v3.0.0

Geode 3.0.0. Major version: local geode run and Linux custody now refuse a secret binding with an empty or unusable allow_hosts, and macOS now enforces allow_hosts.

Crates: geode-cli, geode-grotto, geode-tui, geode-redact, geode-os at 3.0.0.

BREAKING

• Linux custody and local geode run refuse a secret binding whose allow_hosts is empty or unusable (policy_deny, nothing spawned). Tokens issued with an empty list no longer run and must be reissued with the hosts they may contact.

Security

• test-trusted-root is also refused at build time for any optimized build (opt-level other than 0), so a custom profile with debug assertions on cannot ship the test-only trust-root switch. The release check script now proves this.
• geode run --home refuses a path that is itself a symlink. The flag docs now say plainly that these checks are a usability guard, not a security boundary.
• CI fails if any release, publish, or tag workflow does not run check-no-test-trusted-root.sh.
• The interim custody argv lint compares path components and requires the pinned command to sit directly in /usr/local/libexec/hedronite.
• geode-grotto also refuses its test-trusted-root feature in any optimized build, matching the CLI guard.
• The release-workflow guard ignores comments, requires check-no-test-trusted-root.sh on a run: line or inside a run block, and detects release triggers in map, flow-list (on: [release]), and scalar (on: release) form.
• cargo test -p geode-cli with default features passes. The run tests that spawn a child with a secret need the test-only host override and are compiled only with test-trusted-root, which CI uses.
• Local geode run enforces allow_hosts for every secret binding on every platform, including macOS. The check is the custody allowlist (AllowList): a host that is not listed is host_denied and is not dialed. A secret binding with an empty or unusable allow_hosts is refused before spawn (non-zero exit). There is no environment variable, flag, or config key that disables the check. Pass hosts with repeatable --allow-host. macOS confines the child with a deny-by-default seatbelt: file and process access is limited to what the child needs to run, mach-lookup is a named allowlist with no network service, Apple events are denied, and network helper programs cannot be exec'd. LaunchServices, the preferences daemon, and the keychain service are not on that list. The seatbelt used when there is no egress proxy is deny-by-default as well and has no outbound network. Outbound network for a confined run is allowed only to the local egress proxy. The proxy listens on both loopback stacks, because the seatbelt loopback name covers both, and refuses to start if either bind fails. Each run puts a token in the proxy URL; a request without it is not dialed. A process that can read the child environment can present that token. A DNS answer in a loopback, private, link-local, multicast, benchmarking, reserved, NAT64, or other non-global range is not dialed unless the request host is an IP literal already on allow_hosts. Proxy denials are audit rows with outcome host_denied. Linux keeps the network namespace and the same proxy checks.
• The egress dial filter treats the local-use NAT64 prefix 64:ff9b:1::/48 as restricted, next to the well-known prefix 64:ff9b::/96. A name that resolves into that range is not dialed unless the request host is an IP literal already on allow_hosts.

Changed

• Tests: CLI test helpers point HOME and the XDG dirs at per-test tempdirs and drop GEODE_KEY_FILE/GEODE_PASSPHRASE, so no test can resolve the operator's key. Custody geode_run gains Fix 3 audit-fault tests (started-row and close-row) on the in-process daemon.

Full changelog: v2.0.0...v3.0.0

v1.2.1

Patch on 1.2.0. Command help describes what each command does. Internal design notes are no longer in the help text.

Behavior, exit codes, and the vault format are unchanged. GDE1 objects stay readable. Suite 0x01 stays. A Read token still defaults geode_read to text.

Identity lock: git tag v1.2.1 = Cargo 1.2.1 = crates.io geode-redact → geode-os → geode-grotto → geode-tui → geode-cli.

v1.2.0

Compatible 1.x minor on the 1.0 contract. Foundry pack v034: keyring custody and inject-only exec. GDE1 objects written by 1.0.0, 1.0.1, and 1.1.0 remain readable. Suite 0x01 stays. A Read token still defaults geode_read to text. Existing custody verbs, exit codes, and MCP tools geode_list / geode_read / geode_write for a token 1.1.0 already accepts are unchanged.

Added

• geode-redact covers the v1 encodings. Shell quoting is not claimed. A named binding redacts as [REDACTED:NAME].
• Op::Inject is separate from Read. An inject-only token defaults geode_read to hash. Explicit text without Read is plaintext_denied.
• token issue accepts allow_cmds, allow_hosts, peer_uid, and redact. token inspect prints those claims and does not print sealed bytes.
• geode run injects locally with a clean child env. geode audit verify checks the hash chain.
• geode agent serve --custody runs the custody daemon. Linux children run as geode-run. macOS children stay _geode under a seatbelt. No same-uid mode. No run_as_peer.
• geode custody unlock, lock, and status. status prints no key bytes.
• MCP geode_run is advertised only by a --custody server when the token holds Inject. One buffered result. Linux non-empty allow_hosts uses a per-child network namespace. If that namespace cannot be made, the run is policy_deny. macOS refuses a non-empty list before spawn. An empty list records hosts: unrestricted.

Not in this tag

• geode run --file and geode run --socket exit 1. The custody geode_run tool is the remote run surface.
• The machine hook is a later verb. UKI and PCR signing stay on the LE13 interim.
• Darwin geode mount still exits 1. Windows is not offered.

