Sanctuary v1.4.0 release notes

Released: 2026-06-15

Minor release. main has accumulated a large body of work since the v1.3.2 git tag: the macOS Castle Wall enforcement proof, a wave of Sentinel and audit-surface hardening, the agent-native cooperative surface, the Sovereign Data Workspace storage spine, federation v1 plumbing, signed transparency checkpoints with opt-in external-anchoring scaffolding, and operator custody and distress-channel mechanisms.

Why this release exists (the version story)

The published latest channel was at 1.3.3 (2026-05-26), roughly three weeks behind main. There is no separate v1.3.3 git tag, so main could not honestly be republished as 1.3.3, and the feature weight since the v1.3.2 tag makes a semver minor bump correct. v1.4.0 reconciles the version story: it brings the published package back in line with main and is the first tag cut since v1.3.2.

The full per-PR detail lives in the git history from the v1.3.2 tag through main. The summary below groups that work and traces each capability claim to a proven or partial row in ASSURANCE_MATRIX.md or to merged code.

Highlights

Castle Wall macOS: per-uid allow/deny enforcement demonstrated

The macOS egress-enforcement row in ASSURANCE_MATRIX.md is now proven (it was partial). The proven claim is exactly what the drill captured:

• Drill 2026-06-11 on Mini1 (macOS Tahoe 26.5.1, system extension v716): agent egress to a non-allowlisted IP blocked, agent egress to an allowlisted hostname allowed, operator egress unaffected, across 3 armed cycles, with graceful disarm 3/3, dead-man fail-open 3/3, and zero ruleDigestMismatch.
• Evidence in-repo: docs/audit/castle-wall-macos-allow-deny-drill-2026-06-11.md, castle-wall-macos/README.md, castle-wall-macos/Tests/CastleWallExtensionTests/FilterProviderTests.swift.

What this release describes macOS Castle Wall as: a signed system extension plus content-filter provider with a proven per-uid allow/deny egress-enforcement demonstration. It does NOT claim an audited per-rule-per-flow trail, and it does NOT claim reboot-survival. Named remaining gaps from the assurance row: the arm-lease TTL-expiry leg is inconclusive because the headless CLI arm path is wedged on Tahoe (W7-1); proof is one host and one OS version; no p99 overhead is captured.

Supporting work landed alongside the proof: an IP/CIDR rule matcher with auto-derived scoped DNS allow (#464), headless arm/disarm verbs sanctuary castle-wall enable|disable routed through LaunchServices for Tahoe (#448, #462), a provider-side dead-man lease for wedge-proof headless disarm (#471), live content-filter state in sanctuary castle-wall status (#456), operator-differential baseline-allow with a signed descriptor (#374), and an operator override plus audit-findings verb for a broken audit chain (#461).

Castle Wall macOS hostile-guest containment

The trusted launcher applies seccomp-deny-AF_VSOCK inner-confinement to uncooperative plugins running in the Apple Containerization box. The vminitd escape reproduced without the jail is shut with it (drill N=3/3, 2026-06-09; proven row in the matrix, for python-preamble delivery on a python-capable image). A static-binary jail-delivery path for python-less guest images is built and unit/CI-verified but has not yet run its own box drill, per the matrix gap. This is one inner-confinement layer, not full plugin isolation; it is not a “plugin-isolated on Mac” claim (#441, #439, #443, #376).

Agent-native cooperative surface

A safety base (gate verify-mode, preflight, opaque-handle ownership) plus a cooperative surface of verbs, help, introspection, compound operations, events, and audit search for agents operating their own fortress (#417, #419).

Sovereign Data Workspace (SDW)

A storage spine with an enforced write gate that cannot persist secrets, Phase 2 stores (working-state, query-history, document-corpus), blind plaintext query-history timestamping, provenance-derived taint propagation, and a memory-backend adapter contract (#420, #421, #449, #440, #438, #484). Current correction: approval-bound vault export/import is not shipped because createSdwTools has no production caller, so persisted SDW agent output is not exportable despite AGENTS.md MUST-NEVER #2. Open defect: IC-15.

Federation v1 foundation

A /v1 node skeleton with session ceremony, enable/disable/status verbs, durable operator attestations, agent protect/unprotect endpoints, node sync plumbing, and a cross-machine sync plus identity-portability demo (#445, #457, #465, #466, #507).

