# GLMChat V2.2 Release Notes

Updated: 22 July 2026

## Release summary

GLMChat V2.2 converts the agentic automation prototype into a maintainable, typed and server-enforced React/PHP production implementation. The interface uses mobile tiles and guided animated wizards while preserving the offline-first PWA, PHP 8.2+, SQLite and LiteSpeed shared-hosting architecture.

## Major capabilities

- Typed agents, teams, workflows and templates.
- Immutable execution snapshots.
- Separate workers, delegation, coordination, scoped memory, consensus and checkpoints.
- Custom workflow stages with dependencies, retries, limits, approvals and expected outputs.
- Genuine pause, resume, cancel, retry, optional-stage skip, reassignment, tool revocation and checkpoint branching.
- Server-owned PHP tool registry with JSON-schema validation, project confinement and risk-based approvals.
- Together tool-call continuation and structured output.
- Separate vision-model routing and TTS playback.
- Project workspaces, searchable history, prompts and typed templates.
- IndexedDB-first drafts, definitions, runs and explicit offline recovery.
- Conflict review and resolution.
- Provider, model, cost, privacy and diagnostics controls.
- Accessible Android-first wizard and run interfaces.

## Security and release hardening

- Restrictive same-origin CSP without `unsafe-eval`.
- Direct-access denial for private source, storage, tests, handovers and evidence.
- Explicit denial for `evidence/` and `implementation-prompts/` if accidentally uploaded.
- Shell-only service-worker caching.
- Content-addressed immutable assets and collision rejection.
- Secret-safe bootstrap errors, logs, diagnostics and exports.
- ZIP traversal, symlink and decompression protections.

## Local and emulated verification

The completed release passed the feature lock, Node contracts, PHP static/portable checks, migration scenarios, bootstrap preflight, offline/PWA browser tests, accessibility, deferred reopen synchronisation, required responsive widths, full-spec interface evidence, deterministic builds and adversarial asset checks.

## External acceptance

The following remain environment-specific and must be completed after deployment:

- physical Android Chrome and TalkBack;
- physical Samsung Internet;
- live LiteSpeed root and subdirectory deployment;
- live PHP extension, permission, rewrite and header validation;
- live Together GLM-5.1, tool calling, vision and TTS.

These checks are classified as external, not as completed passes.