v0.1.1

Changelog

• 3f99eea fix(release): de-quarantine the whole cask staged tree so bundled limactl/qemu are not killed by Gatekeeper on first init
• 394b0d7 chore(release): skip Homebrew cask upload on prereleases so rc tags never overwrite the stable cask
• fbe54a1 docs(architecture): close the review gaps (serve exposure, filesystem, egress network, DNS pinning, introspection sandbox, replay, catalog enforcement)
• 29714a1 feat(mcpgateway): pin each USES edge to the sub-agent's build-time tool catalog, refusing and stripping uncataloged tools
• 3eac365 feat(egress): bound CONNECT hostnames to a strict charset at the proxy and re-check them in the daemon's log parse
• 0f374ce docs(architecture): drop the redundant identity-derivation figure, fold its chain into the section intro
• b2a023f docs(architecture): add Figure 3 (secret flow) and renumber the identity figure to Figure 4
• c816e5c feat(egress): fail fast when serving (hold for run/call), show all three grant scopes in blocked-host errors, and wire in Figure 2
• c3b02ac archi.md
• 44ad4ac archi.md
• 4697f02 feat(egress): deny-default egress with interactive approval and operator egress/secret config; remove observe
• 5fca683 docs ready
• 9fbfd43 docs: trim README support note and SECURITY supported-versions section
• bd5fee1 docs: add per-command guides and Vesselfile, reasoner, and architecture references
• 980257c docs(readme): rework the walkthrough to tag-based examples, comment each block, add tip callouts, state prerequisites, and point commands at --help and docs
• 783290f feat(store): add 'store rm' to remove bundles by reference or hash, several at once
• 4ea5bda fix(run,call): accept a source directory and build it like serve, with a clear error for a non-agent dir
• 6b40011 feat(reasoner): robust internal prompt with operator --prompt/--prompt-file append, harden the tool-loop, and stream REST answers over SSE
• d2b2380 feat: scope --secret grants per agent like --egress, and report each cage's egress and secret grants at boot
• df8089e fix(observe): say the window ends on its own and show the plain-HTTP way to drive the server
• 26cfdfb feat(import): adopt published mcpvessel bundles instead of wrapping them, and let USES pin explicit-host refs
• 9c72f84 docs(readme): tighten the opening, add a one-command try-it, and state egress and secret semantics honestly
• b6f6276 feat(cli): print each run's effective egress allowlist at serve and run start, naming baked and operator hosts
• 55cb620 fix: inject the host's mcp-bridge so bundles run cross-arch, fingerprint image tags so codegen fixes rebuild stale images, and warn when the daemon is stale