v0.11.2

Ghostship v0.11.2

Base image bump to KiroCrew v0.11.2 (TRN-307)

• Crew image now extends ghcr.io/kirodotdev/kirocrew:0.11.2 (multi-arch index digest sha256:b912fdb52f92b9d23b5189e91b44fd01b531a38a2f7dad161f2185af2c24aef9, covering amd64 and arm64). kiro-cli version inside crews: 2.36.0.
• KAS engine MCP server startup fix — resolves a startup failure in the KAS engine MCP server that could prevent agent tasks from starting.
• Crewmate broker overlay routing fix — corrects routing in the crewmate broker overlay, improving inter-crew communication reliability.
• MCP settings file corruption fix — prevents settings file corruption when the MCP settings JSON fails to parse; the file is now left unchanged rather than overwritten with an empty or invalid result.
• Migration schema unchanged from v0.11.1: (6, 5) — seed_kiro_db.py logic unchanged; verification annotation updated to v0.11.2 / kiro-cli 2.36.0 / 2026-11-04.
• Re-run ./install.sh to rebuild the crew image and pick up KC 0.11.2. Existing crews keep their current image until nuked and re-launched.

Reduce default Podman machine memory to 8 GB (TRN-306)

• GA_MACHINE_MEMORY default lowered from 16384 MB to 8192 MB. 8 GB comfortably supports 3 concurrent crew containers; the previous 16 GB default caused unnecessary memory pressure on hosts with 16 GB unified memory.
• Existing machines are unaffected — this is a new-install default only. To resize an existing machine: podman machine stop <name> → edit Memory in ~/.config/containers/podman/machine/applehv/<name>.json → podman machine start <name>. Or uninstall and reinstall.

ghostship v0.10.2

Bug fix

macOS dedicated Podman socket path — ghostship start and ghostship upgrade failed on macOS dedicated Podman machine installs introduced in v0.10.1 with statfs: no such file or directory errors.

Root cause: The v0.10.1 Linux fix for resolve_socket_path() incorrectly applied the {machine_name}/podman.sock path on macOS too. macOS dedicated machines use the in-guest socket (/run/user/<uid>/podman/podman.sock), not a host filesystem path.

Fix: Gate the Linux dedicated socket path on platform.system() == "Linux".

Upgrade: ghostship upgrade from v0.10.1 will regenerate compose.yml with the correct path.

v0.8.1

Ghostship v0.8.1 Release Notes

Overview

v0.8.1 is a hotfix release that addresses four bugs discovered after v0.8.0 shipped
and adds two feature improvements. The fixes cover: richer error detail when a crew
gateway rejects a request, a Caddy CA certificate volume name mismatch in status
output, Python bytecode leaking into Academy skill deliveries, and misleading wording
in Raven's order templates. The two feature additions are the ghostship-spawn Academy
skill for safe named-persona dispatch (resolving the Captain autopilot gap on non-kiro
backend crews) and Academy backend delivery to all harnesses, not only kiro.

---

New

ghostship-spawn Academy skill (TRN-263)

ghostship-spawn is a new Academy skill copied into every crew at launch. It provides
the four gateway operations that were previously unavailable to agents without
hand-crafted REST calls: named-persona dispatch, task detail, steering, and
continuation. The helper sends cookie-authenticated requests to the crew's fixed
loopback gateway only — agents do not assemble raw REST calls or handle session cookies
directly.

With this skill in place, Raven dispatches worker personas through the helper rather
than via hand-built gateway calls. This resolves the Captain autopilot gap that
previously prevented the sdd and independent-review templates from working on
Claude and Codex backend crews.

See the Architecture — Ghostship-spawn gateway skill
section for full details.

Academy backend delivery to all harnesses (TRN-264)

Academy skills, steering documents, and MCP server configuration now reach every
harness in the crew, not only kiro. At launch the transport stages Academy assets into
~/.agents/ and runs .agents/setup, which wires them into the native paths of every
harness detected in the image — for example ~/.claude/skills/ and ~/.claude/rules/
for Claude Code.

Claude crews previously received none of the Academy skills or steering docs. After
upgrading, relaunch existing claude-backend crews so they pick up the new delivery
mechanism.

