v0.7.0

Two of the three headline blockers an enterprise adopter reported against 0.6.6 are
fixed here — both were already built when the report arrived. An operator can trust a
TLS-inspecting proxy's root CA (WARDYN_TRUSTED_CA_FILE): the daemon, the proxy
sidecar and every sandbox pick it up. And an operator can declare internal hostnames —
an in-cluster service, a corporate registry — allowed to resolve to private/CGNAT
addresses (SiteConfig.internal_hosts), so an internal service is reachable by name
instead of only by a literal IP. Everyone signs in once after upgrading: cookies
issued by an older daemon are re-derived rather than accepted. The rest of 0.7 is
assignable governance profiles, a security-admin tier, user drives, and never-resident
git PATs.

Highlights

• Governance profiles — a named policy ceiling an admin can ASSIGN to a person, to an SSO group, or to everyone, so a contractor group and a platform team can hold genuinely different limits on one install. A profile REPLACES the site-wide default rather than composing with it. - A security-admin role, and a console that can be delegated to it — the second admin tier governs the verdict (profiles, permissions, egress decisions, token inventory, audit verification) and deliberately does NOT reach into a run. - A governance profile can cap how many runs one person has going at once, and self-service secrets gain the per-owner cap the sibling surfaces already had. - An admin can fence which agents and which model providers a member may name on their own run, as two more permission kinds on the existing Permissions page. - User drives — an admin registers persistent storage and allocates it to people, groups or everyone; a member mounts theirs per run at /home/agent/drive, read-only unless allowed, and the server resolves which drive belongs to the signed-in caller. Registering a drive on a host path is fenced by WARDYN_USER_DRIVE_HOST_ROOTS, unset and therefore closed by default. - Git PATs for non-GitHub forges are never resident — agent-run rewrites a granted host to a plain-HTTP broker path, the proxy mints server-side and injects Basic auth itself, and the grant ids are withheld from the sandbox env. WARDYN_GIT_PAT_BROKER=off restores the old lane; there is deliberately no automatic fallback. - The lane is on by default and, until this release candidate, was not actually running: "the switch resolved into a setting nothing read, and the lane was carried by an internal per-launch flag no launch path ever set". - An operator can trust a corporate TLS-inspecting proxy's root CA (WARDYN_TRUSTED_CA_FILE), delivered on compose, the desktop profile and the Helm chart. - An operator can declare internal hostnames allowed to resolve to private/CGNAT addresses (SiteConfig.internal_hosts), and can tell a corporate proxy which destinations to skip (upstream_proxy_no_proxy). - Bedrock can be reached through a VPC (PrivateLink) endpoint (WARDYN_BEDROCK_BASE_URL), with full model ARNs documented as accepted identifiers. - An operator can point the API-key model-access lane at an internal gateway (WARDYN_ANTHROPIC_BASE_URL / WARDYN_OPENAI_BASE_URL). - A member can bring their own model API key and set and remove their own secrets — it works in their own runs with no admin setup and is never reachable from anyone else's run. - The People step becomes an acting surface: an admin adds, edits and deletes WARDYN_OIDC_ROLE_MAP role mappings live from the console, guarded by a posture-flip acknowledgement and a lockout refusal. - Console tool_rules: a per-tool allow / hold / deny editor in the policy panel, a "What this run can do" line on the New run rail, and audit rows that read Decided by rule with the verbatim rule_source. - A blocked egress request now says WHICH rule blocked it — X-Wardyn-Egress-Reason carries the decision log's own rule source (policy:default-deny, approval:denied, builtin:private-ip, …). - Wardyn reports whether the Kubernetes NetworkPolicy that isolates sandboxes is actually enforced (/healthz's network_policy field, plus a boot-time audit event on an unenforced-but-allowed cluster). - Helm image.digest — the blessed Kubernetes path no longer has to float on a mutable tag. - External clients can drive a sandbox over the SSH gateway: wardyn ssh-key ensure|list, wardyn run wait-ready <id> --json, wardyn ssh <id> --json, plus the per-run git_push_any_branch opt-out. - A browser desktop (noVNC) is a shipped image variant (deploy/images/novnc/, make agent-image-novnc) — local build only, and it changed no server code. - A fresh install remembers being set up server-side (POST /setup/onboarding-complete), so a different browser — or a different admin — lands past the funnel too. - threatmodel/AGENT-THREAT-MODEL.md — a portable threat model for agent systems generally, carrying twice as many non-mitigated verdicts as mitigated ones.

---

The full 0.7.0 section — the hardening pass with its per-round counts and sources, every contract and compatibility change, the migrations 0050–0061, and the known residuals — is in CHANGELOG.md. Verify the artifacts with docs/VERIFY.md.

Demo videos: six episodes re-recorded on 0.7 ship below (01, 02, 03a, 03b, 03d, 05); the rest of the series is being re-recorded and is added to this release as each take passes.