Cortex v6.13.3 -- anchored CTX_REPO validation (defense-in-depth on the stand-up clone)

What's Changed

• fix(quickstart): anchored CTX_REPO validation before scaffold+clone (#2462) by @mellanon in #2468

Full Changelog: v6.13.2...v6.13.3

Cortex v6.13.2 -- clearer install: secrets carry purpose + optional markers

What's Changed

• fix(manifest): declare secrets in object form with reason + optional (arc#358 cortex side) by @mellanon in #2466

Full Changelog: v6.13.1...v6.13.2

Cortex v6.13.1 -- coding-tier stand-up: agent bash on systemd + granted repo cloned into the workspace

What's Changed

• feat(runner): dev consumer resolves its forge identity per operation (#2438) by @mellanon in #2442
• docs(design): forge-neutral agent identity — supersede the GH_TOKEN transport by @mellanon in #2423
• fix(systemd): punch ReadWritePaths for ~/.claude/session-env (EROFS broke all agent bash on systemd) (#2451) by @mellanon in #2457
• feat(quickstart): clone the granted repo into the workspace for code stacks (#2452) by @mellanon in #2460
• docs(design): correct §3.5b — record the #2438 identity precedence by @mellanon in #2453

Full Changelog: v6.13.0...v6.13.1

Cortex v6.13.0 — execution-boundary hardening (NWS review response)

The response to NorthWoods Sentinel Labs' 2026-07-23 adversarial review is code-complete. Epic #2341.

The diagnosis this answers

That review had one finding under every finding:

Cortex enforced at the gate, not at execution. Boundaries were declared at load-time and prompt-time — but once an agent driven by untrusted content was running, most boundaries were an instruction the model was asked to obey, not a wall that stopped it.

This release turns that ladder: prose → code → kernel.

Live by default

• Cortex-owned PreToolUse path guard for file tools and Bash read-command paths — nine adversarial rounds, each one closing a real bypass found by trying to break the previous fix
• Read-only directories enforced through the dispatch seam, not asserted in a preamble sentence
• Path containment in principal-DM guard-off sessions
• Persona-declared allowedTools enforced at dispatch instead of being decorative

Shipped switched off — deliberately

The session-sandbox choke point, the macOS sandbox-exec backend, the L3 egress allowlist proxy, plugin bundle signature verification, and the v2 strict posture all default to inert, and no caller turns them on.

Building a boundary and enabling it are separate decisions with separate blast radius. Correctness risk and availability risk should not land in the same change.

The headline result: strict

(deny default) plus a derived allow set — an out-of-scope path is refused because nothing permits it, not because someone remembered to forbid it. Verified on the real kernel: out-of-scope reads, read-only writes, and private-key reads all refused while no rule names any of them.

Getting there meant root-causing why deny-default aborted every session. The cause was dyld's own bootstrap being blocked before any denial could be logged — which is why it was invisible in the security log and found instead in the crash reporter. Fixed by importing Apple's own baseline fragments rather than loosening the boundary.

Two limits documented rather than papered over

• The v1 guarded posture is a denylist and therefore not a boundary. A denylist cannot be completed by adding entries — the next unenumerated path is always available. Enumeration raises an attacker's cost; it never draws a line. The docs say so explicitly.
• The macOS keychain cannot be protected from the session. Denying the read kills authentication outright (Not logged in), because that is how the session authenticates. Permanent, not a bug awaiting a fix.

Also in

• audit mode no longer terminates connections. It was killing cortex's own event ingest — found by running it against a live session, which is exactly what audit mode is for.
• Plugin reload brought under the same signature gate as boot, after an adversarial pass found it skipped verification entirely and let tampered code execute.
• Test specifications for the second NWS adversarial round (#2434) and for Linux field validation (#2435), the latter carrying the capability probes that unblock the Linux sandbox backend.

Known gaps, stated plainly

Plugin process isolation is not built — ADR-0024 D4 still stands as an accepted risk. The web-gateway path still bypasses per-agent tool policy (#1758). All of L2 is macOS-only; Linux is unvalidated. L3 egress holds for cooperating clients only — a raw socket defeats it.

