Colonizer v0.2.23

Colonizer v0.2.23

What's new

• Dependency audit fixes supply-chain vulnerabilities. The Claude Code module's ip-address (10.7.3 → 10.7.4) fixes GHSA-rxp7-6hxx-x8q5: Address6 zone identifier parsing that ran in quadratic time (a single long string could stall the process); it comes in through @modelcontextprotocol/sdk → express-rate-limit as a runtime dependency of the agent module. The cockpit's dompurify override goes 3.4.16 → 3.4.17, clearing GHSA-cg2g-xh64-v4q7 and GHSA-mrv2-3pqr-j5jr. The bundled DOMPurify 3.4.15 in monaco-editor 0.57.0 still runs in the cockpit, since monaco imports its own copy and sets neither SAFE_FOR_TEMPLATES nor IN_PLACE, so neither advisory is reachable through it; the bundled copy updates when monaco releases a newer version.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from 88dcf22.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

The observability add-on rides along as colonizer-observability-.tar.gz for the same platforms; the installer puts it beside the colonizer binary, and the checksums and the attestation above cover it too.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

aeab18f273e7b2f54297250b8f0c6d7f3d0f8fbfcada75b60cac219f449e11b7  colonizer-darwin-arm64.tar.gz
8723d1b9ede4bbed2660e265f986ecacce8475752f01313fdee541e070873cd1  colonizer-linux-x86_64.tar.gz
cb29fe3a8ec4cb8f30f64e0450e58a43bae3b67b978e00bf9109b33dff1f8bdb  colonizer-observability-darwin-arm64.tar.gz
3e5571a59e8dde8d8ef4c53a36cc663184da23c62280ef984671c10dcc216b1c  colonizer-observability-linux-x86_64.tar.gz
197288486132125d7e0036883f8dde42cb9c1ae5e5b86f7310b754c37931d7db  Colonizer-arm64.dmg
a65be2043bbd94aa8d5e1e122113ae3d3945120bf4b2771fc300298a06e60f4e  install.sh

Colonizer v0.2.22

Colonizer v0.2.22

What's new

• A colony, or a bench run, can run entirely on Pi. POST /api/sessions takes agent_module to run one colony on a named agent module (pi, opencode, claude-code, …) whatever the org's pick, refused with 400 unknown_agent when no install has it. With agent_module: pi and a Claude model in model_override, Pi runs on the colony's Claude account (the stored subscription token or key, reachable only at api.anthropic.com). The cockpit's agent/model menu chooses the agent and model for new colonies, lists only the models the owner enabled in Settings → Models (PUT /api/models/enabled), and sends the chosen Claude account, and node scripts/bench.mjs run --agent pi --model claude-opus-5-5 --claude-account <name> launches a bench on it, tagged with the agent that ran it. Harness-side summaries, the shadow review and the autonomy judge still use the install's models (#403)
• The cockpit now shows why queued colonies wait when the host has capacity. New /api/status.queue
• DNS rebinding protection for webhook and subscription deliveries. A webhook address pointing at a public-looking domain name no longer opens the mothership to DNS rebinding attacks, where the name answers with the checked public address at validation time but rebinds to 127.0.0.1 or another private address when the connection is made. This required two changes: a pinned DNS resolver enforces that every address a domain resolves to remains public or allowlisted across the full request lifetime; and owner-created webhooks and subscriptions (not scoped-token-limited ones) can point to private addresses on allowlisted hostnames. The redirect policy's per-hop lookup keeps its existing check as a second layer (#1377)
• Issue intake scans with the PromptDecode engine, not only the in-repository scanner. Before auto mode queues an issue, its title, body and trusted comments are read by promptdecode-core 0.1.0 (crates.io, MIT OR Apache-2.0), which now also catches variation-selector payloads. The in-repository scanner still covers zero-width runs, HTML comments and base64 payloads, which the engine does not. Each scan records every engine that ran, and if the engine fails on a text, the in-repository scanner reads it instead and the scan says so. Nothing is stripped: a finding still holds the issue for review with its decoded text shown. (#1485)
• Security runs: Strix can be a red-team hunter, and Shannon and Strix always run the security preset. A red-team run can name Strix, which drives its pinned PyPI wheel in one colony against the repository and an optional https staging host the owner declares; its SARIF report is filed as findings. Strix needs a Docker daemon for its sandbox and colonies have none yet, so its start is refused with that reason, shown on its card in the wizard. Shannon and Strix are security scanners: the wizard hides the security/bugs choice for them, an unset preset means security, and "preset": "general" is refused with a message saying why. (#1487)

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from 96c55bf.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

The observability add-on rides along as colonizer-observability-.tar.gz for the same platforms; the installer puts it beside the colonizer binary, and the checksums and the attestation above cover it too.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

6efec9aaa680b7b8b64f76992d8b3ab895f69b8fbfeb92187ddf15f463190216  colonizer-darwin-arm64.tar.gz
759fb31a43ef28cc49d692c438a511336a3555e05b3022233f27778910c13a27  colonizer-linux-x86_64.tar.gz
3e474f1d4951c5512aed6cd4dc1783540383088628d746918bad468657163afa  colonizer-observability-darwin-arm64.tar.gz
1c33e7c8c0057b7ae02449ee0ded983269e5f1cc2688ee931d70bbdfcc16890c  colonizer-observability-linux-x86_64.tar.gz
87a608949f5d7a3115da990d2c91555f78df0cf8a10635be1e02a3baf684416b  Colonizer-arm64.dmg
a65be2043bbd94aa8d5e1e122113ae3d3945120bf4b2771fc300298a06e60f4e  install.sh

