DeadBolt 2.0.0-rc.2 — corrected execution gates and supervised defaults

DeadBolt 2.0.0-rc.2 is a corrected developer-evaluation prerelease of the local execution gate. The matching Python client is 2.0.0rc2. It gates integrated tool/MCP/spawn admissions; it is not an agent sandbox, an OS firewall or a compliance certification.

Corrections in this candidate

• Require pre-issued leases and explicit tool policy for raw MCP admissions. Raw downstream startup remains outside that gate; configured bundle startup has a separate liveness check.
• Check the complete ancestor chain for liveness and inherited tool, destination, offline-exception, clip, approval and reported-spend requirements.
• Require an operator token for Unix sidecar startup by default, with an explicit legacy migration option. Refuse malformed/mixed role headers rather than downgrading authority.
• Create private Unix state and SQLite auxiliary files; refuse unsafe existing paths. Same-user code that can edit operator state remains outside this boundary. Windows permissions require operator-managed ACLs.
• Return policy denials as MCP tool results with isError: true, a stable reason and retry hint. Report effective idle/deadline expiry in status; missing named CLI status exits unsuccessfully.
• Default fresh root runs to supervisor-only renewal. Preserve existing modes and provide explicit legacy activity setup. The trusted heartbeat helper remains separate from workload credentials; late renewal never resurrects an expired identity.
• Fail closed on malformed persisted policy/state/spend values; distinguish unset policy from an empty deny-all list. This is not detection of valid same-user edits.
• Improve exact-action fingerprint feedback, operator TTL/child-readiness controls and hash-pinned integration dependencies.

Fixed absolute deadlines remain immutable. Destination declarations/offline exceptions are trusted policy inputs, not network interception; use OS egress controls when required. Spend caps depend on trusted accounting. A grant authorizes one admission; admission and callback execution are separate boundaries, and new-admission denial does not automatically cancel running work.

Install the matching candidate

Download the ZIP for your target and its .zip.sha256. Verify the checksum, extract it, then run deadbolt --version and deadbolt drill. Expected version: deadbolt 2.0.0-rc.2. Run python3 examples/evaluate.py --binary /absolute/path/to/deadbolt from the extracted archive for disposable effect checks. It uses no model key or real account.

For Python, install the attached n11_deadbolt_client-2.0.0rc2-py3-none-any.whl. The wheel does not contain the engine. The base client has no runtime dependencies; the optional Agents extra is pinned to openai-agents==0.23.1. Use matching engine/client versions and read the packaged migration, supervision, trust and privacy guides.

cargo install n11-deadbolt --version 2.0.0-rc.2 --locked --bin deadbolt
deadbolt --version
deadbolt drill

deadbolt = { package = "n11-deadbolt", version = "=2.0.0-rc.2" }

Distribution update, October 12, 2026: the exact RC2 Cargo archive is now published on crates.io. The registry metadata and downloaded crate both match SHA-256 b7a54a6eb15dc151018ed859d11da51054a59a84c2c2b910ac078777092d91a7. Rust 1.85 public-registry CLI installation, drill, all 11 disposable effect cases and a separate version-pinned embedded Rust consumer passed. The matching Python client is also on PyPI; Homebrew preview, MCPB preview, MCP Registry and Smithery routes remain separately versioned. Published RC1 and stable 1.x tags/downloads retain their original bytes and behavior. Packaged READMEs are immutable release snapshots and contain older publication wording; use the current installation guide and explicit RC2 commands above. These publication checks are NextEleven-operated, not independent review.

Stop protected dispatch and back up private state before upgrading. Existing killed/expired identities remain denied. Provision a fresh executor-owned run and its separate supervisor before initial idle expiry; do not reissue or delete state to hide a denial. Supervisor renewal cannot slide an absolute deadline. Downgrading to an engine that ignores newer fields does not preserve newer guarantees.

Verified artifacts and explicit open gates

Selected source: d166c7b039800bbd6d8acb1bc5c66f9add472f5f. All 32 exact-main checks passed. The corrected source includes 173 optimized Rust tests, Rust 1.85 package/migration checks, installed Python/SDK and FastMCP effects, Hermes MCP/filesystem acceptance and native upgrades from checksum-pinned 1.0.3 and 1.1.0-rc.1. Each native target passed extracted client, deadline, supervisor, authentication/private-state and upgrade checks. Linux/macOS exercised supported POSIX cancellation; Windows verified unsupported-mode refusal.

