Kurahi 2.2.0

日本語: Kurahi 2.2.0

Kurahi 2.2.0 is the Business Edition and Autopilot release, and the first release with an enterprise package. Kurahi is built by the KODA SōKEN team. The complete list of changes is in the changelog.

With 2.2.0 you can:

Run approvals the way Japanese companies work. The Business Edition brings a work queue with 稟議 approval routes, 15 department workspaces and business connectors for Microsoft 365, Gmail, Entra ID, kintone, freee, Money Forward, SmartHR, LINE WORKS and Box.
Hand repetitive work to Autopilot, in every edition. Routines gather, prepare and act end to end at the autonomy level you choose. The model never holds a tool that can send, pay or delete, and acting externally needs a person’s standing approval.
Modernise legacy systems with evidence. The Industrial Edition analyses Java, databases, stored procedures and PLC programs in depth, reports nightly what changed and writes 設計書 as Word files.
Research with sources you can cite. The Scholars research workspace connects arXiv, OpenAlex, Crossref, PubMed and doi.org, watches the literature weekly, checks the citations in your drafts and reminds you of grant deadlines.
Roll out to the whole organisation. Single sign-on with OIDC or SAML, SCIM provisioning and roles come in every plan; attachment scanning and the new enterprise package round it out.

What is new

Business Edition

Work queue with approval routes (稟議): ordered stages with role, named or department approvers, minimum approvals, due times, delegation and escalation, all recorded with signed evidence. In the console people create and edit expense requests, approve, send back or cancel with a written reason, preview the exact draft they decide on and verify the evidence.
Departments: 15 department workspaces and six SME groups, each with its own queues and a conversation that opens agent chat in that department.
Email intake and risk flags: a message becomes a work item by reference, never by copying its body. Suspected fraud (including a proposed change of bank details) and malicious attachments block approval until a person clears the flag with a reason.
Connectors, all off by default: kintone, freee 会計, マネーフォワードクラウド請求書, SmartHR, LINE WORKS and Box, next to Microsoft 365, Gmail and Entra ID. Microsoft 365 adds draft-only replies with attachments and a mail watcher for triggers. See Business connectors.
Office documents: the office plugin writes PowerPoint, Word and Excel files, with editable charts, into the Project. See Office documents.

Autopilot

Routines that carry repetitive work end to end, in every edition. The model never holds a tool that can send, pay or delete; the engine executes only what the routine’s autonomy level allows.

Levels L0 observe, L1 prepare, L2 act internally, L3 act externally within policy. L3 needs a standing approval made by a person, limited to named recipients, a template, a daily maximum and an expiry.
Real-time triggers (mail, work items, deadlines, files) next to schedules, with rate caps and a loop guard.
A behaviour watchdog that pauses a routine acting outside its pattern, and a global stop.
Earned autonomy: the engine proposes a level from recorded corrections; only a person accepts it, and a serious error demotes the routine.
A morning brief per person, built from recorded data only.

See Autopilot.

Industrial Edition

Java and database analysis in depth: JPA mappings compared with the DDL, MyBatis mapper XML, stored procedures (DB2 SQL PL, PL/SQL, package bodies) linked to their callers in Java, COBOL and PL/I (EXEC SQL CALL).
A PLC engine for IEC 61131-3 Structured Text and for FBD and LD networks in PLCopen XML exports. It reads source text only and never connects to a controller.
Change detection against a stored baseline, so the nightly analysis reports only what changed, with file and line evidence.
Design documents (設計書) as Word files.

See Industrial modernisation.

Scholars

The Research & academic template becomes a working research workspace: the scholar-sources plugin (arXiv, OpenAlex, Crossref, PubMed, doi.org), a weekly literature watch, a citation check of drafts and grant deadline reminders. A missing fact is marked 【要確認】, never invented. See Scholar sources.

Security

Enterprise identity: single sign-on for people with OIDC (Entra ID, Google, Okta, Keycloak) or SAML 2.0, SCIM 2.0 provisioning, departments, teams and roles. It was reviewed and hardened in three rounds of adversarial security review before this release. Off by default, and included in every plan, Free included: security is never a paid extra. See Enterprise identity.
Attachment intake: quarantine, a static file policy, a malware scan (ClamAV or Microsoft Defender) that fails closed, and isolated text extraction. See Attachment intake.
Enterprise profile and package, see below and Enterprise profile.
Console responses carry a Content-Security-Policy; the gateway reads client addresses behind proxies correctly and applies a Project’s scope to every tool it invokes.

