mgit v0.4.5

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (libkrun, Apple Silicon — the macOS default backend since ADR-010; -tags vzf selects Virtualization.framework instead). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 2,200+ automated tests, race-detector clean under -race, zero lint warnings, and the microVM behaviour proven on real hardware rather than only in unit tests.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Install script (macOS/Linux) — verifies checksums, and avoids the macOS
# quarantine trap below because curl does not set the attribute
curl -fsSL https://raw.githubusercontent.com/hyper-swe/mgit/main/install.sh | sh

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

macOS: a BROWSER-downloaded archive will not run until you clear
quarantine. The install script above and Homebrew are unaffected — curl
and brew are not quarantine-aware apps, so the attribute is never set.
A browser download is: the binaries are ad-hoc signed (no notarization
yet), and on Apple Silicon Gatekeeper kills a quarantined ad-hoc-signed
binary outright — no dialog, just zsh: killed or a "cannot verify this
app is free of malware" alert. Both binaries are affected, and the
attribute survives extraction.

xattr -d com.apple.quarantine mgit mgit-sandboxd

After that both run normally — the binaries are fine. The attribute is
written by the downloading app on your machine, so nothing in this build
can remove it; only notarization fixes the browser path. (MGIT-64)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• f9f884b Merge MGIT-87: the Linux libkrun column, validated continuously on real KVM
• 14809e0 Merge MGIT-89: the guest root can copy up on Linux/libkrun; the networked column opens
• a8cb74f Merge MGIT-90: a deleted path can no longer serve deleted content to a running guest
• 07bf4ef Merge MGIT-91: the first exec after launch no longer dies on a reset
• 896460f Merge MGIT-92: a launch that cannot serve fails closed, with the guest's own error
• a0f97df Merge MGIT-96: the firecracker kill/drain proofs wait for the guest's bytes
• 82d9ee4 ci(release-smoke): install libkrun so the gate actually tests the daemon
• c3b7411 docs(changelog): cut the 0.4.5 section — the Linux release
• 4fd6d86 docs+ci: dogfood the sandbox too, and stop asserting a shell that no build serves
• b287cde feat(ci): validate the Linux libkrun column on real KVM, continuously
• 21afcfd feat(sandbox): fail a launch closed when the guest never serves, and say why
• 25aa6b8 fix(exec): retry a first command the guest RESET, not only one it EOF'd
• a9d8c4f fix(guest): make the root writable on Linux/libkrun, and open the networked column
• 87cef9f fix(lint): satisfy the Linux gosec pass, and make make lint cross-target
• c819765 fix(release-smoke): establish liveness first, and stop drawing conclusions the host cannot support
• ebff7a1 fix(release-smoke): stream the output, and bound the quarantined execution
• ff106cd fix(release-smoke): the Gatekeeper check is real-Mac only, and a RAN result is inconclusive
• 82f06f5 fix(sync): empty a file before unlinking it, so a stale guest name yields nothing
• 8954b07 test(e2e): drive the sandbox CLI verbs against a live VM, and gate on it
• 9e363b8 test(sandbox): wait on the GUEST's established flow in the firecracker revoke e2e

mgit v0.4.4

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (libkrun, Apple Silicon — the macOS default backend since ADR-010; -tags vzf selects Virtualization.framework instead). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 2,200+ automated tests, race-detector clean under -race, zero lint warnings, and the microVM behaviour proven on real hardware rather than only in unit tests.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Install script (macOS/Linux) — verifies checksums, and avoids the macOS
# quarantine trap below because curl does not set the attribute
curl -fsSL https://raw.githubusercontent.com/hyper-swe/mgit/main/install.sh | sh

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

macOS: a BROWSER-downloaded archive will not run until you clear
quarantine. The install script above and Homebrew are unaffected — curl
and brew are not quarantine-aware apps, so the attribute is never set.
A browser download is: the binaries are ad-hoc signed (no notarization
yet), and on Apple Silicon Gatekeeper kills a quarantined ad-hoc-signed
binary outright — no dialog, just zsh: killed or a "cannot verify this
app is free of malware" alert. Both binaries are affected, and the
attribute survives extraction.