Both final signed Mac ZIPs passed fresh strict signature/version/drill checks and repeated extracted client/upgrade acceptance. Apple accepted both exact ZIPs with no reported issues; hashes and code tickets match:

• ARM Mac: 7114d73f-9b78-4c29-b8c6-32278b353627.
• Intel Mac: 57b8e0ce-0f9f-4987-af24-7864f36b72a0.

All four unsigned CI archive attestations were verified against this repository, the release-candidate workflow, refs/heads/main and the exact source digest. Final Linux/Windows downloads retain those exact attested bytes. Local Mac signing changes ZIP bytes; their CI receipts prove the unsigned inputs, while Developer ID signatures and notarization records cover the final signed binaries/ZIPs. Do not verify a signed Mac download using a receipt for different unsigned bytes. Inspect NATIVE-CI-PROVENANCE.json, ACCEPTANCE.json, the Apple records and SHA256SUMS.

Tested CI targets: Ubuntu 22.04 x86_64 glibc, macOS 15 ARM64/Intel and GitHub Windows x86_64. Linux/Windows ARM64 and Alpine/musl are outside this matrix. Local Intel signing acceptance ran through Rosetta on an ARM Mac. A clean, independently downloaded Mac installation remains open; do not bypass OS security warnings.

This prerelease enables artifact-pinned retesting. NextEleven-operated actual model/tool checks now passed in Claude Desktop Chat, Cursor and VS Code on macOS ARM64 using this published bundle. Exact host versions, counts and limits distinguish editor connection restart from full application restart and deadline precedence from live-heartbeat deadline testing. Stable release remains gated on a separate independent artifact-pinned developer rerun. Other host/platform GUI coverage remains separate. Synthetic tests, listings and submissions do not establish production adoption or universal containment.

DeadBolt 2.0.0-rc.1 — bounded leases and packaged developer evaluation

DeadBolt 2.0.0-rc.1 is a developer-evaluation prerelease of the local execution gate. The matching Python client is 2.0.0rc1. Stable 1.0.3 and older 1.1.0-rc.1 downloads remain available.

This is a major Rust API transition. Read MIGRATING-V2.md before replacing a protected dispatcher or opening existing state.

What changed

• When a destination allowlist is configured, every tool requires a declared allowed destination unless the operator explicitly grants that lease an offline-tool exception. Destination declarations are trusted policy inputs; pair them with OS egress controls when you need network enforcement.
• Optional immutable run deadlines deny new admission with DeadlineExceeded. Agent activity and supervisor heartbeats cannot move the deadline.
• Optional supervisor-only idle renewal uses a separate scoped credential. Admission no longer keeps supervised leases alive; a supervisor can maintain liveness without gaining operator authority.
• A Python POSIX reference executor watches revocation and cancels its owned process group. It is a reference for owned local work, not a sandbox or a universal in-flight cancellation guarantee. It refuses unsupported execution on Windows.
• Packaged migration/privacy guides, outside-checkout Python/Rust consumers and actual old-release upgrade fixtures are included.

Choose an installation route

Download a ZIP for your native target, together with its .zip.sha256, verify the checksum, extract it and run deadbolt --version and deadbolt drill. See archive instructions.

For Python, download the attached n11_deadbolt_client-2.0.0rc1-py3-none-any.whl and install it with python -m pip install /absolute/path/to/the-wheel.whl. The wheel does not contain the native engine. Use the matching 2.0 engine; follow the Python guide. The base client has no runtime dependencies. The optional Agents SDK extra is pinned to openai-agents==0.23.1.

For a Rust CLI source build:

cargo install --git https://github.com/seanebones-lang/deadbolt --tag v2.0.0-rc.1 --locked --bin deadbolt

For an embedded Rust dependency:

deadbolt = { package = "n11-deadbolt", git = "https://github.com/seanebones-lang/deadbolt", tag = "v2.0.0-rc.1" }

The tested Cargo source archive is attached as well. This GitHub prerelease does not upgrade crates.io, PyPI, Homebrew or separately pinned editor/MCP plugins; those distribution versions are tracked separately. Node remains a versioned source client.

