SIQ Agent Security 0.4.1

Windows + WorkBuddy 修复正式版。固定源码 a620a31b1dccdc7d2061e97ed4378c574321860d（PR #111，已合入 main），从同一已验证源码重新构建并签发 0.4.1；保留既有 0.4.1-rc.1 和 0.4.0 制品。

• 包含 Windows 私有文件/路径检查、受管配置写入与诊断、状态兼容、调用关联及相关回归修复，保持最小授权与失败关闭。
• Windows 原生组件 CI 全量退出 0（55 包；67 条条件/平台 skip 不计通过）；Linux 源码测试、vet 与重点 race 检查通过。
• 四目标制品：Linux amd64/arm64、macOS arm64、Windows amd64。沿用原 publisher Ed25519 信任根；独立验证实际 Skill、四目标二进制 pin、八资产及包内一致性通过。
• 0.4.1 最终包的 Linux ARM64 全新状态 start/status/pair/控制台/stop 检查通过；篡改 Skill、二进制及错误公钥三项均拒绝暂存。

下载完整离线包 siq-agent-security-0.4.1-bundle.zip，按包内 INSTALL.md 使用固定官方公钥核验实际 Skill 和目标程序后安装。SHA256SUMS 用于传输核对，不能替代 publisher 签名。已有状态先按安装说明检查 reader/writer 与 Windows profile 兼容性；不要把旧程序覆盖到不兼容的已升级状态。

验收范围：Windows 正式包安装/升级/回滚和真实 WorkBuddy N、R/W/T、J、F 新批次仍待专用实例验收。正式发行状态不代表该原生业务矩阵已完成，也不代表 Authenticode 或 Apple 公证。未扩大 Grant、自动续期、重放 uncertain 或改写历史实验数据。

源码原生 CI：https://github.com/maoyadongsh/siq-agent-security/actions/runs/36379619929

SIQ Agent Security 0.4.1-rc.1 — Windows WorkBuddy 验收候选

0.4.1-rc.1 是供 Windows WorkBuddy 新批次验收的正式发行身份签名候选，现已公开为预发布版，不是稳定版；0.4.0 继续为 Latest。

固定源码：a620a31b1dccdc7d2061e97ed4378c574321860d；合并提交：3f0f9b585628cae07347ab9e9c50af8e9ecde0dc，二者代码树一致。

本次修复 Windows 配置暂存后复验和有限改名重试、连接器祖先 junction 拒绝、UNC 拼写兼容，并修正跨平台测试夹具。原 publisher Ed25519 签名绑定 Skill 实际内容和四平台二进制 pin；不替换发行信任根，不修改已发布 0.4.0 资产。

源码验收：远端 Windows 55 包完整退出 0，67 项条件/平台 skip 不计通过；Linux 全模块、vet、相关 race 通过。真实 WorkBuddy 桌面新批次 N / RWT / J / F、Windows 安装升级重装回滚尚待执行；项目签名不是 Windows Authenticode 或 Apple 公证。

Windows 验收建议下载完整离线 bundle，按包内 INSTALL.md 使用固定官方公钥先验签，再在专用实例中继续。完整包、Skill ZIP 和四平台二进制均已公开。不得扩大业务 Grant 或自动续期。

签后验证：八资产一致、官方签名及四目标 pin 通过；Linux ARM64 最终离线包首次启动/status/pair/控制台/stop 通过；三项篡改负向均退出 3。Windows 正式包仍需原生验收。

SIQ Agent Security 0.4.0

SIQ Agent Security 0.4.0 is the signed stable personal-client release built from main commit 2cd61160849f50794c2dc632771a6e6ed6149eef.

