Recuse v0.1.1 — Debian package + Kubernetes adapter

Adds a Debian/apt package for the SSH adapter and a Kubernetes adapter, on top of the v0.1.0 SSH + PostgreSQL signal.

Install on Ubuntu

One line (SSH signal — set your policy URL):

curl -fsSL https://raw.githubusercontent.com/mthamil107/Recuse/v0.1.1/adapters/ssh/bootstrap.sh \
  | sudo bash -s -- --ref=https://yourco/ai-policy

Or the .deb (attached below, CI-built + smoke-tested):

sudo apt install ./recuse-ssh_0.1.1-1_all.deb

Kubernetes (new)

A ValidatingAdmissionWebhook that emits the RECUSE/0.1 signal on governed create/update/delete/exec/port-forward by non-exempt identities — default warn (non-blocking; the agent recuses), deny optional. Works on EKS, k3s, kubeadm. Cannot wedge a cluster: failurePolicy: Ignore (fail-open), system namespaces excluded, system/own identities exempt, kill-switch documented. Image: ghcr.io/mthamil107/recuse-webhook:v0.1.1. See adapters/kubernetes/. (Admission webhooks don't see reads; that's documented.)

Assets

• recuse-ssh_0.1.1-1_all.deb — Debian package (attached by CI on this tag).
• recuse-pg-proxy-linux-amd64 + SHA256SUMS — prebuilt PostgreSQL proxy (static ELF).

Cooperative governance signal, not a security control (spec §9).