Validation and distribution boundaries

Selected source: d14f81f974c556446e520d896acf7761f73861e6. All five required exact-main workflows passed: core CI, native release candidate, FastMCP recipe, plugin security scan and Pages deployment. The candidate includes 125 optimized Rust tests and packaged Rust migration/consumer checks. Each of the four native targets passed extracted-executable client, deadline and supervisor acceptance, plus upgrade fixtures from checksum-pinned published 1.0.3 and 1.1.0-rc.1 artifacts. Linux/macOS exercised POSIX cancellation; Windows checked its explicit unsupported-mode refusal. Hermes MCP/filesystem acceptance used actual allowed and denied effects without a model turn.

The final signed Apple Silicon ZIP passed its client, deadline, supervisor and owned-executor checks again locally. Both signed Mac executables passed strict signature verification, version and drill; the Intel executable also ran via Rosetta. Both final Mac ZIPs received accepted Apple notarization, with ZIP hashes and code tickets verified:

• Apple Silicon: 5aae083d-e2ab-4a5c-9e33-64a693b31bad
• Intel: b903a9a9-7603-45ff-81d4-2d3afdf90cc7

Apple online tickets are associated with the signed CLI code. An independently downloaded installation on a clean Mac remains a separate check; do not bypass OS security warnings. Linux and Windows binaries are unsigned. Tested targets: Ubuntu 22.04 x86_64 glibc, macOS 15 ARM64/Intel and GitHub Windows x86_64. Linux/Windows ARM64 and Alpine/musl are outside this matrix.

Inspect ACCEPTANCE.json and SHA256SUMS. CI native receipts describe the unsigned build inputs; separate signing/notarization records and the signed Apple Silicon acceptance describe the distributable Mac ZIPs. Runtime fixtures use only disposable synthetic state, with no real accounts or model-provider requests. Passing checks do not establish universal containment, independent security certification or production adoption.

Stop dispatch and back up state before upgrading. Preserve killed identities, review the major Rust source edits, and issue new run IDs deliberately. Downgrading to a version that ignores the new fields does not preserve the new guarantees.

DeadBolt MCPB 2.0.0-rc.2 — corrected local preview

Matching MCP bundle for the corrected 2.0.0-rc.2 preview, not a stable release. Stable and RC1 assets remain unchanged.

• Packaging source: 96fc55be0f8f9b81ed37ea43d86522d99b1fda8b.
• Native engine source: d166c7b039800bbd6d8acb1bc5c66f9add472f5f, from the matching core release.
• Contains macOS ARM/Intel, Linux x64 and Windows x64 engines. Mac engines are Developer ID signed and notarized. Verify SHA256SUMS before installation.
• Model-facing policy denials use tool results with isError: true, a stable reason code and a retry hint. Denied calls are not forwarded downstream.
• Fixed deadlines and supervisor renewal are distinct controls. New roots default to supervisor renewal. A supervisor must renew before the idle TTL expires; a late renewal does not revive an expired run. Existing operator configurations retain their explicitly configured mode.
• Read-only setup mode does not start a downstream tool server. Configured operation requires an operator-owned version-2 configuration with an operator-assigned run ID, explicit tools and a finite deadline. The trusted launcher can issue a missing run from that configuration and checks liveness before starting the configured child. The raw MCP proxy separately requires preissued lease/policy setup. Read INSTALL.md and the trust documentation before connecting real tools.

Validation: official MCPB pack/unpack and 55 disposable launcher/effect checks on the exact downloadable outer bundle on macOS ARM. All four CI hosts passed 55 checks on equivalent binary, launcher and template payloads; their outer ZIP metadata and JSON whitespace differ. ACCEPTANCE.json records this distinction. These are terminal/stdio tests, not graphical-client model tests or independent developer adoption.

Open gates: actual GUI/model invocation, the independent artifact-pinned rerun and stable-release approval. This preview does not close those gates. Registry/editor routes may have separate release versions; do not assume that a directory listing points at RC2.

DeadBolt gates connected calls. It does not sandbox the whole agent, enforce OS egress, cancel every in-flight effect or protect operator files from other processes running as the same user. Keep operator credentials out of the model-facing process. Use disposable tools for your first evaluation.

