v0.4.0

Warning

Use v0.4.1 instead. This release is missing the multi-arch images ghcr.io/runeeward/runeward:v0.4.0 (the Helm chart's default server image) and ghcr.io/runeeward/runeward-ide:v0.4.0. The Python and npm SDKs were not published for 0.4.0. The binaries, signed checksums and other images below are fine.

What's Changed

• docs: remove internal release and comparison pages by @adefemi171 in #28
• feat: add governed agent sessions and live demo by @adefemi171 in #33
• fix(security): bump Go to 1.26.6 and clear code scanning alerts by @adefemi171 in #34
• fix(security): restore IDE scans and apply Dependabot updates by @adefemi171 in #37
• fix: remediate security alerts and improve dashboard UX by @adefemi171 in #46
• fix(security): harden dependencies and CI supply chain by @adefemi171 in #50
• fix(security): consolidate dependency and supply-chain updates by @adefemi171 in #56
• chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #57
• feat: port Rune Box to Rust by @adefemi171 in #65
• fix(security): distrusted emSign intermediates and follow-redirects by @adefemi171 in #78
• fix(isolation): refuse krun, flag non-persistent kata-fc workspaces, fail fast on Kubernetes by @adefemi171 in #77
• feat(k8s): persistent kata-fc workspaces with a bundled direct-volume driver by @adefemi171 in #80
• ci: run the Python SDK tests on Ubuntu 24.04 by @adefemi171 in #87
• feat(k8s): run the in-sandbox supervisor on Kubernetes by @adefemi171 in #83
• feat(egress): enforce endpoint binaries with in-sandbox attribution by @adefemi171 in #86
• feat(secrets): resolve 1Password op:// references by @adefemi171 in #84
• feat(policy): admit child Charters proven no broader than the parent's by @adefemi171 in #85
• fix(secrets): retry the 1Password CLI spawn while its binary is busy by @adefemi171 in #90
• docs: align the docs with the CLI, schema and server by @adefemi171 in #89
• feat(microvm): native Firecracker and libkrun sandbox hosts by @adefemi171 in #88
• fix(backend): drain streamed export archives and stop the docker_golden flake by @adefemi171 in #92
• fix(authz): verify OIDC RS256 signatures with ring and drop jsonwebtoken by @adefemi171 in #91
• fix(k8s): record egress sidecar decisions and verify endpoint binaries on Kubernetes by @adefemi171 in #93
• docs(security-model): Kubernetes sidecar decisions are Chronicled by @adefemi171 in #94
• docs: change the tagline to "roam freely but with receipts" by @adefemi171 in #97
• docs: replace the banner with an animated Rune Box banner by @adefemi171 in #98
• docs: redraw the governance flow diagram in the Rune Box style, animated by @adefemi171 in #99

Full Changelog: v0.3.0...v0.4.0