Colonizer v0.2.9

Before you update

• Fixes running colonies: Stacked chains no longer fail all at once, idle colonies stop holding slots, and Needs you stops listing superseded failures (#1140)

Colonizer v0.2.9

Stalls fixed: stacked chains wait, idle colonies free their slot

Update if colonies stacked on one another have been failing together or sitting idle.

• A colony stacked on a parent that is stopped or parked now waits as Blocked: no slot, no
  microVM, not failed. It runs again when the parent resumes or finishes. If the parent is gone for
  good, it re-bases on the default branch and queues. A stack no longer fails all at once
  (#1140).
• A colony that is idle, held or flagged, with no open question and nothing being published, parks
  after 15 minutes (the Watchdog setting idle_park_minutes) instead of holding its slot for 90.
  Its worktree is kept. If its last turn did not write /harness/out/pr.md, it is asked once to.
• Needs you shows one entry per issue. It drops failed or stopped colonies that a newer colony
  for the same issue has overtaken, and any cascade failure. Abandoned questions older than 72 hours
  fold into one row with Dismiss all.

If Claude runs out, use a model you choose

The Claude Code module has a new setting, If Claude runs out, use (#1130). Pick a
<provider>/<model>. While your Claude plan is at its session or weekly limit, every role and
override that would use Claude runs on that model instead, and goes back to Claude by itself at the
reset. Nothing you saved changes, so there is nothing to switch back. Running colonies carry on and
parked colonies resume.

• Restricted-sensitivity work uses the fallback only if its provider is marked trusted; otherwise it
  parks with "needs a trusted provider".
• The plan bars and a banner say "Claude out, running on MiniMax until 19:51".
• With no fallback set, nothing changes.

Colonies are sized to the machine

With the stack on Automatic and no number in Parallel sessions, each colony's vCPUs and memory now
come from the machine, and a queued colony starts only while the machine has the memory and CPU free
for it (#1141). Builds and other programs on the same computer lower how many colonies fit;
admission pauses when memory is short and resumes by itself. A running colony is never stopped for
it. Safety cap on colonies (default 32) still applies. A number in Parallel sessions, or any
named stack, works as before.

On a small machine (16 GB of RAM or less) the host keeps a fifth of the memory and colonies are 4 GB, and
the first colony always starts, sized to what is free, so a small computer is never left waiting.

A macOS app, unsigned for now

Every release now carries Colonizer-arm64.dmg (#1138). Open it, drag Colonizer in and run it:
it installs Colonizer, sets up the login item and opens the cockpit.

• The app is not signed or notarized yet, so macOS blocks it the first time. Open System
  Settings, Privacy & Security and choose Open Anyway for Colonizer, once.
• macOS may ask for Keychain access. Allow it; this is the unsigned build, and it should stop once
  the app is signed.
• The curl installer below is still the recommended path.

Red team: one run per repository, and Cancel

A repository can have only one red-team run at a time (#1145). A second start is refused with a
409 naming the run, however it is started, and the dialog shows that repository disabled with its
progress and a Cancel run button. Cancel stops every hunter of the run, keeps the findings
validated so far and files nothing afterwards. Each repository row now reads its red-team history
("never hunted", "last hunted 3 d ago · 4 findings (2 filed)"), and the list puts never-hunted
repositories first.

Faster boot

A colony boots about 5 seconds faster (#1143). The wait for the agent no longer rides out the
mesh proxy's first stalled dial, and a fresh colony's fetch of the local mirror runs alongside its
issue fetch.

Install and update checks retry on network trouble

If Sigstore cannot be reached while the installer verifies a download, it retries three times and
then stops with "could not reach Sigstore to verify the build (network: …); nothing was installed",
instead of saying the attestation is wrong (#1126). Only a real mismatch says it is wrong.
Verification of a colony's work before publishing keeps the network retries added in v0.2.8
(#1117).

Security

• The Claude Code module's locked @modelcontextprotocol/sdk moves from 1.30.0 to 1.32.1, fixing
  GHSA-6qxp-vccf-f47h (an OAuth client could send credentials to an authorization server chosen by
  the MCP server).
• The telemetry and relay services pin sharp 0.35.5, fixing GHSA-wq5f-xc86-pv6w.

Both are build and dev dependencies; nothing you run changes.

Everything else

• History search filters are a row of chips (#1124): Repository, Agent, Status and Date open
  small popovers, the search runs as you type, and the filters live in the address bar so a search
  can be shared.
• Release notes in Settings, Updates read as text (#1125), and the critical or
  fixes-running line shows once, in the banner.
• colonizer-redact has a README on crates.io.
• The remote-access docs say the relay at my.colonizer.dev was redeployed on 2026-10-06 and
  carries its fixes and pairing by code.

Every entry is in
CHANGELOG.md.

Install

curl -fsSL https://colonizer.dev/install.sh | sh

Prebuilt bundles are published for Linux x86_64 (with KVM) and Apple Silicon Macs
(darwin-arm64); there is no Intel-Mac or Windows build. What one machine needs:

• Linux: /dev/kvm readable and writable by your user (sudo usermod -aG kvm "$USER", then log
  out and back in) and a native Claude Code install, which colonies run.
• Either platform: git, gh, curl and tar (with xz); on Apple Silicon the installer also
  fetches the Linux build of Claude Code a colony needs.

Run colonizer afterwards; it prints a sign-in link and opens it. The full walkthrough — install
options, first run, where things live, how to update — is in
docs/install.md.

Security status

Colonizer is alpha and not ready for unattended work on sensitive repositories, real credentials
included. An external audit of v0.1.3 (commit d89ce76, 17 September 2026) found four ways a
colony could cross into the host; they are filed as draft advisories (F01–F04) and are not fixed
yet, and its four release checkpoints (G1–G4) are all uncleared. Controls added since — scoped
tokens, remote-access fencing, sensitivity-aware routing, gateway audit lines, log and secret
redaction, path policy, egress and exec policies — do not close those findings, so attended work is
what the harness is good for today. The live status is
docs/audit.md and its tracking
issue (#91); report vulnerabilities privately
through SECURITY.md.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from 29666d3.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

432b6966bbd42053b62dfd25f5d964b51066134f475422a98ce6db0c3bc29f05  colonizer-darwin-arm64.tar.gz
63785e787439779cd010462a67c7e7569608102323403a57331f558563192e86  colonizer-linux-x86_64.tar.gz
9cde826604a1a5bb6f5f34bc41ada89b9dd340cb15f37c1c6c31f336f6f794e3  Colonizer-arm64.dmg
4293bed20d991fb79164e457163a058fb362f10e480c0588e0edac4d3ffd7b4b  install.sh