This is the release-facing operator guide for Veritas Kanban 6.1.0. The detailed provider commands live in Agent Providers, the machine-readable support contract is summarized in Harness Compatibility, and Buzz relay setup lives in Buzz Integration.
Documentation freshness: 2026-07-26 for Veritas Kanban 6.1.0.
Do not install 6.0.0. It is retained as a quarantined prerelease. Version 6.1.0 is the current supported stable v6 build and supersedes 6.0.2.
Install the signed/notarized stable app:
brew tap BradGroux/tap
brew install --cask veritas-kanban
Manual installation uses
Veritas-Kanban-6.1.0-mac-arm64.zip from the
v6.1.0 GitHub release.
Move Veritas Kanban.app into /Applications, launch it normally, and verify
Settings -> Maintenance before enabling an agent or external integration.
For a new board:
/api/health reports version 6.1.0.The default desktop workspace remains:
~/Library/Application Support/@veritas-kanban/desktop/profiles/default/workspaces/local/
Keep the authoritative SQLite database on the normal local Application Support filesystem. NAS, SMB, NFS, FUSE, iCloud, Dropbox, OneDrive, and other synchronized/remote filesystems are unsupported database locations.
The supported source is the latest signed v5.2.5 desktop release or an equivalent v5.2.5 self-hosted workspace.
Wait for the exact-version readiness gate:
EXPECTED_VERSION=6.1.0
pnpm desktop:wait:ready -- --expected-version "$EXPECTED_VERSION"
PRAGMA quick_check, the representative counts, owner metadata,
provider profile normalization, board/search/task detail, workflows, Squad
Chat, Maintenance, and /api/health.version.vk doctor --json. Review each enabled profile’s support tier,
version/build, authentication posture, capability evidence, and
remediation. Do not assume a v5 profile remains Certified.The public API remains v1. v6 adds provider, approval, lifecycle, tool,
credential, compatibility, Buzz, and conformance records without requiring a
new API mount.
Veritas Kanban 6.1.0 advances the SQLite workspace through migrations 30 to 33 for knowledge collections and integrity operations. Keep the stopped-writer backup until collection, task, workflow, provider, and board data have been accepted. Rollback to an older schema requires restoring that backup; do not open migrated data with an older binary.
For any later v6 patch:
Run:
brew update
brew upgrade --cask bradgroux/tap/veritas-kanban
brew list --cask --versions veritas-kanban
CFBundleShortVersionString, launch the app, and use
pnpm desktop:wait:ready -- --expected-version <version>.Homebrew replacement does not launch the app or wait for its bundled server.
Do not substitute an immediate curl or fixed sleep for the readiness gate.
Veritas never installs a third-party harness. Install the exact tested build from its official distribution, authenticate using the provider’s supported flow, then enable its built-in profile in Settings -> Agents.
