What we shipped, and why.

A real invoice chase wrote its answer five minutes in. Everything the task asked for, correct. Then it spent twenty more minutes reading the same policy file again until a time limit killed it.

The run was recorded as failed. The customer would have been told their invoice chase did not work, while the finished answer sat in a sandbox we deleted a moment later.

The problem: the run ended when the agent said it was done. That is not the same question as whether the work is done. So the harness watches the file instead. When the result file is there and matches what the task promised to produce, the run ends. Nothing left to pay for.

Free runs also got faster and cheaper. Free was capped to the cheapest model. That model kept getting one tool call wrong and repeated the same broken call eleven times without ever getting it right. It is 4x cheaper per token and far more expensive per job, because it loops until a ceiling stops it — and the ceiling is where the bill lands. Free now reaches the standard model. Spend is still capped in dollars, which was the control doing this job all along.

Found by an audit, before a customer found it.

Every API route scoped uploads and answers to the business that wrote them. The one place that puts those files in front of the agent did not. So two businesses running the same wedge shared a pile: uploaded documents, intake answers, prices, policies, and past corrections.

It was not only a disclosure. Intake answers use the same filename for everyone, so the last business to answer a question quietly overwrote everyone else's answer. Your agent could quote a stranger's late fee to your client, and nothing anywhere would say why.

Reading knowledge now requires a business id and fails closed. An unlabelled row belongs to nobody rather than to everybody.

Also: what we charge you was measured wrong, by 15-60x. The meter used hardcoded prices from a different model provider than the one we run. The free tier's "$2 a month" of usage was really about three cents. It reads the real price table now — which is the same number the plan ceiling enforces, so the limits mean what they say.

We had 700 lines of machinery for turning your edits into rules the agent follows. Nothing called it. What actually ran was: mount every file for this wedge and hope.

Now, when you edit what the agent proposed before approving it, your version is captured and turned into a rule. The next run gets the rules that matter for that client and that job — not everything ever written, which grows without limit and drowns the relevant thing.

Three decisions we would defend:

• A rule about one client beats a general rule, because the exception is the expertise.
• Auto-approvals do not count as learning. Nobody looked at them. Counting them would let a wedge that approves everything report itself getting better while getting worse.
• If the agent runs out of room for rules, it says which ones it dropped instead of silently cutting the list.

Your own words decide it, not the agent's paraphrase of them.

Someone running Mycel themselves should never meet a paywall. That default was applied to everybody, including accounts on our hosted product — and the self-host plan has no seat limit, no job limit, and no spend ceiling. We bought the tokens. Nothing capped them. The pricing page was decoration.

Hosted signups now start on Free. Self-hosting is unchanged and still has no paywall: the hosted behaviour is opt-in, so nobody acquires a bill by accident.

A connected app now means a connected app. We marked an app connected the moment you opened its login screen. Close the tab without finishing and it still said connected — with a green pill — so the agent was told a tool existed, reached for it, and failed at the moment it tried to do real work. Connected now means the provider confirmed it, and it clears when they stop confirming. Half-finished is its own state, so you get "finish connecting" instead of a lie.

The LinkedIn executor ignored which action it was asked to run. Endorse a skill, view a profile, anything at all — it sent a direct message. So the card you approved named one thing and a different thing happened. That makes the approval a decoration, which is the one thing it can never be.

There are seven named LinkedIn actions now, and anything outside that list is refused by name rather than guessed at. The sequencer and the executor read the same list, so they cannot drift apart again.

The outreach loop also runs end to end: find people, add them to a campaign, pace it, warm up, invite, message. People found this way are written into the CRM as records, and their employers as companies — the screens that have been rendering empty now fill.

Two rules worth naming. A campaign cannot grow after you approve it: the card said "N prospects", and a list that grows after your signature is a different decision wearing your consent. And a prospect added without copy parks rather than improvising words to send a stranger.

When the kernel starts, it looks for jobs that were interrupted and cleans them up. That is right when there is one process. We run several. So any container booting — a deploy, a scale-up, one health check restarting one task — marked every job in flight failed, across every customer, with "interrupted by a restart".

Found by running a real job twice and getting that error both times on a settled deployment. The second one was killed by our own probe container.

Cleanup now only touches jobs that have gone quiet for ten minutes. A live run writes constantly, so silence is the difference between a run whose process is gone and one another machine is still driving.

And there is a run page. A to-scale waterfall of what the agent actually did, drawn on the server so it works without JavaScript, then live over the stream: tool results, cost per step with the model and token count behind it, and where it drifted. Failure is treated as the normal case, because it is — "ran out of time" and "an approval was never answered" used to read identically, and now say which. The step where a run died stays amber and open, because nothing is running there.