Sanctuary v1.3.3 release notes

Released: 2026-05-26

Castle Wall macOS Phase 2.5 retail UX + Track 4A IPC integration + Track 4A.2 sysext socket-path discovery. Five of six Phase 2.5 tracks landed plus the full IPC integration stack: daemon wired into sanctuary wrap startup AND a shared discovery file so daemon and sysext find each other.

What’s in this release

Phase 2.5 retail UX (#361)

• Track 1 – AgentDetector. Swift module that detects OpenClaw, Claude Desktop, Claude Code, Codex CLI, Hermes, Cursor, and Cline on the operator’s machine via file, process, and bundle ID scanning. Cline detector ships with a glob match against the actual extension (not the bare ~/.vscode/extensions directory, which previously false-positived).
• Track 2 – Protect UI. Tabbed agent list in the host app’s main window with protect/unprotect controls. Green shield indicates a protected agent. Delegates to sanctuary wrap --<agent> --no-open under the hood; the CLI alias wrap is preserved for backward compatibility.
• Track 3 – First-run UX. Welcome screen on first host-app launch with batch-protect for detected agents. Sets a UserDefaults flag so subsequent launches go straight to the main UI.
• Track 4B – Plain-English activity log. Event feed in the dashboard polls the server HTTP API every three seconds; events are color-coded and rendered as plain-English sentences (privacy, approval, denial, egress, lifecycle, compliance, integrity).
• Track 4C – Vocabulary normalization. sanctuary protect becomes the primary CLI verb (with sanctuary wrap preserved as an alias). Dashboard labels switch from verified / wrapped to protected. Help text and three vocabulary-affected tests updated to match.

Track 4A IPC integration (#362)

• Daemon wiring. startMacOSCastleWallDaemon wraps MacOSFlowIpcListener with policy loader, audit sink, and shutdown registry. Invoked from sanctuary wrap startup after fortress bind, before agent harness launch. Daemon lifetime is fortress-scoped; clean shutdown on wrap exit.
• Best-effort startup. A daemon startup failure (e.g. Linux EACCES when binding the fortress-scoped socket without root) does not fail wrap. The agent harness still gets wrapped; the IPC daemon will surface its absence at handshake time. Mirrors the existing best-effort discipline for the v1.1 dashboard wiring.
• Three new CLI verbs:
  • sanctuary castle-wall reload – reload the policy manifest from disk for the running daemon’s fortress.
  • sanctuary castle-wall audit-dump --fortress <id> --since <duration> – emit Castle Wall audit events as newline-delimited JSON.
  • sanctuary castle-wall approve <request_id> [--scope=once|session|always] – operator approval for prompt-disposition flows. Correction, 2026-08-07: prompt-disposition policy rules are not currently enforced on macOS or Linux. Do not rely on a disposition: prompt rule to block traffic. Open defect: IC-01, IC-02, IC-03, IC-04.
• Provision-pin auto-bootstrap. Fresh fortresses now have pinned-pubkey state ready at sanctuary init; the existing sanctuary castle-wall provision-pin verb stays callable for manual rotation.
• Second-wrap collision guard. A second sanctuary wrap against the same fortress errors cleanly with a Phase 3 pointer message rather than racing for the UDS socket.

Track 4A.2 – sysext socket-path discovery (#364)

Closes the path-agreement gap the 2026-05-25 Track 4A drill identified (Wiki/sessions/sanctuary-castle-wall-mac-phase-2-5-track-4a-ipc-drill-mini1-2026-05-25.md). The daemon binds at {fortressPath}/castle.sock; the sysext (separate process, doesn’t inherit env from sanctuary wrap) previously fell through to a sysext-context home that the user couldn’t reach. Track 4A.2 introduces a shared discovery file at /tmp/sanctuary-castle-active.json:

• Daemon side: writes the file atomically on bind (mode 0644) with {socket_path, fortress_id, pid, started_at}. Refuses startup if the file points at a live PID. Removes only its own matching config on shutdown (stale-config-safe).
• Sysext side: path resolver checks the discovery file first; only trusts it when the recorded PID is alive. Falls through silently to the existing fallback chain when absent, malformed, or stale.
• Hardening tradeoff: /tmp is world-writable for first integration. Phase 3 hardens to /Library/Application Support/Sanctuary/active.json with admin-write / world-read.

End-to-end IPC validation requires a new sysext bundle build + deploy to operator machines so the sysext-side Swift code becomes active. The npm package ships the daemon-side discovery code immediately.

What’s NOT yet in this release (deferral list)

Sysext bundle redeploy

Track 4A.2 added Swift code to the sysext. Operationalizing end-to-end requires a fresh sysext build + sign + notarize + install on operator machines (user clicks “Allow” in System Settings during activation). Until that deploys, the path-agreement code is live on the daemon side but dormant on the sysext side.

Track 4A drill re-firing

The 2026-05-25 drill halted twice at Step 0 (once on missing integration code, once on missing path-agreement). Both root causes are closed by PR #362 + PR #364. The drill spawn prompt (Review/Coordinator/Castle_Wall_Mac_Phase_2_5_Track_4A_IPC_Drill_Spawn_Prompt_2026-05-25.md) re-fires unmodified once the new sysext bundle deploys; the 7-rung ladder is still sound.

Drill subject definition

A small spawn-prompt clarification still pending: how to express the drill subject (a curl loop that exercises NEFilterDataProvider scope). Minor scope item; does not block the integration claim. To be addressed before re-firing.

Dashboard republish

Phase 2.5 deployed dashboard changes to Mini1 via in-place dist/ swap. This release includes those changes via npm publish so downstream npm install -g consumers receive the protected vocabulary and the new CLI verbs.

Test posture

• Local mac: 5172 tests passing (baseline 5145 + 27 additive across all three PRs)
• Linux CI: passing count below mac local by ~18 (macOS-only tests skipped on Linux per existing platform parity), still above baseline floor
• Swift SocketPathTests: 14 tests passing (Track 4A.2 sysext discovery)
• Baseline floor stays at 5145; bump deferred until Linux CI cascade-bump is appropriate

Substrate verification

• Sanctuary main: b423b585 (Track 4A.2 sysext discovery merge SHA)
• Mini1: sysext ai.sanctuaryprotocol.macos.castle-wall (0.1.0/1) [activated enabled] from Phase 2 install ceremony 2026-05-25 morning; sysext-side Track 4A.2 code requires fresh bundle build + deploy to activate
• Saturday show fortress (PID 96988) running pre-Track-4A binary; will pick up new code on next wrap restart

Upgrade path

npm install -g @sanctuary-framework/mcp-server@1.3.3

Existing fortresses continue to work. New sanctuary init runs bootstrap the pinned-key state automatically; existing fortresses can call sanctuary castle-wall provision-pin manually. Track 4A.2’s daemon-side discovery activates immediately on the npm install; the sysext side activates after a fresh sysext bundle deploys.

Known gaps acknowledged in release

1. Sysext bundle redeploy required to operationalize Track 4A.2 on operator machines.
2. Drill subject definition for Rungs 3-7 of the IPC integration drill needs clarification (curl loop semantics under NEFilterDataProvider scope).
3. Dashboard republish closes the in-place-swap drift on Mini1.

These do not block the release; they shape the next iteration. After the sysext redeploy, re-firing Review/Coordinator/Castle_Wall_Mac_Phase_2_5_Track_4A_IPC_Drill_Spawn_Prompt_2026-05-25.md provides the end-to-end thesis-gate proof.