v0.16.1

v0.16.1 closes the proven macOS SecurityServer Keychain route and restores Linux project-ancestor metadata used by Git 2.56. It also adds installed-release network checks and signed cross-version upgrade/rollback acceptance. Linux support remains Ubuntu 24.04 amd64 with glibc 2.39.

Upgrade notes: tools that obtain macOS credentials through SecurityServer inside the fence need an alternate supported credential source. Other Keychain backends are not claimed isolated. Managed Linux installation requires the six signed assets for the chosen release; all six assets are now published after real signed cross-version and broader-network acceptance passed. Existing source/candidate installations cannot migrate through this installer. Unix sockets remain a named limitation below Landlock ABI 9.

Fixed

• Release acceptance bounds subprocess groups and lifecycle probes, refuses optimized Python execution, and checks the specific stale-executable refusal.
• Linux interposer stat-family calls permit metadata on canonical ancestors of the project root, restoring path walking used by Git 2.56. Ancestor directory reads, sibling metadata and file reads remain denied; explicit denies and malformed policies retain precedence.

Added

• Disposable hosted acceptance checks for immutable signed release upgrade/rollback, preserved config and audit state, and installed Linux/macOS network enforcement. Direct Linux denial requires packet counters at the unchanged default-drop policy and reachable unfenced controls. These checks do not publish assets.

Security

• macOS profiles now deny com.apple.SecurityServer Mach lookups independently of file-path denies, hardened mode and proxy configuration. A synthetic private-keychain regression proves both Security.framework query APIs are blocked and become readable when only the service deny is removed; ordinary file reads still work. Tools using this service for Keychain credentials inside the fence must use another supported credential source. trustd and ocspd remain allowed; other Keychain backends are not claimed isolated. System curl and Go HTTPS, git over HTTPS and the Claude Code preset have live allowed controls. Attributed kernel service denials enter the signed audit log as secret_blocked, subject to the existing unified-log delivery and event-cap limits; OCSF identifies the Mach service. This closes a missing service boundary, not a demonstrated bypass of an already-denied Keychain file.

Release source commit: 13536800ab397c0b2f4a2ea3d9dc1fbc54f7e104 (promotion #289). Both manifests verified against the exact v0.16.1 workflow identity; embedded build metadata and every payload checksum matched. Production build and fresh-host CONFINED/KERNEL acceptance passed.

Linux installer publication acceptance

The signed cross-version and network run passed for v0.16.0 and v0.16.1. It verified upgrade, repeat installation, normal downgrade refusal, explicit rollback, re-upgrade, stale-executable refusal, unchanged config/audit state and retained release bytes, and an AUTHENTIC closed audit after rollback. Both versions passed allowed and denied HTTP/HTTPS plus direct TCP/UDP probes on Ubuntu 24.04 amd64 and macOS 15.7.9 arm64. Linux required reachable unfenced controls, packet-drop counters at the unchanged default-drop policy and startup refusal after helper failure; macOS required denial errnos. No applicable acceptance job was skipped.

Support is Ubuntu 24.04 amd64 with glibc 2.39. Source/candidate installations cannot migrate through this installer. Linux CONFINED Unix-socket isolation remains unavailable below Landlock ABI 9; fresh-install doctor exit 3 was only that named limitation. AUTHENTIC verifies recorded audit integrity, not complete denial coverage. Python and Go are test/build tools, not installation dependencies.

Acceptance summary and asset hashes · Raw receipts, audit outputs and network observations · Authenticated installation guide. The guide’s publication prerequisites are now satisfied.

Distribution completion

Main push CI passed. Back-sync merge 3f1340ed1f04c96a1f11638c922f24c27394bf65 includes main as an ancestor with an identical tree; next-push CI passed.

Homebrew tap ca9ffc013c3737b56fb228e1239a92c33a7dffa3 installs v0.16.1. Clean macOS 15.7.9 arm64 source installs, brew tests and product smoke passed, including signed SEATBELT and an AUTHENTIC closed audit. Doctor’s sole warning was the hosted runner’s passwordless sudo; all five boundaries were enforced. The Linux-only syscall self-probe was explicitly skipped on macOS. Two independent source-tarball downloads matched SHA-256 df1ecd15e2445a5efeae61fc33b55b107d77f95effc4abac47b8a0f70c438fab.

Release handoff · Raw Homebrew smoke evidence.