VOR Stream Release 2026.1.3

VOR Stream 2026.1.3 is the third patch release on the v26.1 line and the most capability-rich of the three. It adds two statistical functions to structured-model transformations, brings the Model Performance and Run Models panels to structured models, and ships a suite of task-specific agent skills served straight from the vor binary. It also strengthens how runs behave when a node hits an error, keeps subprocess execution conditions in step with the rest of a process, and lets large dictionary imports finish at scale. The user and admin guides are joined into one cross-linked site, and a broad set of security updates spans the engine runtime, the web application, and the components shipped by the installer.

Highlights

Statistical functions for structured-model transformations

Structured models gain two statistical functions you can call inside a local transformation:

• probnorm(x) — the standard normal cumulative distribution function, Φ(x).
• probit(p) — its inverse, Φ⁻¹(p), defined for p in the open interval (0, 1).

They open up capital calculations that need the normal distribution as an intermediate step rather than a final output. In an AIRB Stressed RWA calculation, for example, the capital requirement K is derived from the normal CDF and its inverse and then feeds the RWA formula as an input. With probnorm and probit available inside a transformation, that full chain lives in the model definition.

Both functions appear under a new Statistical category in the formula palette and function reference, so they are discoverable alongside the arithmetic and logical functions. They use the standard normal distribution and follow the same convention as sqrt and ln: an out-of-range input yields NaN rather than an error, probit(0) returns -Inf, and probit(1) returns +Inf.

Model Performance and Run Models for structured models

The Model Performance and Run Models panels are available for structured (regression) models, matching what freeform and script models already offer.

Model Performance renders whenever a model carries the insight metadata that drives it. The equation explorer computes live output as you move the input sliders, and the surface chart plots the model’s response across two chosen inputs, so a validator can explore how a structured PD or LGD model behaves without leaving the editor. Run Models renders its process table and run control for structured definitions, because the engine evaluates a structured model directly the same way it runs a script model.

Task-specific agent skills, served from the binary

The vor CLI carries a set of bundled agent skills: short, task-specific guides that teach an AI coding agent how to do real VOR Stream work from the shell. Six skills cover models, risk factors, the data dictionary, scenarios, processes, and computational nodes. Because the skills are compiled into the binary, the guidance an agent reads always matches the installed version.

Two commands surface them. vor show skills lists the bundled skills, and vor show skill <name> prints one in full — rendered for reading in a terminal, or as plain text when piped to another tool. vor enable skills writes a pointer skill into an agent’s project directory for Claude Code, Codex, or GitHub Copilot, so the agent discovers the VOR Stream skills on its own.

Supporting this, vor show doc serves the user guide embedded in the binary, so an agent (or a person) working on a host without a browser can read the documentation offline, matching the installed version exactly. A few companion commands round it out: vor show connections reports service health and a ready-to-use API URL, vor show dictionary includes each variable’s identifier, and vor show playpen resolves a playpen’s path or identifier.

Tunable node network timeouts

Two engine timeouts that were fixed values are configurable through Super. On slower or heavily loaded hosts, a node’s REST call to the Super API could reach its timeout before the server replied. You can raise it with super_node_http_timeout, and tune the Python node command-queue timeout with super_python_command_timeout, either as deployment host variables or as vor serve flags. Left unset, both keep their existing behavior, and an invalid value falls back to the default with a logged warning.

Stability & Quality Improvements

A run ends cleanly when a node hits an error. If a node’s code hit an unexpected condition mid-run — for example a scenario set that filtered down to nothing for the reporting date — the run could stall with no clear signal, as downstream nodes waited on input that never arrived. Any error inside a node’s worker ends the job with a logged message and terminates the run, so a run reaches a definite outcome and the underlying cause is visible in the logs. This strengthening covers model and computational nodes as well as Go input/output nodes, and it also closes a related stall on a malformed row filter.

Execution conditions stay in step across subprocesses. Execution conditions defined inside a subprocess — including a subprocess kept in its own stream file and referenced by name — appear in the Run Study options and are honored by --exec-when, at any nesting depth. Editing a subprocess and rebuilding it on its own keeps the parent’s conditions current, with no need to rebuild the parent, and the condition list is de-duplicated and ordered for a stable view.

Large dictionary imports finish at scale. Importing a large playpen’s variables through vor update dictionary or the Data Management import completes in a fixed amount of database work regardless of how many rows the import carries, so a big import finishes well within the request budget. An import that spans more than one playpen returns a clear error, and the response is ordered by name.

Administration & Deployment

One documentation site. The User Guide and Admin Guide are joined into a single Material for MkDocs site with shared search, a tag index for topics that span both audiences, and validated cross-links between related pages. The site is served at /latest/guide/. Bookmarks to the old admin-guide paths should be updated to the new guide location.

Extend the web server with custom routes. Administrators can add custom routes under the existing Web UI listener, in addition to whole new site blocks, using drop-in directories that survive redeploys.

Installer components updated for security. The bundled third-party components move to their latest same-minor patch releases, each closing one or more published advisories: PostgreSQL 14.23, HashiCorp Consul 1.22.7, Caddy v2.11.4, and Erlang/OTP 27.3.4.13. All are patch-level updates within their existing series, so no compatibility changes are expected.

Security

This release applies a broad set of security updates:

• The engine runtime moves to Go 1.26.5, closing a transport-layer privacy issue and a filesystem symlink issue, along with fixes in the spreadsheet and Markdown libraries the engine uses.
• Django moves to 5.2.16 within the 5.2 long-term-support series.
• Updates land across the Python and web-application dependency trees, including the cryptography library and the Angular runtime packages.

Every finding is verified against the project’s dependency scanners before release.

Upgrade Notes

If you host the documentation yourself, publish the renamed guide.tar.gz bundle at /guide/. Deployments that saw Python nodes reach a network timeout on a busy host can raise the tunable timeouts described above. Runs that used to stall on an unexpected node error reach a clean outcome with no process or model change required.