michael-zelos · Oct 4, 2026 · Oct 4, 2026
diff --git a/bench/agent-entrypoint.sh b/bench/agent-entrypoint.sh
@@ -6,11 +6,6 @@
 # disables extension installs while more than one agent is connected.
 set -euo pipefail
 
-# The agent runs as root, and its default umask leaves everything it writes
-# into a mounted volume unreadable to the user who owns the checkout. Rendered
-# notebooks and recorded traces are meant to be opened.
-umask 022
-
 CONFIG=${BENCH_CAN_CONFIG:-/bench/can.json}
 EXTENSION=${BENCH_CAN_EXTENSION:-zeloscloud.zelos-extension-can}
 
@@ -23,8 +18,7 @@ echo "config:    ${CONFIG}"
 # every sample, so queries return nothing.
 zelos-agent \
     --store-type memory \
-    --store-retain-duration "${BENCH_RETAIN:-15m}" \
-    --listen-address '[::]:2300' &
+    --store-retain-duration "${BENCH_RETAIN:-15m}" &
 agent_pid=$!
 
 trap 'kill "${agent_pid}" 2>/dev/null || true' TERM INT

diff --git a/bench/agent.Dockerfile b/bench/agent.Dockerfile
@@ -4,17 +4,19 @@
 # download, the Python interpreter and its dependencies in an image layer.
 FROM ubuntu:22.04
 
-ARG AGENT_VERSION=26.0.8
-ARG CLI_VERSION=0.1.9
-# The marketplace identifier is the repository path, and the version is the git
-# tag, including its leading "v".
+ARG AGENT_VERSION=26.0.9
+ARG CLI_VERSION=0.1.10
+# The marketplace identifier is the extension's repository.
 ARG CAN_EXTENSION=zeloscloud/zelos-extension-can
 ARG CAN_EXTENSION_VERSION=v0.1.17
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends ca-certificates curl procps \
- && echo "deb [trusted=yes] https://release.zeloscloud.io/app/ubuntu jammy main" \
-      > /etc/apt/sources.list.d/zelos.list \
+ && curl -fsSLo /usr/share/keyrings/zelos-archive-keyring.gpg \
+      https://release.zeloscloud.io/app/zelos-archive-keyring.gpg \
+ && printf '%s\n' 'Types: deb' 'URIs: https://release.zeloscloud.io/app/ubuntu' 'Suites: jammy' \
+      'Components: main' 'Signed-By: /usr/share/keyrings/zelos-archive-keyring.gpg' \
+      > /etc/apt/sources.list.d/zelos.sources \
  && apt-get update \
  && apt-get install -y --no-install-recommends "zelos-agent=${AGENT_VERSION}" \
  && rm -rf /var/lib/apt/lists/*

