ActantOS v1.1.0 Stage 3 — Governed Enterprise Autonomy

v1.1.0 Stage 3 — Governed Enterprise Autonomy

Stage: Stage 3 done (built + tests pass)
Artifact tag: v1.1.0
Ship rule: Built + tests pass = done (no partner gate)

Highlights

• Multi-tenant foundation — required tenant selectors (no production t_demo defaults), OIDC JWKS + optional HS256-dev, service principals, RBAC, identity schema, PostgreSQL RLS migrations
• Hardened isolation — signed single-use execution tokens; fail-closed gVisor/runsc provider (Docker remains development compatibility only; no silent downgrade)
• Credential broker — AWS STS AssumeRole leases with hashed metadata and secret-residue scanning (tmpfs injection model)
• WORM evidence archives — signed evidence artifacts with Object Lock COMPLIANCE semantics and post-upload verification
• Productized SIEM — durable webhook + Splunk HEC connectors on a transactional outbox (retry, dead-letter, private-network denial)
• Release ledger — stage3-capabilities.json aggregate done with evidence fields; npm run stage3:validate

Frozen contracts

• /v1 intercept + tool-result shapes remain compatible
• Stage 1 kernel decision loop and Stage 2 ops surfaces remain available

Upgrade notes

1. Backup Postgres
2. Run migrations through sql/migrations/008_tenant_rls.sql (production Postgres)
3. Require explicit tenant_id (or principal tenant) on operator routes
4. For OIDC HS256 dev only: set ACTANTOS_OIDC_ALLOW_HS256=true plus client secret
5. Enable hardened gVisor mode only after runsc + profiles + proxy preflight pass
6. See docs/STAGE3_HOSTED.md and docs/STAGE3_RUNBOOK.md

Verification baseline

cd actantosd
npm test                 # 193 pass
npm run typecheck
npm run stage3:validate  # aggregate done
npm run release:verify   # typecheck + test + build + policy regression

Not claimed in this release

• Enterprise memory vault
• Firecracker microVM runtime (gVisor/runsc is the hardened path)
• Full multi-tenant managed SaaS commercial packaging
• Living external customer pilot proof (optional; not a ship gate)

Related

• Product ledger: actantosd/stage3-capabilities.json
• Capability ledger doc: docs/STAGE3_CAPABILITY_LEDGER.md
• Marketing site Stage 3 matrix: actantos.com/roadmap

ActantOS v1.0.1 Portable Agent Test

v1.0.1 Portable Agent Test

ActantOS v1.0.1 makes the first-run experience portable across Windows,
macOS, and Linux while preserving the frozen /v1 API.

New

• npm run quickstart installs dependencies, builds source clones (or uses the
  compiled service in a release tarball), starts
  an isolated in-memory server, tests an agent, and shuts the server down.
• The portable test verifies safe workspace reads are allowed, credential
  reads are denied, remote actions require approval, and decisions return
  audit evidence identifiers.
• Docker and Postgres are no longer required for the first product test.
• ACTANTOS_QUICKSTART_PORT can select another local port when 4310 is busy.

Requirements

• Node.js 22 or newer
• Git when cloning the repository

Quickstart

git clone https://github.com/kotobuki09/actantos-releases.git
cd actantos-releases/actantosd
npm run quickstart

A successful run ends with:

Portable agent test passed: 4 checks, 0 failed

Scope

The quickstart uses in-memory state for portability. Use the Compose-backed
Postgres setup for persistent audit timelines, evidence packages, and normal
self-host operation. This release does not claim external customer validation.

v1.0.0 Quiet Open-Core

ActantOS v1.0.0 — Quiet Open-Core

Public release repository: this repo (actantos-releases).

Govern every agent action before it executes.

ActantOS is an out-of-process, fail-closed runtime control plane for AI agents. v1.0.0 freezes the self-host Enforcement Kernel (actantosd): policy, approvals, sandbox, audit, Pi guarded tools, and an optional MCP gateway.

Stage

Stage	Open-Core / Design Partner
Meaning	Installable, API-frozen, lab-verified kernel
Not claimed	Living-customer "battle-tested in production" proof

Install

git clone https://github.com/kotobuki09/actantos-releases.git
cd actantos-releases
cp actantosd/.env.example actantosd/.env
docker compose -f actantosd/docker-compose.yml up -d --build
cd actantosd && npm install
npm run demo -- --url http://localhost:3100

Assets

• actantosd-1.0.0.tgz
• release-manifest.json
• ship-verification-v1.0.0.md
• v1.0.0-public-comms.md (website / social copy pack)

Website

https://actantos.io/v1

ActantOS v0.1.0

v0.1.0 Release Notes

Highlights

• frozen /v1 API contract for runtime, operator, and MCP gateway integrations
• verified upgrade path from v0.7.0-pilot-beta to v0.1.0
• release checklist, artifact manifest, and release packaging workflow
• expanded policy template pack to five starter templates
• stable MCP gateway client guidance for operators

Upgrade notes

• run npm run db:migrate before starting the upgraded service
• the demo tenant policy bundle is backfilled from the old placeholder policy text to the checked-in Cedar source
• db:seed-demo remains optional and is only for local demo fixtures

Verification baseline

• typecheck
• test
• build
• policy:regression
• smoke:fresh-install

Known limits

• this is a first public test release — API contracts may still evolve in minor ways
• Firecracker / gVisor sandboxing, full OIDC/SCIM, and multi-tenant SaaS are not in scope for v0.1.0