FerroGate v2026.07.18

FerroGate v2026.07.18 — Secure Agent Gateway

First release since v2026.07.09. A large body of security-hardening, self-hosted worker, isolation, and storage-correctness work, all tested (full workspace suite green; live-Supabase and real-Firecracker validated).

Highlights

Self-hosted worker execution & transport

• Report-only self-hosted execution across the local-process backend, network/REST, and the real Firecracker backend (cloud = enforced, self-hosted = observe+record on a customer-owned host).
• Durable dispatch lease queue with restart no-drop / no-double-deliver coverage.
• Real mTLS transport (rustls trust-anchor verifier, client-cert 4-tuple binding, VerifiedMutualTls channel, cert-bound transport tokens with rotation) + downgrade-rejection policy.

Isolation & sandbox

• Per-VM Firecracker rootfs isolation (read-only shared rootfs + per-VM writable workspace); real-hardware microVM boot validated (rootfs mounted read-only).
• Local-process isolation backend with an adversarial containment suite (filesystem/network/process/namespace/resource/secret), fail-closed.

Storage correctness (found + fixed at release time)

• Schema initialization/validation now provisions the configured postgres_schema (auto-migration previously created tables in public when a non-default schema was configured — the configured schema stayed empty).
• Uniform postgres_schema pinning across the entire control plane; two billing/wallet schema-routing fixes from adversarial review; billing idempotent-retry connection-deadlock fix.

Security fixes

• Tenant-scoped admin accounts/roles/refresh tokens; response cache keyed on guardrail-policy revision (TTL-bounded DLP bypass); bounded + SQL-filtered worker/agent-run stores; sealed-exec argv[0] preservation.

Guardrails

• Two semantic security adapters (Presidio DLP/PII + LLM-Guard prompt-injection) with conformance + evaluation harness and shadow→promote→rollback loop.
• Durable per-check evidence + unified investigation view (usability-validated).

Verify per docs/supply-chain/release-verification.md (cosign signature + GitHub provenance + SBOM, pinned to workflow identity and image digest).