DeadBolt 2.0.0-rc.2 — corrected execution gates and supervised defaults

DeadBolt 2.0.0-rc.2 is a corrected developer-evaluation prerelease of the local execution gate. The matching Python client is 2.0.0rc2. It gates integrated tool/MCP/spawn admissions; it is not an agent sandbox, an OS firewall or a compliance certification.

Corrections in this candidate

• Require pre-issued leases and explicit tool policy for raw MCP admissions. Raw downstream startup remains outside that gate; configured bundle startup has a separate liveness check.
• Check the complete ancestor chain for liveness and inherited tool, destination, offline-exception, clip, approval and reported-spend requirements.
• Require an operator token for Unix sidecar startup by default, with an explicit legacy migration option. Refuse malformed/mixed role headers rather than downgrading authority.
• Create private Unix state and SQLite auxiliary files; refuse unsafe existing paths. Same-user code that can edit operator state remains outside this boundary. Windows permissions require operator-managed ACLs.
• Return policy denials as MCP tool results with isError: true, a stable reason and retry hint. Report effective idle/deadline expiry in status; missing named CLI status exits unsuccessfully.
• Default fresh root runs to supervisor-only renewal. Preserve existing modes and provide explicit legacy activity setup. The trusted heartbeat helper remains separate from workload credentials; late renewal never resurrects an expired identity.
• Fail closed on malformed persisted policy/state/spend values; distinguish unset policy from an empty deny-all list. This is not detection of valid same-user edits.
• Improve exact-action fingerprint feedback, operator TTL/child-readiness controls and hash-pinned integration dependencies.

Fixed absolute deadlines remain immutable. Destination declarations/offline exceptions are trusted policy inputs, not network interception; use OS egress controls when required. Spend caps depend on trusted accounting. A grant authorizes one admission; admission and callback execution are separate boundaries, and new-admission denial does not automatically cancel running work.

Install the matching candidate

Download the ZIP for your target and its .zip.sha256. Verify the checksum, extract it, then run deadbolt --version and deadbolt drill. Expected version: deadbolt 2.0.0-rc.2. Run python3 examples/evaluate.py --binary /absolute/path/to/deadbolt from the extracted archive for disposable effect checks. It uses no model key or real account.

For Python, install the attached n11_deadbolt_client-2.0.0rc2-py3-none-any.whl. The wheel does not contain the engine. The base client has no runtime dependencies; the optional Agents extra is pinned to openai-agents==0.23.1. Use matching engine/client versions and read the packaged migration, supervision, trust and privacy guides.

cargo install n11-deadbolt --version 2.0.0-rc.2 --locked --bin deadbolt
deadbolt --version
deadbolt drill

deadbolt = { package = "n11-deadbolt", version = "=2.0.0-rc.2" }

Distribution update, October 12, 2026: the exact RC2 Cargo archive is now published on crates.io. The registry metadata and downloaded crate both match SHA-256 b7a54a6eb15dc151018ed859d11da51054a59a84c2c2b910ac078777092d91a7. Rust 1.85 public-registry CLI installation, drill, all 11 disposable effect cases and a separate version-pinned embedded Rust consumer passed. The matching Python client is also on PyPI; Homebrew preview, MCPB preview, MCP Registry and Smithery routes remain separately versioned. Published RC1 and stable 1.x tags/downloads retain their original bytes and behavior. Packaged READMEs are immutable release snapshots and contain older publication wording; use the current installation guide and explicit RC2 commands above. These publication checks are NextEleven-operated, not independent review.

Stop protected dispatch and back up private state before upgrading. Existing killed/expired identities remain denied. Provision a fresh executor-owned run and its separate supervisor before initial idle expiry; do not reissue or delete state to hide a denial. Supervisor renewal cannot slide an absolute deadline. Downgrading to an engine that ignores newer fields does not preserve newer guarantees.

Verified artifacts and explicit open gates

Selected source: d166c7b039800bbd6d8acb1bc5c66f9add472f5f. All 32 exact-main checks passed. The corrected source includes 173 optimized Rust tests, Rust 1.85 package/migration checks, installed Python/SDK and FastMCP effects, Hermes MCP/filesystem acceptance and native upgrades from checksum-pinned 1.0.3 and 1.1.0-rc.1. Each native target passed extracted client, deadline, supervisor, authentication/private-state and upgrade checks. Linux/macOS exercised supported POSIX cancellation; Windows verified unsupported-mode refusal.

Both final signed Mac ZIPs passed fresh strict signature/version/drill checks and repeated extracted client/upgrade acceptance. Apple accepted both exact ZIPs with no reported issues; hashes and code tickets match:

• ARM Mac: 7114d73f-9b78-4c29-b8c6-32278b353627.
• Intel Mac: 57b8e0ce-0f9f-4987-af24-7864f36b72a0.

All four unsigned CI archive attestations were verified against this repository, the release-candidate workflow, refs/heads/main and the exact source digest. Final Linux/Windows downloads retain those exact attested bytes. Local Mac signing changes ZIP bytes; their CI receipts prove the unsigned inputs, while Developer ID signatures and notarization records cover the final signed binaries/ZIPs. Do not verify a signed Mac download using a receipt for different unsigned bytes. Inspect NATIVE-CI-PROVENANCE.json, ACCEPTANCE.json, the Apple records and SHA256SUMS.

Tested CI targets: Ubuntu 22.04 x86_64 glibc, macOS 15 ARM64/Intel and GitHub Windows x86_64. Linux/Windows ARM64 and Alpine/musl are outside this matrix. Local Intel signing acceptance ran through Rosetta on an ARM Mac. A clean, independently downloaded Mac installation remains open; do not bypass OS security warnings.

This prerelease enables artifact-pinned retesting. NextEleven-operated actual model/tool checks now passed in Claude Desktop Chat, Cursor and VS Code on macOS ARM64 using this published bundle. Exact host versions, counts and limits distinguish editor connection restart from full application restart and deadline precedence from live-heartbeat deadline testing. Stable release remains gated on a separate independent artifact-pinned developer rerun. Other host/platform GUI coverage remains separate. Synthetic tests, listings and submissions do not establish production adoption or universal containment.