Cortex v6.12.1 -- purge reports kept shared state + runbook single-fork

What's Changed

• docs(readme): lean so-what rewrite — THE iteration PR, do not merge until Andreas approves by @mellanon in #2310
• feat(common/auth): GitHub App installation-token minting for atlas/luna-dev bot identities by @mellanon in #2399
• feat(runner): EBH-2 — SessionSandbox choke point + none backend (L2 scaffold) by @mellanon in #2394
• feat(runner): EBH-3a — macos-sbpl SessionSandbox backend, audit-capable, enforcement off (#2345) by @mellanon in #2410
• feat(runner): EBH-4 — egress allowlist proxy, deny-by-default, enforcement off (#2346) by @mellanon in #2412
• fix(runner): #2409 part 1 — extend the L2 v1 guarded sensitive-set (cost-raising, not a boundary) by @mellanon in #2414
• fix(dispatch): #2386 — enforce persona allowedTools at the dispatch seam by @mellanon in #2416
• feat(bus/runner): mint + inject a per-session GitHub App identity for agents that declare one (#2406) by @mellanon in #2408
• fix(manifest): strict arc/v1 migration — 4 of 5 validate violations (#2397) by @mellanon in #2407
• feat(adapters): EBH-5 — plugin bundle signature verification (#2347, signing half only) by @mellanon in #2422
• docs(runbook): bundle replaces manual quickstart, never follows it (luna-stack#5) by @mellanon in #2426
• fix(purge): report ~/.claude/relay+events as intentionally-kept shared state (#2420) by @mellanon in #2427

Full Changelog: v6.12.0...v6.12.1

Cortex v6.12.0 -- code capability grants the Write tool (create new files)

What's Changed

• fix(bash-guard): drop gh api/run from the DEFAULT floor (cortex#2335) by @Magnussmari in #2337
• docs(security): NWS review + execution-boundary hardening plan by @mellanon in #2350
• feat(runner): EBH-1 — cortex-owned PreToolUse path guard (F1) by @mellanon in #2355
• docs(security): L2 session-sandbox platform & feasibility spec by @mellanon in #2357
• docs(security): OQ-1 resolved — Linux/container sandbox probe (E5-E8) by @mellanon in #2361
• fix(runner): EBH-1c — close bare-relative flag-value bypass in path guard (round 7) by @mellanon in #2363
• docs(security): OQ-3 decided — sandbox unavailability splits on input trust (DD-11) by @mellanon in #2366
• fix(runner): EBH-1d — git path-checking + end-of-options handling (round 8) by @mellanon in #2368
• fix(runner): EBH-1e — invert path-checking to opt-out, closes the coverage-drift class (round 9) by @mellanon in #2371
• feat(services): OQ-5 — systemd unit hardening for cortex@.service (untested on real Linux boot) by @mellanon in #2372
• docs(security): EBH-6 — F3/F4 posture findings by @mellanon in #2376
• fix(runner): EBH-1f — harden floor-derivation trust root + correct the overclaim by @mellanon in #2379
• fix(bus): EBH-6b — sovereignty posture config key + honest docs (F3) by @mellanon in #2382
• fix(runner): EBH-1g — guard-off Bash sessions run path containment (F4 residual) by @mellanon in #2385
• fix(bus): EBH-1b — wire readOnlyDirs through the dispatch seam (F6 goes live) by @mellanon in #2388
• feat(ci): EBH-7 — swarm-posture structural gate (least-privilege + attack paths, warn-only) by @mellanon in #2387
• fix(runner): EBH-1h — allow bare numeric short flags on head/tail by @mellanon in #2392
• feat(manifest): declare owns {config,state,userData} + scripts.purge by @mellanon in #2395
• fix(stack): code capability grants the Write tool (create new files) (#2331 finding 8) by @mellanon in #2400

Full Changelog: v6.11.0...v6.12.0

Cortex v6.11.0 -- code-capability bash allowlist + macOS quickstart parity

What's Changed

• docs(compose): fix the secrets-verify troubleshooting entry (compose config shows runtime values by design) by @mellanon in #2278
• docs(readme): overhaul README to launch grade — Soma-class shape (#2286) by @mellanon in #2291
• feat(manifest): release-readiness — namespace, full capability declarations, preview-scope description (#2285) by @mellanon in #2293
• test(deploy): container-compose regression bench — scripted, exit-coded release gate (#2284) by @mellanon in #2295
• fix(quickstart+services): unify macOS daemon log paths so the healthy-boot gate works on macOS (#2282) by @mellanon in #2297
• fix(quickstart): re-run restarts a running daemon so fixed configs are picked up (#2283) by @mellanon in #2300
• docs(readme): IoAW thesis + in-the-wild receipts by @mellanon in #2302
• docs(readme): testers plural, generic web receipt, guardrails, features-at-a-glance by @mellanon in #2304
• docs(readme): myelin foundation in the hero + why-it-matters (signed/encrypted envelopes, trust zones, sovereignty) by @mellanon in #2306
• docs(readme): polish batch — OS badges, two-zone trust, distribution USP, plug-and-play surfaces, contributors by @mellanon in #2308
• fix(ci): green main — vocab renames + XDG migration carve-outs + bench placeholder ids by @mellanon in #2313
• feat(federation): WP-6 — stage class-explicit resolved-peer relabel (inert, flag-day R) by @mellanon in #2316
• docs(runbook): zero to MVP software-factory Luna walkthrough (#2320) by @mellanon in #2324
• docs(bootstrap): zero→Luna spec + agent-bundle blueprint gallery by @mellanon in #2318
• fix(quickstart): macOS parity — reach a running daemon on a fresh host (#2322) by @mellanon in #2328
• docs(runbook): GitHub permissions recipe, env-var reuse, bundle-live status (#2331) by @mellanon in #2332
• fix(stack): code capability carries a repo-scoped bash allowlist (#2331 7a) by @mellanon in #2334

