v0.4.0 (2026-08-14) is the first public release of Ony.ai. This is everything it ships, curated by area from the repository changelog. No inflated version history, no roadmap dressed up as done.
Place a real phone call when an agent needs a decision, read out the action and its risk, and take an approve or deny by keypad.
When an agent asks a real multiple-choice question, the call reads out the options, tells you which one it recommends, and takes your pick on keys 1 through 7, with press 8 for per-option detail.
Decide a pending request from the dashboard when you are at your desk, through the same server-authoritative state machine as a keypad decision.
On-call escalation: ring a backup contact and fall back across SMS and Telegram when the primary call goes unanswered.
Inbound voice agent: call in, authenticate, and hear a spoken summary of what your agents are doing, then decide a pending request by keypad.
Security and trust
Server-authoritative risk classification. The agent's own risk hint is discarded and re-derived from a closed action taxonomy; unknown actions fail closed to critical.
Signed decisions. Every verdict is HMAC-signed, bound to the exact request, and verified on-device before it is honored.
Tamper-evident audit chain. Decisions land in a keyed, hash-chained, append-only log the dashboard verifies end to end.
Encrypted secrets at rest, a fail-closed production boot guard, and per-carrier signature verification on every inbound webhook.
Teams and accounts
Multi-tenant authentication with organization-scoped isolation on every route, self-serve signup, and password login (PBKDF2).
Phone and authenticator (TOTP) onboarding, with a second factor on the dashboard and on the inbound line.
Team invites and roles (admin, member, viewer), seat limits, and a signed accept-invite flow.
Single sign-on over OIDC, with just-in-time provisioning guarded to strictly single-tenant deployments.
Connect your agent
A Claude Code plugin that answers the permission gate (PermissionRequest) with signed verdicts, and an OpenAI Codex hooks config wiring the pre-execution gate, both through the local connector.
The ony connector CLI: enrol a device, install hooks, set modes (on, away, off), and diagnose the whole setup with ony doctor.
A hardened destructive-command classifier and fail-closed verdict verification in the connector.
Run it yourself
Production docker-compose that runs the full stack behind one web origin, applies migrations on start, and serves the dashboard with the API and webhooks reverse-proxied.
A Proxmox stack with an automatic-TLS Caddy edge, encrypted offsite backups, and an optional Prometheus and Grafana monitoring overlay.
Bring your own telephony (SignalWire, Twilio, Telnyx, or Plivo), model, email relay, and identity provider. No telemetry is sent anywhere.