Reality Kernel 0.2.0

[HunterX461]

Reality Kernel 0.2.0 - Adoption. From nothing to an AI agent under an enforced, least-privilege profile in a few commands.

New

• One-command install: curl -fsSL https://realitykernel.dev/install.sh | sh picks the deb or rpm, refuses a package that doesn't match SHA256SUMS, and with cosign also refuses one not signed by this release workflow.
• rk init: a starter profile in AUDIT that fits the host. It records every connection, exec and secret-file read, and blocks nothing.
• rk policy suggest: turns the signed audit log into an ENFORCE profile that allows exactly what the agent did. Secrets stay denied. It never applies anything by itself.
• docs/agents.md: a runbook your coding agent can follow, with a prompt to paste.
• TUN/TAP containment: governed agents can no longer create or attach to TUN/TAP devices, including ones their own user owns.

Fixed

• Audit records of an rk run agent that exits quickly keep its profile name.

Full list: CHANGELOG.md. Every claim maps to tests that pass on five kernels: docs/evidence.md.

Image: ghcr.io/keter-lab/reality-kernel:0.2.0 (linux/amd64, linux/arm64), signed. Every file is signed (*.sigstore.json), with SLSA provenance and an SPDX SBOM. Verify: docs/releases.md.

---

This discussion was created from the release Reality Kernel 0.2.0.