Release DemonClaw 1.1.0 · BlueDot-IT/DemonClaw

Active Defense Phase 3 baselines and drift detection backed by tamper-evident evidence events
scheduler-driven defend:drift monitoring and guarded --apply auto-remediation
fail-closed UTC maintenance windows for automatic remediation

upgraded wasmtime and wasmtime-wasi to the patched 46.0.2 release line
made zizmor findings fail the security workflow instead of being suppressed
pinned third-party GitHub Actions and the pgvector CI image by immutable digest
consolidated cargo-audit policy into .cargo/audit.toml
removed obsolete advisory exceptions and documented the remaining lockfile-only exception
removed committed development database credentials from CI and Compose configuration
made startup fail closed when persistence or evidence initialization fails
enforced Wasmtime epoch deadlines and bounded guest-provided string allocations
restricted payload paths, SSH destinations, active-defense scope, and executable capabilities
serialized evidence appends and rejected chain forks
changed engagement, tool-level, HTTP bind, ingest-auth, and remediation defaults to fail-safe values
replaced raw envelope-content evidence and SSE broadcasts with hashes and byte counts

first-class registered targets and persistent finding lifecycle state
operator CLI for initialization, health checks, target management, findings, scans, defense, and remediation
operations dashboard and JSON APIs for targets and findings
stable /api/v1/* operator API aliases while retaining unversioned 1.1 compatibility routes
versioned SQLx migration for operational state

normalized Evidence Locker timestamps to PostgreSQL microsecond precision before hashing
initialized the configured rustls crypto provider before CLI HTTP clients are constructed

Navigation Menu