v0.4.1

What's Changed

• ci(release): keep each image's digest pattern from matching other images by @adefemi171 in #100
• chore(release): 0.4.1 by @adefemi171 in #101

Full Changelog: v0.4.0...v0.4.1

v0.4.0

Warning

Use v0.4.1 instead. This release is missing the multi-arch images ghcr.io/runeeward/runeward:v0.4.0 (the Helm chart's default server image) and ghcr.io/runeeward/runeward-ide:v0.4.0. The Python and npm SDKs were not published for 0.4.0. The binaries, signed checksums and other images below are fine.

What's Changed

• docs: remove internal release and comparison pages by @adefemi171 in #28
• feat: add governed agent sessions and live demo by @adefemi171 in #33
• fix(security): bump Go to 1.26.6 and clear code scanning alerts by @adefemi171 in #34
• fix(security): restore IDE scans and apply Dependabot updates by @adefemi171 in #37
• fix: remediate security alerts and improve dashboard UX by @adefemi171 in #46
• fix(security): harden dependencies and CI supply chain by @adefemi171 in #50
• fix(security): consolidate dependency and supply-chain updates by @adefemi171 in #56
• chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates by @dependabot[bot] in #57
• feat: port Rune Box to Rust by @adefemi171 in #65
• fix(security): distrusted emSign intermediates and follow-redirects by @adefemi171 in #78
• fix(isolation): refuse krun, flag non-persistent kata-fc workspaces, fail fast on Kubernetes by @adefemi171 in #77
• feat(k8s): persistent kata-fc workspaces with a bundled direct-volume driver by @adefemi171 in #80
• ci: run the Python SDK tests on Ubuntu 24.04 by @adefemi171 in #87
• feat(k8s): run the in-sandbox supervisor on Kubernetes by @adefemi171 in #83
• feat(egress): enforce endpoint binaries with in-sandbox attribution by @adefemi171 in #86
• feat(secrets): resolve 1Password op:// references by @adefemi171 in #84
• feat(policy): admit child Charters proven no broader than the parent's by @adefemi171 in #85
• fix(secrets): retry the 1Password CLI spawn while its binary is busy by @adefemi171 in #90
• docs: align the docs with the CLI, schema and server by @adefemi171 in #89
• feat(microvm): native Firecracker and libkrun sandbox hosts by @adefemi171 in #88
• fix(backend): drain streamed export archives and stop the docker_golden flake by @adefemi171 in #92
• fix(authz): verify OIDC RS256 signatures with ring and drop jsonwebtoken by @adefemi171 in #91
• fix(k8s): record egress sidecar decisions and verify endpoint binaries on Kubernetes by @adefemi171 in #93
• docs(security-model): Kubernetes sidecar decisions are Chronicled by @adefemi171 in #94
• docs: change the tagline to "roam freely but with receipts" by @adefemi171 in #97
• docs: replace the banner with an animated Rune Box banner by @adefemi171 in #98
• docs: redraw the governance flow diagram in the Rune Box style, animated by @adefemi171 in #99

Full Changelog: v0.3.0...v0.4.0

v0.3.0

Changelog

• 473015c: Ci/sdk publish retry clean (#24) (@adefemi171)
• ac9cd87: fix: make SDK publishing retry-safe (#23) (@adefemi171)
• f66a404: fix: publish SDK retries from release tags (#25) (@adefemi171)
• ef8e841: fix: publish SDK retries from release tags (#26) (@adefemi171)

