v0.40.0 — Build Once, Run Anywhere

Describe what you want in plain English and Sandcastle builds the workflow. Run it on any model — Claude, GPT, Mistral, a local model on your own box — and move it between them with one line. Deploy it your way: cloud, your server, fully air-gapped, EU-only. And it gets better over time, on its own.

Highlights

• Omnibox — "What should your agent do?" Describe a task in plain English, Sandcastle generates the workflow, you run it. Also one keystroke away with ⌘K.
• Three-verb navigation (Build / Run / Improve) + density tiers (Essentials / Standard / Everything), a tabbed Settings hub, and a self-explanatory Workflow Builder (hover cards, inline help, plain-English step summaries, live validation).
• The Black Box — a tamper-evident, signed hash-chain over every recorded run, a black_box compliance mode, and sandcastle audit verify. A replayable, verifiable audit trail for the EU AI Act era.
• The Architect — generate → run → judge → refine until the workflow actually works, then ship it with a recorded cassette as a Proven template.
• Self-Healing Workflows — failed runs get an LLM diagnosis, a patched version behind an approval gate, and regression tracking.
• Model Time Machine — replay your real recorded workload against a different model and get a quality / cost / latency delta. Dry-run pricing is free; live replay runs under a hard budget.
• Sandcastle Mesh — register multiple machines and route steps by capability (requires: [gpu, browser]) across your own hardware, with a Fleet view.
• Night Shift (what your agent learned overnight) and Mission Control (a full-screen live run theater at /runs/:id/live).
• Verified template bundles (.sctpl) with replayable proofs, plus a real GPU LoRA trainer for Overnight Self-Tune.

Changed

• New "Sand & Ink" visual identity (instrument-panel layout, control-room status lights, illustrated empty states, settle motion) and an editorial Manifesto rebuild of the marketing site.
• LLM/standard steps pin a low sampling temperature — output stays deterministic across providers (some endpoints default to 1.0 and produce garbled output).

Fixed

• POST /generate accepts any configured provider (not just Anthropic) and clearly warns when none is connected.
• An empty model response is now a failed step with a clear message, not a silent "completed" run.

Security

• SECURITY.md with a coordinated-disclosure policy, antivirus false-positive guidance, and download verification. Releases now ship SHA256SUMS.txt with keyless cosign signatures.

Install / upgrade: pip install -U sandcastle-ai

Full changelog: CHANGELOG.md

v0.33.0 — Your Box, Your Brains

The cloud was always someone else's computer. This release is yours.

NVIDIA put a Grace-Blackwell supercomputer and 128GB of unified memory on a desk. Most teams will run a demo and screenshot the tokens-per-second. We made Sandcastle treat it like home.

⚡ Spark Mode, zero flags

Sandcastle auto-detects an NVIDIA DGX Spark and flips to local-first defaults on its own. A startup banner, a dashboard badge, and GET /api/runtime all say the same thing: you're running on your own silicon.

🧠 Local inference, first-class

A new nim/* provider (NVIDIA NIM, OpenAI-compatible) joins ollama and oMLX — every one at region=local, $0.00/run, data-stays-on-box. On a Spark, the default model auto-routes to the local NIM. No token meter. No egress.

🌙 Overnight Self-Tune

The evolution loop can train a task-specific LoRA adapter on a workflow's own eval data and route to it. The box doesn't just run your task — it gets better at it, on your data, for $0.

…and the rest

Deterministic cassettes (+ strict mode), shareable run permalinks with a 30-day TTL, sandcastle run --local, a Template Hub explosion (new categories + a community gallery + dozens of provider-neutral RPA workflows), tool step + UGC Studio, llms.txt, the 2026-06 model wave (GPT Image 2, Gemini 3.5, GPT-5.2), a provider-neutral dashboard refresh, and a security & reliability sweep (browser-step SSRF guard, share-token TTL, NIM model-id validation, a sync run endpoint that no longer lies "completed", and a sandbox_exec fix for browser dom/computer-use/lightpanda).

pip install sandcastle-ai==0.33.0

Full notes: CHANGELOG.md · Release history: sandcastle-ai.eu/whatsnew

_{NVIDIA, DGX, and DGX Spark are trademarks of NVIDIA Corporation.}

v0.32.0 - Claude Agents Deep Integration

You shipped the agent. The client wants the integration. The auditor wants the trail. The user wants you to ask the next question without restarting the whole workflow. v0.32 is the answer to every one of those.