Colonizer v0.2.21

Colonizer v0.2.21

What's new

• Exec-policy loop detection parks the colony and frees its slot, with guidance for the operator. Three refusals by the same exec-policy rule within 10 minutes now park the colony as exec_policy_loop, freeing its microVM slot and showing "Blocked by exec policy" instead of falsely flagging a control breach. When a rule denies, the agent is told what to do instead (for script-egress: use a network-free path, leave fetching to CI, or ask the operator). A repo can allow pinned fetch scripts past script-egress with a fetches entry in .colonizer/exec-policy.json (script, sources, hosts, verify: "sha256"), honoured only when every URL names a listed host, the script checks sha256, and the policy file matches the base commit. (#1378)
• Quota-parked colonies resume when alternatives become available. When a provider runs out of quota and colonies park waiting for its recovery, colonies now also resume if changing the model settings (e.g., model_low) routes them to a healthier provider, or if that provider recovers. The resume sweep re-evaluates routes every tick; colonies that were stranded with stale models now resume automatically instead of waiting for the original provider's reset (#1403).
• Colonies run Claude Code 2.1.304 and a re-pinned Go image. The Claude Code pin in
• The vulnerability check passes again: the websocket relay dial trusts the operating system's certificate roots. The cargo audit job failed every pull request on three RustSec advisories against the bundled root store (RUSTSEC-2026-0381, 0382 and 0383). rustls-webpki moves to 0.103.16, and webpki-roots / webpki-root-certs to 1.0.10. The 0.26 line has no fixed release, so the wss:// relay dial now uses the operating system's root store (rustls-tls-native-roots) instead of the bundled Mozilla roots. No advisory is ignored. (#1484)
• Auto mode: a team member approves an outside issue, and PromptDecode scans every issue before it queues. An issue from someone outside the org now waits in review until a trusted person adds the colonize-approved label or comments /colonize. Colonizer checks that person's permission through the API, ignores the same label from anyone else, and drops the approval when an outsider edits the issue afterwards. Every issue's title, body and trusted comments are scanned for hidden text before it queues. A finding holds the issue for review with the decoded text shown, and a trusted approval lets it proceed with the text marked as untrusted data in the brief. The scan is required on public repositories and can be turned off per org only for private ones (auto_colonize_require_scan). The approver and the scan result show in the issue list, and each decision is in the activity log. (#1485)
• The cockpit has a Brain view: your Living Brain as a 3D map, with each running colony drawn as an ant walking over it. A new Brain page (/brain) draws the team brain's graph in 3D, turned by drag, zoom or pinch, and places each running, queued or parked colony as an ant on the node its repository matches. The mothership reads the brain's map once a minute and shares only its structure: node kinds, degrees and links, with labels shown locally or replaced by keyed hashes in structure-only mode (always on over remote access). The brain's token stays in the mothership's secret store, and the map route is rate-limited and refuses a foreign Origin. Nothing is fetched from a CDN.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from 14d441d.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

The observability add-on rides along as colonizer-observability-.tar.gz for the same platforms; the installer puts it beside the colonizer binary, and the checksums and the attestation above cover it too.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

ad551ac6574e62baab0a1ba7fce7da5b3c78ab0845b8d55741880d252bda2135  colonizer-darwin-arm64.tar.gz
7209d5203322e0ea9fb98264d4cda116285f5e3d3c6b5bd0e2bf696151603577  colonizer-linux-x86_64.tar.gz
162ee043c635ea9b95839716a65f03843c85faae848ff2519e9610cfbb7c68be  colonizer-observability-darwin-arm64.tar.gz
373d6ba36fdd7ef64a05e5bb73cdf0062e7f69ede73461e95efadf14d79eb59f  colonizer-observability-linux-x86_64.tar.gz
99be32042559b4c19d9969a95bedef3b376ee63caec424d833682063195beb78  Colonizer-arm64.dmg
a65be2043bbd94aa8d5e1e122113ae3d3945120bf4b2771fc300298a06e60f4e  install.sh