| Harness | Install/verify | Authentication names accepted by the v6 profile | Safe default |
|---|---|---|---|
| Buzz Agent | Build/install Buzz v0.4.24 buzz-agent; verify ACP identity buzz-agent 0.1.0. |
ANTHROPIC_API_KEY, OPENAI_COMPAT_API_KEY, or DATABRICKS_TOKEN. |
Disabled; no resume; only the system-owned veritas-run MCP bridge. |
| Grok Build | Install v0.2.111; run grok --version. |
Existing GROK_HOME, XAI_API_KEY, GROK_CODE_XAI_API_KEY, or GROK_DEPLOYMENT_KEY. |
Disabled; dedicated agent --no-leader ... stdio; restrictive policy only. |
| Codex CLI/app-server | Install the reviewed Codex CLI; run codex login status. App-server certification requires 0.145.0. |
Existing Codex login or OPENAI_API_KEY where supported. |
Workspace-write task sandbox; app-server plugins, apps, hooks, browser/computer tools, remote control, and unsandboxed shell command disabled. |
| Codex SDK | Installed with Veritas as @openai/codex-sdk 0.144.3. |
Existing Codex login or OPENAI_API_KEY. |
Shared manifest, sandbox, tool, event, and completion controls. |
| Claude Code | Install 2.1.218; run claude --version and claude auth status. |
ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, Foundry, bounded Bedrock keys, or explicit Vertex credential file reference. |
Disabled; --bare, dontAsk, strict MCP, credential scrubbing; no permission bypass. |
| GitHub Copilot CLI | Install v1.0.74; run copilot --version and provider login. |
COPILOT_GITHUB_TOKEN, COPILOT_PROVIDER_API_KEY, COPILOT_PROVIDER_BEARER_TOKEN, GH_TOKEN, or GITHUB_TOKEN. |
Disabled; ACP public preview, remote/plugins/custom instructions/experimental features off. |
| Hermes Agent | Install v2026.7.7.2; run hermes --version. |
HERMES_API_KEY or the documented model-provider key. |
Disabled; one-shot scripted execution. |
| OpenClaw | Run v2026.6.11 gateway and verify tool policy. | OPENCLAW_GATEWAY_TOKEN when required. |
Explicit gateway URL; sessions_spawn and sessions_send must be allowed. |
Credential values belong in the operator environment or the platform’s login store. Settings, docs, task bodies, screenshots, logs, issue comments, and support packets must contain only environment key names or opaque references.
After setup:
vk doctor --json
Fix Degraded or Unsupported evidence before dispatch. Detected means the executable exists but the profile is disabled. Configured is usable adapter evidence without current certification. Certified requires matching deterministic evidence; live authentication and quota remain separate facts.
Buzz communication and Buzz Agent execution are independent:
env:BUZZ_PRIVATE_KEY, optional
env:BUZZ_AUTH_TAG, and one explicit channel mapping under Settings ->
Notifications.message.posted workflow triggers. Replies, edits,
deletes, reactions, echoes, replays, and predicate mismatches do not start a
workflow.buzz-agent profile only when ACP task
execution is required.See Buzz Integration for API examples, channel mapping, Nostr identity, trigger rules, replay, and rollback.
Remote mode remains a trusted-host setup. Serve web, /api, /ws, health
routes, manifest, service worker, and assets from one HTTPS origin. Keep
VERITAS_AUTH_ENABLED=true and
VERITAS_AUTH_LOCALHOST_BYPASS=false.
Use scoped device sessions or API tokens for remote browsers, CLI, MCP, agents, and automation. Never share owner/admin credentials with providers. Approval reviewer identity, authentication freshness, workspace membership, and exact action binding are enforced server-side.
Use Self-Hosting Guide, the v5 remote security ADR, and Identity And RBAC for unchanged remote/server foundations.
Before upgrade, provider-profile changes, or Buzz setup:
Rollback from v6 means reinstalling the prior signed app only when its data contracts remain compatible. Otherwise restore the stopped-writer v5.2.5 backup. There is no promise of destructive schema down-migration.
For Buzz rollback, disable trigger rules first, then the channel mapping, then the adapter. Audit records and local Squad Chat content remain. Veritas never deletes remote Buzz events or writes imported definitions back.
For a provider rollback, disable the changed profile and restore the reviewed profile configuration from backup. Do not lower support evidence, bypass permissions, or route an ambiguous record through another adapter.
Use:
vk doctor --json
curl http://127.0.0.1:3001/api/health
curl http://127.0.0.1:3001/health/ready
Compare app, server, CLI, MCP, and updater versions. Review redacted runtime-manifest, support-profile, compatibility-matrix, launch-manifest, approval, run-event, and completion evidence. Never paste raw private relay events, provider output, credentials, or unrestricted support bundles into a public issue.
In the packaged macOS app, choose Veritas Kanban → About Veritas Kanban for the authoritative running version. Copy Version Information in the same native menu produces a redacted offline support string with the build identity, release channel, macOS version, and architecture even when the renderer or local API is unavailable.