xattr -d com.apple.quarantine mgit mgit-sandboxd

After that both run normally — the binaries are fine. The attribute is
written by the downloading app on your machine, so nothing in this build
can remove it; only notarization fixes the browser path. (MGIT-64)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• b685147 docs(changelog): cut 0.4.4 — install and operability, with the backend matrix stated
• 026c41d docs(release): the Gatekeeper smoke step invoked a flag the daemon does not have
• 3b0aefb docs(release): the archive smoke's liveness probe must not depend on a feature flag
• 0c8f85c feat(install): ship install.sh and make it the headline install path
• 9845976 feat(release): script the post-publish smoke, and stop it firing malware alerts
• f3d026f feat(sandboxd): --version, stamped from one shared buildinfo package
• f1527ee fix(ci): the brew guard stamped a symbol MGIT-83 had moved, and the guard test missed it
• 7cfcd7e test(release): gate on the tap being reachable UNAUTHENTICATED

mgit v0.4.3

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (libkrun, Apple Silicon — the macOS default backend since ADR-010; -tags vzf selects Virtualization.framework instead). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 2,200+ automated tests, race-detector clean under -race, zero lint warnings, and the microVM behaviour proven on real hardware rather than only in unit tests.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

macOS: a downloaded archive will not run until you clear quarantine.
Any transfer that sets com.apple.quarantine — a browser download,
AirDrop, anything but scp or a local build — triggers this. The
binaries are ad-hoc signed (no notarization yet), and on Apple Silicon
Gatekeeper kills a quarantined ad-hoc-signed binary outright: no dialog,
just zsh: killed. Both mgit and mgit-sandboxd are affected.

xattr -d com.apple.quarantine mgit mgit-sandboxd

After that both run normally — the binaries are fine; this is purely a
distribution/signing gap. Whether a Homebrew install carries the same
problem is not yet verified. (MGIT-64)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• 651b2c2 Merge MGIT-72: live egress policy mutation + hygiene
• 5ffe62d Merge MGIT-73: guest->host artifact export
• 74b59f0 Merge MGIT-76: ship mgit sandbox sync
• 530612a Merge MGIT-77: refuse empty commits, and make the generated agent loop match
• 51d57cc Merge MGIT-78: the Linux firecracker live gate now runs in CI
• 224122b Merge MGIT-80: keep mgit's generated scaffolding out of the landed patch
• 9bc5d34 Merge MGIT-81: exported artifacts keep the guest's mode
• 7597026 Merge pull request #10 from hyper-swe/fix-flaky-kill-test
• 8f265bc ci(e2e): allow on-demand dispatch of the e2e gate
• fd6788c ci(e2e): run the Linux firecracker live gate on hosted runners (MGIT-78)
• 9d5e218 docs(adr): ADR-011 promised a sandbox sync verb that never shipped
• 7e78768 docs(changelog): assemble the 0.4.3 release section
• dee4da8 docs(release): correct the release notes, and close two stale tap checklist items
• 4ecfd49 docs+fix: record the live Linux gate, and unbreak GOOS=linux go vet ./cmd/mgit
• 0cce4ae feat(sandbox): guest->host artifact export, host-named, bounded and audited
• 686802d feat(sandbox): host->child control channel for running libkrun VMs (MGIT-74) (#8)
• 549e573 feat(sandbox): live egress policy — grant, then revoke, without a relaunch
• fa14df6 feat(sandbox): ship mgit sandbox sync, the verb ADR-011 promised
• 0e88be6 fix(brew): core mgit installs without the untrusted libkrun tap (MGIT-75)
• 459f08c fix(brew): stage before committing in the no-libkrun smoke test
• ea94c55 fix(commit): refuse an empty commit — mgit reported success for work it never recorded
• 6b49f8f fix(export): reproduce the mode the guest set, not the share's placeholder
• 1021a72 fix(lint): justify the portability conversion unconvert flags on linux/amd64
• bac0882 fix(staging): apply the worktree mode explicitly, not through O_CREATE
• 2f4d75d fix(work): keep mgit's own generated scaffolding out of the landed patch
• 372a875 style(egress): US spelling to satisfy misspell
• c416c91 test(egress): fix the flaky revoke-kills-flows test, and unmask its drain twin
• 334487c test(firecracker): poll for the published-port bytes, not just a connect