Sandcastle now exposes every Anthropic Managed Agents primitive shipped under the managed-agents-2026-04-01 beta umbrella, plus the things Anthropic doesn't ship: cryptographically verifiable trajectory replay, a Skills publisher that turns workflows into uploadable Claude Skills, and an Agent SDK runtime for teams that want in-process execution. Two weeks of work, 169 new tests, one release.

Highlights

Anthropic primitives (under the beta header)

• Memory Stores - versioned per-session memory at /mnt/memory/, redact endpoint, optimistic concurrency
• Multiagent coordinator - 20 specialist agents in parallel, 25 threads, 1-level depth, 3 pre-baked templates
• Outcomes API - user.define_outcome events + span.outcome_evaluation_end capture wired into AutoPilot
• Webhooks - HMAC-signed lifecycle events at /agent-webhooks/anthropic
• MCP Elicitation - 6th MCP primitive (spec rev 2025-11-25). Ask the user for missing input mid-workflow.

Sandcastle differentiators

• Skills Publisher - sandcastle publish-skills --upload packages every workflow as SKILL.md tar.gz and uploads to /v1/skills
• Trajectory Replay step type - SHA-256 over recorded tool-call sequence, diff vs candidate run. Cryptographically verifiable because Sandcastle's audit trail is a hash chain.
• Agent SDK runtime - runtime: "agent-sdk" swaps Managed Agents for in-process Claude Agent SDK
• Computer Use - type: computer-use with computer_20251124 beta + 8-item safety pre-flight
• Tool Search + 1-5 examples convention - Anthropic measured 49% to 74% tool-selection accuracy + 85% context savings + 72% to 90% parameter accuracy

Tier 1 wire fixes (table stakes)

• tools_enabled finally reaches the API
• temperature, max_tokens, thinking_budget on ManagedAgentConfig
• stream config field actually honoured
• Pricing table for every Claude 4.x model
• Fallback chains of up to 5 templates

Dashboard

• Live Agent Reasoning panel with SSE event stream (agent.thinking, agent.tool_use, agent.message, agent.complete, agent.error)

By the numbers

• 15,176 tests passing
• 169 new v0.32 tests, all green in 1.8s
• 9 new modules
• 24 step types (was 22)

Install

pip install sandcastle-ai==0.32.0

PyPI: https://pypi.org/project/sandcastle-ai/0.32.0/
Live demo: https://gizmax.github.io/Sandcastle/
EU AI Act landing: https://sandcastle-ai.eu/eu-ai-act/
Full changelog: CHANGELOG.md

v0.31.0 - Compliance & Connections

Eighty days. That is how long you have until the EU AI Act's general-purpose obligations go live. After 2 August 2026, "we'll figure it out later" stops being an acceptable answer. v0.31 is the answer you can ship today.

Highlights

EU AI Act (the deadline)

• Dedicated landing page at sandcastle-ai.eu/eu-ai-act/ mapping every Sandcastle control to Articles 9, 11, 12, 14, 25, 49, 50, 73 and Annex IV
• 10 compliance workflow templates in workflows/compliance-pack/: DPIA, vendor risk, incident report, bias audit, model card, AI inventory, risk register, GDPR DSAR, human oversight log, transparency report
• 4 marked risk_level: high with mandatory approval steps

MCP-First Publishing (the connections)

• sandcastle publish-mcp [<workflow>] generates ready-to-paste Claude Desktop / Cursor / Windsurf config blocks
• All 5 MCP primitives shipped: tools, resources, prompts, sampling, roots
• .well-known/mcp.json discovery manifest
• Each published workflow becomes one MCP tool whose input schema mirrors the workflow's input_schema

Eval Gates That Block Bad Models

• New GoldenDataset + GoldenCase models (tenant-scoped, versioned)
• POST /api/workflows/{name}/publish?strict=true runs the gate; regression fails closed (422)
• POST /api/golden-datasets, GET /api/golden-datasets/{name}, POST /api/workflows/{name}/eval-gate

Per-Workflow Stats API

• GET /api/workflows/stats (bulk) and GET /api/workflows/{name}/stats aggregate run counts, success rate, average cost, last-run status. Tenant-scoped, 30s cache.
• GET /api/schedules/{schedule_id} returns a single schedule (was missing)