Colonizer v0.2.19

Colonizer v0.2.19

What's new

• Code review with Kodus (issue #1280). The reviewer org setting lets you pick between open-code-review (the original ocr binary) and Kodus, a self-hosted AI reviewer service you install yourself using kodus-installer. Both backends use the same shadow mode — findings are recorded, nothing changes — and share the diff snapshot. Store the Kodus URL and team key in Secrets, and the mothership sends only the redacted diff. Kodus's model is configured in Kodus itself, not in Colonizer. Findings land in the colony log and sessions/<id>/kodus.json. (#1280)
• Settings → Colonies & runtime → Modules lists Cratefield modules as searchable cards. Each shows name, summary, status (published/unreleased/planned), versions (catalogue and published to crates.io), required and optional ports, and links to docs.rs, crates.io, and the catalogue. Search and filters by status and port. "Copy use line" puts a module in the clipboard. Data fetches hourly from CATALOG.json and crates.io with in-memory cache, falling back gracefully to disk cache and bundled snapshot with a banner if the network is down. (#1291)
• Shadow sentinel logs a verdict before risky tool calls run. Colony tool calls in a narrow risky class — mount/umount/chroot/nsenter, writes to .git/config, .git/hooks or other protected paths, credential-shaped paths, curl/wget off the box, and kill of pid 1 or harness processes — now get an allow/refuse/ask verdict with a probability and a reason, bound to a digest of the exact call, written to the decisions ledger (point sentinel, shadow mode) next to what actually happened (ran, refused_by_policy, error). Read-only commands over credential paths (the grep/node --check shape behind false control_defeat holds) are recorded as allow. Nothing is blocked yet; exec and path policy stay the hard boundary. See docs/sentinel.md. (#1323)
• Provenance ledger: records every worktree, branch, and pull request the harness creates,
• Every trace span carries the colony id. Child spans (turn, execute_tool, subagent,
• PlanetScale skillset: pscale CLI (Apache-2.0) and verified skills (MIT), off by default, downloaded on demand from pinned releases with sha256 verification.
• Self-host fonts: no external Google Fonts requests. Geist and Geist Mono for the cockpit, and Instrument Sans and JetBrains Mono for crate banners, are now bundled as local WOFF2 files. The web UI no longer connects to fonts.googleapis.com or fonts.gstatic.com; banner rendering (scripts/render-crate-banners.sh) works offline. Font files are hashed at build time and cached for one year on CDN. (#1351)
• Bench and evolver check the configuration each colony ran under. Every new session records
• evolve draft: automate prompt generation — evolve.mjs draft spawns a model to generate candidate prompts for a failure class, reads the class evidence and optionally colony transcripts into an evidence directory, and turns valid replies into proposals. The command receives a brief on stdin, sees EVOLVER_LENS and EVOLVER_EVIDENCE in the environment, and must output either KEEP_BASE <reason> or cite-annotated replacement text. A leak guard refuses to spawn if the evidence contains sensitive paths or markers. (#1353)
• An after colony no longer starts without its parent's work when the parent made no changes and its issue is still open. A colony queued to start once its parent's pull request merges (after without stack) used to be re-based on the default branch and started when the parent ended no_changes or its pull request was closed unmerged. Every colony queued behind it followed, each on a base that lacked the work it depends on. Now, while the parent's issue is still open, the child stays blocked (no slot, not failed) with a reason that names the issue, and so does the chain below it. Closing the issue re-bases and queues the child as before. A newer colony launched for the same issue becomes the child's parent, so its merge releases the chain. A parent without an issue, and stack children, behave as before. (#1362)
• Pre-publish checks for cargo fmt and cargo clippy now succeed when the rust-toolchain is pinned with profile = "minimal". When a repository pins a Rust toolchain without bundled components, the verifier now automatically installs rustfmt and clippy in the guest sandbox, so these checks run to completion instead of failing with "component not installed". Failed pre-publish checks that fail on the base branch too now show a sample of their output in the PR note for audit, redacted like other log output (#1363)
• Auto-promote drafts when base-shared CI failures are fixed. When a pre-publish check fails on the base branch, the mothership opens the PR as a draft to hold it. Now, when the PR head's CI is green and all the base-shared red checks pass, the merge train automatically marks the PR ready and posts a comment identifying the now-passing checks. Operator-initiated drafts are never auto-promoted. (#1364)
• Prevent saving model tiers with inverted pricing: tasks routed high now can't run on cheaper/weaker models than medium ones. When saving agent settings, the mothership now checks whether model_high is cheaper than model (or model_low more expensive than model) and refuses with a clear error naming both models and their prices, unless the new allow_inverted_tiers setting is enabled. Every colony's model_routing now always names the lead model it ran with, and outcome activity entries (merged, failed, stopped, no_changes, etc.) now record the tier and model. Boot warns when tier inversions are detected. (#1366)
• ECC agents with comma-separated tools are now accepted without warnings. ECC agents with tools: Read, Grep, Glob (comma-separated, the form Claude Code accepts) were dropped from the ant registry with ~70 "must be an inline array" warnings per boot. Now tools and disallowedTools accept comma-separated strings (parens-aware, e.g., Bash(git add:*, git commit:*)), skillsets stays inline-array only, and unparseable agent files are reported as one warning line per pack. (#1367)
• Copy buttons work when the cockpit is reached over plain HTTP. On a tailnet IP there is no secure context, so navigator.clipboard is missing and Copy did nothing. Every copy button now goes through one helper that falls back to a hidden textarea and execCommand("copy"), shows "Copied" only when the text really reached the clipboard, and otherwise says "Press ⌘C to copy" (Ctrl+C elsewhere).
• One floating chat button on phones. On a phone the cockpit showed two round accent buttons at the bottom right, search and Ask Colonizer. The Ask button now shows from the sm breakpoint up, and on a phone the search button opens Spotlight, whose Ask row opens the Ask panel. ⌘J is unchanged.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from d4a22ee.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

The observability add-on rides along as colonizer-observability-.tar.gz for the same platforms; the installer puts it beside the colonizer binary, and the checksums and the attestation above cover it too.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

4b346bce2aeb180999f85a218f2c9794fbe9dc5a884237f75501d3df13dfd9e7  colonizer-darwin-arm64.tar.gz
937ba3eb1ffba02dc0440b2811fee8be0e1bd9111b08129de95dcb4af6d01fea  colonizer-linux-x86_64.tar.gz
49b19cb381bbb42bbef0bd72571fab781954d9d24c238846fba7719ee901e762  colonizer-observability-darwin-arm64.tar.gz
5fe4e20b077ef34b78742cef5aed7517fea3c777d48a44a51d3244fa3e46efb0  colonizer-observability-linux-x86_64.tar.gz
4f84fb271bb43faec209f685850824775417f2227ab27f52ca33b582d2105821  Colonizer-arm64.dmg
a65be2043bbd94aa8d5e1e122113ae3d3945120bf4b2771fc300298a06e60f4e  install.sh