Highlights:

• agent-assisted browser connection without manually copying a pairing code
• fixed 24-hour personal management sessions; connection requests expire after 5 minutes
• unified agent, Skill, permission and task visibility
• visual permission management with batch revoke support
• signed Skill plus Linux amd64/arm64, macOS arm64 and Windows amd64 binaries

Verification completed before publication:

• full release source inventory fixed and checked before build/signing
• all six GitHub workflows for the fixed source commit passed
• official publisher trust root, Skill content and all four binary pins verified
• Linux ARM64 fresh-state start/status/pair/console/stop passed
• Skill content, binary and wrong-key tamper probes rejected 3/3

Installation:

1. Download siq-agent-security-0.4.0-bundle.zip and SHA256SUMS.
2. Verify the checksum and signed manifest before startup.
3. Follow the bundle INSTALL.md using a new state directory.

Scope boundary: Linux ARM64 has native fresh-state verification. The other targets have build and signature-pin verification only; this release does not claim native installation, upgrade/rollback, Apple notarization or Windows Authenticode acceptance on those targets. The personal-client bundle does not deploy the enterprise Control API, Edge or Connectors.

SIQ Agent Security 0.4.0-rc.3

Signed personal-client release candidate built from main commit 2cd61160849f50794c2dc632771a6e6ed6149eef.

Highlights:

• current personal console with agent-assisted browser connection and fixed 24-hour management sessions
• agent, Skill, permission and task visibility with batch permission management
• signed Skill plus Linux amd64/arm64, macOS arm64 and Windows amd64 binaries

Verification completed before publication:

• source inventory fixed and checked before build/signing
• four binary pins and official publisher trust root verified
• Linux ARM64 fresh-state start/status/pair/console/stop passed
• Skill, binary and wrong-key tamper probes rejected 3/3
• all six GitHub workflows for the fixed source commit passed

This is a prerelease. 0.3.1 remains Latest. Linux ARM64 native verification does not establish native installation, upgrade or rollback acceptance on the other targets. The personal-client package does not deploy the enterprise Control API, Edge or Connectors. Use the complete bundle and verify it before startup.

SIQ Agent Security 0.3.1

SIQ Agent Security 0.3.1 正式版。

本版从固定主线源码 f3d9c3f0933f3b08d15b2d3dbc522f409c77a355 构建，使用现有发行信任根对实际 Skill 内容及四目标程序摘要签名。

本版更新

• 更新包内 Skill 操作指引：明确已签名安装与源码开发边界、首次 start、浏览器配对、人工审批及 Writer 锁约束。
• 对齐当前宿主范围：Linux 的 OpenClaw/Hermes，macOS/Windows 的 OpenClaw/Hermes/WorkBuddy；CodeBuddy 仅保留历史兼容与安全退出。
• 源码仓库完成 research、evaluations、platforms 导航整理，文献归位、过时入口清理，以及应用、适配器、合同、评测等模块 README 与授权/效果核验流程图更新。
• 提供可复用发行验包、公开回读与源码基础检查工具。运行时、Web 功能、适配器实现与合同相对 0.3.0 未改变，本版不新增平台验收承诺。

下载与首次使用

选择 siq-agent-security-0.3.1-bundle.zip 完整离线包，解压后按包内 INSTALL.md 验签，选择本平台程序，通过 start 初始化独立状态并启动，再在本机浏览器配对。启动服务不自动安装宿主钩子或批准权限。

另提供签名 Skill ZIP、Linux amd64/arm64、macOS arm64、Windows amd64 四目标二进制，以及 SOURCE-INFO.json 和 SHA256SUMS，共八个附件。GitHub 自动生成的 Source code 压缩包是开发源码，不是已签名安装包。

验证与支持范围

发行前验证完整资产清单、校验和、官方根签名、实际 Skill 内容、四目标程序 pin、包内外一致性与安装说明；在 Linux ARM64 上运行本版最终包的空状态启动、status、pair、控制台与停止链路。

其他三目标完成构建和签名摘要验证，未声称完成本版原生安装、升级回滚、系统服务或全部宿主验收。既有四目标源码检查和历史宿主结果仍属于各自候选。项目签名不等于 Apple 公证或 Windows Authenticode。