Kurahi Desktop 0.5.0

Kurahi Desktop 0.5.0 ships with this release and carries the new console: the Business department workspaces and work queue, the Autopilot panel (runs, evidence, pause and resume, promotion proposals), and the Industrial workbench with the PLC engine. Windows (installer and Microsoft Store package) and Linux (deb, AppImage). Desktop connects to a Kurahi 2.2 gateway on the same PC.

IBM watsonx interoperability (Preview)

Kurahi now works alongside an IBM watsonx estate. watsonx Orchestrate can call Kurahi over A2A, an OpenAPI endpoint or a remote MCP toolkit, and Kurahi can call Orchestrate agents, use watsonx.ai models, send governance traces to watsonx.governance and read watsonx.data and Db2. Everything follows IBM’s published APIs and is off by default. See IBM watsonx.

Fixed

Packaged installs now load every bundled plugin (Microsoft 365, Gmail, Entra ID, A2A, the legacy analyser and others), and every package is checked for this before release.

Upgrade from 2.1.0

Standard installations

kurahi update (or install.sh / install.ps1 with --version 2.2.0) installs 2.2.0 as usual; see Updating. Your configuration loads unchanged: everything new in 2.2.0 is off until you turn it on, and nothing in the 2.1.0 configuration was removed or renamed.

Standard or enterprise package

From 2.2.0 there are two packages:

Package	Files	Contains
Standard	`kolo-2.2.0-<os>-<arch>.*`, `kurahi-2.2.0.tgz`	Every bundled plugin except WhatsApp, as in 2.1.0
Enterprise	`kolo-2.2.0-<os>-<arch>-enterprise.*`, `kurahi-2.2.0-enterprise.tgz` (private)	Only the plugins classified as enterprise; consumer channels and logins are not shipped and are refused at runtime even if someone copies them in

An installation keeps its package: a standard installation updates to standard assets and an enterprise installation only to -enterprise assets. To move to the enterprise package, install the enterprise bundle (install.sh --bundle ./kolo-2.2.0-linux-x64-enterprise.tar.gz --sums ./SHA256SUMS.txt, or install.ps1 with the Windows archive).
Turn the profile on in the configuration as well: profile: "enterprise". The enterprise launcher sets KURAHI_PROFILE=enterprise, but the configuration also covers a gateway started without the launcher.
Check the package yourself with node scripts/enterprise-check.mjs <archive> from a source checkout of the same tag.

Optional plugins

Plugins that need their own review (for example WhatsApp, LanceDB memory, OCR.space, Matrix, voice calls) are published as separate archives, kurahi-<id>-2.2.0.tgz, each with a .sha256. Install one with kurahi plugins install ./kurahi-<id>-2.2.0.tgz, pin it and enable it. Under the enterprise profile an optional plugin loads only with an explicit opt-in (plugins.entries.<id>.enabled: true or plugins.allow). WhatsApp remains a separate install, as since 2.1.0.

Single sign-on is off by default

Nothing changes for sign-in until you add gateway.identity to the configuration. Plan the switch: configure the identity provider and roles, test sign-in, and only then set ssoRequired: true, which turns token logins of people into an audited break-glass. See Enterprise identity.

Roll back

To return to 2.1.0: installations keep the previous version, and install.sh --version 2.1.0 (Windows: install.ps1 -Version 2.1.0) installs it again; see Updating. Before you start 2.1.0:

Remove the keys 2.1.0 does not know from the configuration file. 2.1.0 does not accept a configuration with keys it does not know: it reports the file as invalid and does not use it. The new keys are the top-level profile and security (attachment intake), gateway.identity, diagnostics.otel.captureContent, diagnostics.otel.maxContentChars and diagnostics.otel.orchestrate, and models that use the watsonx-chat API. The KURAHI_PROFILE environment variable alone is harmless.
2.1.0 has no enterprise package. Rolling an enterprise installation back means a standard 2.1.0 installation, without the runtime refusal of excluded plugins.
On 2.1.0, packaged installs do not load the bundled a2a, microsoft-365, gmail, entra, legacy-analyzer, lobster and twitch plugins (see Fixed).
Autopilot routines (autopilot.yaml) do not run on 2.1.0, and approval routes (稟議) in the work queue policy are not applied. Finish or pause open multi-stage approvals before you roll back.

Notes

In the enterprise package, the consumer channel modules built into the core stay inert: their channel plugins are not shipped and are refused at runtime.
Verify downloads with SHA256SUMS.txt; builds are not code-signed.