Repository navigation
DeadBolt 2.0.0 — stable release
A local execution gate for tool, MCP and child-agent routes that your executor
connects through DeadBolt. This release freezes the tested RC3 behavior.
Version 2 includes supervisor-renewed leases, fixed deadlines, explicit tool and
destination policy, ancestor policy ceilings, scoped admission credentials,
operator-only controls and exact-action one-use grants for integrations that
wire the exact-action API. The MCPB launcher uses broad one-shot tool approvals;
it does not provision exact-action grants.
The final candidate corrections reject conflicting recognized destination fields
before forwarding or consuming approval, refuse damaged state without rebuilding
missing authority, and remove DeadBolt operator state locations from downstream
environments. Tool denials have readable reason codes and retry guidance.
The stable source adds clear ensure state/expiry diagnostics and consistent
cross-platform metadata line endings, without expanding the feature set.
Upgrade: read MIGRATING-V2.md, stop protected effects, back up state consistently,
and verify the selected archive against its published checksums. Use a fresh
operator-assigned identity for a new run; restarting never revives an expired or
killed identity. The default idle TTL is 60 seconds. Keep the separate supervisor
heartbeat active before that window expires, and configure a fixed deadline.
Native targets: macOS Apple Silicon and Intel, Linux x86_64/glibc, Windows x86_64.
Source: 14804f2. All four extracted native
install/upgrade CI checks passed, as did main source CI, FastMCP and Hermes MCP
transport checks. SHA256SUMS and CI provenance verification receipts are included.
Both final Mac ZIPs are Developer ID signed (team L35VLYNTLK), Apple-notarized
and passed separate signed-package install/upgrade tests. The local Intel test
used translation on Apple Silicon; the CI test ran on an Intel host. CI attestation of
an unsigned Mac archive does not attest the later locally signed archive bytes.
Acceptance: artifact-pinned RC3 actual Cursor model/Reload results passed three
requested cases on macOS arm64. The Auto model identity was unknown. Separate
Linux headless checks passed their recorded scope; they are not GUI evidence.
Stable native installed artifacts passed their own qualification checks.
RC3 GUI evidence is not relabelled as stable-byte GUI testing. No claim of
independent certification or marketplace acceptance is made.
Limits: only connected routes are gated. Startup/non-tool MCP traffic, alternate
execution paths, arbitrary OS access and same-user operator-state rewriting are
outside containment. Destination declarations are not OS egress enforcement.
Recognized MCP fields are url, uri, href, endpoint and host, recursively in
objects/arrays; aliases and bare URL strings in unrecognized lists are not
inspected. Spend caps depend on trusted reporting. Kill blocks subsequent
admissions; cancelling in-flight work requires the executor supervisor pattern.
tools/list may advertise tools policy will deny. Ordinary trusted-executor /admit
with unset tools policy differs from the explicit-policy MCP path. /spend is
operator-only. Review the trust, configuration and troubleshooting guides before
connecting effects.
Package registries, editor plugins and the MCPB bundle are separate
publications; check each exact version before installing. They are being
synchronized to this frozen stable engine.
Start with INSTALL.md,
MIGRATING-V2.md,
TRUST.md and
TROUBLESHOOTING.md.
Future expansion will follow adopter feedback.