0.3.0 与更早发行资产及签名保持不变。研究源码标签、历史实验分母和证据也保持原身份。

SIQ Agent Security 0.3.0

SIQ Agent Security 0.3.0

正式发布版本，源码固定为 83fde2df0bcfc817d85568978e3881e22474815e。基于已集成的个人客户端、Windows、macOS、Linux 双宿主和 OpenShell 阶段成果，使用原发行密钥重新签发版本一致的程序、Skill 及 v3 client-compatible 清单。

与 0.3.0-rc.1 相比，产品功能源码保持一致，更新版本身份、签名及下载地址，并将首次启动的完整步骤写入包内 INSTALL.md。原 RC 及其制品保留。

下载和启动

普通用户下载 siq-agent-security-0.3.0-bundle.zip，解压后按包内 INSTALL.md 选择系统对应程序，先验签并安全暂存，再运行已验证程序的 start，初始化状态后启动服务并配对浏览器。无需安装 Go 或编译 UI，验签需要 Python 3。

还提供 siq-agent-security-skill-0.3.0.zip、Linux amd64/arm64、macOS arm64、Windows amd64 四目标二进制，以及 SOURCE-INFO.json、SHA256SUMS。独立 Skill 获取程序必须走明确启用的签名 URL 下载和校验路径。GitHub 自动生成的 Source code ZIP 是开发源码，不是签名安装包。

注意：bootstrap 调用 serve，只适用于已初始化的状态目录；首次使用按 INSTALL.md 的已验签 start 路径操作。在线安装指南。

本版本验证范围

• 最终压缩包 14/14 验证通过，包含原发行根验签、实际 Skill/二进制校验、六条篡改或不受信输入拒绝，以及 Linux ARM64 bootstrap、控制台、正常停止。
• 包内实际 INSTALL.md 命令在 Linux ARM64 空状态目录中通过验签暂存、初始化启动、身份检查、配对、控制台和正常停止验证。
• 四目标交叉构建、UI 重建与提交 embed 一致性、自扫描及秘密扫描通过。
• Linux amd64、macOS arm64、Windows amd64 本版完成构建和签名核对，仍属实验性验证范围，尚未完成本版原生安装/升级及完整宿主复测。Linux ARM64 的上述检查也不代替全部升级/回滚、宿主与性能验收。
• GitHub 正式发布状态不提升清单中平台能力等级，不宣称所有平台稳定或生产验收通过。项目清单签名不是 Apple 公证或 Windows Authenticode；OpenShell 远端单任务停止和部分性能条件继续独立记录。

完整包 SHA-256：6132d68fa97b6b01fba36355a0636650cb1180cb0d703e0b48a4fcafd8d4211e。SOURCE-INFO 与 SHA256SUMS 为描述性元数据，不是额外的发行者签名；包内 published: false 保留打包时事实，发布回读结果单独记录。

SIQ Agent Security 0.3.0-rc.1

SIQ Agent Security 0.3.0-rc.1

基于集成主线 58ab22e882452116444eb00e47e14cecdf98772a 签发的候选安装版，包含已合入主线的个人客户端、Windows 与 OpenShell 阶段开发成果。它为当前源码提供匹配的签名安装包，解决直接复制开发源码缺少发行清单而无法 bootstrap 的安装入口问题。

安装资产

• 完整离线包：siq-agent-security-0.3.0-rc.1-bundle.zip，含四目标程序、签名 Skill、许可及 INSTALL.md。
• 独立 Skill：siq-agent-security-skill-0.3.0-rc.1.zip；必须显式设置 SIQ_AGENT_SECURITY_ALLOW_DOWNLOAD=1 才允许下载本版本二进制。
• 原始二进制：Linux amd64/arm64、macOS arm64、Windows amd64。
• SHA256SUMS 与 SOURCE-INFO.json 提供摘要和构建来源；它们本身不是额外发行者签名。

GitHub 自动生成的 Source code 压缩包是开发源码，不含发行清单，请下载上述安装包。完整包解压后，将 SIQ_AGENT_SECURITY_BIN 设置为对应 bin/ 程序的绝对路径，再运行 skills/siq-agent-security/scripts/bootstrap.sh（Linux/macOS）或 bootstrap.ps1（Windows）。沿用正常系统脚本策略。签名校验失败继续拒绝启动。

