What's changed

Several decisions inside a turn were full LLM calls whose only output was a label. They are now typed questions answered by TypeSafe Jev (“System One” by TypeSafe AI), a decisions-only model: it picks one of a set of options, answers yes or no, or places text on an ordered scale, with a calibrated probability, and never writes text. Every site keeps its previous LLM implementation as an automatic fallback when Jev cannot answer, and a circuit breaker makes that fallback immediate during an outage. Jev runs on Rylvo’s own key, so these decisions no longer use your provider key; the fallback still does.

New

• Custom-evaluation guardrail rules are judged together: every custom rule that checks the same text is one request, instead of one sequential LLM call per rule. The reason carries the probability, for example Violates “Never promise a refund” (p=0.94). The fail-closed policy is unchanged: if no judge can answer, the rule counts as violated.
• For a bot whose workflow has two or more stages, the stage is picked from that workflow’s own stage ids, and the user’s sentiment is scored from -1 (furious) to 1 (delighted) in the same request.
• Agent-group routers whose rules read only the intent are dispatched by Jev. Routers with other rules keep the LLM classifier.
• Knowledge Base Self-RAG grades every retrieved passage relevant or not in one request. If it would reject every passage, all of them are kept, because an answer with no evidence is the failure it exists to prevent. It still adds a network round trip, but no longer spends your model tokens.
• Mission Control adds a model-scored risk signal alongside the deterministic ones on live channel conversations: frustration, urgency and cancellation-threat probabilities over the last five user turns. The existing frustration and urgency detection is English keyword lists, which score zero on other languages. The score is still a fixed-weight combination with every contributing signal listed; this signal is one input and can raise the score, never lower it.
• Flow steps that branch on intent: Jev picks the intent, and a branch is taken only when it is at least 50% sure. Otherwise the flow stays on its step.
• Fan-out “vote” merges: Jev picks the best branch and that branch’s reply is returned exactly as written. Before, an LLM re-typed it.
• Jev decisions are steps on the turn’s trace (jev-guardrail-check, jev-workflow-stage, jev-kb-relevance, jev-flow-intent and so on) with model typesafe/jev-latest, tokens, cost, latency, and each question with its answer and probability. Question text that quotes your customer is stored only when the bot captures inputs. The Mission Control risk signal is the exception: it is shown with the conversation’s other risk signals in Mission Control.

Fixed

• Workflow escalation rules written over sentiment could never match: the engine evaluated them against a hardcoded sentiment of 0. They now compare against the scored sentiment above.
• After the 22 September release, orchestrated agent-group turns failed with a server error. The new router fast-dispatch path imported a name that did not exist, and nothing that ran before the deploy exercised that path. It was fixed and deployed within the day, and a check that resolves every import written inside a function now runs before each engine deploy.
• The new Mission Control risk signal ignored the platform-wide “shadow only” switch, which exists so Jev can be observed without deciding anything. While that switch was on, the signal could still raise a conversation’s risk score. It now honours the switch.

Changed

• Our subprocessor list now includes TypeSafe AI, which classifies conversation text for the decisions above. TypeSafe began processing on 22 September and was added to the list on 23 September. The list should have come first.
• Organizations can turn Jev off in Settings → Security. Nothing from that organization is then sent to TypeSafe, not even for comparison, and each decision goes back to its previous implementation. The change is recorded in the audit log.

A platform-wide reliability and correctness pass. Most of this month's work was verifying that features behaved the way the product said they did — and fixing the places where they did not.

New

• Single sign-on (SAML 2.0) on Enterprise, against any identity provider — Google Workspace, Okta, Entra ID. A domain must be verified by your organization before it can be routed to a provider, so nobody can point your company's sign-ins at a provider they control. Enforcement is checked server-side on every request rather than in the browser, and enforcing it requires nominating a break-glass address that keeps password sign-in: if your identity provider fails, the people who can turn enforcement off must still be able to get in.
• SCIM 2.0 user provisioning — add and remove people from your directory without touching the dashboard. Removing someone revokes access but keeps their audit trail intact. A directory sync cannot change a Rylvo role, by design: a sync that could set roles could create administrators unattended.
• Two-factor authentication (TOTP) is live. Note two limits we would rather state than have you discover: there are no recovery codes, and exactly one authenticator can be enrolled per account — losing your device means asking an operator to remove the factor.
• Public status page at /status — per-surface state, 24-hour uptime and p95 latency, refreshed every five minutes. It names recent failures rather than hiding them.
• Public security overview at /security — architecture, data residency, encryption, retention and access control, with the gaps stated plainly.
• Agency workspaces now show what each client workspace spent this billing period.
• Uploads are validated by their contents, not the filename or declared type: an executable renamed to .txt is rejected.
• Per-loader timing in traces, so the slowest part of building a bot's context is attributable rather than a single number.

Fixed

• The knowledge-base vector store was reached over plaintext HTTP across the public internet, so its credential crossed an unencrypted connection on every request. Authentication always held, so no customer data was ever readable by a stranger — the exposure was the credential in transit. It now speaks TLS and the plaintext port is refused outright rather than merely unused.
• The sign-in page crashed for every visitor for roughly ninety minutes on 13 September after a change of ours. It was our defect, caught by us, and the automated check that would have prevented it is now part of the pre-release gate.
• Data export returned only part of an organization's data. It now covers every namespace, and reports any collection it could not read instead of omitting it silently.
• Audit-log export stopped at 500 rows without saying so. It now pages to the end of the selected range, and tells you when a range is too large.
• Organization deletion left some records behind when a background trigger recreated them mid-delete. The cascade now re-sweeps until nothing remains.
• Broadcast targeting could use a stale audience segment. Segments older than 15 minutes are now resolved live.
• Support requests reached storage but notified nobody. Both the contact form and in-product support now alert us immediately.
• Mission Control approvals in some workspaces could never expire.
• Automatically detected edge cases were written where the dashboard could not display them.
• The prompt optimizer could promote a new prompt version after evaluating it against synthetic samples. It now requires real traffic before promoting automatically.
• Knowledge-base retrieval now says when it returns nothing, instead of appearing to succeed.
• Several plan-gate and empty-state messages that described the wrong thing, and accessibility labels missing from icon-only controls.

Changed

• Pricing no longer lists SSO/SAML and multi-region as available. Both are roadmap items; the pricing page and security overview now say so.
• Deleting an organization from the admin console now requires a recent sign-in, matching the other irreversible actions.
• Our subprocessor list now includes Upstash, which processes IP addresses for rate limiting.

This changelog starts with September 2026. Earlier changes were not published; the release history before this point lives in the repository.