> ## Documentation Index > Fetch the complete documentation index at: https://ara-90a60a07.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # GOAL # Goal Version: 1.9.2. Last verified: 2026-08-25. Build an Aside-inspired **Ara agent runtime powered by Pi**. The short implementation name is **Pi runtime**; **Live Pi eval** names the evaluation workflow. Ara is not a byte-for-byte clone of proprietary Aside internals. It should match the felt behavior: one adaptive conversation, progressively useful Workspace skills, durable personal memory, contextual tools, lazy Hands, recovery, compaction, and bounded specialized subagents. Ara should take a request from intent to verified work with as little ceremony as possible. The product must support: * MCP tools and integrations whose settings distinguish saved setup from a verified connection; * durable memory and reusable skills; * steerable, resumable Sessions; * isolated sandboxes; * GitHub repositories, branches, pull requests, and reviews; * browser and device use; * write-only secret injection; * explicit tools with observable, session-visible results. One Workspace owns configuration. Resources attach dynamically. Capabilities, tenant identity, memory ownership, and evidence provenance are scoped mechanically even where copying a looser interaction literally would be unsafe. Pi runtime is the only agent runtime. Aside is the preferred authenticated browser and device boundary when local or in-app browser access is insufficient. Physical user computers are dormant in the current rollout. One source-level release switch keeps the CLI, web app, API, agent tool catalog, and installed controller aligned. The controller, Device identity, heartbeat, signed updater, and execution plumbing stay shipped, but both the server and controller reject physical work while the switch is off. Cloud and ephemeral sandbox Devices remain active. Installation may record versioned consent for a future Device and a separate grant for Ara's private `~/.ara/workspace` folder. After the release switch flips, the updater may activate only installations with both matching records; the resulting controller has read, write, and confined-execution authority only inside that folder. Host-wide process/port inspection, desktop Hands, environment discovery, MCP exposure, and the unsandboxed shell stay disabled. Update-only, CLI-only, missing-grant, and legacy full-home installations remain drained until a fresh explicit folder action makes them eligible. Ara measures CLI installation and updater health with a random per-installation identifier, bounded version/platform/consent fields, update outcomes, and coarse ingress geography. This telemetry must never include local paths, filenames, hostnames, environment names, file contents, or secrets. Legacy Device heartbeats remain observable to measure controller-version adoption and rollout readiness. Their service and Device identity remain dormant rather than being removed; heartbeat or update authority never restores execution authority. The goal is not more framework. The goal is a fast, legible path from request to tested code and a focused pull request. ## Runtime trajectory The current end-state contract is one ordinary `conversation` profile that can move between Brain and Hands as the work requires. Brain and Hands are execution lanes, not permanent user modes. Provider requests declare only the contextual subset of the canonical tool vocabulary, with one `repl` entrypoint for typed, scope-filtered Ara capabilities. Workspace skills remain Workspace-scoped; personal memory remains owner-scoped and durable; connected resources remain tenant- and grant-scoped. Specialized subagents are exactly `code_explorer`, `context_explorer`, `default`, and `fork_self`. Those names describe durable policy differences: repository-only investigation, memory/skill/web context gathering, bounded general work, and a bounded fork of the source context. They are exact because the same identifiers bind persisted profile snapshots, prompt composition, tool authority, telemetry, and evaluation. Adding aliases or version suffixes would create competing meanings rather than compatibility. The remaining trajectory is to make the adaptive Conversation faster and more truthful: progressively disclose context, preserve continuity through compaction and recovery, activate Hands only when physical work is needed, improve useful skill and memory retrieval, and make every result inspectable without broadening mechanical authority. New runtime work should reduce owners, duplicate instruction paths, and hidden state rather than add another executor or compatibility vocabulary. The model-visible Workspace skill catalog is bounded relative