L4 0.3.0

This release turns L4 into a workspace for teams and their agents and starts the server-v2 database lineage. Landing, Shell, installer, Server, portable runtime and Docs share 0.3.0. Customer Servers update only when their operator chooses an update.

Fresh Servers only

Server migrations are squashed into one server-v2 baseline. A 0.3.0 Server requires a fresh database: it refuses a server-v1 database, and the release declares llll-server-schema-v2, so the installer neither installs nor updates across lineages. Install a new Server for 0.3.0; Servers on 0.2.x stay on their selected release. Durable Object migrations are unchanged.

Agents and code work

• Agents work on repository Tasks through a connected Compute Node or Lizard VM and open draft pull requests. Server settings group Agents, Models, Repositories, Compute and Tools, with a setup checklist.
• Roles are collections of reusable policies; the Owner can extend Admin and Member with policies.
• Agents can be deleted. The Runs page lists your own Runs. A Task can be created from a chat message, linked both ways.
• Agents receive mentions as names; a bare mention is a ping.

Inbox, chat and mail

• Inbox is a queue of what needs you: approvals, unread mentions, your agent work, Tasks assigned to you or waiting for your review, unread mail and unread chats, with Mark as read.
• Server-wide message search; role mentions (opt-in per Role); channel archiving; visibility changes and reordering for channels; live channel updates; one 1:1 DM per pair; edit mentions notify only new people.
• Message moderation for channel managers, chat rate limits, emoji-only reactions.
• Mail: push notifications for new inbox mail, folder search, Cc/Bcc and forward.
• Data and Apps are paused in this release and shown as coming soon; their APIs and stored data are unchanged.

Live and Schedules

• Live rooms always end, reconnect after a dropped connection, expose host remove/mute and use clearer errors and incoming-call controls.
• Schedules retry with visible errors, report the real block reason, notify the person who set a reminder, handle time zones and DST, and can be paused, resumed and inspected.

Security

• Sign-in, signup, password reset, recovery and Owner claim are rate-limited per address and per account and fail closed. Self-host gateways no longer trust a client-sent CF-Connecting-IP.
• Role-mode agents cannot reach arbitrary web or MCP destinations after reading private data; private-source answers post only in the initiator's DM.
• read_url blocks IPv6, mapped, NAT64, CGNAT and single-label internal addresses and rechecks the final URL.
• Content-Security-Policy without inline-script 'unsafe-inline', HSTS and Permissions-Policy. Every Server document, including the PWA's cached shell, carries the Server's frame-ancestors; the build publishes no static HTML.
• Cookie-authenticated mutations require a same-site Origin or Sec-Fetch-Site. /api/setup/health is read-only.
• Mention pushes from mailboxes and Task discussions reach only people who can read them.

Runtime

The Cloudflare Agents SDK is removed; MCP uses the MCP SDK directly. celld is 0.6.3. npm advisories are patched. Container images move to Caddy 2.11.7, AWS CLI 2.38.5, Node 26.12.0 and Docker CLI 29.9.2.