v0.13.0

What's Changed

• docs(security): re-baseline egress snapshot for 2026-09-21 by @h1d3mun3 in #184
• chore(augur-vm): drop stale M0-M4 milestone comments and version tags by @h1d3mun3 in #187
• feat(augur-vm): track the repo-root VERSION file instead of a hand-maintained string by @h1d3mun3 in #188
• chore(augur-vm): drop stale milestone comments, track root VERSION by @h1d3mun3 in #189
• docs(readme): lead with macOS VM + Xcode sandbox, add Why augur and quick start by @h1d3mun3 in #193
• refactor(augur-vm): split VMBundle.swift into one file per type by @h1d3mun3 in #190
• docs(readme): add a demo GIF of the macOS VM + xcodebuild test flow by @h1d3mun3 in #194
• refactor(augur-vm): standardize ParsableCommand struct naming to Command by @h1d3mun3 in #191
• fix(gvproxy): re-pin to upstream fc319b8f, rebase augur-egress.patch by @h1d3mun3 in #195
• refactor(augur-vm): extract shared VZVirtualMachineConfiguration builder by @h1d3mun3 in #192
• refactor(augur-vm): readability pass — command naming, file splits, shared config builder by @h1d3mun3 in #196
• docs(readme): document the two-running-macOS-VMs-per-Mac limit by @h1d3mun3 in #197
• docs(augur): rewrite the already-running up comments in present tense by @h1d3mun3 in #198
• docs(augur): merge the stacked history-mount comments into one by @h1d3mun3 in #199
• docs(augur): move the guest-clock explanation onto its function and trim it by @h1d3mun3 in #200
• refactor(augur): split cmd_up into reconcile / reuse / recreate by @h1d3mun3 in #201
• docs: add CLAUDE.md with code-comment conventions by @h1d3mun3 in #203
• chore(augur): drop decision history from code comments by @h1d3mun3 in #204
• chore(augur): remove ADR references from code comments by @h1d3mun3 in #205
• chore(augur): explain the admin password and path-hash keying once by @h1d3mun3 in #206
• chore(augur): sweep leftover review labels and history from comments by @h1d3mun3 in #209
• fix(augur): make the history-layout comment match the whole-parent mount by @h1d3mun3 in #207
• fix(tests): the UDP/ICMP drop is no longer review-only in tests/30's note by @h1d3mun3 in #208
• docs(readme): fix inaccuracies and restructure around shared sections by @h1d3mun3 in #210
• docs(adr): ADR-0021 — Container mode injects credentials per session by @h1d3mun3 in #211
• feat(container): inject credentials per session instead of at container run by @h1d3mun3 in #212
• docs(security-review): add the 2026-09-24 egress snapshot by @h1d3mun3 in #213
• fix(augur): refuse to attach to a running guest whose egress proxy binary changed by @h1d3mun3 in #202
• docs(invariants): fix stale anchors and enforcement wording in I7, I8 and I10 by @h1d3mun3 in #214
• fix(container): run the self-test and setup-token integrity gate by absolute path by @h1d3mun3 in #215
• fix(container): stop mounting the host's ~/.config/gh by @h1d3mun3 in #216
• fix(macos): feed the guest admin password to sudo -S over ssh stdin by @h1d3mun3 in #217
• chore: bump VERSION to 0.13.0 by @h1d3mun3 in #218

Full Changelog: v0.12.0...v0.13.0

v0.12.0

What's Changed

• chore(gvproxy): repin to 50edb65e (upstream main), dependency refresh only by @h1d3mun3 in #174
• feat(macos): unattended base-VM provisioning on macOS 27+ (ADR-0018) by @h1d3mun3 in #173
• docs(adr): macOS 27 resolves the virtiofs staleness defect by @h1d3mun3 in #176
• chore(gvproxy): repin to b6bb07ed (upstream main), rebase augur-egress.patch by @h1d3mun3 in #177
• fix(macos): hint at a stale clone password on sudo failure by @h1d3mun3 in #178
• feat(container): inject the host's timezone into Apple Container guests by @h1d3mun3 in #179
• feat(macos): inject the host's timezone into the VM guest by @h1d3mun3 in #180
• fix(container): refresh TZ on every claude/shell exec, not just at container run by @h1d3mun3 in #182
• chore: bump VERSION to 0.12.0 by @h1d3mun3 in #183