mgit v0.4.2

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• fb88b90 docs(changelog): 0.4.2
• 1b46bfa docs(changelog): fold 0.4.2 into one dated section
• a6b46fc feat(egress): mutable policy with kill-by-default revoke (#7)
• ab3357f feat(egress): revoke a running sandbox's egress policy without relaunch (MGIT-72)
• 9550d5d feat(sandbox): carry host worktree edits into a running guest (MGIT-71)
• 341c6eb feat(sandbox): propagate host worktree edits into a running guest (#6)
• aba6e38 fix(egress): exempt the gateway's own services from the redirect
• 469b04d fix(sandbox): make allowlist egress usable from inside a firecracker guest
• f490dcc fix(sandbox): make guest DNS and allowlist egress actually usable (#5)
• f5d0e59 fix(sandbox): refuse allowlist on vzf; pair the last negative-only assertions
• 823ecdc test(firecracker): assert a refusal by what it denies, not by an exit code
• a676322 test(firecracker): assert the redirect via the PINNED address, not the fixture's libc
• 7a13c45 test(firecracker): instrument both ends of the redirected flow
• 1e55769 test(portpublish): put the liveness control on a port mgit's own rules admit

mgit v0.4.1

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• f984150 docs(changelog): 0.4.1
• 0c878a3 docs(changelog): date 0.4.1, drop a duplicated section
• f526629 fix(sandbox): configure the guest network so egress actually works (#4)
• 0a3b039 fix(sandbox): give the guest an address — libkrun egress was dead in 0.4.0
• 837c39b style(guestnet): fix a comment misspelling the linter rejects

