erebus v0.6.3

Fixed

• Windows release build: LocalFree receives the SID string pointer as an
  untyped allocation, so erebus-stub compiles for x86_64-pc-windows-gnu.

Changed

• Registry bearer comes from --token-file or ERE_TOKEN. A --token flag
  would show the secret in ps and in shell history.
• The transparency log timestamps the checkpoint after the publish response,
  so a slow RFC 3161 server no longer holds POST /attestations.
• An installed CLI with no local erebus-stub downloads the matching stub
  from the GitHub release and checks it against checksums.txt.
• A release uploads one archive per built architecture plus checksums.txt.

Added (registry)

• scripts/erebus_registry/: the registry's proof core (Ed25519, Merkle,
  RFC 3161, transparency log) as a stdlib-only package; byte formats
  unchanged and pinned against the reference implementations in the battery.
• Merkle roots and inclusion/consistency proofs are O(log n) over a cached
  append-only tree instead of O(n) list scans (200k leaves: ~0.3 ms vs
  ~0.5 s per query); leaf lookup is a hash map.

Added

• Spec 2.1 action receipts: erebus serve --attest-key signs every tool
  call the engine returns (name and call id in clear, sha256 of the
  arguments) into execution.request.tool_calls, for chat completions
  (JSON, SSE deltas, legacy function_call) and the Responses API. A
  response that cannot be fully parsed is flagged tool_calls_incomplete
  instead of being reported as "no calls". Receipts without tool calls stay
  byte-identical to 2.0.
• erebus verify-attest <receipt> --response-body FILE: an auditor holding
  the plaintext response checks it against the signed output_hash and
  re-derives the signed tool-call list (exit 2 on any mismatch). Human
  output lists the signed tool calls.
• Spec 2.1 tool linkage: the proxy also signs the request's tool context
  (tools_offered, replayed tool_history, tool_results as call id +
  content digest). verify-attest --chain links every result to the call
  that requested it and reports injected results, rewritten history,
  changed results and calls to unoffered tools; --require-tool-linkage
  makes them fatal (exit 2). verify-attest <receipt> --request-body FILE
  re-derives the request side from the request body.
• Spec 2.1 attested tool boundary: erebus attest-tool http --listen … --upstream … (plain HTTP tools, MCP Streamable HTTP with JSON or SSE
  answers) and erebus attest-tool stdio … -- <mcp server> sign one receipt
  per tool execution (tool_invocation: tool name, canonical arguments
  digest, result digests, error flag). verify-attest --chain AGENT --tool-trail [NAME=]DIR matches every issued call to an execution and
  reports results no tool produced (result_without_execution), results
  that differ from what the tool returned (result_not_from_tool) and tool
  runs no model call asked for (execution_without_call);
  --require-tool-execution makes them fatal (exit 2). Tool calls gain an
  optional arguments_jcs_hash (JCS of the parsed arguments) so the two
  sides match whatever the whitespace.
• Tool executions can be bound to the engine's call id: MCP
  params._meta["dev.erebus/call_id"] or the Erebus-Call-Id HTTP header
  is signed as tool_invocation.call_id. A bound execution matches only
  its call, so identical calls executed out of order no longer yield a
  spurious result_not_from_tool, and a tool that ran the call with other
  arguments is reported execution_altered (fatal with
  --require-tool-execution).
• verify-attest --tool-trusted-dir DIR: tool trails are verified only
  against the tool operator's keys, which must share none with the agent's
  trusted keys, so a single stolen key can no longer forge both the agent
  and the tool trail. Reports tool_trust: separate|shared; shared trust
  is flagged in the human output.
• Egress confinement: ERE_EGRESS=PORT[,PORT…]|none limits the payload's
  outbound TCP to the given ports (macOS Seatbelt: localhost only; Linux
  6.7+: Landlock TCP connect rules plus a seccomp filter refusing UDP, raw
  and packet sockets, TCP Fast Open, io_uring and foreign ABIs). Signed
  as execution.egress; an invalid policy or a kernel without Landlock
  ABI 4 refuses the launch. scripts/egress_e2e.sh (Linux) and
  scripts/macos_slice.sh check it on a real bundle against a control.
• erebus evidence export <bundle> -o pack.zip and erebus verify-evidence pack.zip [--bundle] [--json]: a self-contained, offline-verifiable audit
  pack (receipts, inclusion proofs, checkpoints, RFC 3161 tokens, DSSE
  envelopes, signing keys). Export refuses an unverifiable trail; verify
  refuses any edited, missing, extra or path-traversing entry and a
  mismatched bundle (exit 2).
• verify-evidence --operator-key <key> --log-key <hex> pins the
  keys an auditor obtained out of band; any other key in the pack is
  refused, and the report lists every key as pinned or NOT PINNED.
• Evidence packs carry anchors/<receipt>.checkpoint, the exact bytes the
  RFC 3161 token covers, so openssl ts -verify -data checks the TSA
  signature without erebus.
• Docs: guides/audit.md (auditor walkthrough); proof-first introduction,
  problem, positioning and comparison pages, in English; CLI help leads
  with the proof commands.

Fixed

• Health-check server (stub): on macOS/BSD an accepted socket inherits
  O_NONBLOCK from the listener, so a probe that had not yet written its
  request got a reset instead of 200. Accepted sockets are now blocking
  with a 2 s read timeout.
• SISR e2e mock server: same inheritance made e2e_sisr_main and
  upgrade_migration fail randomly on macOS ("Peer disconnected").
• erebus build detects Mach-O (thin and universal) agents as the binary
  runtime; it only knew ELF and PE, so native macOS apps were refused. Java
  class files, which share the fat magic, are not mistaken for them.
• erebus build no longer stages a Linux glibc base (and warns about it)
  for non-ELF payloads.
• verify-evidence --operator-key accepts the public key hex that
  erebus keygen prints, as well as the sha256: fingerprint.
• attest --push also stores the inclusion proof beside the trail entry,
  so trails built with attest carry their proofs like serve --push ones.
• Spec and docs: a batch run's input_hash covers the launch vector
  (entrypoint + arguments), not stdin, and output_hash needs Linux
  isolation ≥ 2; the spec claimed stdin. Quickstart trusted-keys path fixed.

Fixed (macOS, ROADMAP P1-5)

• --landlock bundles are now confined by Seatbelt (sandbox_init), and
  the launch is refused if the profile cannot be installed. Before, the
  profile was never applied. Payload reads are limited to the system trees
  and the rootfs; writes go to the rootfs and a private TMPDIR.
• With ERE_ATTEST_KEY, macOS receipts now carry output_hash and
  exit_code (the Linux capture supervisor, shared).
• A launch that failed inside the capture supervisor exited 0, so its
  receipt would have signed a clean run. It now exits 126.
• scripts/macos_slice.sh: no KNOWN GAP left; the chain check no longer
  fails at random under pipefail.

Added (batch stdin)

• Spec 2.1 execution.stdin_hash: with capture on, a non-terminal stdin
  is relayed by the supervisor and its sha256 signed, only when the whole
  input was delivered (Linux isolation ≥ 2 and macOS). Receipts without it
  keep the 2.0 bytes.

---

Install: curl -fsSL https://raw.githubusercontent.com/Encapsul/erebus/main/scripts/install.sh | bash