diff --git a/can-bench/README.md b/can-bench/README.md
@@ -129,7 +129,6 @@ bench runs.
 ../nodes/vcu|bms|dcdc/    three Zephyr applications
 bench/                    the agent's config; the images and Renode script are ../bench/
 notebooks/                the tests
-traces/                   recorded runs the tests check against
 ```
 
 The firmware lives at the root of the repository, shared with any other bench.
@@ -168,16 +167,16 @@ and 512 KB.
 Open the Zelos app and connect to the bench:
 
 1. Open the right sidebar — `Cmd+J` or `Ctrl+J`
-2. **Data Sources** → **New agent**
+2. **Data** → **New agent**
 3. Enter `localhost:2300`, or `<bench host>:2300` from another machine
 
 The signal tree fills with `vcan0` and every message in the table above.
 Double-click a signal to plot it.
 
-Signals are named `vcan0/<id>_<Message>.<Signal>`, for example
-`vcan0/0300_DCDC_Status.InputCurrent`. A second source, `vcan0_raw`, carries
-every frame undecoded, which distinguishes "no traffic" from "traffic the DBC
-does not match".
+Signals are named `CAN/vcan0/<id>_<Message>.<Signal>`, for example
+`CAN/vcan0/0300_DCDC_Status.InputCurrent`. `CAN/vcan0/Frame` carries every frame
+undecoded, which distinguishes "no traffic" from "traffic the DBC does not
+match".
 
 **If port 2300 is already in use**, `docker compose` fails with `failed to bind
 host port`. The Zelos app runs its own agent on that port, so this happens on
@@ -214,8 +213,8 @@ That restarts the simulator with the second DC-DC firmware and gives the agent a
 fresh store, so what you see next comes only from this build. Give it a couple
 of minutes to get through a drive cycle, then plot two signals together:
 
-- `vcan0/0201_BMS_Limits.AuxCurrentLimit`
-- `vcan0/0300_DCDC_Status.InputCurrent`
+- `CAN/vcan0/0201_BMS_Limits.AuxCurrentLimit`
+- `CAN/vcan0/0300_DCDC_Status.InputCurrent`
 
 When the vehicle enters Charge, the BMS drops the converter's allowance. The
 draw should be under the new limit at once. Instead it walks down to it, drawing
@@ -247,8 +246,7 @@ Each file in `notebooks/` is a test, and `just test` runs both:
   the allowance rather than assuming the bench has been up long enough.
 
 `just flash defect` loads the defective DC-DC build, and the second notebook
-fails on it. `traces/dcdc-defect.trz` is a recording of that build, if you want
-to look at the fault without running it.
+fails on it.
 
 Each notebook is also a report: it charts what it measured and ends with its
 checks. `just test` exits non-zero if either fails, and writes a self-contained
@@ -292,8 +290,9 @@ extension in the app's Explorer. This has not been run here.
 | Zephyr | `v4.4.2` |
 | Zephyr SDK | `1.0.1`, Arm only |
 | Renode | `antmicro/renode:1.16.1` |
-| Zelos agent | `26.0.8` |
-| Zelos CLI | `0.1.9` |
+| Zelos agent | `26.0.9` |
+| Zelos CLI | `0.1.10` |
+| Zelos SDK (notebooks) | `0.0.12` |
 | CAN extension | `zeloscloud/zelos-extension-can` `v0.1.17` |
 | cantools | `41.3.1` |
 

diff --git a/can-bench/compose.yaml b/can-bench/compose.yaml
@@ -38,8 +38,6 @@ services:
       # Mounted rather than copied into the image, so editing it takes effect
       # on the next `just up`.
       - ./bench:/bench:ro
-      # Recorded runs the tests check against, and where `just record` writes.
-      - ./traces:/traces
       # Writable: the notebook runner assigns cell ids and stages a
       # provisioning script beside each notebook.
       - ./notebooks:/notebooks
diff --git a/can-bench/justfile b/can-bench/justfile
@@ -41,10 +41,6 @@ test:
             zelos notebook run "/notebooks/${name}" -o "/notebooks/${name%.md}.html" \
             || failed+=("${name}")
     done
-    # The agent writes its rendered pages 0600 and owned by root, so the user
-    # who asked for them cannot open them. Fixed from inside the container,
-    # because only root there can.
-    docker compose exec -T agent sh -c 'chmod a+r /notebooks/*.html' || true
     if [ ${#failed[@]} -gt 0 ]; then
         echo
         echo "failed: ${failed[*]}" >&2
@@ -72,17 +68,6 @@ flash VARIANT: _elf
     echo
     echo "DC-DC is now the {{ VARIANT }} build. Give it ~2 min for a drive cycle, then: just test"
 
-# Record the running bench to traces/, for a test to check against later.
-#
-# trz2 rather than the default: the legacy format is a DuckDB database with a
-# 2.8 MB floor regardless of window, where this is about 100 KB.
-record NAME:
-    docker compose exec -T agent zelos live export \
-        --output "/traces/{{ NAME }}.trz" --last 5m --format trz2 --force
-    # As with the rendered pages: written 0600 and root-owned. See `test`.
-    docker compose exec -T agent sh -c 'chmod a+r /traces/{{ NAME }}.trz'
-    @echo "wrote traces/{{ NAME }}.trz"
-
 # Regenerate the CAN codec from the DBC. Deterministic: no timestamps.
 dbc:
     {{ FIRMWARE }} dbc

diff --git a/can-bench/notebooks/bench-health.md b/can-bench/notebooks/bench-health.md
@@ -2,7 +2,7 @@
 description: Every node on the bench is talking, and what it says makes sense.
 requires-python: '>=3.10'
 dependencies:
-- zelos-sdk[notebook]>=0.0.12a2
+- zelos-sdk[notebook]==0.0.12
 - tzdata
 params:
   window: -2m

diff --git a/can-bench/notebooks/dcdc-respects-allowance.md b/can-bench/notebooks/dcdc-respects-allowance.md
@@ -2,7 +2,7 @@
 description: The DC-DC converter stays under the current the BMS allows it.
 requires-python: '>=3.10'
 dependencies:
-- zelos-sdk[notebook]>=0.0.12a2
+- zelos-sdk[notebook]==0.0.12
 - tzdata
 params:
   window: -5m

diff --git a/can-bench/traces/dcdc-defect.trz b/can-bench/traces/dcdc-defect.trz