Colonizer v0.2.18

Colonizer v0.2.18

What's new

• **Observability: a file provider that writes the export stream to disk, a disk guard, a status
• Models served by several providers are ranked by price, and a colony can start on the cheapest host. GET /api/model-hosts lists every canonical model two or more connections serve, each host with its input/output $/1M and when the price feed last verified the price, ranked cheapest first by a blended rate (three parts input to one output, cache-aware when a cache-read rate is known); the cockpit's model picker and the routing settings show the same table. A new prefer_cheapest_host module setting (off by default) re-pins a colony's open-weight models to the cheapest healthy connected host at boot: it skips degraded, out-of-quota or tools-disabled hosts, never moves closed models, and never moves a model the operator marked host-sensitive via host_sensitive_models on a provider connection — the model itself is kept, only the host serving it changes. (#1039)
• Releases now ship the observability add-on. colonizer-observability-linux-x86_64.tar.gz and
• Stacked colonies no longer cascade into failure when their parent fails; they now wait for recovery. Colonies stacked on a parent that entered a failed state used to immediately fail themselves, killing entire dependency chains with a single failed parent. Now, when a parent enters a failed state, its children transition to a waiting state instead, pausing their work until the parent recovers. When the parent recovers, waiting children automatically resume from where they left off, allowing the full stack to continue working together. This prevents the loss of work in multi-level colony stacks and enables recovery scenarios where a transient parent failure can be resolved without restarting all dependent colonies. (#1066)
• A provider outage no longer ends a colony. A turn that dies on a model gateway error is retried
• Retry a colony that failed before it had a worktree. A colony that dies at boot or sync has
• Claude's exhausted quota no longer holds colonies that never spend it. The Claude account's
• Colonies park when the Claude account and its fallback's provider are both out of quota. Where before a running colony kept its microVM and had its agent re-ask every minute, each request coming back quota_exhausted, the queue's 5 s tick now parks a colony whose whole provider chain — the Claude account and every provider its allowed_providers list can reach — is out, releases the slot and, under the usual discard_vm, removes the microVM. The park names the exhausted provider and the earliest reset in the chain, so the colony rejoins the queue on its own when either plan refills. The account fallback's route answer matches: a fallback whose own provider is out is now parked with a reason rather than "go ask Claude", which could only produce another 429. (#1160)
• Skill pack MCP hosts join the egress allowlist. A skill pack's mcp.json declares remote tool servers and the hosts they live on. In allowlist mode, those hosts now join the colony's allow list, recorded in egress.json as each pack's contribution alongside the module's, so the agent reaches the tool servers the packs' skills call without the operator restating them. The hosts are clamped by the fleet floor like module hosts. In open mode they are not a fence (the public profile covers them); a per-pack fence in open mode is future work. (#1165)
• secret-paths exec policy now detects secrets in git refs and flag-value pairs. The words() tokenizer was modified to split on : and = characters in addition to whitespace, enabling proper detection of secret paths in contexts like git object refs (e.g., HEAD:.env) and command-line flag-value pairs (e.g., --flag=.env). (#1174)
• Setup flow now optional for Claude login when other model providers are configured. The "GitHub & Claude" page has been renamed to "GitHub & models" to reflect the broader scope of model providers. The Setup checklist now displays "A model colonies can use" instead of requiring a Claude login, making the Claude login step optional when other model providers (like Anthropic API keys, OpenAI, or other LLM services) are already configured. The needs-you indicator clears as soon as any working model provider is available, reducing setup friction for users who bring their own models. (#1211)
• Resumed colonies keep their place in queue: When a stopped colony is resumed, it now gets a
• Cross-member launch references consolidated to issue #1252. The closed outposts design gate
• Autonomy judge model test call now accepts extended thinking. The test call's token budget
• Autopilot no longer publishes, or releases the issue as "no changes", while the agent's background subagents are still running. When a lead agent launches background subagents with the Agent or Task tools, autopilot waits for them to settle before publishing the PR, even if the PR description is already written. This prevents premature releases while the subagents are still making changes. Errors are not blocked by subagents: a turn that ends with an error is held or retried immediately. An empty branch whose PR description names changed files is now held as contradicted, rather than published as "no changes" (#1268).
• context-mode, an opt-in third-party module, with the exec policy enforced on its tools. Organisation settings take a context_mode of off (the default), shadow or on, passed to the colony as COLONIZER_CONTEXT_MODE. In on, the Claude Code runner registers the context-mode MCP server only from an operator-installed copy whose package.json matches the pin in modules/agents/claude-code/context-mode.json (1.0.169, sha256 and npm integrity, ELv2 — never bundled), with its data kept in the colony guest's ~/.colonizer/context-mode rather than the shared ~/.claude. shadow is accepted but does nothing yet. Whatever the mode, the exec-policy hook now also covers ctx_execute, ctx_execute_file and ctx_batch_execute: shell code is judged exactly as the same Bash command, other languages as an inline script, every batch command separately with the strictest decision winning, and malformed input, .. paths and ctx_upgrade are refused. (#1273)
• Org dashboard: Cost per merged PR now reads the same window as the Spend tile, not the all-time session rollup. When the live-session rollup was close to zero but the spend history showed measured activity, the Cost per merged PR tile could contradict the Spend tile or round to "$0.00". The tile now divides the period spend (from /api/spend/history, the same value the Spend tile shows) by the number of PRs merged in that same date range (not all-time), so the two tiles always cover the same window and can never contradict each other. The sub-line now says "N merged in range" instead of "N merged", and the tile shows "—" with an explanatory note when nothing merged in the period but spend was measured (or when spend is unmeasured). (#1275)
• Input screening detects hidden text in GitHub issues and comments at launch. The promptdecode org setting (off by default) runs a local scanner for zero-width characters, tag runs, bidi controls, HTML comments, and base64 payloads: off skips scanning; shadow records findings in the session log and ledger without mutating the issue; on removes hidden text and appends a visible note. The screening runs before the prompt is built, using a local decoder until the promptdecode CLI ships; PR comments, fetched pages, diffs, and the cockpit card are future slices. (#1277)
• Red-team: detects repository artifacts that would change the colony's PATH (executable shims, direnv, version managers, Makefiles). The colony ledger now flags repositories with committed bin/cargo, .envrc, Makefile with PATH assignments, and similar artifacts that hostile repos use to fool agents. Verification gates are unaffected: they trust the VM's reported exit code, not fabricated output. PATH stays pinned by the image. (#1278)
• Provider catalog adds quota probe presets for DeepSeek and Z.AI, with clearer UI messaging for providers without balance APIs. The provider catalog now includes quota probe presets for DeepSeek and Zhipu GLM (Z.AI), so colonies connecting to these models can set up quota monitoring out of the box. The providers page UI now clearly distinguishes providers without quota probe support by showing "no balance API" instead of the generic "balance unknown", making it easier for operators to understand which providers support balance queries and which do not. (#1281)
• Placement verdict is no longer shown on running colonies. A placement verdict — a message like "archlinux: no free slot; no member has room" — appeared on every colony's detail page, whether it was queued, blocked, or actively running. This made operators think running colonies couldn't actually run because they seemed to be blocked on...

