v3.0.0

Breaking changes and upgrade

• sekai-chisei workers authenticate as registered service principals: the
  new governance.client_secret_env names the env var holding the client
  secret, which the adapter exchanges for short-lived service tokens and
  refreshes before expiry. The static bearer is removed: governance.token_env
  with sekai-chisei fails at startup (it remains the host token for
  http-callback / host-authz). A refused credential exchange fails closed.
  Requires a plane with the service-principal token call. See
  service-principal tokens.

• Plane intake authenticates every call for claimed work (heartbeat,
  acknowledgement, claim events) with the claim's short-lived runtime token
  instead of the governance.token_env bearer, and uses each refreshed token
  from heartbeats. A claim without a runtime token is refused and serve
  exits; an expired token is fence loss. Upgrade the plane to one that issues
  runtime tokens (assertion signing key configured) and give the worker a
  tenant-scoped credential. token_env remains the credential for listing,
  claiming, and governed execution. The sekai-client pin moves to the
  release that carries the token fields. See
  runtime tokens for claimed work.

• PlaneClaimLease gains a runtime_token: RuntimeToken field; hosts that
  build leases (for example test fakes) construct it with
  RuntimeToken::from_grant.

• Remote governance adapters (sekai-chisei, http-callback, host-authz)
  now fail closed by default: doctor, run, and serve refuse when
  governance is unreachable or refuses, whatever governance.fail_closed
  says. The governed Bash sandbox and egress rule applies to them too.

• governance.namespace no longer defaults to "default". A remote
  governance adapter without an explicit namespace fails at startup. Set
  namespace in [governance] or the new SHIKIGAMI_GOVERNANCE_NAMESPACE;
  use "default" to keep the old value. See
  upgrading remote-governance configs.

Security

• [tools.mcp_gateway] (off by default) routes every remote MCP tool call
  through one governed gateway, authenticated per request with the run's live
  job credential. Direct HTTP tools.mcp_servers entries are refused while it
  is set, and third-party tool credentials stay in the gateway (#458).

• Sandboxed tool children receive only a live job-scoped token
  (SHIKIGAMI_JOB_TOKEN, plus tenant/namespace when present) minted for the
  claimed work. The worker client secret, plane bearer, model keys, and MCP
  tokens stay in the harness process: they are stripped from the reconstructed
  child environment, and leftover SHIKIGAMI_JOB_* parent exports cannot
  impersonate a grant. Expired grants are not injected. A heartbeat that
  refreshes the claim token updates the grant seen by later child spawns (#442).

• sandbox.tool_sockets ships (deny default, host grant). linux_native
  children cannot open host sockets unless the job/operator sets host;
  doctor reports the effective mode. [network].egress remains harness HTTP
  only (#442, ADR 0013).

• examples/red-team.toml and the red-team skill pack: a read-only run that
  reads RPC surface diffs and past security bug reports and emits
  sekai.probe-spec/v1 probe specs in its final report. It has no network,
  exec or RPC tool, refused tool attempts are journaled, and a run that
  exhausts its budget ends blocked with no specs (docs/red-team.md, #466).

• A shikigami.toml in the current working directory is no longer loaded
  implicitly, so a cloned repository cannot run its hooks or relax governance,
  sandbox, or egress settings. The CLI prints a note when one is present; pass
  --config shikigami.toml to use it. --config, SHIKIGAMI_CONFIG, and the
  state-root config are unchanged.

• Dependency patches: quinn-proto 0.11.18, rustls 0.23.46, and the
  rustls-webpki / webpki-roots / ctutils advisories (#453, #456, #477).

Added

• Fail-closed site-agent profile: requires tools.mcp_gateway, refuses
  direct MCP servers, and allows only gateway tools, report, and escalate
  (#489). Agent-turn claims run as the instance principal (#491).
• security-finder profile: specialised read-only reviewer roles that emit
  typed findings (pkg:security.finding-exposure/v1) (#492).
• security-triage profile: site-agent overlay that turns findings into
  exposure verdicts (pkg:security.exposure-verdict/v1) (#493).

Changed

• OS sandbox enforcement moves to a pinned kekkai
  v0.1.0 dependency. Settings names, CLI, and doctor output are unchanged
  (no behavior change).

• TUI reports working, permission requests, completion, errors, and idle via
  OSC 7501 so supporting terminals can surface agent status.

• CLI default --state is the platform user-state directory keyed by cwd
  (XDG_STATE_HOME/shikigami/<encoded-cwd> when set; otherwise macOS
  Application Support, Windows %LOCALAPPDATA%, Unix ~/.local/state).
  tui / acp no longer need --state to keep harness files outside the
  inplace workspace. --state / SHIKIGAMI_STATE still win. Embedders keep
  StateRoot::default_in for cwd-local scratch. Project-local trees remain
  available as --state ./.shikigami-state. Existing .shikigami-state
  directories are not migrated: without --state, the CLI stops with an
  error naming both directories instead of silently ignoring one, so pass
  --state ./.shikigami-state or move its contents and remove it. New state
  directories are created mode 0700 on Unix.

v2.0.0

Release v2.0.0

v1.1.1

Release Shikigami 1.1.1

v1.1.0

Release Shikigami 1.1.0

v1.0.7

Release Shikigami 1.0.7

v1.0.6

Release Shikigami 1.0.6

v1.0.5

Release v1.0.5

v1.0.4

v1.0.4

v1.0.3

v1.0.3: http-callback host-authz governance

v1.0.2

v1.0.2: run --task-file for private host prompts