stack-single 1.3.0

stack-single 1.3.0

This is a minor release, not a patch. The default credential changes: agent tokens are required, a static client key is admitted only when its id is named on a list, and vouchryx starts on every box. A re-run keeps the static keys a box already had, so an agent that worked before keeps working until it moves to a token. The release also pins tokenfuse v1.19.0 and four other components to their 2026-10-19 releases.

Upgrade first

1. Re-run ./install.sh on every existing box, once. Until that re-run, a box keeps its current compose file, images and .env. The re-run writes the new pins, turns agent tokens on, starts vouchryx and prints the static-key list described in item 2.

2. Agents with static keys keep working through the re-run, and should move to tokens. The installer keeps every static key id the box already had. The closing report prints them under "static keys still admitted; move these agents to tokens", so that list is the set of agents to move. A fresh box lists felyx and broker, the two clients that cannot sign a proof. Moving an agent to a token takes it off the list. Today one agent per box can be enrolled for a token (agent://<RECORD_TRUST_DOMAIN>/agents/operator, its secret in $STACK_DIR/agent-token.key), because vouchryx reads its registry from one variable. Other agents stay on the list until that changes.

3. A new static key needs STATIC_KEY_IDS. Name its key id in STATIC_KEY_IDS (comma-separated). Without the name its calls are refused 401 agent_token_required. The installer refuses a name that is not one of the box's own keys. A box given its own CLIENT_KEYS_FILE must also add a broker:<secret> line, bound in its identity map, or run with WITH_AGENT_TOKENS=0. Without one of those the installer refuses before it installs anything.

4. WITH_AGENT_TOKENS=0 is the weaker way back. It writes TOKENFUSE_AGENT_TOKENS=off, clears both static-key lists and leaves every file in place. The closing report calls it the weaker setting, because static keys are then the only credential. Use it to step back, then move the agents to tokens.

5. vouchryx runs by default. With agent tokens on, the installer starts vouchryx, enrols the operator agent and writes its enrolment secret to $STACK_DIR/agent-token.key (mode 0600). The secret is never printed and never written to .env. vouchryx publishes no port. A box that does not want it runs WITH_AGENT_TOKENS=0.

6. The tokenfuse-cloud state rewrite is one-way. tokenfuse v1.19.0 keeps paired-device tokens as digests. The first save after the upgrade rewrites the device map, and a v1.18.0 control plane cannot authenticate devices from the new state file. To roll back, pair each device again. A device request signed before the restart, or in the same second as it, is refused once, and the device retries with a fresh timestamp.

7. The costcrew console runs with -insecure-http. costcrew 0.10.0 refuses a non-loopback listener unless it has -behind-tls or -insecure-http. The console stays published on 127.0.0.1:8321 only, so reach it through an SSH tunnel to that port.

8. The governed profile in tokenfuse v1.19.0 changes nothing on this box. The gateway and the MCP broker default to the governed profile, which sets defaults for every variable left unset. This launcher writes each of those variables in compose.yaml, so the profile changes no behaviour here. A gateway run by hand from the image, outside this launcher, takes the governed defaults unless it sets TOKENFUSE_PROFILE=observe.

9. The broker's key file changes owner. $STACK_DIR/broker/key is now owned by uid 20012 (group 10001), mode 0400, the broker's own uid. The installer makes the change, so nothing is needed by hand.

Breaking

• Static client keys are no longer admitted by default. A static key is refused 401 agent_token_required unless its id is on the list. Migration: items 2 and 3.
• vouchryx starts on a default box. Migration: item 5, or WITH_AGENT_TOKENS=0.
• The tokenfuse-cloud device state is rewritten one way. Migration: item 6.

What is new, by PR

• #142, no credential on any argument list. Closes the exposure of credentials in a process's argument list during install, in the health checks that prove a key is accepted, and in the console clone URL. Each check request now goes to a throwaway container on stdin. The console clone gives git its token through a credential helper that reads it from the environment of that one command, so the clone's .git holds no token. The shell lint refuses a function named after a common developer command. Adds invariant 46, gate scripts/no-secret-on-argv.sh and features/no-secret-on-argv.feature. Not breaking.
• #143, agent tokens required by default. Covers a named static-key list and wardryx verifying tokens.
  • Agent tokens are on unless WITH_AGENT_TOKENS=0. The gateway and the MCP broker run TOKENFUSE_AGENT_TOKENS=require. The installer writes the static-key lists and prints them in the closing report (items 2 to 4).
  • wardryx v2.3.0 verifies the agent's token and its DPoP proof itself, against the issuer, audience, key set and revocation list the installer writes.
  • Pins: tokenfuse v1.19.0 (gateway, OpenAI door, MCP broker and control plane), wardryx v2.3.0, idryx v1.3.0, costcrew v0.10.0 and trailryx-node v1.4.0, each by tag and digest.
  • The costcrew console runs with -insecure-http (item 7). The broker's key file changes owner (item 9).
  • Invariant 47 added, invariants 14, 15 and 40 amended. scripts/agent-tokens-are-wired.sh extended. 256 scenarios across 28 feature files, each bound to a test.

Not proven

• The install legs on a fresh Ubuntu runner (.github/workflows/install.yml): cosign verification of the new digests, the agent-token exchange at the doors, the 401 body and the door origins. CI runs them on the release pull request.
• A box installed before this release and then re-run. The static-key lists, the new pins and the control-plane state rewrite have not been measured on an installed box.
• The tokenfuse-cloud digest rewrite and the re-pairing on rollback, as tokenfuse measured them. Not measured on this box.
• Trailryx 1.4.0 sealing typryx's four event types on the record plane. Not measured for this release.
• One enrolled agent per box is the only supported shape, and a real agent framework calling the doors with its own token was not measured.
• The costcrew console reached through an SSH tunnel.