v0.1.2

[0.1.2] 2026-11-08

Documentation

• Vertical layered architecture diagram
• Horizontal layered architecture diagram
• Compact horizontal architecture diagram
• Recorded terminal demo of a real run, with its vhs tape
• Remove authorship statements from docs and scripts
• Recorded demos of more commands, with their vhs tapes (#2)
• Recorded demos of the HTTP service and more commands (#3)
• Complete citation metadata and bump it on release (#5)
• Add a threat model mapped to OWASP Agentic 2026, OWASP LLM 2026 and MITRE ATLAS v2026.10 (#7)
• Add standards keywords to the citation metadata (#8)

Build and CI

• Build release archives for Linux and macOS on arm64 and amd64 (#1)

Maintenance

• Add release automation, AGENTS.md, llms.txt and contributor docs
• Classify squash merges in the changelog by the commits they contain
• Latest toolchain and CI versions (#4)
• Release script keeps hard-coded version strings in step (#6)

v0.1.1

Bug fix: output captured before a stream reached end of file is now kept. Previously, if end of file arrived after the drain grace period (for example on a slow machine after the process group was killed), already captured output was discarded. The timeout and output-limit behaviors are now tested separately.

v0.1.0

First release of a policy-based sandbox for running AI agent tool calls.

Highlights

• Declarative policies: executable allowlists with argument patterns, filesystem roots with path canonicalization against ../ and symlink escapes, environment allowlists, and resource limits (timeout, CPU, memory, output size, processes)
• Allow or deny decisions with the matching rule and reason, dry-run mode, and a hash-chained audit log whose tampering is detectable
• An adversarial test suite of known agent misbehavior that must be denied or contained
• CLI, Rust library, and a JSON-over-stdio mode for agents written in other languages

A macOS arm64 binary is attached. On other platforms, build from source with cargo or install with Homebrew, which builds from source.