v1.7.0 (2026-07-26)

Minor release: the first release whose macOS app artifact is signed and notarized, carrying roughly three and a half weeks of feature, hardening, and fix work since v1.6.1 (2026-07-01). Backward-compatible; the new enforcement mechanisms fail closed.

Why this release exists

Two reasons. First, the release pipeline can now produce a signed and notarized macOS app: earlier attempts died inside Keychain without naming the missing Apple credential (#1008) and zipped before notarizing (#1015). This release’s app bundle is the first Sanctuary macOS artifact that passes Gatekeeper as a signed, notarized app. Second, the unified-protect exclusive-egress path lands end to end in code: one protect flow can provision a confined agent account, arm a per-uid pf-anchored exclusive route through a dedicated gate process, hold the agent parked behind a release barrier until the gate verifies, and tear down per agent through a registry.

What changed

• Exclusive-egress gate (unified-protect Slice 5): pf-anchor registry, gate-port generation state machine, gate-as-TCB with its own uid and fail-closed client auth, exclusive routing composition, release barrier, provision-flow arming, and per-agent unprotect (#935, #938, #943, #948, #957, #959, #961, #947), plus a long drill-found fix wave on the install-and-arm path (#977 through #1014).
• Castle Wall: signed per-uid allow-list confined-agent egress provisioning (#905), one-flow agent-account auto-provisioning (#893, #901, #903), observe/learn allow-list v1 with human-gated promote (#897), Slice M macOS audit-producer authenticity plus emission watchdogs (#927, #946, #960), and an operator-side enforcement-event exporter with a frozen public schema and streaming consumer (#907, #911).
• Evidence pack v0.1-preview with repeated honesty-chokepoint hardening waves (#933 and follow-ups).
• Fleet and entitlement: add-machine enrollment, signed compliance-attestation export, offline Ed25519 entitlement scaffold, paid-tier license issuance CLI with a tamper-evident ledger, and downgrade UX with a signed revocation list (#894, #895, #859, #868, #871, #890).
• Dashboard and UI: one paper/ink token system across every web surface, posture-first landing, evidence spine, and slice 1 of a PWA mobile approval companion (#963, #964, #965, #992).
• Privacy: Tier B PII rewrite live on the query-anonymity path, privacy-filter tier-2 pinned local-only, and zero unrequested outbound by default (#996, #997, #869).

See CHANGELOG.md for the grouped detail and the git history from the v1.6.1 tag through the v1.7.0 tag for per-PR detail.

Known limits (fixed in v1.7.1)

This tag was cut before the gate-reachability fix (#1024) and the boot fixes (#1027, #994) landed. As tagged:

• An unmodified agent harness cannot reach the exclusive-egress gate; reaching it required a bespoke token header that no stock HTTP client sends.
• A gate-daemon plist healed at boot takes effect only on the NEXT boot, because launchd has already loaded the stale job when the heal runs.

v1.7.1 completes this path; see the v1.7.1 release notes.

Install

npx @sanctuary-framework/mcp-server

or explicitly pinned:

npx -y -p @sanctuary-framework/mcp-server@1.7.0 sanctuary

Capability bounds

The macOS Castle Wall bounds are unchanged from v1.6.x: per-uid allow/deny plus attended boot-survival are proven; there is no per-flow rule-attributed audit trail. The exclusive-egress gate ships in code in this release but is not usable by an unmodified agent harness until v1.7.1.