Skip to content

v6.0.0 — Perpetual Runtime Phase 5: zero-day containment

Latest
Latest

Choose a tag to compare

View all tags
@Jovancoding Jovancoding released this 06 Nov 00:40
v6.0.0
7d0c358

What's changed

Perpetual Runtime Phase 5 — binary-level resilience and zero-day containment. Opt-in, no new runtime dependencies. Guide: docs/hardened-deployment.md

Added

  • k-of-n lease authorities (invariant I4) — code on the agent host cannot cause a lease to be issued or extended. Leases name their issuing authority; co-signers sign only issuer-signed claims and decide independently. Granting needs k authorities; any one can stop a run.
  • Posture gate — network-ai perpetual doctor; authority / proxy refuse to start on unsafe deployments unless --accept-risk is given (audited).
  • Human checkpoints — runs stop unless an operator signs a checkpoint every humanCheckpointEveryMs.
  • Honeytokens and tripwires — decoy credentials and files; any use is refused at the egress proxy, revokes every run, and latches the authority until an operator resumes.
  • Attestation-gated renewal — a modified agent image cannot renew its lease.
  • Capability-evaluation gating for high-risk scopes (elevated, self_improve, financial routes).
  • No-network agents — VsockRelay, Firecracker / Kata runners, one-way spool transport; hardened Node profile.
  • Hardware-backed signers — Signer, CommandSigner, --signer-cmd.
  • Merkle audit (RFC 9162) with a witness and proof-carrying claims.
  • Verified core — pure decision functions with property tests and a machine-checked Lean 4 model; LeanCertificateVerifier.
  • Fuzzing of every control door (test-perpetual-fuzz.ts).

Security

  • ClawHub skill (SkillSpector): environment names from a fixed list; writes confined to data/ with no-follow, exclusive, owner-only files.

Breaking

  • High-risk policies need authorityQuorum.threshold >= 2 and a capability evaluation, unless the operator signs acceptRisk.
  • perpetual authority / proxy refuse to start on failed posture checks.
  • NETWORK_AI_ENV values outside dev|st|sit|qa|sandbox|preprod|prod are rejected.
  • Sandbox refuses uid 0; revoked / stopped run states are absorbing; a sentry stop at quorum latches the authority.

Tests: 4,561 passing across 45 suites.

Full changelog: https://github.com/Jovancoding/Network-AI/blob/main/CHANGELOG.md

Assets 2
Loading