Colonizer v0.2.21

Colonizer v0.2.21

What's new

• Exec-policy loop detection parks the colony and frees its slot, with guidance for the operator. Three refusals by the same exec-policy rule within 10 minutes now park the colony as exec_policy_loop, freeing its microVM slot and showing "Blocked by exec policy" instead of falsely flagging a control breach. When a rule denies, the agent is told what to do instead (for script-egress: use a network-free path, leave fetching to CI, or ask the operator). A repo can allow pinned fetch scripts past script-egress with a fetches entry in .colonizer/exec-policy.json (script, sources, hosts, verify: "sha256"), honoured only when every URL names a listed host, the script checks sha256, and the policy file matches the base commit. (#1378)
• Quota-parked colonies resume when alternatives become available. When a provider runs out of quota and colonies park waiting for its recovery, colonies now also resume if changing the model settings (e.g., model_low) routes them to a healthier provider, or if that provider recovers. The resume sweep re-evaluates routes every tick; colonies that were stranded with stale models now resume automatically instead of waiting for the original provider's reset (#1403).
• Colonies run Claude Code 2.1.304 and a re-pinned Go image. The Claude Code pin in
• The vulnerability check passes again: the websocket relay dial trusts the operating system's certificate roots. The cargo audit job failed every pull request on three RustSec advisories against the bundled root store (RUSTSEC-2026-0381, 0382 and 0383). rustls-webpki moves to 0.103.16, and webpki-roots / webpki-root-certs to 1.0.10. The 0.26 line has no fixed release, so the wss:// relay dial now uses the operating system's root store (rustls-tls-native-roots) instead of the bundled Mozilla roots. No advisory is ignored. (#1484)
• Auto mode: a team member approves an outside issue, and PromptDecode scans every issue before it queues. An issue from someone outside the org now waits in review until a trusted person adds the colonize-approved label or comments /colonize. Colonizer checks that person's permission through the API, ignores the same label from anyone else, and drops the approval when an outsider edits the issue afterwards. Every issue's title, body and trusted comments are scanned for hidden text before it queues. A finding holds the issue for review with the decoded text shown, and a trusted approval lets it proceed with the text marked as untrusted data in the brief. The scan is required on public repositories and can be turned off per org only for private ones (auto_colonize_require_scan). The approver and the scan result show in the issue list, and each decision is in the activity log. (#1485)
• The cockpit has a Brain view: your Living Brain as a 3D map, with each running colony drawn as an ant walking over it. A new Brain page (/brain) draws the team brain's graph in 3D, turned by drag, zoom or pinch, and places each running, queued or parked colony as an ant on the node its repository matches. The mothership reads the brain's map once a minute and shares only its structure: node kinds, degrees and links, with labels shown locally or replaced by keyed hashes in structure-only mode (always on over remote access). The brain's token stays in the mothership's secret store, and the map route is rate-limited and refuses a foreign Origin. Nothing is fetched from a CDN.

Prebuilt Colonizer for Linux x86_64 (with KVM) and Apple Silicon Macs, built from 14d441d.

curl -fsSL https://colonizer.dev/install.sh | sh

The installer checks the archive against SHA256SUMS. It fetches the Claude Agent SDK from the npm registry, and on a Mac the Linux build of Claude Code, from Anthropic's own channels: neither is in the release. Guide: https://colonizer.dev/docs/install

Each artifact, SHA256SUMS included, also carries a build-provenance attestation recording the commit that built it. Verify one with:

gh attestation verify colonizer-<platform>.tar.gz --repo Colonizer-dev/harness

Here is linux-x86_64 or darwin-arm64.

The observability add-on rides along as colonizer-observability-.tar.gz for the same platforms; the installer puts it beside the colonizer binary, and the checksums and the attestation above cover it too.

Apple Silicon Macs can also use Colonizer-arm64.dmg: an unsigned app, so macOS asks you to approve it once (System Settings > Privacy & Security > Open Anyway). The curl installer above is the recommended path.

ad551ac6574e62baab0a1ba7fce7da5b3c78ab0845b8d55741880d252bda2135  colonizer-darwin-arm64.tar.gz
7209d5203322e0ea9fb98264d4cda116285f5e3d3c6b5bd0e2bf696151603577  colonizer-linux-x86_64.tar.gz
162ee043c635ea9b95839716a65f03843c85faae848ff2519e9610cfbb7c68be  colonizer-observability-darwin-arm64.tar.gz
373d6ba36fdd7ef64a05e5bb73cdf0062e7f69ede73461e95efadf14d79eb59f  colonizer-observability-linux-x86_64.tar.gz
99be32042559b4c19d9969a95bedef3b376ee63caec424d833682063195beb78  Colonizer-arm64.dmg
a65be2043bbd94aa8d5e1e122113ae3d3945120bf4b2771fc300298a06e60f4e  install.sh