mgit v0.4.0

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• 94b68ed build(sandbox): reproducible, SOUP-pinned guest-image build (MGIT-30)
• e191bfa chore(mtix): capture libkrun/netstack decisions and follow-up tasks
• 84727f3 chore(mtix): reconcile the backlog with the single-backend decision
• 161d3cf chore(mtix): record libkrun lifecycle, litmus and coverage findings
• 20e5f2e chore(mtix): record the GA-readiness decisions and follow-up tickets
• 3c80887 chore(mtix): record the Linux/KVM parity findings and status
• e766321 chore(mtix): record the capability gate, litmus completion and guest-userspace options
• 1474284 chore(mtix): record the default flip, guest-base contract and gateway logging
• 5954c4c chore(mtix): record the release-blocker findings from the clean-Mac run
• b7abdfb chore(mtix): record the tree-pinning design and the BYO base path
• d03374b chore(mtix): sequence the guest-image publish decision (MGIT-61.12)
• 80a069e chore(release): one source of truth for the Homebrew formula (#3)
• 9209d92 docs(build): clarify make lint already inherits PKG_CONFIG_PATH
• 5d351de docs(changelog): note the brew sandbox-activation caveat (MGIT-61.3)
• 12717cf docs(changelog): promote the unreleased section to 0.4.0
• 369a0fe docs(changelog): record the OCI guest base and the five boot defects
• dd08f7e docs(changelog): record the attested base digest and the clean-install fixes
• af87152 docs(e2e): rebuild E2E-MATRIX as a full-product audit, not a sandbox-only map
• 5c4e454 docs(e2e): record claude-hook's new real-process coverage
• 86fea52 docs(e2e): record the SEC-09 real-VM proof and correct a pass-count miscount
• 7ff1850 docs(e2e): reflect the new cmd-level coverage, correct earlier severity
• fa3c433 docs(guestboot): record the backend-specific precedence rule and firecracker re-verification
• 095563f docs(install-sandbox): stop claiming published guest-image bundles ship with the release
• 57faeba docs(release): hold the guest-image publish pending the libkrun path (MGIT-61.12)
• 030c97c docs(release): record the GA backend split in CHANGELOG and the checklist
• e6c21ec docs(sandbox): correct libkrun comments that no longer describe the code
• f71f387 docs(sandbox): refresh the libkrun package doc after open mode landed
• 1c45c2b feat(cli): boot the registered guest base when no --image is given
• 53d6f45 feat(cli): compose a guest base from an OCI image (mgit sandbox base from)
• b984666 feat(cli): mgit sandbox base set — the bring-your-own-tree guest base
• be03005 feat(release): ship the linux guest binaries beside mgit so an install can compose a base
• 31565fd feat(sandbox): attest the guest base a commit was produced in
• 6c613ff feat(sandbox): deliver the SEC-03 quarantine and SEC-09 publishing on libkrun
• 5170132 feat(sandbox): fail closed when libkrun lacks networking support
• 948f6c3 feat(sandbox): give open mode an authorizer so it is unrestricted but audited
• 783dfbd feat(sandbox): libkrun backend core + rootless netstack egress gateway
• e590bcc feat(sandbox): libkrun backend, rootless egress gateway, and OCI guest bases (#1)
• c8c02b2 feat(sandbox): libkrun re-exec VM lifecycle + Hypervisor.CreateVM
• fb0d533 feat(sandbox): make libkrun the default backend on macOS
• 6e3b46c feat(sandbox): mgit sandbox image install — one-command sandbox activation (MGIT-61.1)
• 0506501 feat(sandbox): pin a libkrun guest base by tree digest
• 92015d7 feat(sandbox): publish multi-platform image bundles + default install source (MGIT-61.2)
• d2c3fa9 feat(sandbox): pull an OCI image into a guest base tree, stdlib only
• c0c571d feat(sandbox): ship the mgit CLI inside the guest image
• 104acec fix(cli): CI first-run fixes for the guest boot-token merge and libkrun jobs
• aae1787 fix(cli): collapse to one Homebrew formula source, fix drift found by reading the live tap
• 4209caa fix(cli): compose a guest base without a manual image init first
• c95ea11 fix(cli): find the shipped guest binaries however mgit was installed
• 2ec0537 fix(cli): make the macOS live sandbox gate exercise the shipped OCI path
• 3503a3a fix(cli): make the macOS live sandbox gate exercise the shipped OCI path (#2)
• bd65973 fix(cli): the actual formula/checklist/doc fixes from the prior commit
• 28a7514 fix(cli): widen the claude-hook real-process test's build timeout
• fe7d63b fix(deps): clear 7 disclosed vulnerabilities in the storage engine
• a10e639 fix(guest): boot the real mgit-guest under libkrun
• 6b446f0 fix(release): brew formula never installed mgit-sandboxd, and pointed at the wrong repo
• 4c5a62d fix(release): install libkrun on the release runner
• 64c1222 fix(sandbox): five defects that stopped any real base from booting on a Mac
• 9eb52d5 fix(sandbox): give TestKVM_CreateVM_InvalidConfigSurfaces a StateDir
• 885649c fix(sandbox): launch a sandbox for a task that was never squashed
• 2bc8f61 fix(sandbox): make a failed daemon activation say why, and stop it failing at all on first run
• 6dca717 fix(sandbox): make the libkrun control plane and child loader path...

mgit v0.3.1-beta

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• 07ea750 chore(docs): stamp 0.3.1-beta in the changelog
• d9cb948 feat(cli): mgit serve --project to target a repo without cwd (MGIT-60)
• b4a318d fix(sandbox): mgit run waits for guest readiness + resolves bare commands (MGIT-58)
• 165714e fix(sandbox): route mgit run to the parent repo's daemon and match canonical paths
• 93da7ab style(sandbox): gofmt e2e_workflow_linux_test (drop stray blank line)
• 135444e test(sandbox): fix stale e2e image-digest fixture (MGIT-59)

mgit v0.3.0-beta

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

Each archive below ships two host binaries: mgit and, where a
sandbox backend exists (Linux and macOS arm64), the mgit-sandboxd
daemon next to it. Homebrew installs both.

