interpose v3.20.0

Install

curl -fsSL https://github.com/interposed/interpose-releases/releases/download/v3.20.0/install.sh | sh

Or pin to this version explicitly:

curl -fsSL https://github.com/interposed/interpose-releases/releases/download/v3.20.0/install.sh | sh -s -- --version v3.20.0

Verify

Every artifact is signed with Sigstore cosign (keyless — no key to trust,
the signature is bound to this repo's release workflow and logged in Rekor).
Each <file> ships a <file>.sig and <file>.pem. To verify a download:

cosign verify-blob \
  --certificate interpose-v3.20.0-linux-amd64.tar.gz.pem \
  --signature   interpose-v3.20.0-linux-amd64.tar.gz.sig \
  --certificate-identity-regexp "^https://github.com/interposed/interpose/.github/workflows/release.yml@" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  interpose-v3.20.0-linux-amd64.tar.gz

---

interpose v3.20.0

• Agent-approval wait-verdict timeout raised from 60s to 5 minutes, giving a human time to answer before an agent action expires.
• Lab sandbox sessions push the box's real enforced policy to the member on open (network allow/deny/ask, trust/quarantine exec, filesystem jail), so a governed terminal reflects the actual policy read-only.
• Ephemeral sandbox sessions are ended (not paused) on detach, so a closed lab tab no longer lingers in the operator Sessions list.