v0.0.30 — always-on protections + full robustness audit

An early preview. main is a development snapshot; treat releases as previews.

Highlights

Protections are always-on and secure-by-default. A repo-wide audit of every config-switchable function established the principle a protection mechanism must not be switchable, and made the guarantees non-optional:

• Design → build lifecycle, completion authority, coder authorization + audit ledger, the untrusted-result injection fence, and the OS execution sandbox (bwrap/firejail on Linux) are mandatory and fail-closed — not switchable off.
• Secure deployment defaults: fresh servers bind loopback under the unauthenticated profile and refuse non-loopback exposure without explicit auth; search/forge default off; connection/coder timeouts are finite and ceiling-bounded.
• Typed config schema + transactional /config set (clone → validate → derive → commit-or-rollback), a generated config reference, and a documented-switch/read-switch parity guard so a raw config gate outside the typed accessor fails CI.
• Build-boundary egress tripwire (advisory supply-chain signal driven by the approved design's network posture).

A full-Ironclad robustness audit hardened ten defects across the engine and the terminal client:

• Whole process-tree termination for model commands and coder launches on timeout/cancel; a hard per-coder wall-clock; bounded model-facing filesystem I/O and Ink output capture.
• Atomic skill-catalogue install and transactional multi-file generation (no data-loss on a failed write); fail-closed MPR evidence retention with verified deletion.
• Tool-result delivery that resends independent of the reconnect edge; a serialized, seal-on-stop session heartbeat; /update runs executable+argv without a shell and validates its source path.

See the CHANGELOG for the full list.

Install: pip install ironclad-ai==0.0.30