Agent persona JSON files (academy/agents/*.json) continue to be delivered to
~/.kiro/agents/ on every backend — the gateway reads this directory to resolve named
dispatch for claude and codex crews as well as kiro.

---

Fixed

Gateway error detail now includes HTTP status and response body

When a crew gateway rejects a request and recovery gives up, the error returned to MCP
callers now includes the gateway's HTTP status code and response body (redacted, up to
500 characters). Previously, all rejection cases surfaced only the generic "crew …
is unresponsive" message — making a plain rejection such as Agent 'ghost' not found
indistinguishable from a genuine connectivity failure. Rejected requests now say so
explicitly, instead of suggesting a crew health check.

Caddy CA certificate volume name corrected

ghostship status and the install output now correctly show the Caddy CA certificate
path. Both previously looked up the volume as ga-portal-data, but Compose creates it
as ga_ga-portal-data. The lookup now uses the correct name, so the cert path shown
in status output can be used directly with caddy trust.

Academy skill bytecode excluded from crew delivery

Academy skills no longer carry Python bytecode (__pycache__/ directories and *.pyc
files) into crew containers. Previously, any compiled bytecode present in the local
Academy checkout was copied verbatim, which could trigger import warnings and wasted
space.

Raven order-template wording clarified

The sdd and independent-review order templates now tell Raven explicitly that a
change's artifacts describe the target behaviour after the change is applied, not
the current live behaviour. This prevents a self-referential hold where a change that
rewrites Raven's own rules caused Raven to treat the unmerged new rules as the current
standing order.

---

Resolved Limitations

Captain autopilot on Claude/Codex backends (from v0.6.0, v0.8.0)

Resolved by TRN-263 (ghostship-spawn).

The v0.6.0 release noted that Captain autopilot did not work on Claude or Codex backend
crews because Raven could not make the authenticated gateway calls needed by the sdd
and independent-review templates. This is now fixed: the ghostship-spawn skill
provides a cookie-authenticated helper that any agent can invoke without constructing
raw REST calls or managing session cookies, so the Captain loop works on all backends.

Relaunch existing non-kiro crews after ghostship upgrade so they receive the helper.

Claude Code attribution on commits (from v0.8.0)

Resolved by TRN-264 (academy backend delivery).

Claude-backend crews previously added Claude Code attribution trailers to commits and
PR descriptions (Co-Authored-By and "Generated with Claude Code" text) because the
setting to suppress this was not being baked into the crew image. The setting is now
applied at image build time. Relaunch existing claude-backend crews after
ghostship upgrade to pick up the corrected image.

---

Upgrading

Run ghostship upgrade to rebuild images and restart the transport. If you use
Claude or Codex backend crews, also relaunch them after upgrading so they receive the
ghostship-spawn skill and the corrected Academy delivery path:

ghostship upgrade
# Then, for each claude/codex crew:
nuke(crew_id, confirm=True)
launch(crew_id, backend="claude")   # or "codex"

See docs/configuration.md for the full variable reference, and
docs/auth.md for credential management.

v0.5.2

What's Changed

TRN-169: Fix presigned evac/supply URLs requiring Bearer auth

Presigned URLs returned by evac and supply were returning HTTP 401 without an Authorization header. Root cause: Caddy's blanket Bearer check fired before the request reached the Python transport (which already bypassed Bearer correctly for /files/ routes).

Fix: Add a ga-transport-files-presigned Caddy route matching /files/*?sig=*, ordered before the Bearer-gated files route. Presigned URLs are now fully self-authenticating — any HTTP client (bare curl, browser, S3 SDK) can use them without an Authorization header.

