Skip to content

v1.8.4

Latest
Latest

Choose a tag to compare

View all tags
@eriknewton eriknewton released this 06 Sep 07:08
· 9 commits to main since this release
v1.8.4
2596a2c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.8.4 (2026-09-05)

v1.8.3 was tagged but never published. v1.8.4 supersedes it, carries every v1.8.3 change listed below, and adds one custody fix.

What changed

Fixed

  • The machine-local passphrase fallback file now survives a change in the host's resolved hostname (for example .local versus .localdomain after a reboot); a file written under an earlier derivation keeps opening, and is migrated on the first read by a caller that is allowed to write and whose re-wrap succeeds. Read-only callers read the value and leave the file as it is.

Carried from v1.8.3 (unpublished)

v1.8.2 was tagged but never published. v1.8.3 supersedes it, carries every v1.8.2 change listed below, and adds one release-process fix.

Release process

  • Release coverage checks credit each fixture to the assurance row it proves. The fixtures behind the release coverage report now name their correct Assurance Matrix rows, fixture registration refuses two different claims under one row number, and the ordinary test suite checks that every proven row has a passing fixture. Product runtime, fixture bodies and assurance claims are unchanged.

Carried from v1.8.2 (unpublished)

  • Local concierge responses use a longer generation window and complete after their outcome is recorded.
  • Local-intelligence setup shows signed model-manifest verification before consent and download. The operator can see which manifest was verified before approving the model pull.

Setup and shutdown fixes

  • Headless init and Protect stage recovery material outside the fortress and show only its location.
  • A failed Castle Wall daemon start no longer implies that an existing wall is unarmed.
  • Idle MCP sessions close their own listeners when the harness disconnects or requests shutdown.
  • A briefly indeterminate custody-lock owner is checked again within the existing timeout; uncertain ownership still refuses access.

Capability bounds

Ollama is installed by the operator. Light assurance compares the runtime-reported model digest with the signed manifest at the documented checkpoints. Automatic discovery of newer signed manifests is unavailable.

Assets 5
Loading