stack-single 1.4.3

stack-single 1.4.3

A patch that moves TokenFuse from 1.19.0 to 1.20.1, a security fix. Before TokenFuse 1.20.1, a JSON-RPC batch sent to the MCP broker skipped every check the broker keys on tools/call: the policy decision, the identity requirement, the scan of the arguments and the tool-call record. The broker forwarded the batch to the upstream as it came. TokenFuse 1.20.1 refuses it before anything is forwarded. Upgrading is recommended for every box that runs the broker.

Upgrade first

1. Run ./install.sh again from this release. A box with its own operator files names them as before (CLIENT_KEYS_FILE=... IDENTITY_MAP_FILE=...). The installer verifies the two new TokenFuse images' signatures, pulls them by digest and recreates the services that run them.
2. A client that sends JSON-RPC batches to the MCP broker now gets an error. The answer is JSON-RPC -32600 (Invalid Request) with a null id, and HTTP 400. Send each message on its own. The Model Context Protocol removed batching in its 2025-06-18 revision, so a client on the current protocol is not affected.
3. TokenFuse 1.20.0, which this release passes through, requires TOKENFUSE_DELEGATION_URL to be an origin. install.sh writes http://$GATEWAY_PROBE:4100, an origin with no path, so nothing changes here. 1.20.0 also reads TOKENFUSE_DELEGATION_ORIGINS and TOKENFUSE_MCP_PROOF_ORIGINS for a gateway reached at more than one address; this launcher sets neither and keeps its one origin.

What changed

Image	1.4.2	1.4.3
tokenfuse (MCP broker, gateway, OpenAI gateway, FOCUS export)	v1.19.0	v1.20.1
tokenfuse-control-plane	v1.19.0	v1.20.1

• Both are pinned by tag and digest in compose.yaml and components.json (#155): the gateway image sha256:8de459eca2a10ae36a01d0249b91c3b0c62b50b47ad2c4a309e2ea02e0a460dd, the control plane sha256:157d5801367674e7af8625b391fba8e26e3b72fe95dcb5e435cebee5555fa92a. Each is an amd64 and arm64 manifest list with a cosign signature, and the gateway image's build provenance names commit 27a0a2f at refs/tags/v1.20.1 of TAIPANBOX/tokenfuse. The image-verify fixtures, a teeth case and the README sentence that names the TokenFuse pin follow them.
• TokenFuse 1.20.1 also clears five RustSec advisories, among them a timing issue in crypto-bigint, by moving its P-256 code to p256 0.14 with the wire format unchanged.

Measured

• forge, 2026-10-26, upgrading from 1.4.2 to the tree of this release (fc7ebd5), with agent tokens on and its own operator files: installer exit 0, 59 checks ok, none failed. The MCP broker, the gateway, the OpenAI gateway and the control plane came up on v1.20.1, healthy, with no restart; install.sh status 49 ok.
• The batch, before and after, on that box. One request to the MCP broker carrying a JSON-RPC batch of two tools/call, admitted by an agent token. On 1.4.2 (TokenFuse 1.19.0) the batch reached typryx and wardryx made no decision. On 1.4.3 the broker answered HTTP 400 with -32600, logged that it forwarded nothing, and typryx logged nothing.
• Agent tokens on the same box, using docs/evidence/agent-token-audience/measure.sh (agent agent://home.taipanbox.dev/agents/operator, BUDGET_USD=0.000001): 10 of 10 expectations held, among them a single tools/call through the broker that typryx answered.
• One proof sent twice to the gateway, five seconds apart: the first was admitted and stopped at the budget step (402), the second was refused at the gateway's own door (401 agent_token_refused, logged as Replayed).
• CI on #155: eight checks green, six of them full installs with these pins.

Not measured

• A box with agent tokens off was not upgraded live; the CI install legs cover that path.
• A second installer run on the measured box was not made, so this release does not record that a re-run recreates nothing.
• The FOCUS export runs only under the routines profile, which forge does not enable, so its new image was pinned and verified but not run there.
• A gateway reached at a second address was not exercised: this launcher sets one origin.