Dashboard

• Overview page split from 2,261 lines into a 241-line orchestrator + 20 sub-components, each in its own error boundary
• A11y pass: aria-expanded, aria-controls, aria-hidden, focus-visible rings, sr-only labels
• localStorage wrapped in try/catch (private browsing fallback)
• Modal widths scale on tablet
• Disabled opacity bumped to WCAG-AA contrast

Security - Codex Audit Rounds 9 + 10 (5 HIGH + 1 MEDIUM)

• A2A endpoint honours allowed_workflows and per-key max_cost_usd budgets
• Mem0 scope IDs tenant-prefixed; tenant_id threaded through every executor path
• ReportConfig HTML-escaped, accent_color hex regex (stored XSS)
• WeasyPrint URL fetcher blocks private IPs + non-http(s) schemes (SSRF)
• Workflow generator no longer inlines content from shared workflows_dir for tenant-scoped callers (cross-tenant prompt injection)

Fixed

• Evolution token estimator uses workflow-specific run history instead of hardcoded 1,000

By the numbers

• 15,014 tests passing
• 240 MCP-related tests (13 new)
• 266 eval-related tests (14 new)
• 37 compliance pack tests + 6 skips
• 69 evolution tests (8 new)
• 784/784 dashboard vitest passing

Install

pip install sandcastle-ai==0.31.0

PyPI: https://pypi.org/project/sandcastle-ai/0.31.0/
Live demo: https://gizmax.github.io/Sandcastle/
EU AI Act landing: https://sandcastle-ai.eu/eu-ai-act/
Full changelog: CHANGELOG.md

v0.30.0 - Agents Unleashed

v0.30.0 - "Agents Unleashed"

Claude Managed Agents are now workflow steps. Pick from 15 templates or describe what you need.

Highlights

• Managed Agents - type: managed-agent delegates to Anthropic cloud runtime (bash, web, code)
• 15 Agent Templates - researcher, coder, analyst, writer, reviewer, scraper, tester, devops, translator, designer, sql_expert, seo_specialist, legal_analyst, financial_analyst, project_manager
• Describe Mode - AI designs agents from natural language
• Agent Chaining - output_format, shared_files, fallback_template
• GLM-OCR - 0.9B model, 94.6% accuracy, runs locally via Ollama, free
• Token Waste Detection - file cache, duplicate detection, output_max_tokens, per-run report

Install

pip install sandcastle-ai==0.30.0

https://sandcastle-ai.eu/whatsnew/

v0.28.1 - Every Step Knows Its Story

v0.28.1 - "Every Step Knows Its Story"

Steps explain why they exist. Errors tell you what went wrong. The CLI shows you what's happening in real-time.

Highlights

• Self-Describing Workflows - responsibility, source_hint, owner on every step. sandcastle describe/lint/owners CLI.
• context_query - LLM steps fetch context dynamically from memory, web, files, or custom commands before execution.
• sandcastle run --stream - Live terminal output with colors, timing, cost.
• Real-time step progress - Dashboard shows live checkmarks via SSE.
• Detailed errors - Full error messages, not just "failed". PDF download for report steps.
• Batch cancel - Stop running batches mid-flight.
• Template semantic search - "Did you mean..." fuzzy suggestions.
• 540 new tests - 280 template e2e + 260 provider integration.

Install

pip install sandcastle-ai==0.28.1

v0.28.0 - Batch, Monitor, Report.

v0.28.0 - "Batch, Monitor, Report."

Sandcastle stops being a tool and becomes a platform.

Highlights

• Auto-Update - sandcastle update with rollback, channels, blackout windows
• Batch Run - 1000 items in parallel, progress tracking, aggregate cost
• PDF Reports - type: report step, WeasyPrint, auto-charts, KPI boxes, 3 themes
• Schedule Monitor - dashboard with status grid, success rate, next-run countdown
• Chandra OCR - scanned docs, handwriting, 90+ languages. pip install sandcastle-ai[ocr]
• oMLX - 7th provider, local AI on Apple Silicon (Llama 4, Mistral, Gemma, Qwen)
• Version Diff - YAML diff between workflow versions
• Activity Feed - real-time audit events on dashboard
• Deep Research Pipeline - 6-step OpenVLAW-inspired template

Install

pip install sandcastle-ai==0.28.0
pip install sandcastle-ai[report]  # PDF reports
pip install sandcastle-ai[ocr]    # Chandra OCR

Local AI with oMLX

pip install omlx
omlx serve mlx-community/Llama-4-Scout-17B-16E-Instruct-4bit
export SANDCASTLE_ADVISOR_PROVIDER=omlx
sandcastle serve

Links

• Web: https://sandcastle-ai.eu
• What's New: https://sandcastle-ai.eu/whatsnew/
• Live Demo: https://gizmax.github.io/Sandcastle/

v0.2666b1 - Hardened

v0.2666b1 - "Hardened"

v0.2666 was the vision. v0.2666b1 is the proof.

