v1.2.0

Compatible 1.x minor on the 1.0 contract. Foundry pack v034: keyring custody and inject-only exec. GDE1 objects written by 1.0.0, 1.0.1, and 1.1.0 remain readable. Suite 0x01 stays. A Read token still defaults geode_read to text. Existing custody verbs, exit codes, and MCP tools geode_list / geode_read / geode_write for a token 1.1.0 already accepts are unchanged.

Added

• geode-redact covers the v1 encodings. Shell quoting is not claimed. A named binding redacts as [REDACTED:NAME].
• Op::Inject is separate from Read. An inject-only token defaults geode_read to hash. Explicit text without Read is plaintext_denied.
• token issue accepts allow_cmds, allow_hosts, peer_uid, and redact. token inspect prints those claims and does not print sealed bytes.
• geode run injects locally with a clean child env. geode audit verify checks the hash chain.
• geode agent serve --custody runs the custody daemon. Linux children run as geode-run. macOS children stay _geode under a seatbelt. No same-uid mode. No run_as_peer.
• geode custody unlock, lock, and status. status prints no key bytes.
• MCP geode_run is advertised only by a --custody server when the token holds Inject. One buffered result. Linux non-empty allow_hosts uses a per-child network namespace. If that namespace cannot be made, the run is policy_deny. macOS refuses a non-empty list before spawn. An empty list records hosts: unrestricted.

Not in this tag

• geode run --file and geode run --socket exit 1. The custody geode_run tool is the remote run surface.
• The machine hook is a later verb. UKI and PCR signing stay on the LE13 interim.
• Darwin geode mount still exits 1. Windows is not offered.

Identity lock: git tag v1.2.0 = Cargo 1.2.0 = crates.io geode-redact → geode-os → geode-grotto → geode-tui → geode-cli.