Skip to content

v0.18.0 — trust hardening (batch 2)

Choose a tag to compare

View all tags
@elkaix elkaix released this 17 Jul 19:30
v0.18.0
7ae7841

Second trust-hardening release from the post-0.17.0 dogfood scouting pass (Codex GPT-5.6 Sol). Every fix was driven through the delegate/delegatePipeline MCP lifecycle and independently verified; cross-platform CI is green on macOS, Linux, and Windows.

Highlights

  • Pipeline trust: fixer commit-provenance validation, final verification routed through the AcceptanceVerifier (archived logs, zero-executed rejection), and OS-confined non-Codex fixers that fail closed without a usable sandbox.
  • Protocol 1.1.0: strict-literal protocolVersion, closed schemas, schema-encoded timeout floor, manifest write-validation, provenance-only archived runtimeVersion, SHA-256 (64-hex) OIDs, and per-command expectBaselineFailure.
  • Isolation & git hardening: timeout --kill-after process-tree kills, a Codex flag denylist, and runtime git insulated from host/local/worktree config, hooks, fsmonitor, attributes, and content filters.
  • Leak & durability: redacted pipeline artifacts and doctor output, and crash-recoverable baseline/verify worktrees.
  • Verifier trust: gitlink (160000) rejection, nested-repo forbiddenScope enforcement, broader secret discovery, skip-worktree mutation detection, WSL fail-closed, and probe/routing robustness.

See CHANGELOG.md for the full list and known limitations (deferred reproducibility-provenance and write-confinement redesigns).

Assets 2
Loading