# Homebrew (installs mgit + mgit-sandboxd)
brew install hyper-swe/tap/mgit

# Go — core mgit
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Go — the sandbox daemon (Linux works out of the box; on macOS the
# go-installed binary is unsigned and needs the virtualization
# entitlement — prefer brew or the release archive there)
go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest

# Binary — download the archive below for your platform (contains both)

The microVM sandbox also needs a guest image; see
docs/INSTALL-SANDBOX.md.

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• 803b079 chore(docs): stamp 0.3.0-beta in the changelog
• 60b16de docs(api): record the REST scope decision; align README + changelog
• 1b8658b docs(readme): boxed flow diagram; drop broken Go Report Card badge
• 4ec1863 docs(readme): promote the audit trail to a first-class pitch
• 6423032 docs(readme): reframe intro around the value, not fear
• d8cdbbf docs(readme): remove em-dashes throughout (LLM-tell cleanup)
• fd4f67b docs(readme): responsive Mermaid flow diagram (ASCII art clipped on narrow viewports)
• 0d97b3c docs(readme): restructure landing page for skimmability and trust
• 59de6b9 docs(readme): split install commands into separate copyable blocks
• 46ce6d3 docs(readme): static SVG flow diagram (dark/light variants)
• 991c071 feat(ci): ship mgit-sandboxd through every host channel
• cc30dc5 feat(mcp): GA-parity audit — real tools, hostile-input hardening, no-drift docs
• 51c0cc8 feat(mcp): implement the worktree tools (add/list/remove)
• 27ed6d9 feat(service): content-restoring course-correction, hardened by adversarial review
• f83908e fix(api): remove dead REST auth; make the localhost trust model explicit
• 740f7f7 fix(cli): make sandbox-less mgit work wiring honest (MGIT-47)
• 3ce2427 fix(cli): serve acquires the repo lock per-operation, not for its lifetime
• be7041d test(ci): install-channel + posture e2e as release gates (MGIT-48)
• c2ebdba test(e2e): prove the flagship claims end to end (MGIT-53)

mgit v0.2.1-beta

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

# Homebrew
brew install hyper-swe/tap/mgit

# Go
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Binary
# Download from the assets below for your platform

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• 281ae37 docs(changelog): add [0.2.1-beta] — MGIT-42 branch-delete fix + README/skill
• 7c2a669 docs(readme): lead with benefits + testimonial; scannable hero
• f215f92 docs(readme): plain-language intro; sharpen the nudge to try it
• fd5d8b3 docs(skill): add "Common pitfalls (and the fix)" to the agent skill
• 04827fd fix(branch): delete clears both ref + index; create self-heals stale orphan

mgit v0.2.0-beta

mgit — a sandboxed, checkpointed working substrate for LLM coding agents

mgit gives a coding agent two things together: containment — its untrusted code (npm/pip installs, builds, tests) runs in a disposable per-task microVM, not on your machine — and a checkpointed working substrate — every step is a task-tagged micro-commit in an isolated .mgit store that never touches your real .git, so you review and land only the squashed result.

Beta. The microVM sandbox is the differentiator; it is live-validated on Linux (firecracker/KVM) and macOS (Apple Virtualization.framework, arm64). Windows runs core mgit without the sandbox. See Known limitations in the CHANGELOG.