Colonizer v0.2.17

Colonizer v0.2.17

What's new

• Observability can replay archived colonies (--include-archive) and write an offline export to a file (colonizer observability export). Both observability backfill and the new observability export accept --include-archive, which also reads colonies that live only in the local log archive: the latest revision of each bundle, only the ledgers the exporter already reads (events, harness, gateway, findings — credential files are never opened), with disk winning when a colony exists in both places and ids derived from the bundle's original host id so a replay still matches what was exported live; archived colonies export structure only. Watch the retention window (#606): a sweep can delete bundles before a backfill reads them. colonizer observability export --out FILE|DIR writes the OTLP/JSON requests the exporter would have sent — one request per line, files 0600, an existing directory getting logs.jsonl and traces.jsonl inside — without contacting any backend, for an OpenTelemetry Collector to replay elsewhere or as a support bundle; --since/--until/--signals logs,traces narrow it, and --content includes conversation text only after a typed yes on a terminal — the flag stands in for the install switch, so an organisation's opt-in and each colony's sensitivity still apply. (#859)
• A fleet owner may relay members' synced history to its own observability backend, and members are told before they push.
• understand-anything: a shared knowledge graph, built once per commit of main and handed to every colony on the repository. An org's ua_graph setting — off by default, read like merge_prs (owner/name, an org's name, or *) — names the repositories the mothership builds a graph for. A dedicated "Knowledge graph" colony runs the full /understand pass the cost guard refuses everywhere else: once, then incrementally whenever a 10-minute tick sees main move past the stored graph (a failed pass is retried at most once an hour). Every colony on the repository then finds the newest graph at .ua/knowledge-graph.json — bound read-only when its base is the graph's commit, else a writable copy plus a note in its brief to refresh only the changed files — and .ua/ stays git-excluded either way. The graph colony's cost runs through the model router like any colony's and shows on the cockpit's Code page ("Open knowledge graph" for the raw JSON, owner-only, "graph jobs: $X"), as does GET /api/understand-anything/graphs/{owner}/{name}. Until the pinned plugin is prebuilt host-side — /understand needs packages/core/dist/index.js, which the pin ships as TypeScript source; a follow-up issue tracks the build — the graph colony refuses to launch. (#1015)
• Observability: the exporter add-on installs itself — colonizer add observability. The
• One untaggable release no longer blocks every later tag. The release train's tag job now skips an older merged release that fails the gate when a newer release commit supersedes it (a notice, not a failure), and the gate accepts fragments that landed on main while the release pull request was open, since they belong to the next release. A fragment that was there when the release was cut still blocks its tag. node scripts/release-prep.mjs tags prints what the job would do. (#1396)
• The Release workflow runs the same history-aware changelog gate as the release train, so a tag whose leftover fragments landed during the release freeze publishes instead of failing at "Check the changelog covers the tag".

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from a730a0c.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

a596817a734ed88e6a0ab357dbe9861d7abd67511a1ba965bc5ddcbf0ece43ae  colonizer-darwin-arm64.tar.gz
42035c3a4852706821365d807f093e19936c00169191163b91a3a09c331073a4  colonizer-linux-x86_64.tar.gz
19304c78fb5e728141ca54cb83c1352ed517462ef4242e20b9ddeeed2a9c7643  Colonizer-arm64.dmg
e608fc5270f739c657807725e98bb82718ed357c20b7a93746ce20ba65bad8f6  install.sh