We shipped universal advisor, EU data residency, smart failover. Then we spent a week trying to break it.

What's new

• AI Assistant got smarter - Auto-fixes validation errors (2 retries). Suggests matching templates. Learns your workflow style. Knows which tools you have configured.
• First 60 seconds redesigned - Auto-detects Ollama and API keys. One-click demo workflow. 2-step onboarding (was 5).
• Failover Dashboard - See when and why providers failed over. Per-workflow cost recommendations.
• Agent Memory Page - Search, browse, delete memories. Importance and decay visualization.
• Security hardened - 10 fixes: admin auth, template injection, EU residency enforcement, rate limiting.
• Executor bulletproofed - 10 fixes: race conditions, NaN budget bypass, timeout enforcement, thread leaks.
• Performance - GZip, cache headers, 2-phase loading, search debounce, DB indexes.

Numbers

New tests	1,875
Bug fixes	90
Security patches	10
Total tests passing	14,361+

Install

pip install sandcastle-ai==0.2666b1

https://sandcastle-ai.eu/whatsnew/

v0.2666 - Your AI, Your Rules, Your Borders

v0.2666 - "Your AI, Your Rules, Your Borders"

The release where Sandcastle stopped being an orchestrator and became a platform.

One setting changes everything

Set SANDCASTLE_ADVISOR_PROVIDER=mistral and every AI feature - generation, evolution, evaluation, quality scoring - switches to Mistral. Tomorrow you want Claude? Change one line. Ollama on your laptop? Same line. Six providers, one setting, zero code changes.

Your data stays where you say

DATA_RESIDENCY=eu - that's it. All AI processing routes through EU providers (Mistral) or stays local (Ollama). Not a policy document. Not a promise. Hard enforcement at the routing layer. Try sending data to a US provider with EU mode on - Sandcastle won't let you.

Your infrastructure, your choice

Provider hits a rate limit at 3 AM? Sandcastle switches to the next one. No error. No alert. No intervention. You wake up, check the cost dashboard, and see: "Failover activated 2x overnight. $0.12 additional cost." That's it. That's the whole story.

It knows more about your costs than you do

Per-provider cost breakdown. "Last 30 days: $120 via Claude. Same workloads via Mistral: $45." One-click to see the math. Proactive recommendations that actually make sense.

What's new

• Universal Advisor - 6 providers (Claude, Mistral, OpenAI, Google, MiniMax, Ollama). One setting switches all.
• EU Data Residency - Hard enforcement. EU or local only. Compliant by design.
• Smart Auto-Failover - Seamless provider switching on 429/5xx/timeout.
• SLO-Aware Routing - Best model for critical ops, cheapest for simple ones. Automatic.
• Cost Dashboard - Per-provider breakdown + "what if" savings calculator.
• Provider Recommendation Engine - Proactive suggestions. Not just data - advice.
• Document Parser - PDF/DOCX/XLSX at 576 pages/sec. New type: parse step.
• OpenClaw Integration - New type: openclaw step. Call OpenClaw agents from workflows.
• 20 Step Types - Up from 17. Added openclaw, parse, composio.
• UX Overhaul - Getting Started checklist, Quick Run cards, collapsible sidebar, step categories, backend configurator, lazy loading, infrastructure switcher.

Numbers

AI providers	6
Step types	20
Templates	236
Integrations	63
Tests passing	9,400+
Lines to switch providers	0
Pages/sec parsed	576

Install

pip install sandcastle-ai

Links

• Web: https://sandcastle-ai.eu
• What's New: https://sandcastle-ai.eu/whatsnew/
• Live Demo: https://gizmax.github.io/Sandcastle/

Built in Prague. European-built, open source. Your AI, your rules, your borders.

v0.25.1 — UI Finetuning

Bell simplified to notifications only. AI Generate + Edit with AI merged into single AI Assistant button. Health info consolidated in overview.