Highlights

• Per-task microVM containment — installs/builds/tests run in a disposable, hardware-isolated VM; a poisoned dependency burns the VM, not your host. Default-deny per-task egress allowlist; verified land (dual-hash + task binding + host-anchored attestation) through an airlock.
• mgit work — one command starts an agent on a task: a task-bound worktree with the agent's shell wired through mgit run into the sandbox.
• Runs over your existing git repo — a self-contained .mgit store; your project's .git is provably never mutated, and the base stays in sync with your local working state automatically (no manual sync).
• Checkpointed, reviewable history — task-tagged micro-commits; backtrack / fork / cherry-pick to course-correct; squash --to-git | git apply lands a byte-for-byte patch.
• Multi-agent worktree isolation, REST + MCP integration surfaces, dual-hash integrity, append-only audit.
• Pure Go, zero CGO — single static binary (Linux, macOS, Windows; amd64 + arm64).

Quality

• 530+ automated tests, race-detector clean under -race, zero lint warnings.

Install

# Homebrew
brew install hyper-swe/tap/mgit

# Go
go install github.com/hyper-swe/mgit/cmd/mgit@latest

# Binary
# Download from the assets below for your platform

Pairs with mtix

mgit + mtix form a closed loop for enterprise AI-driven development: mtix tracks what to build, mgit tracks what was built. Task IDs flow between both systems. The unit of failure is a task, not a session.