DeadBolt local MCP bundle 2.0.0-rc.1 preview

DeadBolt 2.0 local MCP bundle preview

This preview packages the immutable engine 2.0.0-rc.1 native archives from source d14f81f. It adds version 2 launcher configuration, explicit offline exceptions (default empty), a fixed absolute run deadline, and an explicit activity or supervisor renewal mode. Existing killed, paused or expired runs cannot start the configured downstream server; existing deadlines and renewal modes never silently change. Legacy idle-only run IDs and version 1 configuration are refused. Use a fresh operator-issued ID and review your policy when migrating.

Blank configuration still provides two read-only setup tools and no active protection. Supervisor renewal is separately provisioned through the trusted operator lifecycle; this launcher never reads or forwards a renewal key. Its irreversible tool approvals remain broad one-shot approvals. Exact-action grant provisioning is not included in this launcher.

The configured downstream server is trusted. Destination declarations and offline exceptions are policy, not OS egress enforcement. The gate controls routed tools/call requests; startup/non-tool MCP methods, arbitrary OS access and already running effects remain outside tool admission. Fixed deadlines bound new admission, not running-body duration.

Mac ARM64/Intel binaries retain their published Developer ID signatures and accepted notarization. Linux/Windows binaries and the outer MCPB are unsigned. Packaged hashes detect corruption relative to supplied metadata, not an attacker who can replace the entire bundle.

Use the README and operator-config.example.json inside this bundle. Its zero deadline is an invalid placeholder and must be replaced with a future integer Unix timestamp. The stable 1.1.0 bundle, stable engine 1.0.3, editor kit and existing marketplace plugin submissions retain their separate supported artifacts.

Validation and exact bundle SHA-256 are published alongside the artifact. Tests use disposable state and fixture tool effects with no model or account access. GUI client installation of this preview and independent outside-adopter reproduction remain separate open gates.

All four native host acceptance jobs passed at bundle source 79f31c9; their launcher and native binary hashes match this package. Reports are embedded under validation/.

DeadBolt 1.1.0-rc.1 — developer prerelease

DeadBolt 1.1.0-rc.1 is a developer-evaluation prerelease. Stable v1.0.3 remains available. This release integrates callback dispatch, an installable Python client with an optional OpenAI Agents SDK function-tool decorator, admission credentials scoped to one run, and one-use approvals bound to exact action arguments. Free under Apache-2.0.

Start with the installation guide, quick start, and integration paths. The captioned walkthrough includes the real Harness terminal and web UI with a deterministic local provider.

Downloads: four native ZIPs for Linux x86_64/glibc, Windows x86_64, Apple Silicon Mac and Intel Mac; the Python wheel and source distribution; checksums and verification evidence. Download the matching archive and .zip.sha256, verify, extract, then run deadbolt --version, deadbolt drill and the eleven-case real-file-effect evaluator. Native archives contain source, examples, documentation, notices and BUILD.json. Hosted video binaries are excluded from installation packages.

The Python wheel installs the client, not the native sidecar. Download the wheel and SHA256SUMS, verify its hash, then install into a virtual environment. Base client: Python 3.9+, no third-party runtime dependencies. Optional openai-agents extra: Python 3.10+, pinned SDK 0.23.1. Node remains a bundled source client. No crates.io, PyPI or npm package publication is claimed. Rust developers can use the immutable v1.1.0-rc.1 Git tag.

Source and validation: 52a2085155b658f3d1dda5a73a8d95a7a1d88fad. Exact-source CI. Native packaging and Hermes/upgrade CI. Complete static scan. The integrated source tree matches the reviewed PR #24 tree. Cross-platform tests, strict Clippy, MSRV 1.85, outside Cargo consumer, four optimized native archives, installed SDK acceptance on all three OSes, Hermes MCP and legacy-state upgrade passed. Local acceptance: 96 Rust tests, 16 Python/Node client checks, 19 real SDK checks without API requests, Python 3.9 wheel import and fresh native-file evaluation. Pinned HOL scanner completed at 100/100 with no findings. Audit and acceptance reports are attached.

