Ghost v0.3.0

Ghost v0.3.0

Ghost v0.3 evolves the hardened deception runtime into an integrated agent-security runtime while keeping the same workflow:

ghost init
ghost run -- <agent>

Verified capabilities

• One monotonic NORMAL / CONTAINED security state and one persisted event pipeline integrate policy, runtime enforcement and evidence.
• A bounded Prompt-Injection Guard inspects supported workspace instruction surfaces and records minimized rule/category/hash findings. Deterministic trust context enriches policy and temporal reconstruction without becoming an authorization authority.
• ALLOW / DENY / SHADOW / ASK includes exact, session-local human decisions. ALLOW_ONCE applies once; ALLOW_SESSION stays within the exact scheme, host, port, method and session. Containment and hard forbidden destinations override approval; unavailable or malformed interaction fails closed.
• Mandatory resource limits cover the agent and its descendants: 2 GiB RAM, no additional swap, one CPU, 256 processes/threads, 64 MiB /tmp and a one-hour session deadline. Bounded graceful/forced cleanup and trusted pre-teardown kernel accounting address the reproduced rapid-child OOM evidence loss.
• Automatic secure preflight, simpler init guidance and concise evidence-derived summaries remain part of normal execution. Inspect, graph and incidents stay optional.
• GhostBench has exactly 25 named security-property scenarios, including integrated prompt/SHADOW/network chains, approval/containment precedence, concurrent approval isolation, runtime timeout cleanup and cross-session isolation. The strict release gate requires 25 PASS / 0 FAIL / 0 SKIP.

The final audit also fixed noninteractive approval wiring, late containment checks, HTTP framing/forwarding, evidence-write failure closure, monotonic persistence, recovery/finalization, bounded inspection and secret-minimized exports. Regression tests remain in the repository.

Installation and compatibility

Linux amd64 with Docker Engine and a numeric non-root host UID/GID is the runtime-tested release target. Linux arm64 binaries are cross-built and checksum-verified. Verify the Linux amd64 or arm64 binary against SHA256SUMS. Source builds require Go 1.26.8 or a newer supported patch release. Existing version-1 configurations receive safe runtime defaults; no new mandatory configuration or command is required.

The pinned minimal Alpine runtime supplies its existing tools. An agent command must be available inside that image; missing commands never fall back to host execution. Unsupported Docker/cgroup security capabilities fail clearly, including unsupported rootless configurations.

Limits

Prompt findings are heuristic and may miss attacks or flag benign content. Ghost does not establish model intent, causal influence or exfiltration. Provenance distinguishes observations, derived exposure and temporal FOLLOWED_BY relationships; user approvals remain USER_DECISION.

Docker, the OCI runtime, the pinned image and the host kernel remain trusted. Limits do not provide a workspace/evidence disk quota or aggregate host admission control. Host/daemon crashes can interrupt cleanup or evidence collection. Containment governs subsequent decisions and does not revoke established connections. Attached program output is not sanitized; older databases may retain historical command arguments. Passing GhostBench demonstrates its named properties, not universal attack prevention.

Ghost v0.2.0

Ghost v0.2.0

Ghost is a deception-aware security runtime for autonomous AI agents built around deterministic ALLOW, DENY, and SHADOW policies. Version 0.2.0 is a security-hardening release; it does not expand Ghost into a general firewall or attack detector.

Highlights

• Stronger HTTP/HTTPS destination controls reject raw IPs, local-use names, and prohibited resolved IPv4 ranges, then connect to the validated numeric address.
• Agent and sidecar containers run non-root with dropped capabilities, no-new-privileges, read-only roots, bounded writable paths, private namespaces, and a positive environment allowlist.
• Token-scoped containment fencing orders new gateway decisions against observed decoy access, while interrupted-session recovery removes only exactly identified Ghost-owned resources.
• The Alpine runtime image and GitHub Actions are immutably pinned; Linux release binaries include a verified SHA256 manifest.
• GhostBench expands from 10 to 15 explicit security-property scenarios. The release gate requires PASS: 15, FAIL: 0, SKIP: 0.

Quick start

Download the Linux binary for your architecture and verify it against SHA256SUMS, or build with Go 1.26 or newer:

go build -o ghost ./cmd/ghost
./ghost init
./ghost run -- echo "hello from ghost"
./ghost inspect latest

Docker Engine and a numeric non-root host UID/GID are required for execution.

Important limitations

Docker, its daemon, the pinned image, the OCI runtime, and the host kernel remain part of Ghost's trusted computing base. Ghost does not prove model intent, causal influence, or credential exfiltration; it does not inspect TLS content or provide arbitrary TCP/UDP egress. Containment cannot revoke traffic that was already authorized and established. GhostBench demonstrates only its named scenarios and is not a universal security proof.

Ghost v0.1.0

chore: prepare v0.1.0 release