Colonizer v0.2.14

Colonizer v0.2.14

What's new

• The observability exporter can be configured entirely from OTEL_* environment variables, and a header it cannot parse is refused rather than half-sent. The standard variables are read and each one overrides its module field, with GET /api/observability/status naming where every field came from (module, env:<VAR> or default). COLONIZER_OBSERVABILITY=on turns export on for a setup with no module saved, and set to anything else (off, false, 0, no, empty) turns it off even when a module is saved and enabled — an operator who wrote it meant it. OTEL_SDK_DISABLED still wins over both. A header list from OTEL_EXPORTER_OTLP_HEADERS or the Observability headers secret is now really parsed: k=v,… pairs, values percent-decoded so Grafana Cloud's Authorization header, whose value carries a percent-encoded space before the base64, works, = allowed inside a value, an empty value legal, and one malformed pair refuses the whole list rather than sending a half-read credential. A rejected pair is reported by its position in the list, and by its name only when the pair has a legal one, so a mistyped Authorization: Basic … or a bare token can never reach the status page; the same rules are applied as the add-on applies them when it reads the list, so a header list the status calls valid never fails at spawn. Every export now carries the whole resource (service.name, service.version, service.instance.id, host.name, and colonizer.fleet.id/colonizer.fleet.role where they are known); OTEL_RESOURCE_ATTRIBUTES can add keys to it but never supply service.name, service.instance.id, host.name or anything under colonizer. — a fleet member carries no fleet id and a lone mothership no role, whatever the environment says. The effective config serialises with header names and never a value, so the status API and any log line are safe by construction. The default service name is now colonizer-mothership, which says which install is talking. (#841)
• understand-anything: an optional knowledge-graph skillset, with a cost guard in colonies.
• Colonies can run the repository's own check scripts, syntax-check a script, and ask git about the placeholders with -C, without a security hold. The exec policy's script-egress rule refused python3 tools/sync-nav.py --check and other check scripts a repository ships and tells contributors to run, so colonies retried and were held for repeated_denial. The boot now writes the base commit's scripts, with their git object ids, to /colonizer/tracked-scripts (read on the host from the merge-base, where the colony cannot change it), and the default rule leaves a script to the VM's network policy while its bytes are still the committed ones. A script the colony adds or edits is read as before, and an org, install or repository layer still sees every script. bash -n, sh -n, --noexec, node --check, node -c and ruby -c parse the script without running it and are no longer read as a run (bash -n -c … still is). The name-only allowance from #1169 now accepts git -C <the repository> check-ignore --no-index …; a -C naming any other directory is still refused. (#1239, #1227, #1079)
• The exec policy now refuses reading a committed secret file through a git object spec. secret-paths matched path-looking words, so the <rev>: prefix in git show HEAD:.env, git cat-file -p HEAD:.env, git show origin/main:.npmrc or git show <sha>:.netrc hid the path, and the command printed the committed file. A git command's <rev>:<path> arguments now have their path part matched too, for any subcommand (show, cat-file, archive, diff, grep, log and the rest). git show HEAD:README.md and committed templates such as HEAD:.env.example still pass. (#1241)

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from f59bdf7.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

e9563804d9f2d85cd534e0a721d21ec7d20c1f704f826f0fc8b766eebd9adda1  colonizer-darwin-arm64.tar.gz
de1211f1bc1954d98b13d7b49eb5aead2a69214d780d404a7bb0c3a98b1dd7d1  colonizer-linux-x86_64.tar.gz
ddab5dee7e70cedf8f8bc9fbbdd8e493e913e6de0d29eb017fe96fafe12af61a  Colonizer-arm64.dmg
4293bed20d991fb79164e457163a058fb362f10e480c0588e0edac4d3ffd7b4b  install.sh

Colonizer v0.2.13

Colonizer v0.2.13

What's new

• Checking the placeholder dotfiles no longer puts a finished colony on a security hold. The exec policy's secret-paths rule now also lets through commands that only learn a secret path's name or size: stat, wc -c, test -s and [ -s x ] join git check-ignore, ls and test -e, and such a command may fold stderr in with 2>&1, discard output to /dev/null and pipe into head, tail, sort, uniq or wc (with no path of their own). Anything that reads the bytes (cat, head .env, grep, cp, source, base64, wc -l, a pipe into cat or xargs) is still refused. An exec-policy denial now names the path its rule matched as its target instead of the first path in the command, so cd /workspace && … no longer makes the workspace root the refused target. The watchdog's deny-then-reach signature resolves paths against the workspace and counts a later call only when it names the refused path, something under it or a glob that matches it; a call that only names an ancestor (cd /workspace, ls /workspace) does not, and neither does a write to the colony's own /harness/out after a refusal there. (#1079, #1153)
• Every menu has the Spotlight look, and chat is one key away. The model menu, Colonize, the workspace switcher, the notifications and the composer's repository picker are now built on one frosted SpotlightPanel (a search box, sections with small headers, a solid accent selection row, a footer of key hints, ↑ ↓ ⇥ ↵ and Esc the same everywhere, a bottom sheet on a phone). The model menu lists Roles, Providers (credits and reset) and Quick switches; Colonize is one panel with the task box, repository, model and options as chips; workspaces are grouped as Pinned, Recent and All; notifications as Needs you, Updates and Done. A new round Ask button (and ⌘J / Ctrl-J) opens a compact chat panel on every view but Chat, with the colony you are on attached, and a colony page gets an "Ask about this colony" action. Settings still merge and every call is unchanged. (#1228)
• A test the colony broke gets a fix round even when the base commit fails the same check for another reason. Verification used to compare the head with the base commit check by check, so when cargo test failed on the base for any reason, a different test failing only on the colony's branch counted as preexisting and the colony was parked with preexisting_failure instead of being sent the failure. It now compares the failing tests themselves wherever the run names them (cargo's test … FAILED lines and closing failures: list, vitest and jest marks, node --test's ✖, durations ignored), and falls back to the check only when a side names none. A test failing on the branch alone contradicts the claim and is sent for a fix round, and a fix round is sent whenever the change has a failure of its own, even if another check is inconclusive. A colony is held as preexisting_failure only when every failure is shared with the base, and the hold now names the checks and tests that fail there. (#1231)