Mac distribution: Both Mac ZIPs contain Developer ID Application signed executables with hardened runtime and secure timestamps. Apple accepted these exact ZIPs; notarization logs match their ZIP hashes and executable CDHashes. Apple Silicon submission 731c940c-4f0b-4799-8225-d9c29859d458; Intel submission 7502ad5b-c77b-4a92-adc8-100eee80dac1. Both freshly extracted executables passed signature verification, version/drill and eleven real file effects. Linux and Windows binaries remain unsigned. Apple's accepted online tickets for these command-line executables are not app-bundle stapling or an independent security certification. Clean third-party Mac installation and adopter-owned route acceptance remain open milestones.

Integration and upgrade boundaries: the trusted executor must configure explicit policy and request fresh admission immediately before every protected effect. An unset policy list is open; no allow is cached. Scoped admission credentials separate workload access from operator authority. Exact-action approval binds run, tool, destination, validated JSON arguments, nonce and deadline, and is consumed once. Kill blocks later admissions; it does not cancel a body already running. DeadBolt does not sandbox arbitrary code, intercept traffic, measure external bills or establish whole-agent containment.

Stop protected dispatch and preserve state before upgrade or rollback. Older binaries cannot enforce new scoped-credential and exact-action requirements. See compatibility, credential migration, exact-action review and trust boundaries.

Cargo registry update — October 11, 2026

This exact tagged source is now published as n11-deadbolt 1.1.0-rc.1 on crates.io. Install the CLI with:

cargo install n11-deadbolt --version 1.1.0-rc.1 --locked --bin deadbolt
deadbolt --version
deadbolt drill

For embedded Rust, use deadbolt = { package = "n11-deadbolt", version = "=1.1.0-rc.1" }. Generated Rust API and current installation guide. This remains a prerelease for developer evaluation. The registry archive matches the prepublication tested package checksum and tagged Git revision. Fresh registry CLI installs, drills, real sidecar effects and separate registry-dependent Rust consumers passed on macOS ARM64. No release tag, native asset or engine source was changed. Earlier registry-status wording above describes the original release date. Python/Node clients are not on PyPI/npm.

PyPI distribution update — October 11, 2026

The original release wheel and source archive are now published unchanged as n11-deadbolt-client 1.1.0rc1 on PyPI. Pin the prerelease explicitly:

python -m pip install 'n11-deadbolt-client==1.1.0rc1'
# Optional OpenAI Agents SDK integration, Python 3.10+:
python -m pip install 'n11-deadbolt-client[openai-agents]==1.1.0rc1'

Install engine 1.1.0-rc.1 separately; the Python wheel does not bundle or start it. The wheel uses Python version spelling 1.1.0rc1. The packaged README is the original release snapshot and predates registry publication; use the current Python installation guide for current routes.

Both PyPI file hashes matched this release's archived files. Fresh base and optional-extra installations from PyPI passed, including 19 real SDK Runner checks and a local allow/revoke/blocked-effect demonstration without provider requests. Publication used project-scoped GitHub Trusted Publishing with attestations, through the successful publishing workflow. This distribution update does not change the prerelease source or establish independent security certification.

MCPB bundle 1.1.0 — stable engine 1.0.3

DeadBolt MCPB bundle 1.1.0 packages the stable engine v1.0.3 for local MCP clients. This is a bundle release, separate from engine v1.1.0-rc.1.

Leave Operator configuration blank to use two read-only setup and bundle-verification tools. No downstream server starts and no active protection is provided in this mode. An explicit private operator configuration enables the gate for a trusted downstream stdio server. Invalid configuration stops startup.

The prebuilt bundle includes macOS ARM64 and Intel, Linux x64 with glibc, and Windows x64 binaries. Node.js 20+ is required; compatible clients may provide it. No Rust toolchain or model API key is required.

Installation and boundaries · Operator configuration · Captioned demonstrations

This exact bundle passed 25 installed acceptance cases on each of the four target platforms. Real Claude Desktop on macOS was checked for blank setup, integrity verification, and configuration switching. These checks use disposable tools and do not validate a customer's application routes. The package contains VALIDATION.md, per-platform reports, provenance, licenses, and source links.

DeadBolt gates the tool-call paths you connect. It is not an OS sandbox, does not cancel actions already running, and does not provide compliance certification. The outer bundle is unsigned. macOS engine binaries retain their release signatures; Linux and Windows binaries are unsigned. Engine v1.0.3 has broad one-use tool approvals, not the prerelease's exact-action approvals or admission credentials.

