Skip to content

Walter-OS v0.6.1

Choose a tag to compare

View all tags
@f0x1777 f0x1777 released this 07 Jun 13:42
· 70 commits to main since this release
v0.6.1
f044a9a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Walter-OS v0.6.1 Release Notes

Date: 2026-06-07
Status: Alpha patch release

v0.6.1 is a post-v0.6 operational hardening release. It does not change the
v1.0 stability promise. It tightens release hygiene, documents the current
security follow-ups, and makes AI-provider selection easier for operators who
do not have every supported model/tool account.

Highlights

  • Audit-chain follow-ups: signed rows, cross-day close/verify flows, Loki
    verification, and optional Sigstore Rekor anchoring for daily roots.
  • Provider selection: walter providers configure --category llm now supports
    direct Gemini alongside LiteLLM, Anthropic/Claude, OpenAI/Codex/GPT, and
    Ollama/local.
  • AI-stack resilience: the release documents that Claude and Codex are
    supported agent surfaces, not mandatory dependencies, and ships the AI-stack
    watchdog through the Walter-VM alerting Ansible role.
  • Security tracking: GitHub code-scanning alerts were grouped into follow-up
    issues #390 through #396 and dispositioned before the final v0.6.1 cut.
    Some Scorecard alerts remain visible until GitHub settings, repository age,
    or external OpenSSF processes catch up.
  • Capability-token hygiene: the daily audit now checks session capability
    state for malformed JSON, stale token directories, missing material, and
    unsafe key/token permissions.

Upgrade

Preview first:

walter-os upgrade --dry-run

Upgrade the local install:

walter-os upgrade --target v0.6.1

For a Walter-VM host, keep service rollouts explicit:

walter-os upgrade --all --snapshot --yes
walter-os upgrade --all --service n8n

Do not restart or migrate every Docker service automatically. Name each service
that should roll forward.

Provider Selection

Run the LLM provider wizard after upgrading:

walter providers configure --category llm

Current LLM slugs:

  • litellm: self-hosted gateway that can proxy multiple vendors.
  • anthropic: direct Anthropic/Claude account.
  • openai: direct OpenAI/Codex/GPT account.
  • gemini: direct Gemini account.
  • ollama: local inference for security, compliance, or offline workflows.

The wizard writes provider choices to ~/.config/walter-os/providers.yaml and
activates matching private env vars. Secrets stay outside the repository.

Final Hardening Included

The final v0.6.1 cut also includes these post-release-candidate hardening
slices:

  • walter doctor now treats Infisical machine identity as the preferred clean
    install secrets runtime while preserving legacy secrets.env migration
    warnings, mode-0600 checks, and exported key syntax.
  • The Walter-VM alerting Ansible role now deploys ai-stack-watchdog.sh.
  • The daily supply-chain audit now validates capability-token runtime state and
    documents operator recovery in docs/operational/capability-tokens.md.

Still Open

These issues remain intentionally open after v0.6.1:

  • #122: broader audit/supply-chain hardening epic still has remaining slices.
  • #123, #225, #235, #342, #363: product and operations follow-ups that are not
    required to cut this patch release.
Assets 7
Loading