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from 61fa8d3.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

23ced90d97fcbc943d21aa931bc7b965cc63aa84d06a48af7960f6026e980d1b  colonizer-darwin-arm64.tar.gz
c11e54ff7311054436982bdda1115a68adafb1155bd4455b05b4c1738ee378b2  colonizer-linux-x86_64.tar.gz
764cfc92b5d2b430fea937c5f8911165499e497d3851a3923dd760c803d2d2c9  Colonizer-arm64.dmg
4293bed20d991fb79164e457163a058fb362f10e480c0588e0edac4d3ffd7b4b  install.sh

Colonizer v0.2.12

Colonizer v0.2.12

What's new

• Exec policy: tar and rsync --exclude patterns no longer count as touching a secret path, so copying a repository while excluding the placeholder dotfiles is no longer refused or flagged as a control bypass. --exclude-from and every other word still count.
• The mothership can merge its own colonies' pull requests (merge steward). An org can set auto_merge to green or green+rebase in Settings → Workspaces, with a merge method (squash by default) and delete-branch. Every few minutes, one GraphQL read per org decides each colony pull request: a green, clean one is merged (GitHub's branch protection is never overridden); a behind or conflicting one gets GitHub's update-branch, then its colony is resumed to rebase; a real failing check resumes the colony with the job's log tail, twice at most; and a pull request whose jobs all failed in seconds with no steps, or that GitHub flagged for billing or a spending limit, is marked ci_blocked with one banner per org instead of burning colonies. The workspace page lists each pull request's state with a Merge now button. Off by default. (#1172)
• A contradicted verification now sends the failure back to the agent instead of holding the colony: the failing check and command, the failing test names, the last 60 lines of the log (redacted), and the instruction to fix it, re-run the check and update pr.md. At most 2 automatic rounds per colony, then it holds with attention: verify_failed_repeatedly; when another check also fails on the base commit it holds at once with preexisting_failure and sends nothing. (#1186)
• A question that closes without an answer is closed everywhere. A question whose tool call got its result without an answer (an exec-policy ask that timed out or was refused) no longer stays "open" for autopilot while the Nest shows nothing. It closes with a question_closed event (reason: tool_resolved, timeout or turn_end), a restart or resume repairs such ghosts from the event log, and autopilot only waits on a question the colony's record shows as waiting_for_answer, so a finished colony verifies and publishes instead of sitting until it is parked. (#1189)
• The watchdog now fixes known stalls itself, and releases can install themselves. A remediation playbook (signature, action, bounded tries; defaults compiled in, playbook.toml in the config directory to add or replace rows) answers a placeholder-dotfile denial, a pr.md write refused outside the repo and a toolchain-installer denial with the exact fix message, switches a colony held on unrecognized_model or provider quota to a healthy fallback and resumes it, and publishes an idle colony whose verification is confirmed. The same denial after its tries stops the colony with attention looping. Each fix is logged as auto-fixed: <signature>, listed on the session as auto_fixes and shown in the colony header; security holds are never released. A new updates.auto_apply setting (off, when_idle, always) installs a newer release on the update-check cadence, with when_idle waiting until the spare app slot is free. (#1191)
• Releases can be cut by a release train instead of by hand. scripts/release-prep.mjs does what the release pull requests did: it folds the changelog.d/ fragments into CHANGELOG.md, bumps the release crates to the next patch (a crate such as colonizer-redact that is already ahead is left alone), refreshes Cargo.lock and writes a release-notes stub, and does nothing when no fragment is pending. The new Release train workflow runs daily and by hand: while main has pending fragments and its latest CI runs are green it opens release: vX.Y.Z with auto-merge on, and after the merge it checks the tag gate, pushes the lightweight tag on the merge commit and dispatches Release on it (a tag pushed with GITHUB_TOKEN would not start it). release-train: skip in the head commit of main postpones a run, and only patch bumps are ever made. While a release pull request is open, the merge steward holds colony pull requests that add a fragment. See docs/release.md. (#1193)
• The Loops page is one page, with one card for every loop. Built-in loops (Merge train, Dependencies & supply chain, TypeScript: remove any, Docs & README, Disk cleanup) and your own sit in two sections and wear the same card: name, switch, what it does, when it runs, what it covers, how the last run went, and a 7-day strip of runs coloured by outcome with a hairline for each day's spend. Details open in a drawer with 7, 30 and 90-day charts of runs and spend, the last run grouped by outcome (eleven pull requests blocked by the same billing error are one line with a link to fix it), the settings and every run. The mothership now keeps each loop's runs for 90 days — outcome, counts, dispatched colonies and what those colonies cost — and serves them at GET /api/loops/{id}/history?days=. (#1199)
• Setup no longer asks for the Stack again after every restart. The image-pull status is held in memory, so it read idle after each restart and Setup showed "image is not cached" even with the image on disk. The mothership now checks the image cache at startup and before answering GET /api/sandbox/pull, reporting cached for an image that is already there. Setup shows "Checking the image…" while that state is unknown instead of asking, and the advisory rows (Stack, first launch, live map) no longer turn the Settings dot amber once the machine, GitHub and Claude rows are done. The Stack and live-map rows have a "Don't ask again", kept on the mothership in setup.json (GET/PUT /api/setup). (#1200)
• The navbar model dropdown now sets the judge model too. A Judge row sits below the colony models, labelled "Answers colonies' questions for you", with a health dot (green answering, amber degraded, red failing). Picking a model saves only autonomy.settings.model, merged into the saved settings. The list is every provider/model from Model providers, plus fable and opus only when an api.anthropic.com provider with a key exists. While the judge is failing the pill shows a small warning and the dropdown suggests a healthy model. (#1201)
• Add a provider starts from logo tiles. Anthropic API, OpenRouter, DeepSeek, MiniMax, Z.AI, Alibaba, OpenAI, Local and Custom are one tap away and open a short form (the key, with the models prefilled from the catalogue); "Search 83 more…" opens the rest of the catalogue, and the disclaimers are one muted line with a "Why?" for the full text. (#1204)
• The Model providers page is a quiet list, with credits left and when they reset. Each provider is one row (logo, name, status dot, a gauge of the plan left, "resets in 3 h 12 min") that opens to a credits chart over the last 7 days with reset markers and a projected run-out, requests, failures and time per day as sparklines, the models ("3 enabled · +5 available"), which model settings use it and the connection details. The Mothership now keeps 30 days of per-day usage, plan-balance readings (read on Check and every half hour) and plan events, served by GET /api/providers/{id}/usage?days=; a plan balance reader can name a reset time with a new reset pointer. A provider with no balance reader says "balance unknown". (#1204)
• A moved branch, a failed parent and a fixture key no longer fail a colony. A push rejected as non-fast-forward (something else, such as a merge of main or update-branch, moved the colony's branch on GitHub) now fetches the branch, rebases the colony's new commits onto it (a merge when the rebase cannot), and pushes again, twice at most; a conflict resumes the colony with a rebase note instead of failing it. A colony stacked on a parent is never failed when its boot finds the parent unable to lend a branch: it goes back to the queue (which walks it up the stack or re-bases it on the default branch), waits as blocked while the parent is paused, or re-bases on the default branch when the parent is gone for good. Before pushing, the colony's added lines are scanned with the log redactor, and a secret-shaped literal (a realistic test key) resumes the colony once with the path:line and kind, and never the value, asking it to build the fake key at runtime; a GH013 push-protection rejection is parsed for the same paths and handled the same way. (#1206)
• A long colony opens on its latest messages and loads the older ones as you scroll up. The colony chat used to fetch and render a colony's whole history before anything showed, which was slow for colonies with thousands of events, on a phone or over remote access. Now the events socket takes limit and sends only the newest page of the current run (about 200 events, extended back to the start of the turn it would cut) with a history frame saying whether more is behind it, and GET /api/sessions/{id}/events?before=<seq>&limit= returns the page before, read from...