SHA-256 of deadbolt-1.1.0.mcpb:

7840d23f116b8a162322a372124718ca374296e3b9ca1d781e99f466d7a6634c

Free and open source under Apache-2.0. Built by NextEleven.

DeadBolt captioned developer walkthrough · October 10, 2026

Captioned DeadBolt educational media, October 10, 2026. This media-only prerelease is not a software release.

Includes the 4:31 overview and complete 21:17 developer walkthrough, with Cedar narration and permanent English captions. Transcript, SRT, chapter navigation and pinned demonstration boundaries are available at https://seanebones-lang.github.io/deadbolt/#watch. Narration is AI-generated. Harness demonstrations use a deterministic local provider and disposable files.

Source and demonstration revisions are recorded on the transcript and SOURCES.txt. The recording describes specific admission boundaries, not universal containment or certification.

Deadbolt v1.0.3

Deadbolt v1.0.3 is a macOS distribution update. Its admission, storage, policy, protocol, and public API behavior is unchanged from v1.0.2. The Apple Silicon and Intel ZIPs now contain Developer ID Application signed executables with hardened runtime and secure timestamps. Apple accepted these exact downloadable ZIPs for notarization. Linux and Windows binaries remain unsigned.

Download the archive for your OS and its .sha256 file. Verify the archive using installation instructions, extract it, then run deadbolt --version and deadbolt drill. The release ZIPs include source, examples, documentation, license notices, and BUILD.json with the exact source revision and executable hash. Use first evaluation for 11 disposable real-file-effect checks. No model key or external service is needed for that evaluation.

Source revision: 3a857f8438dcda4bdaadb414d37f128508dc44f1. Exact-main source CI and native packaging, Hermes MCP, and upgrade CI passed. The signed Apple Silicon and Intel ZIPs both passed local signature checks, version/drill, and the 11-effect evaluator after fresh extraction. The selected Hermes MCP route passed 13 observed effects on Linux; this is not a full agent or model-turn evaluation.

Apple notarization: Apple Silicon submission 70ff347c-1a5f-4a6a-ae79-bbbe2e2f64d5; Intel submission 8e4f02bf-09b0-4726-a1b1-47c9e45842fa. Apple's logs for both report Accepted, issues: null, the downloadable ZIP's SHA-256, and the signed executable's CDHash. The logs are attached. These command-line executables use Apple's online notarization ticket; no app bundle or stapled ticket is claimed. A clean third-party Mac download and application-owned integration remain open acceptance steps.

Deadbolt admits actions only when a trusted executor checks and honors a fresh explicit allow. Operator kill blocks later admissions; it does not cancel work already running. The protected dispatcher, identities, policy, credentials, and route coverage belong to the integrating application. See the integration guide, FAQ, and security policy. This release is not a security certification or independent human validation. The earlier v1.0.2 release remains unchanged.

No crates.io, npm, or pip registry package is published by this release. The Rust crate and Python/Node clients are available from this versioned source and native archives.

Cargo registry update — October 11, 2026

This exact tagged source is now published as n11-deadbolt 1.0.3 on crates.io. Install the CLI with:

cargo install n11-deadbolt --version 1.0.3 --locked --bin deadbolt
deadbolt --version
deadbolt drill

For embedded Rust, use deadbolt = { package = "n11-deadbolt", version = "=1.0.3" }. Generated Rust API and current installation guide. The registry archive matches the prepublication tested package checksum and tagged Git revision. Fresh registry CLI installs, drills, real sidecar effects and separate registry-dependent Rust consumers passed on macOS ARM64. No release tag, native asset or engine source was changed. Earlier registry-status wording above describes the original release date. Python/Node clients are not on PyPI/npm.

Deadbolt v1.0.2

Deadbolt v1.0.2 is a maintenance release for teams evaluating a local, cooperative execution gate for software agents. A trusted executor must check each protected action immediately before dispatch and act only on an explicit allow. Kill denies later admissions for an identity and its registered descendants; it does not cancel an already-running action.

