neural Labs deletes legacy neura-private sessions owned by the main agent and writes a marker in the OpenClaw state volume. This was explicitly accepted for the development instance. The migration does not repeat on later health reconciliation cycles.

Security and trust-boundary review

• Personal OAuth material is written only by OpenClaw into the personal agent's persistent auth directory. It is never returned to the browser, serialized in Team Chat, stored in control-plane tables, or committed to the repository.
• Personal account control is active-user-only, same-origin, CSRF-protected, and proxied to a bearer-protected private workspace endpoint. The target user ID always comes from the authenticated session.
• Disabling or rejecting a user pauses their role as a best-effort defense; the control-plane ingress independently prevents inactive users from opening the desktop or Gateway socket.
• Team Chat still uses a random per-run capability whose hash alone is stored. It grants only current-channel MCP operations and expires on completion or after 20 minutes.
• Team Chat supplies large bounded prompts through a mode-0600 temporary file that is removed after execution, rather than exposing the transcript in the process argument list or relying on the host's argument-size limit.
• Passkey ceremonies bind to the configured origin and RP ID, require user verification, use one-time bounded challenges, and store public credential material only.
• Skill Builder routes derive identity from authenticated ingress, authorize each draft, constrain paths and sizes, require exact-origin mutations, and reject common credential shapes.
• The repository adds no tenant credential, provider token, certificate, private key, IP address, VPN state, generated tenant state, or host-level mutation.

The per-agent layout is not an adversarial operating-system boundary. Approved developers retain passwordless root inside one shared workspace container and can therefore inspect or modify another agent's files. Separate containers or VMs are required for mutually untrusted users. ADR 0013 records this limit explicitly.

Deployment and upgrade

1. Create and verify the normal Neural Labs backup before upgrading.
2. Pull the v0.3.0 source and review local .env image pins and immutable digests; do not copy sample placeholder values into production.
3. Rebuild and recreate the control-plane and workspace services so migration 5, the desktop bundle, Gateway client, personal account controller, and Skill Builder are installed. The standard full update may rebuild all services.
4. Wait for loopback health checks to pass, then sign in as an administrator.
5. Confirm Settings → Workspace still reports the system OpenAI account ready.
6. Have each teammate open Alshival once, then connect their account through Settings → Personalization. Confirm private chat creation and a Team Chat $Alshival turn from that teammate.
7. Verify a paused account cannot run private or Team Chat Alshival while automations remain available through the system account.

Persistent workspace files, OpenClaw state/auth, personal account auth, skill drafts, code-server data, and system automation auth survive container recreation in their existing volumes. Running terminal and agent processes end during replacement.

Rollback

Application rollback requires the pre-upgrade source/image and a database schema that older code can tolerate. The additive activity column is safe to leave in place, but the deleted legacy main private sessions can be recovered only by restoring the pre-upgrade OpenClaw state volume backup. Personal agent directories created after upgrade can remain unused during rollback or be removed later through a separately reviewed operator procedure.

Do not use destructive Git or volume commands as an improvised rollback. Use the timestamped image and backup flow documented in the container deployment and backup guides.

Validation evidence

The release gate is make validate, which covers shell syntax, Compose/Nginx configuration rendering, TypeScript checks, unit and integration suites, Vite production builds, workspace runtime checks, documentation links, secret patterns, generated artifacts, and repository policy. Focused coverage includes:

• stable personal agent/role derivation, isolated provisioning, pause/resume, idempotent service/profile reconciliation, and one-time legacy cleanup;
• bearer-protected personal auth and Team Chat runner routes;
• authenticated-user account proxying and CSRF enforcement;
• author ID/run ID propagation, fail-closed personal execution, redacted history projection, persistence, and shared prompt handoff;
• Personalization device-code UI and direct Gateway agent selection; and
• the existing desktop, passkey, Skill Builder, automation, Files, Terminal, VS Code, Alshival steering, and pop-out regressions.

The exact final command outcome and commit are recorded in the release handoff and Git history.