Full Changelog: v6.10.3...v6.11.0

cortex v6.10.3 -- honest container provisioning + daemon-on-bus healthcheck

Container (L4 compose) follow-up to v6.10.2, from community container testing.

Fixed

• cortex quickstart --skip-gate: new flag — the healthy-boot gate is reported as deferred to the supervisor healthcheck (and quickstart exits 0 when steps 1–7 pass) instead of an expected-but-alarming status:error on container boots, where the daemon starts only after provisioning. Default (no-flag) behavior unchanged.
• Container entrypoint uses --skip-services --skip-gate; the old step-8 error-tolerance workaround is removed — any nonzero provisioning exit now aborts the boot loudly.
• The cortex compose service gains a real healthcheck: it probes the NATS monitor's /connz for the daemon's own named bus connection (cortex-<slug>). Strictly stronger than a server-health probe — a live-process/dead-bus-link daemon now flips the service unhealthy in docker compose ps instead of degrading silently.

Container pins

• Default CORTEX_REF is v6.10.3 (Dockerfile ARG + compose default, lockstep). Note: this checkout's entrypoint requires CORTEX_REF >= v6.10.3.

Upgrade (container)
From deploy/compose/: docker compose down -v --remove-orphans && docker compose up -d --build (the -v recreates volumes; required once if coming from a pre-v6.10.2-era build).

Cortex v6.10.2 — quickstart scaffold/gate sync

Fixes for the Linux cortex quickstart path.

• Scaffold/runtime sync: single-stack quickstart no longer scaffolds a nats.credsPath pointing at a federation-account creds file it never mints — the bus now connects on loopback for a plain single-stack install. (Federation's network make-live still provisions its own creds; not regressed.)
• Boot gate: a bus-connect failure is now surfaced with the actual error instead of a silent 60s gate timeout; the append-mode error log is truncated before daemon restart so the gate reads only the current boot.
• Web surface: --surface web scaffold now emits the broadcastUrl the web adapter requires.

Rolls up 6.10.1: content-filter repo-rename resolution, prompt-filter fail-closed posture, and quickstart ~ path expansion.

Cortex v6.10.0 — L4 container standup

First release that boots a working L4 compose container end-to-end. Epic #2164 (found via cloud container testing, @mellanon).

Container standup fixes

• #2154 — quickstart now ships in a release tag; the L4 compose default (CORTEX_REF) points at v6.10.0 (was v6.8.5, which had no quickstart and aborted at boot).
• #2156 — the image installs arc and arc installs the surface adapter bundle(s) (CORTEX_SURFACES, default discord); previously the git-clone image had no adapter and cortex start FATAL'd at surface boot.
• #2155 — cortex quickstart --container skips the healthy-boot gate that can't pass in the split-container model (removes a ~60s stall + guaranteed-fail on every boot).
• #2153 — cortex quickstart --surface <discord|web> — a web/gateway container can be provisioned without placeholder Discord snowflakes (web binding field reconciliation tracked in #2174).
• #2139 — the entrypoint hard-fails at boot on an empty CLAUDE_CODE_OAUTH_TOKEN (a container has no interactive login), instead of booting "running" and failing on first dispatch.

Also since v6.9.0

• #2149/#2150 skill materialiser + Skill Guard name normalisation; #2132 substrate config-home; #2160 confidentiality-gate engine bump (hex-SHA false-positive fix).

Upgrade

arc upgrade cortex. For the container: cd deploy/compose && cp .env.example .env (fill CTX_* + a real OAuth token) → docker compose up -d.

Not yet in this release: per-agent env passthrough (#2133, in review — allowlist redesign) and the CI plugin-dir pin lane (#2157, awaiting a CI credential decision).