This release reduces SQLite writer contention by committing default spend updates, evidence sequence, and primary evidence row in one transaction. It also fixes an operator-grant failure found in our internal security review: on the default sink, approve, resume, and policy updates now roll back if primary evidence writing fails, instead of returning an error after making the grant live. The original intermittent Windows StoreUnavailable event did not recur in ten diagnostic repetitions; its exact initial trigger is still unproven. This release addresses a demonstrated partial write failure, not every storage outage.

Four native archives are attached: Linux x86_64, Windows x86_64, macOS arm64, and macOS x86_64. Verify SHA256SUMS or the archive-specific .sha256 file before extracting. Run deadbolt --version and deadbolt drill, then use the first evaluation for 11 disposable real file-effect checks. The release ZIPs include the source, documentation, Python/Node source clients, tests, license notices, and BUILD.json with the exact merged source revision and executable hash.

The release candidate and merged main passed Rust 1.85 and Linux/macOS/Windows source checks, native packaging, pinned Hermes MCP transport with 13 observable checks, and a tested original-state upgrade. The downloaded macOS arm64 executable also passed the drill and 11-effect Python evaluation locally. A disposable Ubuntu 24.04 arm64 systemd container test verified empty-token startup denial, tokened admission and policy, wrong-token rejection, operator kill, restart persistence, and unrelated-agent isolation. Its report is attached. Native Linux-host and adopter-application acceptance remain separate work.

Start with installation, the evaluator brief, the demonstration, and the pilot checklist.

Distribution and trust limits: the archives have no verified publisher signature; macOS binaries carry only ad hoc signatures and are not Developer ID signed or notarized. Checksums detect file mismatch but do not prove publisher identity. The stdio MCP proxy gates routed tools/call, not a complete model turn or every host tool. Destination and spend fields are caller-supplied conventions. The sidecar token authorizes all routes. The trusted executor and downstream MCP server remain in the trust boundary. No crates.io/npm/pip package, outside security certification, Hermes endorsement, or customer adoption is claimed.

Release source: 9c11053740a2e66678fbebdaa2daaa494bbe5b5e.

• Exact-main source CI
• Exact-main native packaging, Hermes MCP, and upgrade checks

Deadbolt v1.0.1

Deadbolt v1.0.1 is a documentation and distribution maintenance release. Admission, state, protocol and public API behavior remain unchanged from v1.0.0; dependencies are unchanged.

The native archives now include the evaluator brief, observable Hermes demonstration runbook and scoped application pilot worksheet. The legacy Harness-specific overview and cancellation comments are corrected: standalone Deadbolt revokes subsequent admissions, while the executor owns cancellation of running work. Disabled/fail-open Rust configurations are explicit in the documentation.

The repository has a compact README, pinned source installation, linked CI/release/license badges, structured bug/integration forms and verified-enabled private vulnerability reporting. CI now builds Rust API documentation with warnings denied on Rust 1.85.

Four native targets are available: Linux x86_64 (Ubuntu 22.04/glibc validation), Windows x86_64 (GitHub Windows runner), macOS arm64 and macOS x86_64 (macOS 15 validation). Archives are unsigned and Mac binaries are unnotarized. Verify SHA-256, extract, then run deadbolt --version and deadbolt drill. Every archive includes BUILD.json, source, tests, client examples, license notices and the unmodified MPL dependency source.

Final release checks include platform/MSRV source CI, extracted native drills, Python/Node contracts with backup/restore, pinned Hermes MCP acceptance with 13 observable effects, and the tested original-state upgrade. Attached acceptance reports identify the tested executable hashes.

Start with the evaluator brief, installation, demonstration and pilot checklist.

Boundaries remain explicit: the trusted executor must route each protected action through fresh admission and execute only on allow. Kill does not cancel a running body. Spend/destination are caller-supplied. The sidecar token authorizes all exposed routes. The selected Hermes MCP route does not cover built-in terminal/browser/delegation or a full model turn. Systemd remains experimental. No registry package, security certification or Hermes endorsement is claimed.

Release source: 6b61bc9485eccea90cc2766d3e76fde6522fed82. Source CI and native packaging, Hermes acceptance and upgrade validate the exact merged source.

The downloaded macOS arm64 executable also passed the same 13 Hermes MCP effects locally; its attached report matches the archive executable hash.