Skip to content

v0.210.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jul 01:34
v0.210.0
0808fd7

[0.210.0] - 2026-07-21

Features

  • (engine) Facet vocabulary — Capability and Profile
  • (engine) Level predicate evaluator
  • (engine) Compile level TOML; author the three local levels
  • (engine) Supply-chain sub-facets (source, pinning, exec-surface)
  • (engine) Resolver scaffolding — classify_locus (path -> LocalLocus)
  • (engine) Resolver — echo, the reference structural certification
  • (engine) Resolver — cat and grep (the file-read family)
  • (engine) Wire the coexistence bridge, fail-closed flags, review hardening
  • (engine) Resolve rm to a destroy profile (fail-closed, no admitting level yet)
  • (engine) Author the developer level (destroy carve-in)
  • (engine) Resolve mkdir + shared write helpers
  • (engine) Resolve touch
  • (engine) Resolve cp + generalize the developer write carve-in
  • (engine) Resolve mv
  • (engine) Resolve the head/tail/wc read family + numeric -NUM shorthand
  • (engine) Resolve ln as cp-by-reference (gate the target locus)
  • (engine) Resolve dd — key=value operands break the getopt model
  • (engine) Resolve tar — dashless flag bundles + mode-split profiles
  • (engine) Resolve sed — a flag (-i) flips read into in-place write
  • Cwd-aware path classification via a scoped context (HP-19 #1, both layers)
  • Wire the harness project root + CLI --cwd/--root (HP-19 #1 live)
  • (cst) Track intra-line cd across a chain (HP-19 #2)
  • (engine) HP-20 filesystem region model — read/write path faces
  • (engine) Go live — the behavioral engine is authoritative, no opt-out
  • (engine) Bind for-loop variables to their in-list locus
  • (engine) User-level directory trust grants + file-location docs
  • (engine) Workspace-boundary file model + role/scheme-aware command gate
  • (engine) Add the retrieval-granularity facet axis (#1)
  • (engine) Sibling-workspace (adjacent) locus — reach a peer project
  • (hook) Reach the upper levels via a configured ceiling
  • (hook) Support LOWERING the auto-approve ceiling (reader/paranoid)
  • (hook) Make the coverage fallback level-aware — the full editor plan
  • (fd) Delegate -x/--exec to the inner command, like find -exec
  • (credential) Sweep spec + gate op/vault credential reads
  • (kubectl) Gate get secret/secrets as credential-read
  • (credential) Gate password-manager / secret-store reads (sweep batch 1)
  • (engine) Credential_first_arg — the value-dependent credential gate
  • (cursor) Make Cursor a deny-harness (allow is ignored on the CLI)
  • (engine) Decrypt-read archetype — decrypt-to-screen as a facet capability
  • (engine) [[command.flag]] classifying-flag mechanism; gate age -d
  • (sops) Restructure for 3.13 subcommands; gate decrypt to decrypt-read
  • (gpg) Classify -d/--decrypt as decrypt-read
  • (engine) Flag escalation on bimodal subs; gate openssl decrypt
  • (engine) Unless_flags — neutralize a profile when output is diverted; gate openssl private-key subs
  • (gpg) Require an inspection command — deny bare-file implicit decrypt
  • (openssl) Gate pkcs12 -nodes key extraction; extend unless_flags to escalating flags
  • (gpg) Classify --decrypt-files as decrypt-read
  • (rails) Cover db:test:prepare and db:test:load
  • (jjpr) Surface jjpr watch --help
  • (yarn) Run test runners via safe delegation (jest/karma/mocha/vitest)
  • (tmutil) Add read-only Time Machine query subcommands
  • (safe-chains) Allow its own read-only inspection flags
  • (nudge) Explain the peer dot-shield instead of a generic 'outside workspace'

Bug Fixes

  • (engine) Classify_locus fail-closed ordering + proptest gate
  • (engine) Re-author read-local around locus (fail-closed secret handling)
  • (engine) Harden fail-open cases found by adversarial probing
  • (engine) Cp worktree overwrite is recoverable, not effortful
  • (engine) Cp optional-argument longs must not swallow an operand
  • (engine) Sed resolver worst-cases the exec command (RCE parity)
  • (shell) Treat xargs -I replacement string as an invisible stdin item
  • (engine) Grep resolver reads dash-patterns as patterns, not flags
  • (find) Bind -exec {} to the find path locus; add composition harness
  • (gcloud) Rescope subgroup-name globs to per-subgroup read verbs at every depth
  • (az) Rescope subgroup-name globs to per-subgroup read verbs at every depth
  • (pathgate) Gate ~156 ungated output-flag/positional writes (output-flag sweep)
  • (pathgate) Close the output-flag sweep residuals (16 more gates)
  • (pathgate) Close the positional last-arg writer class end to end
  • (copilot) Correct hook config path to ~/.copilot/hooks; allow is honored
  • (ansible-vault) Classify decrypt as decrypt-read (was a bypass)
  • (openssl) Harden decrypt-read against -out/-text/-EncryptedData_decrypt bypasses
  • (openssl) Close -pubout+-text and the --/- alias family (review round 3)
  • (openssl) Fail-closed output-destination check for the resolver
  • (openssl) Reject a dash-leading -out value (parser token-swallow)
  • (pathgate) Gate a sensitive path hidden in a glued -flag=path token
  • (engine) Make flag_present cluster-aware for short classifying flags
  • (pathgate) Gate a short-glued -Xpath (no =) into a simple whole-command gate
  • (pathgate) Close ..-escape/$VAR glued-flag bypass; gate wget warc/cookie writes
  • (pathgate) Gate command-substitution operands in the simple path gate
  • (cargo) Let cargo about accept its own --version/--help

