Rust engine v0.1.33

Rust engine v0.1.33 delivers JANUS-441: the dependency-side PAIMOS v1 external-stage reporter, fixed to the certified Paimos v5.11.0 contract.

janusd-paimos-delivery

• Reads one root-owned, owner-only intent plus separate API-key and raw handoff-secret files; no caller-selected action, callback, command, credential lifecycle, or owner-stage authority is exposed.
• Emits only janus_evidence with role dependency, validates the complete expected remote binding before mutation, and cannot complete the canonical owner deployment/verification stage.
• Journals exact request bytes before sending, binds replay to canonical configuration and the frozen contract tuple, and replays the same body/idempotency key after ambiguous failures.
• Enforces singleton canonical media types, absent content encoding, strict JSON, exact receipt epoch/state, and 201 ⇔ duplicate=false / 200 ⇔ duplicate=true semantics.
• Is included in the Nix package and covered by release-assurance, native amd64/arm64 smoke and vulnerability scans, contract-pin checks, and adversarial replay/credential tests.

Frozen interoperability contract

• Paimos release: v5.11.0
• Certified commit: e5f4c86
• Fixture-set digest: 0318f4025902c9d5dd790384950cc9daebb16e02e79a4a90ce7dddc673e68bed
• Dependency fixture digest: 52a647abd52e229fcdef8461eeb9f7d31f07632501ad33f594cdfbc155c23d4b
• Media and schema-major values are pinned and checked during release admission.

Feature PR: #90

Release PR: #91

Ticket: JANUS-441

Rust engine v0.1.32

Rust engine v0.1.32 delivers JANUS-453: a reviewed, offline operator path for subject enrollment — no more hand-written registry records.

janusd-identity-admin (new authority-side binary beside janusd-identityd; not a runtime-plane action, so it needs no broker admission and can enroll the first subject):

• enroll|revoke --review-evidence-file FILE consume signed, operation-bound review evidence (Ed25519 envelope binding verb, trust-domain fingerprint, target, single-use nonce, validity window ≤ 7 days, reviewer key reference) verified against the pinned JANUS_IDENTITY_REVIEW_VERIFYING_KEY_FILE; list prints opaque refs, class, status.
• Guards, all fail closed: real UID == effective UID == registry-root owner; pre-owned exact 0700 registry root (never created); exclusive lifecycle lock beside the registry (identity_broker_running while the broker runs; list takes the shared lock); mutations refused under enforced_recorded (identity_posture_mutation_forbidden); evidence must verify, match context, be unexpired and never consumed (identity_review_invalid|_signature_invalid|_context_mismatch|_expired|_replayed); write-ahead authorized audit line synced before the record, applied/denied after (identity_admin_audit_unavailable fails closed).
• Reviewer side: review-keys (create/pin reviewer key), review-sign --request-file R --signing-key-file K --out FILE (request is a file, never argv).

Broker: holds a shared lifecycle lock for its lifetime; optional pinned JANUS_ACCOUNTABILITY_CONFIG_FILE must agree with JANUS_ACCOUNTABILITY_POSTURE (runtime_authority_posture_config_mismatch).

Registry hardening (prerequisites from the design review): records, lock, and signing key are opened O_NOFOLLOW and validated on the descriptor (owner == effective UID, mode, regular, single link); private directories require the caller's ownership; new records fsync the directory entry, not only the file; review fingerprints are single-use across enrollments and revocations.

Smokes / docs: scripts/smoke-janusd-identity.sh and scripts/with-runtime-authority.sh enroll through the new tool and assert broker_lock=enforced, replay=denied, write-ahead audit; docs/identity-shadow-runbook.md gains "First host enrollment (janusd-identity-admin)"; reason-code table extended.

Feature + version PR: #89
Tickets: JANUS-453 (context: JANUS-442, NIX-377, NIX-380; design review recorded on the ticket)

Rust engine v0.1.31

Rust engine v0.1.31 delivers JANUS-451: the identity broker's socket lifecycle no longer depends on the embedding sidecar doing cleanup.

Startup. janusd-identityd reclaims a dead socket left by a previous broker (torn-down sidecar, crash) — only when the path is a real socket, owned like its private parent directory, and refuses connections across ten spaced probes (0.5 s). A live broker, a symlink, a non-socket entry, or a socket owned by another user fails closed with identity_socket_occupied, printed as reason_code=identity_socket_occupied value_returned=false.

Shutdown. On SIGTERM/SIGINT and every exit path the broker unlinks its own socket (only while it is still a socket) and exits 0.

Readiness. Documented as accept-connect, never file existence; scripts/smoke-janusd-identity.sh pre-creates a stale socket, gates on a connect probe, and asserts clean SIGTERM shutdown with the socket removed. docs/runtime-accountability-runbook.md gains a "Broker sidecar lifecycle" section (persistent registry/audit paths, registry-directory hygiene, readiness probe, shutdown semantics).

