v3.0.0

Geode 3.0.0. Major version: local geode run and Linux custody now refuse a secret binding with an empty or unusable allow_hosts, and macOS now enforces allow_hosts.

Crates: geode-cli, geode-grotto, geode-tui, geode-redact, geode-os at 3.0.0.

BREAKING

• Linux custody and local geode run refuse a secret binding whose allow_hosts is empty or unusable (policy_deny, nothing spawned). Tokens issued with an empty list no longer run and must be reissued with the hosts they may contact.

Security

• test-trusted-root is also refused at build time for any optimized build (opt-level other than 0), so a custom profile with debug assertions on cannot ship the test-only trust-root switch. The release check script now proves this.
• geode run --home refuses a path that is itself a symlink. The flag docs now say plainly that these checks are a usability guard, not a security boundary.
• CI fails if any release, publish, or tag workflow does not run check-no-test-trusted-root.sh.
• The interim custody argv lint compares path components and requires the pinned command to sit directly in /usr/local/libexec/hedronite.
• geode-grotto also refuses its test-trusted-root feature in any optimized build, matching the CLI guard.
• The release-workflow guard ignores comments, requires check-no-test-trusted-root.sh on a run: line or inside a run block, and detects release triggers in map, flow-list (on: [release]), and scalar (on: release) form.
• cargo test -p geode-cli with default features passes. The run tests that spawn a child with a secret need the test-only host override and are compiled only with test-trusted-root, which CI uses.
• Local geode run enforces allow_hosts for every secret binding on every platform, including macOS. The check is the custody allowlist (AllowList): a host that is not listed is host_denied and is not dialed. A secret binding with an empty or unusable allow_hosts is refused before spawn (non-zero exit). There is no environment variable, flag, or config key that disables the check. Pass hosts with repeatable --allow-host. macOS confines the child with a deny-by-default seatbelt: file and process access is limited to what the child needs to run, mach-lookup is a named allowlist with no network service, Apple events are denied, and network helper programs cannot be exec'd. LaunchServices, the preferences daemon, and the keychain service are not on that list. The seatbelt used when there is no egress proxy is deny-by-default as well and has no outbound network. Outbound network for a confined run is allowed only to the local egress proxy. The proxy listens on both loopback stacks, because the seatbelt loopback name covers both, and refuses to start if either bind fails. Each run puts a token in the proxy URL; a request without it is not dialed. A process that can read the child environment can present that token. A DNS answer in a loopback, private, link-local, multicast, benchmarking, reserved, NAT64, or other non-global range is not dialed unless the request host is an IP literal already on allow_hosts. Proxy denials are audit rows with outcome host_denied. Linux keeps the network namespace and the same proxy checks.
• The egress dial filter treats the local-use NAT64 prefix 64:ff9b:1::/48 as restricted, next to the well-known prefix 64:ff9b::/96. A name that resolves into that range is not dialed unless the request host is an IP literal already on allow_hosts.

Changed

• Tests: CLI test helpers point HOME and the XDG dirs at per-test tempdirs and drop GEODE_KEY_FILE/GEODE_PASSPHRASE, so no test can resolve the operator's key. Custody geode_run gains Fix 3 audit-fault tests (started-row and close-row) on the in-process daemon.

Full changelog: v2.0.0...v3.0.0