v0.3.0-rc.2

Changelog

• 63c3803: Release/v0.3.0 rc.2 hardening (#18) (@adefemi171)
• 648b86c: Security/root scoped archive extraction (#19) (@adefemi171)
• 1ae1bb4: Security/root scoped archive extraction (#20) (@adefemi171)
• e4a4423: chore(deps): bump actions/setup-go from 6 to 7 (#13) (@dependabot[bot])
• 99f953a: chore(deps): bump actions/setup-python from 6 to 7 (#14) (@dependabot[bot])
• 73e054c: chore(deps): bump alpine in /deploy in the docker-minor-patch group (#11) (@dependabot[bot])
• df9a40d: chore(deps): bump github.com/open-policy-agent/opa (#15) (@dependabot[bot])
• 9e841f4: chore(deps): bump github/codeql-action in the actions-minor-patch group (#12) (@dependabot[bot])
• df30bfe: feat: prepare Runeward v0.3.0 release candidate (#16) (@adefemi171)
• 40f7984: fix: harden loopback IDE session cookie (#21) (@adefemi171)
• 7302598: fix: resolve security scanning alerts (#22) (@adefemi171)
• 9b0f3d0: fix: tighten RBAC capability honesty and charter scoping (@adefemi171)
• fbb50cf: v0.3.0 rc (#17) (@adefemi171)

v0.2.1

Changelog

• 2beb00b: fix: enforce configured Trivy severities (@adefemi171)
• c26efe5: fix: harden runtime images and security findings (@adefemi171)

v0.2.0

Changelog

• e837ee5: Update Go version from 1.26.0 to 1.26.2 (@adefemi171)
• 2790b59: Update Go version in CI workflow to 1.26.0 (@adefemi171)
• cd6bd55: Update Go version in CI workflow to 1.26.2 (@adefemi171)
• 06d0846: Update Go version in CodeQL workflow (@adefemi171)
• e3f0d66: Update Go version to 1.26.0 in CodeQL workflow (@adefemi171)
• d2e4862: Update Go version to 1.26.0 in workflows (@adefemi171)
• 1bae259: Update Go version to 1.26.2 in DAST workflow (@adefemi171)
• d543a1d: Update Go version to 1.26.2 in workflows (@adefemi171)
• 14791d8: Update ci.yml (@adefemi171)
• 422e796: Update codeql.yml (@adefemi171)
• 9cfa18a: Update dast.yml (@adefemi171)
• 35904c2: Update go.mod (@adefemi171)
• 959c556: Update security.yml (@adefemi171)
• b5f2357: chore(deps): bump actions/upload-artifact from 4 to 7 (@dependabot[bot])
• a28fc33: chore(deps): bump golang (@dependabot[bot])
• cf69265: chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (@dependabot[bot])
• b383133: chore(deps): bump the go-minor-patch group across 1 directory with 9 updates (@dependabot[bot])
• c07a13b: feat: prepare v0.2.0 governance harness release (@adefemi171)
• 14f6ece: fix(deps): sync go.sum for google.golang.org/grpc v1.82.1 (@adefemi171)
• 159f5ba: refactor: rename public surface to Dune-governance vocabulary (Runeward retained) (@adefemi171)

v0.1.4

Changelog

• 8636473: Bump GitHub Actions to latest majors (silence Node 20 deprecation) (@adefemi171)
• c599b77: chore(mcp): make runeward publishable to the MCP registry (@adefemi171)
• c3f6acb: ci: fix release (cosign v3), security (gosec/govulncheck), and docs builds (@adefemi171)
• 159d068: feat(docker): wire host.runtime_class to --runtime for VM-grade isolation (@adefemi171)
• 33bdc09: feat: hardening, governance, observability, adapters; move to Runewardd org (@adefemi171)

v0.1.3

Changelog

• 5802146: Add observability, telemetry, cosign signing, and speed up image builds (@adefemi171)

v0.1.2

Changelog

• 5ca2447: Enable Material icon/emoji extension so :material-*: shortcodes render (@adefemi171)

v0.1.1

Changelog

• 79be15d: Add Homebrew tap release step and MkDocs documentation site (@adefemi171)
• c2aa9a2: Add OSS product scaffolding: license, community files, goreleaser release pipeline (@adefemi171)
• 7aa381f: Fix goreleaser dirty-state failure by using a separate dist dir (@adefemi171)