to the selected model's context window. Built-in skills remain visible; when optional entries do not fit, the prompt tells the model that more skills remain discoverable through search rather than silently presenting a truncated catalog as complete. A repository-less Conversation has no persistent repository workspace to wake. It remains resumable through ordinary Session messages; reconnect and restart machinery must not invent a repository requirement. Inbound Session instructions pass a narrow, enforceable safety screen before they reach an agent. It rejects verified credential-exfiltration and unsafe process-instruction shapes without rejecting ordinary configuration work. This screen is defense in depth: sandbox confinement and drop-root remain the primary runtime boundary. Product and interaction intent belong to the product roadmap. This file owns the runtime trajectory and its load-bearing contracts; it must not become a second feature roadmap. ## Product test The direction is working when Ara can take a bounded request through one clear path: understand the repository, choose the right tools, delegate without duplicate work, use scoped Hands, preserve continuity, produce a focused change, and return evidence that matches the deployed result. Speed without proof is incomplete. Proof without a useful result is incomplete. The target is the shortest trustworthy path to working software. Deterministic contracts define the runtime boundary; local real-model runs, pull-request CI, previews, and deployed staging each prove a different layer of that trajectory and must remain separately inspectable. ## Living contract This file is writable product memory. Update it only when verified product direction, scope, or a load-bearing product invariant changes. Implementation commands and environment procedures belong in `DEVELOPMENT.md`; rendered and user-facing design rules belong in `DESIGN.md`. 1. Identify the source evidence and the user decision that changed the goal. 2. Patch the smallest affected statement. 3. Promote a repeated product failure into a `HARD RULE` when it protects the direction across implementations. 4. Remove superseded direction. Do not preserve two competing goals. 5. Verify that `AGENTS.md`, `DESIGN.md`, product source, and `DEVELOPMENT.md` still point to one compatible system. 6. Bump the version and add one changelog line. HARD RULE: Do not change the product goal merely because one implementation is easier. HARD RULE: Do not add a second Brain, fallback runtime, or parallel Workspace model as a workaround. HARD RULE: Every authorized Session viewer can inspect each tool's bounded, redacted result. Tool visibility does not vary by Workspace role. HARD RULE: Installer consent and automatic-update authority are never physical execution authority. A user computer cannot run Ara work until that execution is sandboxed to explicitly attached folders. HARD RULE: Disabling physical execution drains claims server-side and blocks them again inside the installed controller. Do not retire the controller or split this boundary into independently drifting rollout flags. Keep the latest ten changelog entries. Git retains older history. ## Changelog * v1.9.2 (2026-08-25): Bounded the model-visible Workspace skill catalog by the selected context window while preserving built-ins and truthful search disclosure. * v1.9.1 (2026-08-25): Made inbound Session instruction screening a load-bearing defense-in-depth contract while retaining sandbox confinement and drop-root as the primary runtime boundary. * v1.9.0 (2026-08-24): Made repository-less Conversations resumable through ordinary Session messages without attempting to wake a repository workspace. * v1.8.2 (2026-08-24): Separated deterministic, local real-model, CI, preview, and deployed-staging evidence in the runtime trajectory. * v1.8.1 (2026-08-24): Verified the canonical Ara agent runtime, Pi runtime, Live Pi eval, Conversation, profile, and contextual tool names against the current delivery path. * v1.8.0 (2026-08-23): Named the Aside-inspired Ara agent runtime powered by Pi and its adaptive Conversation, exact profiles, contextual tools, memory, skills, recovery, and compaction trajectory. * v1.7.0 (2026-08-23): Added separately granted private-workspace activation and a switch-true rehearsal while keeping legacy full-home Devices drained. * v1.6.1 (2026-08-23): Added DESIGN to the root contract boundary and cross-contract verification path. * v1.6.0 (2026-08-23): Preserved physical Device plumbing as a doubly locked dormant controller behind one source-level release switch. * v1.5.0 (2026-08-23): Required integration settings to distinguish pending setup, broken authorization, and verified connections.