v1.7.1 (2026-07-27)

Patch release: completes the exclusive-egress gate path that shipped in v1.7.0, the first signed and notarized macOS release. No new capability, no breaking changes, no config migration.

Why this release exists

The v1.7.0 tag was cut before three gate-path fixes landed:

• Reachability (#1024): as tagged, an unmodified agent harness could not reach the exclusive-egress gate; reaching it required a bespoke token header that no stock HTTP client sends. The gate now accepts standard HTTP Basic proxy credentials whose password carries the existing generation-bound token payload, and the release wrapper exports the proxy environment variables only at exec time, after the release barrier and token checks pass. Clients that ignore proxy environment variables still cannot use this path; this does not add transparent interception.
• Same-boot effect (#1027): a 12-cold-reboot hardware drill showed the plist self-heal writing a healed gate-daemon plist to disk on every stale-plist boot (5/5) while the gate daemon still started on none of them (0/5), because launchd had already loaded the stale job. The boot path now boots out the stale loaded job, settles to unloaded, then bootstraps and kickstarts, and a gate-daemon bootstrap failure is a hard parked outcome, never a logged-and-released one.
• Self-heal (#994): a host armed on a pre-#986 build carries a gate-daemon plist with a non-absolute interpreter that fails on every boot. The boot supervisor now re-renders the plist with its own absolute interpreter path through the same builder the install path uses, atomically and fail-safe.

Claim bound: the bootout-before-bootstrap ordering and the combined heal-then-take-effect sequence are unit-proven against the launchd seams; the hardware reboot re-drill of the combined behavior is still pending, so the same-boot self-heal is not claimed proven on real hardware yet.

What else changed

• Observe/learn promotion reaches live enforcement (#1031, completing the honesty correction #1030): promote now publishes into the same rule source the enforcement daemons read, scoped to the current routing mode and serialized against provisioning; a fresh promote composes on Linux (habeas lane guaranteed). The on-hardware promote-then-reach drill is still owed before any reach claim widens.
• Gate-path diagnosability (#1023, #1025): a hung oracle refresh fails closed loudly, park verification waits for launchd to settle and refuses with measured evidence, and release-barrier refusals record why, so a parked agent is diagnosable.
• Wrap (#1020): one exported chokepoint for PyYAML interpreter resolution, refusals that name what was probed, and a doctor check that shares the same matcher.
• Mesh (#1022): split-brain is raised on a policy refused as a replay, not only on one applied.
• Release pipeline (#1018, #1019): notary credentials are validated against Apple in preflight, and the publish signing gate fails closed with the falsely-named skip step deleted.
• CI and dependencies: Playwright image derived from server/package.json (#1029), timing flakes fixed at the cause (#1021), GitHub Actions bumps (#970, #971, #972, #1026), and routine dependency bumps (#1017, #985, #1009, #1001, #982, #1011, #941, #1010).

Install

npx @sanctuary-framework/mcp-server

or explicitly pinned:

npx -y -p @sanctuary-framework/mcp-server@1.7.1 sanctuary

Capability bounds

The macOS Castle Wall bounds are unchanged: per-uid allow/deny plus attended boot-survival are proven; there is no per-flow rule-attributed audit trail. The exclusive-egress gate is reachable by stock proxy-honoring agent harnesses as of this release; the hardware re-drill of the combined same-boot plist self-heal is pending as noted above.