Feature + version PR: #88
Tickets: JANUS-451 (context: JANUS-442, NIX-377, NIX-379, NIX-380)

Rust engine v0.1.30

Rust engine v0.1.30 delivers JANUS-450 and JANUS-452: runtime-authority denials are now diagnosable end to end.

identityd (JANUS-450). Every runtime-authority denial is answered with its specific value-free reason code (for example subject_not_enrolled, runtime_authority_request_context_mismatch) instead of the generic runtime_authority_request_denied, and every denial is audited in JANUS_RUNTIME_AUTHORITY_AUDIT_FILE as outcome:"denied" with that code — never a UID, PID, path, or value. Frames that never become a request are audited as runtime_authority_request_invalid. The startup precondition runtime_authority_config_invalid is split into runtime_authority_audience_invalid, runtime_authority_ttl_invalid, runtime_authority_release_digest_invalid, and runtime_authority_manifest_fingerprint_mismatch; janusd-identityd prints reason_code=… value_returned=false on every startup failure.

Clients (JANUS-452). Warden, janusd, and every runtime-authority client distinguish runtime_authority_unavailable (broker unreachable or client configuration incomplete), runtime_authority_reply_invalid, and runtime_authority_denied, the last carrying the broker's own token-sanitized code as broker_reason_code. Warden structured errors expose both fields.

Operators. The first allowed audit line for a freshly enrolled subject is the enrollment proof; an empty registry denies by design. The reason-code table lives in docs/runtime-accountability-runbook.md § Reason codes and denial evidence. Bare containers without a configured broker now report runtime_authority_unavailable (previously runtime_authority_denied).

Feature + version PR: #87
Tickets: JANUS-450, JANUS-452 (context: JANUS-442, NIX-377)

Rust engine v0.1.29

Rust engine v0.1.29 delivers JANUS-442 capability-named host projections for Pharos.

Callers name a capability (for example pharos-beacon-token) and a host. Janus resolves the reviewed env-file profile, derives and consumes the permit internally, and returns only value-free projection evidence (handle, generation, paths). There is no credential reveal path.

Feature PR: #85
Version prep: #86

Go envelope v1.182

Security rebuild of the Go envelope from protected main for JANUS-439.

• builds with Go 1.26.6, fixing GO-2026-6218 in net/url and GO-2026-6091 in html/template
• retains the in-product Knowledge section delivered in v1.181
• keeps govulncheck on both pull requests and pushes to main
• signed image, SBOM, provenance, scanner summary, and production admission receipt are produced by the release workflow

Production promotion is pending the exact released digest and the reviewed nixcfg pin/deploy path.

Rust engine v0.1.28

Rust engine v0.1.28 delivers JANUS-417 explicit non-approval permit issuance on the use plane. Operators can now run janusd-use permit issue with only a secret reference, approved-use profile, and purpose for Low and Normal secrets, plus HighValue secrets when the profile has strong egress and a permit TTL of at most 300 seconds. BreakGlass remains fail-closed on this path and continues to require the separate admin approval workflow with a maximum 60-second permit.

The policy is covered by the complete 4 classification x 5 egress mode x approval-state matrix, split-plane CLI tests, and a dual-path env-file smoke proving both approval-backed BreakGlass and direct Normal issuance without returning secret values. The release continues native amd64 and ARM64 publication with source binding, SBOM, provenance, admission, vulnerability scanning, and published behavior smoke evidence.

Rust engine v0.1.27

Rust engine v0.1.27 delivers JANUS-429 runtime accountability wiring. Every production CLI, Warden, permit, role, delegation, break-glass, recovery, and private daemon duty now passes through the local authenticated authority broker; a closed 46-action manifest is drift-checked against the runtime catalogs.

The release supports exactly accountability_legacy, authenticated_observe, and enforced_recorded. Enforced mode requires the reviewed identity migration, strict cutover record, healthy durable journal, pinned authority keys, and at least two active subjects; unmet prerequisites fail readiness and admission closed. Conflict handling covers all nine canonical duty pairs across restart, preserves distinct-subject success, and emits signed value-free evidence.

The release continues native amd64 and ARM64 publication with exact multi-platform digest, source, SBOM, provenance, admission, scanning, and behavior-smoke evidence. Rollback retains accountability history; operators should use docs/runtime-accountability-runbook.md for cutover, recovery, and rollback.

Rust engine v0.1.26

Rust engine v0.1.26 introduces the durable separation-of-duties journal foundation from JANUS-428. It adds signed authoritative operation references, an append-only hash-chained and epoch-signed local duty journal, verified opaque policy views, fail-closed restart/rotation/index/backup/restore behavior, and assurance coverage for all nine canonical duty conflicts.\n\nProduction authorization remains explicitly in the accountability_legacy posture in this release. Runtime-wide wiring and any enforced_recorded claim are reserved for JANUS-429.\n\nThe release continues native amd64 and ARM64 publication with exact multi-platform digest, source, SBOM, provenance, admission, scanning, and behavior-smoke evidence.

Go envelope v1.181

JANUS-419 adds an in-product Knowledge section to the Go envelope.

• 21 code-inventoried glossary concepts with exact closed vocabulary values
• eight illustrated workflow guides with enforced-today and boundary statements
• inline, theme-aware SVGs with no external illustration assets
• Rust-source and role-matrix drift tests
• desktop/mobile Playwright and accessibility assurance

Merged in PR #82.