Changes:

• scripts/install.sh: new Caddy route exempting /files/*?sig=* from Bearer auth
• transport/auth.py: document the intentional Bearer bypass in _dispatch_file
• tests/unit/test_auth.py: 4 new tests for the presigned bypass
• tests/unit/test_hardening.py: regression guard for Caddy route ordering
• docs/architecture.md: presigned URLs documented as self-authenticating

Note: Requires re-running ./install.sh to regenerate the Caddy config on existing deployments.

v0.4.1

See CHANGELOG.md for full release notes.

v0.3.2

Security

• Ed25519 admiral signing (TRN-136) — Admiral mail signing moved from a shared HMAC secret to Ed25519 asymmetric keys. The private key never leaves the transport (persisted at DATA_DIR/secrets/<crew_id>.admiral_secret); each crew receives only the public key, mounted as a read-only, root-owned Podman secret it cannot modify even if compromised. The X-Admiral-Sig header and verify-admiral-sig exit-code contract (0/1/2) are unchanged. Operator action required: existing crews must be nuked and relaunched to pick up the new signing scheme — a plain restart does not migrate a crew. See docs/auth.md.
• Crew proxy no longer forwards transport credentials — the crew UI/API proxy stopped forwarding the inbound Authorization and X-Transport-Token headers down to a crew's own gateway. Crew containers share the ga-starboard network with ga-transport, so a compromised crew that captured either header could previously replay it directly against the transport's own control-plane API. Neither header is used by the crew gateway, so nothing downstream depended on them.
• starlette pinned to >=1.0.1 — closes CVE-2024-47874 and CVE-2026-48710.

API

• GET /openapi.json (TRN-129) — new public, unauthenticated endpoint serving an OpenAPI 3.1.0 schema generated at startup from the live route table and MCP tool registry. Reachable through Caddy's public port as well as directly on the transport.

Fixes

• Stale active-crew counts (TRN-132) — crews() and the GA_MAX_ACTIVE_CREWS limit check now cross-reference the registry against actual Podman container state instead of trusting a potentially-stale status field. A crew stopped outside ghostship no longer inflates the active count or blocks legitimate launches.

Captain templates

• independent-review — four concurrent independent reviewers (Wraith + 3×Banshee); change_name optional — scopes to a change or reviews the entire codebase. (independent-review-all merged in and deleted.)
• sdd — change_name accepts a comma-separated list for parallel multi-change execution with automatic worktree isolation and merge reconciliation. (sdd-parallel merged in and deleted.)
• SDD reconciliation attempts conflict resolution before escalating (TRN-140) — parallel sdd Ghost task now resolves merge conflicts before escalating to the Admiral.
• transport://orders is now a summary index (TRN-135) — use transport://orders/{name} for a specific template's full text. New GA_ORDERS_DIR env var for custom templates.

Install

• --client-only flag — skips container infrastructure, wires up just the CLI and agent harness integrations for machines connecting to a remote transport.
• Transport source hash detection — forces a clean rebuild when the version matches but the source tree has changed.

Testing

• Full-suite test bootstrap stabilized (TRN-144) — shared httpx stub module fixes spurious parallel-runner failures.
• test_uninstall_auth_preservation.sh now wired into the integration suite.

v0.1.1

0.1.1

• fix: dedicated-machine compose calls losing target on macOS (and uninstall on Linux)
• fix: Linux uninstall destroys auth file unless --keep-machine is passed
• fix: nuke does not clear scheduled jobs from registry
• chore: rename base-orientation image stage to base-admission
• ci: add release gate workflow for main branch

v0.1.0

Initial release of Ghostship — a multi-agent orchestration system for KiroCrew over MCP.

Run isolated KiroCrew crews in Podman containers with dedicated workspaces. Command them as Admiral from any MCP-connected agent.

What's in 0.1.0

• Crew lifecycle — launch, nuke, idle-stop and auto-restart, reboot recovery
• Task dispatch — six agent personas (Spectre, Ghost, Banshee, Reaper, Wraith, Raven); dispatch, steer, pickup
• Captain / standing orders — recurring Raven check-ins with the built-in sdd template for OpenSpec SDD workflow
• Scheduler — cron, interval, and one-shot delayed jobs per crew
• File exchange — supply (upload) and evac (extract) via presigned URLs; git bundle seeding
• Auth — device auth flow (Builder ID + IAM Identity Center), API key gate, admiral signature verification
• Transport — single-port MCP + REST + file transfer; podman-compose setup; start.sh for post-reboot recovery
• spec-ops loadout — built-in crew loadout for Spectre-Driven Development with OpenSpec
• macOS + Linux — verified on macOS and Ubuntu 22.04+