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

• feat(container): persist the Apple Container across down/up (reconcile-on-up) by @h1d3mun3 in #114
• feat(agents): persist ~/.claude/agents per-project in both modes (#113) by @h1d3mun3 in #115
• docs(security): re-baseline the egress snapshot (2026-07-23) by @h1d3mun3 in #116
• fix(trust): pre-trust the sandboxed workspace so /agents survives destroy+up by @h1d3mun3 in #117
• docs: document macOS VM CPU/memory knobs in resources.conf by @h1d3mun3 in #118
• feat(container): add augur list for container mode by @h1d3mun3 in #120
• fix(agent): drop workspace-trust pre-seed, fix macOS .claude.json clobber by @h1d3mun3 in #122
• feat(config): classify Claude Code configuration — operator profile, managed policy, prompt-history carry-over by @h1d3mun3 in #123
• fix(macos): unlink the gvproxy socket only when actually starting one by @h1d3mun3 in #125
• fix(security): refuse a workspace that contains augur's own control plane by @h1d3mun3 in #126
• fix(egress): key every per-project egress host-state file on the full workspace path by @h1d3mun3 in #127
• fix(up): reconcile host-side state when the guest is already running by @h1d3mun3 in #128
• fix(macos): validate credentials before the clone, not after the boot by @h1d3mun3 in #129
• fix(macos): a duplicated credential.helper in the host gitconfig must not break up by @h1d3mun3 in #130
• fix(macos): give macOS mode the boot egress self-test I1 already promised by @h1d3mun3 in #131
• fix(macos): down --macos must verify the VM stopped, not assume it by @h1d3mun3 in #132
• fix(macos): set the guest's clock from the host — a cloned VM boots 95 min behind by @h1d3mun3 in #133
• docs(security-reviews): 2026-07-26 egress snapshot — the vehicle for I7's rule change by @h1d3mun3 in #134
• test(macos): stop two stubs draining the caller's stdin (the suite hung on a TTY) by @h1d3mun3 in #136
• fix(macos): boot self-test died silently and skipped its own teardown by @h1d3mun3 in #137
• test(e2e): cover the reconcile path and the stranded-guest self-test by @h1d3mun3 in #139
• Security fix series (2026-07): 11 cross-mode defects in the egress and bring-up core by @h1d3mun3 in #138
• docs: correct what the record says about virtiofs staleness by @h1d3mun3 in #140
• feat(macos): refresh the guest's view of shared files with msync by @h1d3mun3 in #141
• feat(macos): warn when the shared-file refresh stops working by @h1d3mun3 in #142
• feat(macos): keep the shares fresh for the whole session, not just at attach by @h1d3mun3 in #143
• fix(macos): drop the gh-config share, which was exposure without a feature by @h1d3mun3 in #144
• test(e2e): prove the shared-file refresh against a real guest by @h1d3mun3 in #145
• fix(macos): check msync's return value instead of discarding it by @h1d3mun3 in #146
• fix(macos): the freshness tripwire misreported on every run but the first by @h1d3mun3 in #147
• fix(macos): the refresher's warnings went to /dev/null by @h1d3mun3 in #148
• docs(adr-0016): make the removal procedure match what shipped by @h1d3mun3 in #149
• feat(macos): name the files a sweep could not refresh, up to a bound by @h1d3mun3 in #150
• fix(macos): the freshness tripwire could kill up, silently by @h1d3mun3 in #151
• docs(adr): repair the decisions index — layout, and one row that described the rejected option by @h1d3mun3 in #153
• virtiofs staleness (#124 / #135): the guest now sees the host's edits by @h1d3mun3 in #152
• docs(security): egress snapshot 2026-07-28 — re-baseline after the virtiofs-staleness stack by @h1d3mun3 in #158
• feat(macos): an off switch for the share-refresh loop, and augur refresh --macos by @h1d3mun3 in #160
• feat(macos): persist the share-refresh dial per project, host-side by @h1d3mun3 in #161
• fix(macos): pin PATH on the share sweep's guest round trip by @h1d3mun3 in #162
• fix(macos): one transient empty read discarded the whole freshness verdict by @h1d3mun3 in #164
• chore(gvproxy): bump pinned base to 629a4a42 (upstream main) by @h1d3mun3 in #163
• fix(macos): a sourced augur could not enumerate its own shares by @h1d3mun3 in #165
• Remove the macOS virtiofs shared-file refresh; accept the staleness (ADR-0017) by @h1d3mun3 in #168
• docs: re-correct the virtiofs staleness claims, pointing at ADR-0017 by @h1d3mun3 in #169
• chore(gvproxy): repin to d3d4f055 (upstream main), rebase augur-egress.patch by @h1d3mun3 in #170
• chore: bump VERSION to 0.11.0 by @h1d3mun3 in #171

