microagent v0.10.0

The bounded-and-mediated release: every new workspace carries default limits on idle lifetime, egress volume, and host concurrency; broker endpoints require an explicit assurance mode, with semantic validating each request against a typed operation grant before it reaches the upstream service; quarantine freezes and severs a guest's authority before it captures evidence; and egress dropped at the datapath is recorded instead of vanishing. Alongside those, linux-kvm cold boot drops from roughly 1,200 ms to 460 ms and snapshot restore stops panicking the guest.

Breaking: broker endpoint declarations must name an assurance mode, semantic (which also requires a grant file) or trusted-upstream; newly created workspaces are bounded by default — a 7-day idle TTL, 50 GiB cumulative and 256 concurrent egress caps under broker/mitm mediation, and a host-wide workspace ceiling (MICROAGENT_MAX_WORKSPACES), with an explicit 0 still meaning unlimited and pre-existing workspaces unchanged; and a rejected flag value now exits 1 as a permanent error instead of 75 with retryable: true.

Every workspace is bounded by default

• Idle TTL defaults to 7 days when --ttl is not set; --ttl 0 still means permanent
• New --egress-max-total-bytes and --egress-max-conns flags, defaulting to 50 GiB / 256 connections under mediation; caps are fixed at create time and round-trip through every later start
• create and start fail closed once running workspaces reach the host ceiling, computed from host memory or set with MICROAGENT_MAX_WORKSPACES
• inspect/status report every bound in force under a new boundedOperations field

Broker endpoints and credentials

• The new semantic assurance mode validates each request against a typed operation grant, reauthorizes redirects, and buffers responses until status, content type, size, JSON shape, and credential non-disclosure checks pass; the generic relay remains as trusted-upstream
• Broker endpoints now run on macOS, closing the last backend gap: both backends run the same portable endpoint server, so credential handling, decision records, and CONNECT gating are identical
• The oauth2-cc credential-swap strategy is proven end to end — token exchange, injection, caching, and three fail-closed cases — plus a new Linux E2E scenario
• --secret, --secret-on-demand, and --secrets-env-file now warn on stderr that the guest holds the real value, naming broker endpoints as the alternative; the Agentfile examples use broker endpoints
• mitm is staying as the deliberate opt-in for TLS content inspection, no longer described as sunsetting

Containment and audit

• quarantine now creates a durable execution fence, freezes vCPUs, severs network/broker/port/serial authority, captures memory and disk while frozen, then stops into custody — with each phase reported separately and capture failure leaving the guest frozen for a safe retry; Linux KVM and Apple VF implement the same phase contract
• Guest egress dropped at the datapath (ICMP and other non-TCP/UDP) now lands in the audit log and microagent egress with an unmediatable-protocol signal and packet count, instead of vanishing
• Egress mediator liveness is observed from an advisory lock on the mediation lease instead of a process ID that could be misresolved across PID namespaces

Performance

• linux-kvm cold boot through a working guest command improved from 1,198/1,202 ms to 457/459 ms (p50/p95, isolated mode): the kernel console is limited to notices and above, the unused PS/2 keyboard probe is skipped, and a successful structured no-op over direct vsock ends the early-exit window
• Snapshot resume no longer stalls 30 s on clock sync — it dials the guest over the Firecracker vsock UDS, bringing create --from-snapshot to about 1.3 s total
• perf boot now measures the boot a repeat run performs (baseline reuse wired in, each iteration labeled baseline or build), stops timing before teardown, and records exact component paths and hashes

Snapshots

• Fixed a guest kernel panic on every linux-kvm snapshot restore of an XSAVES-capable guest; the guest now boots with clearcpuid=xsaves — snapshots captured before the fix still crash, recreate the workspace to pick it up
• The restore liveness gate now probes over vsock instead of a host port forward that could not be listening yet, so it can actually pass
• Snapshot restore works again on macOS: runtime state persists the declared network rather than replaying effective addressing into validation that rejects it

macOS parity

• Declared DNS reaches mediated guests, and workspace state reports the addressing the guest actually received
• mitm CA delivery works: the cmdline now carries the CA port, pinned by a registry parity test so future ports cannot be silently dropped
• Orphaned one-shot runs die at their timeout via a supervisor-enforced run bound
• Doctor probes what boots actually need: the egress datapath binary, keg-only e2fsprogs tools, and pause support keyed on the right macOS version
• stats measures CPU over a short interval like Linux and omits I/O counters instead of emitting zeros; the result file is written owner-only

Fixes

• Built rootfs images keep the ownership and special mode bits the source image declared (corrected in place with debugfs, no host privilege needed) — no more silently broken setuid or sticky /tmp
• Images that ship systemd build again: backslash-escaped unit file names extract as literal POSIX names, with hostile names contained
• Restarting a model runner no longer silently breaks paired workspaces on Linux/KVM — the guest-facing forward resolves the current runner per connection, and model stop names still-paired workspaces
• connect recognizes detach chords in both keyboard encodings, and host terminal resizes now reach the guest PTY
• Successful create --setup leaves a valid verification baseline instead of a workspace born in verification failure
• A rejected flag value is classified permanent ahead of the message-text table, and a malformed duration says what a usable value looks like
• Doctor renders one glyphed line per check with a closing verdict sentence, verifies TPROXY by installing a real steering rule in a scratch namespace, no longer demands modules the mediator does not use, and reports a verdict field (ok/degraded/failed) in structured output

Full details in CHANGELOG.md.