Identity lock: git tag v1.2.0 = Cargo 1.2.0 = crates.io geode-redact → geode-os → geode-grotto → geode-tui → geode-cli.

v1.1.0

Compatible 1.x minor on the 1.0 contract. geode sign pub and geode sign blob are the Ed25519 cosign verb. The key stays in Geode. Custody verbs, exit codes, MCP tools geode_list / geode_read / geode_write, and GDE1 suite 0x01 are unchanged. GDE1 objects written by 1.0.0 and 1.0.1 remain readable.

Added

• geode sign pub writes the Ed25519 identity public key as SPKI PEM (BEGIN PUBLIC KEY).
• geode sign blob PATH signs the raw file bytes (RFC 8032, no prehash). The signature file is standard base64 plus one trailing newline.
• The seed is blake3::derive_key("geode/v1/ed25519-identity", ISK). A second identity file is a second key on the same verb. Verify with cosign v2.6.5: verify-blob --key pub.pem --signature sig --insecure-ignore-tlog --offline payload.
• geode key pub and .gpub stay X25519.

Not in this tag

• The machine hook is a later verb. UKI and PCR signing stay on the LE13 interim.

Identity lock: git tag v1.1.0 = Cargo 1.1.0 = crates.io geode-grotto → geode-tui → geode-cli.

v1.0.1

Compatible 1.x patch on the 1.0 contract. CLI verbs, exit codes, MCP tools geode_list / geode_read / geode_write, and GDE1 suite 0x01 are unchanged. GDE1 objects written by 1.0.0 remain readable.

Fixed

• Linux FUSE intern path: inherent helpers take the existing Node type
• TUI tests that spawn geode locate the binary under cargo llvm-cov's target dir
• GitHub Actions: sysdeps before --all-features, MSRV 1.89, feature-matrix, nonempty record-only coverage. No job-level RUSTFLAGS. No --fail-under-lines.

Changed

• rust-tops kit drop-in and grotto property tests. Density extracts group the same seal/read fields; on-disk format and CLI surface are unchanged.

Identity lock: git tag v1.0.1 = Cargo 1.0.1 = crates.io geode-grotto → geode-tui → geode-cli.

Darwin live FUSE remains a later 1.x.y patch. Windows is not offered.

v1.0.0

Contract freeze. GDE1 objects written by 0.2.x remain readable. Suite 0x01 is unchanged.

The public API is geode-grotto, the geode CLI, and MCP tools geode_list, geode_read, and geode_write on --stdio or --socket PATH. The next incompatible change to those is 2.0.0.

HedronDB integration and the h3s projected-token cookbook are 1.x minors. The Darwin live FUSE mount is a 1.x.y patch. Linux FUSE shipped in 0.2.8. Windows is not offered.

Identity lock: git tag v1.0.0 = Cargo 1.0.0 = crates.io geode-grotto, geode-tui, geode-cli.

v0.2.9

Compatible 0.x patch. Foundry pack v032: the agent Unix socket.

geode agent serve --socket PATH serves the same newline-delimited JSON MCP frames as --stdio on a mode-0600 Unix socket. --stdio and --socket are mutually exclusive. Passing both exits 1. Passing neither exits 1. --stdio alone is unchanged.

No format change. GDE1 objects from 0.2.8 remain readable. macOS live FUSE is not in this tag. Windows is not offered.

Identity lock: git tag v0.2.9 = Cargo 0.2.9 = crates.io geode-grotto, geode-tui, geode-cli.

v0.2.8

Compatible 0.x patch. Foundry pack v030. No format change. GDE1 objects from 0.2.7 remain readable. macOS live FUSE is not in this tag. Windows is not offered.

• On Linux, feature fuse runs a real FUSE session. Foreground is the default. --daemon forks and writes a pid file. geode unmount calls fusermount3 -u.
• Kernel-free MountSession over the shipped VFS.
• geode mount --help documents the Linux session, the read-write default versus --read-only, and that Darwin is unsupported.

Identity lock: git v0.2.8 = Cargo 0.2.8 = crates.io geode-grotto → geode-tui → geode-cli.

v0.2.7

Compatible 0.x patch. Foundry pack v029. No format change. GDE1 objects from 0.2.6 remain readable. A live FUSE session is still unsupported.

• geode mount without --read-only is read-write. --read-only stays read-only. Darwin live geode mount exits 1. --token cannot mount. Every mount prints the UID-bypass warning.
• Manifest entries may be kind: dir. geode open creates the directory and does not read an object for it.
• geode mount --help documents the read-write default versus --read-only.

Identity lock: git v0.2.7 = Cargo 0.2.7 = crates.io geode-grotto → geode-tui → geode-cli.

v0.2.6 — git sidecar

Compatible 0.x patch. Foundry pack v028 (git sidecar + hooks). GDE1 objects from 0.2.5 remain readable.

• geode git init|add|status|unlock|lock
• BIND_PATHS git-mode; add gitignores plaintext; lock unlinks working copies
• --token cannot git-init/add
• Help documents GitHub-visible metadata

crates.io: geode-grotto → geode-tui → geode-cli