Full Changelog: v0.10.2...v0.11.0

v0.10.2

What's Changed

• fix(release): enforce e2e/macos-vm on the tagged commit (+ document the merge carry-over) by @h1d3mun3 in #111
• chore(release): bump VERSION to 0.10.2 by @h1d3mun3 in #112

Full Changelog: v0.10.1...v0.10.2

v0.10.1

What's Changed

• fix(proxy): classify 6to4 / Teredo / deprecated site-local in the SSRF v6 guard (I8) by @h1d3mun3 in #106
• fix(egress): honor the approved allowlist snapshot, not a post-approval re-read (I7 TOCTOU) by @h1d3mun3 in #107
• chore(release): bump VERSION to 0.10.1 by @h1d3mun3 in #110

Full Changelog: v0.10.0...v0.10.1

v0.10.0

What's Changed

• feat(release): VERSION source of truth + structural macOS-VM E2E gate by @h1d3mun3 in #108
• chore(release): bump VERSION to 0.10.0 by @h1d3mun3 in #109

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• feat(proxy): idle timeout on established tunnels (#101) by @h1d3mun3 in #105

Full Changelog: v0.8.2...v0.9.0

v0.8.2

What's Changed

• fix(proxy): sanitize the SOCKS deny-path host before it reaches the decision log by @h1d3mun3 in #100
• docs(README): call out the .git/hooks RW-mount host-code-execution risk by @h1d3mun3 in #102
• docs(decisions): accept the egress allowlist's exfiltration ceiling, decline to mitigate it by @h1d3mun3 in #103
• docs(security): re-baseline the egress snapshot (2026-07-20) by @h1d3mun3 in #104

Full Changelog: v0.8.1...v0.8.2

v0.8.1

What's Changed

• docs(decisions): record why macOS VM mode keeps the project clone on down by @h1d3mun3 in #98
• fix(macos): stop prompting for the admin password during base-VM build by @h1d3mun3 in #99

Full Changelog: v0.8.0...v0.8.1

v0.8.0

What's Changed

• chore(gvproxy): re-pin to upstream main, resolving the patch-conflict drift by @h1d3mun3 in #92
• test: cover setup-token, init-conf, install-cert, and down by @h1d3mun3 in #93
• fix(proxy): close the splice-layer slot leak; add a capacity gauge (#36) by @h1d3mun3 in #94
• docs(decisions): add ADR directory with the sudo-free principle by @h1d3mun3 in #95
• chore(tests): restore +x on two test scripts by @h1d3mun3 in #96
• fix(container): stop the image cache from growing unbounded on every rebuild by @h1d3mun3 in #97

Full Changelog: v0.7.1...v0.8.0