v0.1.1

Added

• Missions install themselves on run create — xorcise run create no longer refuses an
  uninstalled mission; it pulls it first, docker-run style, which is what POST /runs already
  did. The pull renders the same honest progress as xorcise mission pull, Ctrl-C still cancels
  the job server-side, and all of its messaging goes to stderr so --json output stays
  parseable. A failed or externally cancelled pull exits 1 with no run created; a pull still
  going when the client's poll cap expires exits 3 and continues server-side.
• Model refusals are surfaced as evidence — when a provider blocks a request on policy, the
  OpenHands and Claude Code adapters now record it as a labelled refusal event instead of
  discarding the failed call. A refusal is a fact about the run and is graded as one. The
  console discloses which harnesses support refusal detection, so an unsupported harness reads
  as "unknown", never as "no refusals".

Fixed

• Run replay keeps the agent's own chronology — events are ordered by the agent's clock
  rather than by when XORCISE received them, so a delayed OpenTelemetry export can no longer
  move a prompt behind the response it produced. Ordering stays deterministic when timestamps
  tie.

Security

• Mission slugs can no longer escape the install store — a slug arriving from a REST path
  parameter, a request body or a bundle manifest now resolves through a single choke point that
  rejects anything which is not a direct child of the install root. Previously a slug carrying a
  path separator, .. or an absolute path could aim reads, the delete path's rmtree, and an
  install's staging, backup and final writes outside that root. Reads now degrade to "not
  installed"; installs fail preflight with a named error.
• The filesystem browser answers only the local operator — GET /api/fs/list exposes the
  server host's directory tree, so it is now gated on the peer address: non-loopback clients —
  LAN peers under an explicit XORCISE_HOST=0.0.0.0 bind, and agent containers reaching the API
  over the Docker bridge — get a 403.

Changed

• The README quickstart runs as written — it now follows the CLI's own golden path: set the
  judge model, register the agent with --kind, pull a real library mission, then
  run launch-cmd for the block you paste into the agent's terminal.
• The published policies match the shipped software — the documented default bind is stated
  as it really is (loopback plus the Docker bridge gateway, widening to the IPv4 wildcard only
  when you ask for it, or when the gateway cannot be determined at boot), the security
  response-time commitments that could not yet be honoured are gone, and ACCEPTABLE_USE.md
  now ships inside the wheel, as the policy says it does.
• Fifth Domain Pty Ltd is named as the copyright holder, and a Contributor License Agreement
  now covers contributions. The licence itself is unchanged: Apache-2.0.

What's Changed

✨ Enhancements

• feat(cli): auto-pull missions on run create and fix the README quickstart by @christo-xorciseai in #17

🐛 Bug fixes

• fix(ci): move CLA signatures to the org's private signature store by @christo-xorciseai in #18

🔒 Security

• fix(security): contain mission slugs and gate /fs browse to loopback by @christo-xorciseai in #14

📚 Documentation

• chore(legal): name Fifth Domain as copyright holder and add a CLA by @christo-xorciseai in #16

Other changes

• docs(changelog): record the 0.1.1 release by @guru-xorciseai in #19

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Run your cyber-AI agent against a real mission. Watch everything it does. Grade the evidence.

pip install xorcise
xorcise up          # boots the stack, prints the console URL

Needs Python 3.12+ and Docker Engine. Tested on Ubuntu. xorcise doctor checks the host first;
xorcise up --stub runs the full loop without Docker.

Added

• CLI-first single distribution — pip install xorcise, then xorcise up boots the
  whole stack on one host and prints the console URL; xorcise doctor checks the host,
  xorcise down tears everything down. A stub mode (xorcise up --stub) runs the full
  loop without Docker.
• Agent registry — register any cyber-AI agent (OpenHands, Claude Code CLI, Codex CLI,
  or anything custom) as the unit of evaluation; runs and results accrue to the agent's
  track record, with versioned re-declarations for comparability.
• Missions — real target environments packaged as pullable images (a free mission
  library) or authored locally as bundles (mission.json + compose stack) and ingested
  into a locally built, fused mission image.
• Isolated runs — each run gets its own private WireGuard tailnet (Tailscale +
  Headscale) with a per-run ACL as the hard network boundary: the agent can reach exactly
  its one mission and nothing else. Environments are created per run and destroyed at
  teardown.
• Evidence collection — a built-in OpenTelemetry collector captures every command,
  tool call and message the agent emits (traces and logs), correlated per run; harness
  adapters normalise the raw telemetry into a replayable event stream.
• 50/50 evidence-anchored grading — deterministic, mission-defined checks (the
  reproducible half) combined with a rubric-bound, bring-your-own-model LLM judge (the
  qualitative half), graded over the sealed run evidence, never the agent's claims.
• Run control for agents — a bearer-authenticated REST surface for the agent under
  test: fetch the mission brief and intel, submit artifacts, and mark the run done.
• Results and reporting — per-run scorecards with full breakdowns, exportable run
  reports (Markdown/HTML), per-run event exports (JSONL), agent history, and a
  leaderboard across recorded results.
• Web console — a live trace feed, terrain map, run replay, results, and settings UI
  served by the same process at /ui.
• Deployment flexibility — all-local by default; a distributed topology supports
  relocating the mission plane to a remote host while the control plane and console stay
  local.
• Live lifecycle feedback — xorcise up's frontend install/rebuild and xorcise down's stop/reap/teardown steps show a live spinner with real build phases and elapsed
  time on a terminal (piped output stays line-based for scripts).
• Update notice — xorcise up mentions a newer released version when one exists on
  PyPI (checked in the background, cached for a day, silent on any failure; opt out with
  XORCISE_NO_UPDATE_CHECK=1; source checkouts are never nagged).

---

Links — Website · Documentation · PyPI · Changelog · Contributing · Security

Missions are deliberately vulnerable by design. Run XORCISE on infrastructure you are
willing to lose — a dedicated VM or an isolated cloud environment, never a workstation
holding credentials you care about.

v0.1.0rc1

Full Changelog: https://github.com/xorcise-ai/xorcise/commits/v0.1.0rc1