验证与边界

本版本使用原发行密钥，v3 client-compatible 清单绑定实际 Skill 内容及四目标二进制，未更换公钥、复用旧清单或放宽验证。最终包通过 13 项验证，包括 Linux ARM64 隔离 bootstrap、控制台、正常退出、六条篡改/不受信输入拒绝；UI 重建与固定源码 embed 一致，Skill 自扫描为 admit_with_conditions。资产已完成秘密扫描。

这是一版预发布：其他三个目标本次仅完成构建及签名摘要核对，尚未实机安装或升级验收；本次结果不扩展为三宿主、OpenShell 或性能完整验收。项目清单签名不等于 Apple 公证或 Windows Authenticode。历史版本保持不变。

完整包 SHA-256：8798594a13f2acb70343d3b4292006e974baf207955ec8aa737203cec62a9b14。

research-v0.1.0-rc.1 — licensed research source

research-v0.1.0-rc.1 — source research prerelease

This prerelease makes SIQ Agent Security's existing research implementation explicitly licensed and easier to reproduce, inspect and cite. It includes Apache-2.0 for project-owned software, CC BY 4.0 for listed original research documents, preserved upstream notices, software citation, security/contribution/governance files, six issue forms and three-track reproduction instructions.

The fixed control corpus and existing verifier remain the evaluation engine. Local development checks passed all 23 expectations (318 receipts and 20 effect envelopes verified) and all nine UI fixture cases. The hosted Linux research job adds key-free browser reproduction; its final source/run identity is recorded in the release's external SOURCE-INFO and CI record. Earlier real-model failures and V5 competition identities remain intact. No new paid model run, independent reproduction, accepted paper or DOI is asserted.

Distribution: source-only, with a detached Sigstore digital signature added on 2026-09-09. Verify SHA256SUMS.sigstore.json against this repository’s GitHub Actions release workflow identity, then check SHA256SUMS against the source archive and SOURCE-INFO.json. Verification instructions. Original assets and source identity are unchanged; SOURCE-INFO.json preserves the initial unsigned packaging status. No new native binary acceptance or historical Skill publisher-key signature is claimed. Source/dependency license inventories are included; separately installed Python/model/OS dependencies retain their own terms. Use REPRODUCIBILITY.md to build and run locally.

Main now has PR/check protection, private reporting, platform secret scanning/push protection and dependency security updates. The sole-maintainer administrator exception is disclosed. A previously exposed development-only task seed remains in history; the owner confirmed no external use, and the current local key differs. Do not reuse historical private material.

Known limits: same-UID processes are not isolated, receiver evidence is scoped, source trust/classification has operator assumptions, and fixed small samples do not establish universal agent security. Binary research distribution, long-term archival and external replication remain separate milestones.

Exact release source: aefab111c7fcad9075c8f429f97c9eab519dcd22. Archive SHA256: 4a741a767faae5875ab2ec765b1c91d7f0eca076f5de67cff97ea59d1d4b1779. PR #7 integrated after all 31 required checks passed. The release upload is followed by a fresh download and checksum readback.

Sigstore signing and fresh-download verification succeeded: https://github.com/maoyadongsh/siq-agent-security/actions/runs/34314920961

agentshield 0.1.0

AgentShield 0.1.0 binaries pinned by skills/agentshield/skill-manifest.json.

Judge path: AGENTSHIELD.md (source go build + serve). bootstrap does not download these URLs.

support_matrix has no supported rows. filesystem / process are never effective.

Optional asset: agentshield-skill-v0.1.0.zip is the Skill directory + signed manifest, not the judge reproduction path.

siq-agent-security 0.2.0

siq-agent-security 0.2.0 binaries pinned by skills/siq-agent-security/skill-manifest.json.

Judge path: AGENTSHIELD.md (source go build). bootstrap does not download these URLs.

support_matrix has no supported rows.