Ghost v0.3.0

Ghost v0.3.0

Ghost v0.3 evolves the hardened deception runtime into an integrated agent-security runtime while keeping the same workflow:

ghost init
ghost run -- <agent>

Verified capabilities

• One monotonic NORMAL / CONTAINED security state and one persisted event pipeline integrate policy, runtime enforcement and evidence.
• A bounded Prompt-Injection Guard inspects supported workspace instruction surfaces and records minimized rule/category/hash findings. Deterministic trust context enriches policy and temporal reconstruction without becoming an authorization authority.
• ALLOW / DENY / SHADOW / ASK includes exact, session-local human decisions. ALLOW_ONCE applies once; ALLOW_SESSION stays within the exact scheme, host, port, method and session. Containment and hard forbidden destinations override approval; unavailable or malformed interaction fails closed.
• Mandatory resource limits cover the agent and its descendants: 2 GiB RAM, no additional swap, one CPU, 256 processes/threads, 64 MiB /tmp and a one-hour session deadline. Bounded graceful/forced cleanup and trusted pre-teardown kernel accounting address the reproduced rapid-child OOM evidence loss.
• Automatic secure preflight, simpler init guidance and concise evidence-derived summaries remain part of normal execution. Inspect, graph and incidents stay optional.
• GhostBench has exactly 25 named security-property scenarios, including integrated prompt/SHADOW/network chains, approval/containment precedence, concurrent approval isolation, runtime timeout cleanup and cross-session isolation. The strict release gate requires 25 PASS / 0 FAIL / 0 SKIP.

The final audit also fixed noninteractive approval wiring, late containment checks, HTTP framing/forwarding, evidence-write failure closure, monotonic persistence, recovery/finalization, bounded inspection and secret-minimized exports. Regression tests remain in the repository.

Installation and compatibility

Linux amd64 with Docker Engine and a numeric non-root host UID/GID is the runtime-tested release target. Linux arm64 binaries are cross-built and checksum-verified. Verify the Linux amd64 or arm64 binary against SHA256SUMS. Source builds require Go 1.26.8 or a newer supported patch release. Existing version-1 configurations receive safe runtime defaults; no new mandatory configuration or command is required.

The pinned minimal Alpine runtime supplies its existing tools. An agent command must be available inside that image; missing commands never fall back to host execution. Unsupported Docker/cgroup security capabilities fail clearly, including unsupported rootless configurations.

Limits

Prompt findings are heuristic and may miss attacks or flag benign content. Ghost does not establish model intent, causal influence or exfiltration. Provenance distinguishes observations, derived exposure and temporal FOLLOWED_BY relationships; user approvals remain USER_DECISION.

Docker, the OCI runtime, the pinned image and the host kernel remain trusted. Limits do not provide a workspace/evidence disk quota or aggregate host admission control. Host/daemon crashes can interrupt cleanup or evidence collection. Containment governs subsequent decisions and does not revoke established connections. Attached program output is not sanitized; older databases may retain historical command arguments. Passing GhostBench demonstrates its named properties, not universal attack prevention.