Refactor

  • (engine) Review round-2 code-health + medium coverage
  • (engine) Shared Flags walker for the fixed-flag resolvers
  • (engine) Intention-revealing capability constructors + shared helpers
  • (engine) Split resolve into flags/locus/capability submodules
  • (engine) Funnel cp/mv/ln through a transfer_profile builder (HP-18 rung 2)
  • (engine) Derive the conservation sweep from a resolver-side operand contract
  • (engine) Remove shadow mode; add with_mode test override
  • (opencode) Drop --opencode-config (it advertised an allowlist it never produced)
  • (openssl) Classify decrypt/private-key disclosure in an engine resolver

Documentation

  • (design) Specify the admin level; resolve the containment question
  • (design) The golden-set — full corpus + settled decisions
  • (design) Behavioral taxonomy v1.4 — retire ci, add yolo, per-ecosystem pinning
  • (design) Safety by positive assertion — the fail-closed rule
  • (design) Reframe secret classification as locus + disclosure (fail-closed)
  • (design) Propose the attested-typical basis (third epistemic state)
  • Record the scope / trust-model boundary (identity by name/path, not signature)
  • (design) HP-17 session-scoped grants + record install-clause revision
  • (design) Reflect the write-family resolvers in the golden-set & levels
  • (design) Note ln creation-time target gating in HP-5
  • (design) HP-18 capability laundering + the guard ladder
  • (design) Mark HP-18 guarded — all three rungs shipped
  • (design) HP-18 rung 3 refinement landed — resolver-side operand contract
  • (design) HP-19 cwd-blindness — correct the earlier 'accepted residual' framing
  • (harness) Hook-payload capability matrix + rubric + e2e note
  • (design) Mark HP-19 resolved (with residuals)
  • (design) Drop the install-time-root dead end (HP-19)
  • (design) HP-20 — a positive path-admissibility model (parked)
  • (todo) Mark cargo-fuzz done, protected-location won't-fix, add harness grid
  • (todo) Record credential sweep round-2 findings (value-dependent residuals)
  • (harness) Claude Code decision contract — VERIFIED LIVE
  • (harness) Consolidate the per-target verification scorecard
  • (harness) Cursor CLI verified live — allow IGNORED, deny works (finding)
  • (harness) Opencode integration is INERT — pattern generator is a stub (finding)
  • Regenerate COMMANDS.md and command book for the pre-1.0 batch
  • Regenerate for decrypt-read; record the sops/age/ansible-vault batch
  • Regenerate for gpg/openssl decrypt gating; record in TODO
  • Regenerate for ansible-vault decrypt gating
  • Regenerate for gpg require_any + openssl private-key gating; close #2/#3 in TODO
  • Regenerate for openssl pkcs12 gating; close pkcs12 in TODO
  • Regenerate for openssl decrypt hardening + gpg --decrypt-files
  • (todo) Record the openssl engine resolver + decrypt-read convergence
  • Regenerate for the coverage additions
  • Correctness pass and prose cleanup for the 0.210.0 release

Performance

  • (cst) Make word brace-expansion linear, not quadratic

Testing

  • (engine) Facet-monotonicity coherence check + shared generators
  • (engine) Level -> TOML -> Level round-trip
  • (engine) Golden-profile facet coverage + the data-driven corpus gate
  • (engine) Fix the vacuous corpus gate + cover the rollout modes
  • (engine) Use a designated sentinel for the unresearched-command stand-in
  • (engine) Proptest guarding against capability laundering in transfers
  • (engine) Corpus-wide conservation sweep (HP-18 rung 3)
  • (engine) Prove the cwd-blindness gap at engine + production layers
  • (engine) Rerunnable shadow-validation sweep
  • (registry) Harden the cloud-batch review findings — footgun guards + model limits
  • (pathgate) Sweep guard for ungated output-flag writes + gate asciidoctor/graphviz
  • (registry) Guard the decrypt-read class end to end
  • (registry) Corpus ratchet + bimodal-sub structural guard for decrypt-read
  • (registry) Extend the decrypt-read corpus for openssl keys + gpg bare-file
  • (pathgate) Prove glued-flag handling with a spelling-invariance property

Miscellaneous

  • (fuzz) Cargo-fuzz scaffold + nightly CI for the classifier
  • Drop levels/default.toml.tmp (stray, accidentally committed)
Assets 8
Loading