Skip to main content

​
Goal

Version: 1.7.0. Last verified: 2026-08-23. Build the best GitHub-native coding agent by combining a Pi-based Brain with Aside-based browser and device execution. Ara should take a request from intent to verified work with as little ceremony as possible. The product must support:
  • MCP tools and integrations whose settings distinguish saved setup from a verified connection;
  • durable memory and reusable skills;
  • steerable, resumable Sessions;
  • isolated sandboxes;
  • GitHub repositories, branches, pull requests, and reviews;
  • browser and device use;
  • write-only secret injection;
  • explicit tools with observable, session-visible results.
One Workspace owns configuration. Resources attach dynamically. Capabilities are scoped mechanically. The Pi harness is the only agent runtime. Aside is the preferred authenticated browser and device boundary when local or in-app browser access is insufficient. Physical user computers are dormant in the current rollout. One source-level release switch keeps the CLI, web app, API, agent tool catalog, and installed controller aligned. The controller, Device identity, heartbeat, signed updater, and execution plumbing stay shipped, but both the server and controller reject physical work while the switch is off. Cloud and ephemeral sandbox Devices remain active. Installation may record versioned consent for a future Device and a separate grant for Ara’s private ~/.ara/workspace folder. After the release switch flips, the updater may activate only installations with both matching records; the resulting controller has read, write, and confined-execution authority only inside that folder. Host-wide process/port inspection, desktop Hands, environment discovery, MCP exposure, and the unsandboxed shell stay disabled. Update-only, CLI-only, missing-grant, and legacy full-home installations remain drained until a fresh explicit folder action makes them eligible. Ara measures CLI installation and updater health with a random per-installation identifier, bounded version/platform/consent fields, update outcomes, and coarse ingress geography. This telemetry must never include local paths, filenames, hostnames, environment names, file contents, or secrets. Legacy Device heartbeats remain observable to measure controller-version adoption and rollout readiness. Their service and Device identity remain dormant rather than being removed; heartbeat or update authority never restores execution authority. The goal is not more framework. The goal is a fast, legible path from request to tested code and a focused pull request.

​
Product test

The direction is working when Ara can take a bounded request through one clear path: understand the repository, choose the right tools, delegate without duplicate work, use scoped Hands, preserve continuity, produce a focused change, and return evidence that matches the deployed result. Speed without proof is incomplete. Proof without a useful result is incomplete. The target is the shortest trustworthy path to working software.

​
Living contract

This file is writable product memory. Update it only when verified product direction, scope, or a load-bearing product invariant changes. Implementation commands and environment procedures belong in DEVELOPMENT.md; rendered and user-facing design rules belong in DESIGN.md.
  1. Identify the source evidence and the user decision that changed the goal.
  2. Patch the smallest affected statement.
  3. Promote a repeated product failure into a HARD RULE when it protects the direction across implementations.
  4. Remove superseded direction. Do not preserve two competing goals.
  5. Verify that AGENTS.md, DESIGN.md, product source, and DEVELOPMENT.md still point to one compatible system.
  6. Bump the version and add one changelog line.
HARD RULE: Do not change the product goal merely because one implementation is easier. HARD RULE: Do not add a second Brain, fallback harness, or parallel Workspace model as a workaround. HARD RULE: Every authorized Session viewer can inspect each tool’s bounded, redacted result. Tool visibility does not vary by Workspace role. HARD RULE: Installer consent and automatic-update authority are never physical execution authority. A user computer cannot run Ara work until that execution is sandboxed to explicitly attached folders. HARD RULE: Disabling physical execution drains claims server-side and blocks them again inside the installed controller. Do not retire the controller or split this boundary into independently drifting rollout flags. Keep the latest ten changelog entries. Git retains older history.

​
Changelog

  • v1.7.0 (2026-08-23): Added separately granted private-workspace activation and a switch-true rehearsal while keeping legacy full-home Devices drained.
  • v1.6.1 (2026-08-23): Added DESIGN to the root contract boundary and cross-contract verification path.
  • v1.6.0 (2026-08-23): Preserved physical Device plumbing as a doubly locked dormant controller behind one source-level release switch.
  • v1.5.0 (2026-08-23): Required integration settings to distinguish pending setup, broken authorization, and verified connections.
  • v1.4.0 (2026-08-23): Made CLI version adoption and legacy Device migration observable through privacy-bounded installation and updater telemetry.
  • v1.3.0 (2026-08-23): Made physical computers update-only until folder-scoped sandboxing exists; preserved cloud/sandbox Devices and versioned future consent.
  • v1.2.0 (2026-08-23): Made bounded, redacted tool results visible to every authorized Session viewer, independent of Workspace role.
  • v1.1.0 (2026-08-22): Added the end-to-end product test and surgical self-update contract.
  • v1.0.0 (2026-08-22): Defined the Pi Brain, scoped Hands, Workspace, Resource, Session, GitHub, browser, secret, and tool direction.