station-v0.25 · publisher trust allowlist (Phase 4a sandbox)

What's new

Publisher trust allowlist (Phase 4a of the module sandbox)

Signature verification proves WHO signed a module bundle. This release adds
the second question: WHICH publishers are allowed to register commands on
THIS install. Two modes:

• trust_mode: any (default) — historical behavior; any valid
  signature accepted. Existing installs unchanged.
• trust_mode: allowlist — strict; only publishers in
  <ws>/publisher_trust.json register commands. Rejections surface the
  publisher fingerprint + a copy-pasteable railcall trust add hint in the
  Modules tab.

First-party publishers (Sami's marketplace publisher key 726b327ec6…)
ship pre-trusted in the default allowlist, so first-party modules keep
working when a user flips to allowlist mode.

New CLI: railcall trust

railcall trust list                     mode + allowlist snapshot
railcall trust add <pubkey> [--name]    trust a publisher
railcall trust remove <pubkey>          untrust a publisher
railcall trust mode any|allowlist       flip enforcement mode

New endpoints

• GET /api/trust/state — mode + allowlist
• POST /api/trust/add — {pubkey, publisher_name?, note?}
• POST /api/trust/remove — {pubkey}
• POST /api/trust/mode — {mode: 'any'|'allowlist'}

All session-gated; auto-trigger a modules reload so newly-trusted (or
newly-untrusted) modules register/unregister live.

Sandbox roadmap

• 4a (this release): trust allowlist — WHO's allowed
• 4b (later): subprocess isolation — HOW the still-allowed runs are
  contained (per-module network allowlist, restricted stdlib, timeout,
  memory limit). Defensive against "trusted publisher pushes bad update";
  4a is defensive against "random module from the marketplace runs by
  default".

SHA256

44182d0931e8400f0789152b022484522fd3e9f08174a528b6c3f397f0262b91

Install / update

curl -fsSL https://railcall.ai/install.sh | bash   # fresh
railcall update                                    # existing