v1.1.0 Manifest

Per-run containment you can declare at launch, and the first spectacle counter.

Capability manifests

Declare tools: [...] on any launch and the run may use ONLY those tools, in every permission mode including bypass. Enforced as a hard deny in the permission engine, filtered out of the model's advertised tool list, and excluded from text-emitted tool-call parsing, so there is no path around the cap. Works on background runs, interactive sessions, missions, marathons, and self-evolve (--allowed-tools / HEARTH_ALLOWED_TOOLS).

Egress allowlists (tool layer)

Declare allowed_hosts and the web tools (web_fetch, web_search, http_request, fetch_to_kb) may reach ONLY those hosts (subdomains included, loopback always allowed). Every outbound attempt, allowed or blocked, is recorded to a new egress_log audit table, readable at GET /egress. OS-level enforcement lands in v1.4; this layer stops accidents and naive injection and makes all egress visible.

Swarm scoping inheritance

Specialists spawned by a mission manager now inherit the manager's credential, tool, and host scoping. Previously scoping did not propagate to children.

Cloud cost saved

The audit log now shows what your runs would have cost on a frontier cloud model: a live counter in the world HUD and the cockpit stats panel.

Security scoreboard

GET /security and a cockpit panel showing what containment is active right now: remote auth, rate limit, manifests, egress activity, tripwire status (arriving in v1.2), daemon health.

New endpoints: GET /tools, GET /egress, GET /security.