Changelog

• f5572c0 build(sandbox): add busybox network applets to the guest image
• a89192f chore(docs): approve sandbox backend dependencies per ADR-005 criterion 2
• 6027339 chore(mtix): 11.10.6 image-register CLI done
• 4fa144c chore(mtix): 11.10.7 control-plane protocol done
• f5b539e chore(mtix): 11.10.8 daemon dispatch + service wiring done
• a2b54c1 chore(mtix): 11.10.9 mgit sandbox CLI done
• 1a4fc0a chore(mtix): 11.13.4 guest-image exec round-trip done; 11.6.6/11.10.6 filed
• 9c7cd8c chore(mtix): 11.6.4 firecracker worktree delivery in progress
• 39d389b chore(mtix): 11.6.5 guest identical-path worktree mount done
• f1696e2 chore(mtix): 11.6.6 guest writable root done; 11.6.7 vdb-COW follow-on filed
• f1999fd chore(mtix): 11.9.6 SEC-06 tree binding done
• 1224e93 chore(mtix): 11.9.8 PeerBinder wiring done
• 06ce1eb chore(mtix): 4.2.14 mgit serve command done
• 2ac8f8e chore(mtix): MGIT-11.10.10 land over the control plane done
• a051537 chore(mtix): MGIT-13.1 vzf guest dialer done
• d8a65db chore(mtix): MGIT-14 complete (mgit runs over an existing git repo) + follow-ups MGIT-15/16
• b63b95f chore(mtix): MGIT-20 commit audit trail done
• 5eaad37 chore(mtix): capture FR-17 deferred work as tickets
• 6505a11 chore(mtix): decompose daemon-RPC + CLI (11.10.7-.10) with security-audit hardening
• fc8260f chore(mtix): file MGIT-11.10.10 follow-ups (auto-land notify, land budget, vzf land dialer)
• 83d42a6 chore(mtix): file epic MGIT-14 (mgit must run over an existing git repo) + decomposition
• e102afe chore(mtix): housekeeping triage of the open backlog
• 77cc9bc chore(mtix): reconcile FR-17 task-tree drift with delivered work
• 551915e chore(mtix): refresh task snapshot to current state (IP-clean)
• b760244 chore(mtix): sync task snapshot — 11.6.2 done
• 47d716f chore(mtix): sync task snapshot — 11.8 closed, F3 follow-up filed
• 9934f31 chore(mtix): sync task snapshot — 11.9.1/11.9.2/11.9.3 done
• d1ee8c9 chore(mtix): sync task snapshot — MGIT-13 dialer core in progress
• c802dd2 chore(mtix): sync tasks.json export with current ticket state
• b43760a chore(mtix): update task tree snapshot
• fa8b507 chore(mtix): v1 release scope recorded; 11.9.6 land adapters in progress
• 2061af1 docs(adr): ADR-008 git-authoritative coexistence + auto-housekeeping
• 9b11672 docs(adr): amend ADR-001 for mgit↔git coexistence + skipped spec test (MGIT-14)
• 423915c docs(claude): instruct spawning sub-agents via mgit work (dogfood #5)
• cde8101 docs(docs): draft FR-17/NFR-17 sandboxed agent execution requirements
• f318bdc docs(docs): encode security-audit findings as FR-17 requirements
• 40f4b3a docs(docs): promote ADR-005 to Accepted; add ADR-003/004 sandbox cross-refs
• 49bbe5b docs(docs): record host-matching-guest decision (ADR-006, FR-17.39)
• b331fbe docs(docs): record pre-import vulnerability checks for sandbox deps
• 0411975 docs(readme): lead with sandbox containment
• cf681f6 docs(release): lead release notes with containment; fix goreleaser deprecations
• ed53981 feat(cli): Claude Code PreToolUse hook + worktree settings injection
• 40e6150 feat(cli): add mgit work to start an agent in an mgit worktree (gap #5)
• 4f66939 feat(cli): cooperative Codex/Cursor/generic PATH-shim adapters
• 059fa96 feat(cli): generate worktree CLAUDE.md sandbox environment section
• 6790ae1 feat(cli): mgit run — route task commands into the bound sandbox, fail-closed
• 6e97b31 feat(cli): mgit sandbox commands over the control plane (FR-17.34)
• 5da4ee9 feat(cli): mgit sandbox image init/add — host image registry surface (FR-17.17)
• 52fbdeb feat(cli): mgit sandbox land --task + control-plane client Land
• 336596a feat(cli): mgit serve — wire REST API + MCP server into a command (FR-8.4)
• fb44bf8 feat(cli): report real build metadata; drop safety-critical overclaim from --help
• c1bbd87 feat(land): bind claimed FileDiffs to the landed tree (SEC-06)
• 88fee43 feat(land): host-side land batch derivation + parent-tree resolver
• 8ca5bae feat(mcp): add Linux KVM/Firecracker sandbox backend
• 582c9bd feat(mcp): add host-side guest-filesystem quarantine plan + land defense
• e479ca8 feat(mcp): add image pinning, boot-time signature verification, warm pool
• 5448e0f feat(mcp): add macOS Virtualization.framework sandbox backend
• 474b05a feat(mcp): add mgit-guest PID-1 supervisor
• 678ebba feat(mcp): add mgit-sandboxd daemon lifecycle
• 90b295d feat(mcp): add the reduced-isolation container fallback behind audited opt-in
• 8022b1e feat(mcp): atomic sandbox land import (SEC-11, FR-17.5)
• f54ee85 feat(mcp): authenticate sandboxd IPC peers by kernel-asserted UID
• 232939a feat(mcp): bounded, schema-validated land protocol (F-03, F-09)
• 1baa49e feat(mcp): enforce the host-wide sandbox resource ceiling
• 79c6a61 feat(mcp): extract shared microvm base; add Hyper-V backend skeleton
• 327c1e0 feat(mcp): hash-on-write dual-hash land verification (SEC-06)
• 3789e83 feat(mcp): host-anchored commit attestation (SEC-01) + shared host-key helpers
• 9095763 feat(mcp): require_sandbox attestation enforcement at land (F-02, SEC-02)
• 7ebc387 feat(mcp): sandbox lifecycle service — lazy provisioning (FR-17.1, FR-17.10)
• 9d49a3e feat(mcp): vsock/HvSocket channel peer-binding (SEC-10, FR-17.27)
• 0aad2fc feat(mcp): wire platform sandbox backend; sandbox i...