Colonizer v0.2.3

Colonizer v0.2.3

About this release

v0.2.3 is the release v0.2.2 was meant to be. v0.2.2 was tagged but never published: two pull
requests that landed together both declared the observability module, so the tagged commit did not
compile and its release run was cancelled before anything was published
(#967 fixes it). Everything below ships for
the first time in v0.2.3.

It is a reliability release: colonies that used to sit waiting for a person now finish on their own,
and updating a running install is safer. The headline fixes:

• Parked and answered colonies resume themselves. With the autonomy judge configured, a colony
  parked on an outlived autopilot hold resumes on a 1h/3h/9h backoff, an answer sent while it was
  parked resumes it with that answer, and a resumed colony verifies and publishes like a fresh one
  instead of waiting on a hand-run publish (colonizer list --parked lists the parked ones,
  #876).
• The watchdog finishes a colony whose agent said it was done. When the agent gave its final
  answer but never ended its turn, the watchdog now ends the turn for it (recording
  watchdog_turn_end) so verification and publish carry on (#878).
• An unauthenticated gh is a provenance skip, not a forged release. On a headless host whose
  gh is installed but not logged in, the installer and colonizer update no longer refuse the
  release as a wrong attestation (#940).
• macOS updates keep the Keychain's grant. The installer re-signs the new host binary with
  COLONIZER_CODESIGN_IDENTITY, so the mothership stops asking for every secret again after
  colonizer update (#939).

What's new in v0.2.3

The rest, each backed by an entry in
CHANGELOG.md:

• Updates and restarts drain first. colonizer update, the Settings button and a SIGTERM stop
  hold the queue and wait for booting or publishing colonies, and an app slot in use is never deleted.
• Infrastructure blips are retried. A microVM that fails to start for a transient reason is
  retried on a 1/5/15-minute backoff, and a loop re-runs a run that failed that way once
  (#881).
• Loops that need GitHub run instead of parking on a question (a Needs GitHub switch on the
  triage, CI-flake and changelog templates), and the writes-outside-repo exec policy no longer
  asks about writes inside a colony's own microVM.
• The autonomy judge no longer fails silently: every call is recorded and classified, a failing
  provider alerts once and falls back, and saving the judge probes its model.
• An Observability module kind (OTLP or local files) lands its settings and validation; nothing
  is exported yet (#840).
• A "Your cockpit" card lists the addresses to bookmark, with QR codes, and offers a bookmark or
  app install on first sign-in (#867).
• The graft skillset downloads and installs on linux-x86_64 and linux-aarch64 colonies
  (#607).
• Docs match the code again across architecture, CLI, cockpit, protocol, fleet, install and
  security pages, and the ACP and Grok Build runner tests pass on macOS.

Install

curl -fsSL https://colonizer.dev/install.sh | sh

Prebuilt bundles are published for Linux x86_64 (with KVM) and Apple Silicon Macs
(darwin-arm64); there is no Intel-Mac or Windows build. What one machine needs:

• Linux: /dev/kvm readable and writable by your user (sudo usermod -aG kvm "$USER", then log
  out and back in) and a native Claude Code install, which colonies run.
• Either platform: git, gh, curl and tar (with xz); on Apple Silicon the installer also
  fetches the Linux build of Claude Code a colony needs.

Run colonizer afterwards; it prints a sign-in link and opens it. The full walkthrough — install
options, first run, where things live, how to update — is in
docs/install.md.

Security status

Colonizer is alpha and not ready for unattended work on sensitive repositories, real credentials
included. An external audit of v0.1.3 (commit d89ce76, 17 September 2026) found four ways a
colony could cross into the host; they are filed as draft advisories (F01–F04) and are not fixed
yet, and its four release checkpoints (G1–G4) are all uncleared. Controls added since — scoped
tokens, remote-access fencing, sensitivity-aware routing, gateway audit lines, log and secret
redaction, path policy, egress and exec policies — do not close those findings, so attended work is
what the harness is good for today. The live status is
docs/audit.md and its tracking
issue (#91); report vulnerabilities privately
through SECURITY.md.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from af12292.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

209e88148dd2450ca145310afb21eeafb70b00ca96d48a3888f0f8d4e5eef92e  colonizer-darwin-arm64.tar.gz
2e15a59b0a698d4fad9e51324520db77c857b63b03216f88b4e3b9dc16a7d271  colonizer-linux-x86_64.tar.gz
12eeacb0c7248f4074b6343a1d787182a9ab18590837173dae19306ff33e85aa  install.sh