Verifiable transparency checkpoints

Signed enforcement-evidence checkpoints with a standalone offline verifier (#451). The matrix row is proven for the format and verifier properties only: that row records no hosted transparency log and no external anchoring as part of the proven claim, and publishing remains a manual operator action. An opt-in external-anchoring path to Sigstore Rekor (salted-hash-only, fail-loud) and auditor-side anchor verification are present in code (#487, #489) but are not part of the proven trust claim. Enforcement-on-the-wire claims trace to the Castle Wall rows, not to this format.

Operator custody, distress channel, and Sentinels

• One-master-per-fortress establishment with a two-factor floor, journaled two-phase master rotation that re-keys the whole fortress under an epoch-scoped audit chain, and anti-rollback epoch anchoring with a Rekor counter-floor cross-check (#496, #501, #506, #512).
• A reserved guaranteed-egress habeas distress port with a local listener and a CLI verb, Linux conflict-gate parity, and an honest operator-trust limit (the writ is filed with the jailer) (#497, #500, #503).
• Anomaly detectors: credential-use-sequence and cross-agent-distribution, time-of-day-conditioned baselines, and root-cause hints from feature contributions (#483, #490, #495).

Security hardening

• Agent-facing audit redaction inverted from denylist to allowlist so agent-facing audit, read, and search surfaces expose only an explicit allowlist of fields, closing several policy-inference and self-attestation leaks (#573, #570).
• Sentinel re-tiering: compliance_generate_eu_ai_act_bundle and audit_export_siem move Tier-3 to Tier-1, and policy-read tools require approval, closing agent self-approval and policy-leak paths (#577, #575, #413, #414, #416, #418).
• Approval-path hardening: operator token required even on loopback auto-auth, legacy dashboard buttons routed through the token gate, redirect-inbox approval bound to request args (#525, #526, #521).
• At-rest and crypto hardening: authenticated state version-anchor, MAC’d audit-log rotation checkpoint, stdin keychain writes, internal-only underscore namespaces, zeroed derived keys on eviction, fsynced secure-delete (#394, #396, #392, #393, #522).
• Audit producer authenticity: readers re-verify the producer signature rather than trusting a marker, with Linux daemon enforcement-event signing and producer-key provisioning (#517, #518, #520, #437).
• Boundary hardening: bridge verify/attest authentication with canonicalization byte-parity, did:web SSRF defense-in-depth, fail-closed mesh counter monotonicity, recursive nested-field context-gate filtering, and dependency CVE patches (#412, #434, #409, #388, #524, #519).

Notable fixes

• Castle Wall macOS operability: digest-the-delivered-bytes fix for the Tahoe operator-cut (#479), sysext update path version-stamp plus re-activate (#480), fail-loud on an unnotarized bundle (#481), IPC reconnect and provider-dispatch repairs (#367, #368, #369, #459), and a disarm dead-man lever that survives a flaky verify (#467, #469).
• Exit and migration: exit-bundle re-key under envelope custody with fail-closed import (#499), --import-state rejected without source credentials (#382), read-both/write-new legacy filename migration (#446).
• Wrap install-path hardening against symlink redirection and a Hermes config MCP-injection path (#492, #493).
• Reputation tiers resolve by DID and fail closed on non-finite metrics (#383, #390); anomaly baselines commit only on approval (#411); secrets redacted from the approval context (#384).

Changed and docs

• Vocabulary and layer-naming cleanup: a deprecated legacy CLI alias and its internals are retired behind a repo-wide vocabulary gate, and the numbered-layer naming is dropped for the named layers (Castle Wall, Sentinels, Charter, Heralds) (#444, #458, #510).
• Concordia sidecar bumped to 0.6.0 with the composition pin updated (#566).
• Professionalization: server/src module map, frozen-surface reorg manifest, documentation conventions, sharpened MCP tool descriptions for the AI-agent audience, and pre-outreach repo hygiene (SECURITY.md, badges, SBOM, coverage tooling) (#529, #535, #538, #539, #579).

Upgrade path

npm install -g @sanctuary-framework/mcp-server@1.4.0

Existing fortresses continue to work. The macOS Castle Wall enforcement proof and the hostile-guest containment proof both require the signed system-extension build deployed on the operator host; the npm package ships the daemon-side and server-side code immediately.

What this release does NOT claim

• macOS Castle Wall is NOT claimed to survive a reboot, and the per-uid allow/deny result is a demonstration on one host and one OS version, not an audited per-rule-per-flow trail.
• The transparency-checkpoint row proves format and verifier properties, not enforcement on the wire and not an externally hosted log.
• Hostile-guest containment is one inner-confinement layer, not full plugin isolation.

These limits are the same ones named in ASSURANCE_MATRIX.md; product and marketing copy must preserve them.