Colonizer v0.2.11

Colonizer v0.2.11

Settings are easier to find

Settings is now one vertical menu with search, and every view in the cockpit has its own address you
can bookmark and share (#1180).

• Press / to search any page or field by name, help text or a plain word like "key" or "token".
• A dot on a group shows when something needs you (amber) or is broken (red).
• On a phone, the menu is a list that opens each page with a back arrow.

Fixes

• Auto mode no longer takes on more colonies than the host can hold (#1158). Running colonies are never stopped; over the limit, nothing new starts.
• A quota error is blamed on the right provider (#1168), so one provider running out no longer pauses the whole queue as a Claude problem.
• Providers show their own logo (#1166), even when they were saved as custom at a known vendor's URL.
• No more false alarms for placeholder dotfiles (#1169). The empty .env and similar files the harness mounts no longer look like a control bypass.
• Documented example keys and redacted PR descriptions no longer block publishing (#1175). A colony that is stuck on the same cause now fails fast instead of looping.
• Helper agents work with model aliases (#1176), and a finished colony is no longer held over an unrecognized model.
• The Nest shows every colony (#1177), however busy the host is.

Smaller changes

• The log archive's Clean up now takes hours as well as days.
• The Jev key can be set on the Secrets page, without a restart (#1179).

Security status

Colonizer is alpha and not ready for unattended work on sensitive repositories, real credentials
included. An external audit of v0.1.3 (commit d89ce76, 17 September 2026) found four ways a
colony could cross into the host; they are filed as draft advisories (F01–F04) and are not fixed
yet, and its four release checkpoints (G1–G4) are all uncleared. Controls added since — scoped
tokens, remote-access fencing, sensitivity-aware routing, gateway audit lines, log and secret
redaction, path policy, egress and exec policies — do not close those findings, so attended work is
what the harness is good for today. The live status is
docs/audit.md and its tracking
issue (#91); report vulnerabilities privately
through SECURITY.md.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from c723105.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

e55079f7847b5b798bd6aab25eb89c4d205db904b525668bdd2bbb4c2bcc133a  colonizer-darwin-arm64.tar.gz
d6605c84649c5f48de1bae7e3e6063ab5d591ea886ec9007b0fcf997c070ff8c  colonizer-linux-x86_64.tar.gz
77ec4eb4414d4aa347ffd4573a919df4b5d869214e5480b4eeb092b1294624cf  Colonizer-arm64.dmg
4293bed20d991fb79164e457163a058fb362f10e480c0588e0edac4d3ffd7b4b  install.sh