Skip to content

Releases

ExecBound 0.1.0

ExecBound 0.1.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Oct 06:40
v0.1.0
c8bed3c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ExecBound 0.1.0

The first release of self-hosted ExecBound Community: the gateway and its console, the Python client, the provider protocol, the connectors, the examples and the integrations, published as one signed image.

ExecBound sits between an AI agent and the systems it acts on, and decides outside the model whether each action may run. The agent asks over MCP or HTTP. ExecBound resolves the request to one canonical action and one target against trusted inventory, applies deterministic Cedar policy and shared impact limits, asks a named person when a rule says to, and only then lets the action run.

What is in it

  • Three placements. Execute holds the provider credential and dispatches a governed action itself. Gate issues a plan-bound grant to an external executor. Monitor receives activity without granting execution authority.
  • Decisions outside the model. Policy, trusted context and limits decide. An unknown action, a mismatched target or missing context fails closed.
  • Approvals. A rule can hold a request for a named approver. An approval is scoped to the exact request, expires, and is consumed once.
  • Shared impact limits. Limits count the targets affected across agents, runs and protocols within the scope you configure, and reservations are atomic.
  • A record you can replay. Every decision is appended to the workspace's audit chain with its evidence. An exported history replays offline without acting on anything, and the chain can be verified.
  • The console. Home, Activity, approvals, policies and rules, agent connections, people and Spaces, and monitoring.
  • Integrations, each at its own evidence level: Tines instrumentation and collection, the external execution checkpoint, Arcade hooks, and Scout's Microsoft Entra inventory and audit source. Integrations says which path is tested and how far.

Install

The image is ghcr.io/execbound/execbound:0.1.0, built for linux/amd64. Its digest and the command that verifies its signature follow these notes.

  1. Verify the signature, as Releases describes, and note the digest it names.
  2. Follow Install on one host, using ghcr.io/execbound/execbound@sha256:<digest> wherever it says execbound:community. The guide still describes building the image yourself, which also works.

Upgrading

This is the first release, so there is nothing to upgrade from. On a new installation, execbound quickstart applies the database schema when it sets the deployment up.

What it does not do

  • It supports one canonical target per action and fixed provider operations. There is no generic HTTP passthrough, no batch mutation, no automatic resend of an uncertain operation, and no approval flag the agent can supply.
  • Gate and Monitor do not stop a caller that uses a separate credential outside ExecBound.
  • Tenant row-level security does not contain an attacker who obtains arbitrary SQL access with the runtime credential.
  • A fresh installation runs against two mock providers. Read Deployment before anything real depends on it.
  • No package is published to PyPI. The Python client is installed from the repository with pipx.
  • Only the latest release is supported, and security fixes are made in it alone.

The threat model lists each threat with its mitigation, the code that enforces it, the test that exercises it and its status.

The image

docker pull ghcr.io/execbound/execbound@sha256:1954f9f5edbc25a15deb9f1518f8fdb26b8cdbb191d32be056b61db9ac1c3501

Tagged ghcr.io/execbound/execbound:0.1.0 and ghcr.io/execbound/execbound:0.1. Verify its signature before you run it:

cosign verify ghcr.io/execbound/execbound@sha256:1954f9f5edbc25a15deb9f1518f8fdb26b8cdbb191d32be056b61db9ac1c3501 \
  --certificate-identity https://github.com/ExecBound/execbound/.github/workflows/release.yml@refs/tags/v0.1.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Attached: the SBOM of the image's Python environment (sbom.cdx.json), the provenance document (provenance.json), the distributions read out of the image (image-distributions.json) and the release record (release-record.json), which names the digest of each of the other three and the approval this release was published on. Releases says what each one holds.

Post-release check, 18 October 2026

  • Signature: the publish job verified the signature on sha256:1954f9f5edbc25a15deb9f1518f8fdb26b8cdbb191d32be056b61db9ac1c3501 against this workflow's identity at v0.1.0, with its transparency-log claims and certificate checked. The command above repeats that check.
  • Record: the SHA-256 of sbom.cdx.json, provenance.json and image-distributions.json each match release-record.json. The record's image digest matches provenance.json's registry digest.
  • Pull: an anonymous pull of :0.1.0 and :0.1 resolves to that digest.
  • Install: Install on one host was followed from that digest on Linux. It took 20 seconds from init to the end of quickstart, which governed both requests: ws01.example EXECUTED and ws02.example DENIED. Readiness reports commit c8bed3cb.
  • Found: where Docker runs as root, the guide's first command fails with "/install could not be created or written". Docker creates a missing mount directory owned by root. Run mkdir execbound before the first command. The guide will say so.
  • Upgrade: this is the first release, so there is no earlier one to upgrade from.
Assets 6
Loading