v1.8.0 (2026-09-04)

Minor release: macOS Castle Wall recovery and cold-install hardening, a Rung 1 sovereign memory custody candidate, and a broad internal hardening pass, covering roughly five weeks of work since v1.7.2. Backward-compatible; no config migration.

Why this release exists

This release covers the macOS operator-owned egress enforcement and agent Protect line, now cold-installable end to end by an agent following observed machine state, with attended reboot-survival evidence on a signed binary. It adds Rung 1 sovereign memory custody as a release candidate: hands-free by default on a host that has already stored its credential, so an operator’s agent can store memory and later read it back under the operator’s own encryption with no approval prompt for the read. A Rung 2 local model-provisioning surface now verifies a Sanctuary-signed model manifest against a pinned key before any model pull. At v1.8.0 release time, Linux egress enforcement was not implemented; a later package, not part of v1.8.0, now proves only the narrowed Ubuntu 24.04 (x86-64) install-grade claim. Windows remains roadmap scope for enforcement and read-only-custody scope for memory.

What changed

• Agent-guided cold install is more hardened. The install planner (sanctuary install --profile ... --json) returns one of four explicit states and never invents downloads, retries, privilege, or recovery steps. Preflight now names the content-filter approval and trust-anchor re-pin as human actions, strict arm mode gives an explicit warning instead of a silent pass on a reachable-but-unverifiable provider, and provider-liveness checks require verified auth rather than mere reachability (#1220, #1345, #1346, #1347).
• macOS Castle Wall recovery and operability improved. Recovery disarm resolves its own build identity instead of risking a fail-closed against un-bricking; deactivation survives an app-version skew with a disclosed single-shot recovery path; headless disarm and deactivation work without a GUI session; deploy-preflight verifies the app and the activated system extension are in step before deploy proceeds; and DNS-resolver publication sequencing and manifest refresh on resolver drift were added (#1344, #1323, #1321, #1325, #1290, #1291, #1289, #1286, #1288).
• Rung 1 sovereign memory custody ships as a release candidate. An existing fortress’s stored credential opens memory after restart with no secret typed; a copied fortress enrolls a new host through a hidden recovery-key ceremony without replacing the master; the reset menu is reordered recovery-key-then-shares-then-guardian with destructive nuke last; and memory_get/memory_search now classify as Tier 3 by default, with search bounded to 10 results by default (500 max) and every refusal audited (#1365). Every write verb, plus plaintext ingest, emit, transcode, and export/import, stays behind non-relaxable Tier 1 approval.
• One wrapped agent now owns a fortress’s memory across server processes. The first wrapped agent to touch a fresh, empty memory store atomically claims a durable, authenticated owner pin; a process with a different identity is refused; sanctuary doctor reports a missing or mismatched pin (#1299, IC-16).
• Vault export and import are now on the shipped tool catalog, registered as non-relaxable Tier 1. Export writes a signed bundle into a fresh per-export directory; import is all-or-nothing only where the storage backend supports a transaction, and the shipped filesystem fortress does not, so cross-fortress import is refused there before any approval prompt (#1299).
• Reputation re-exported after import still verifies, carrying forward a signed record of the keys it verified, under an additive manifest version an older verifier cleanly refuses.
• Exit V2’s CLI is merged. Signed memory provenance carries through exported archives and quarantines a foreign signer whose key is later disclosed compromised; the operator CLI (hidden-input custody flow, gate-issued approval provenance, macOS local-human dialog boundary) is merged after independent review (#1314, #1315, #1237, #1239, #1242).
• Documentation and the assurance matrix now match merged behavior. The README distinguishes the CLI’s local-human approval dialog (macOS-only) from the MCP tools’ Tier 1 approval channel for the same verbs; ROADMAP states Exit V2’s CLI as merged; and ASSURANCE_MATRIX.md gains bounded rows for Rung 1 memory custody, Rung 2 catalog-v3 verification, and fleet licensing (#1366).
• Local model provisioning now verifies a Sanctuary-signed manifest, shipped inside the release package, against a pinned model-catalog key before any model pull. The manifest lists Qwen3 4B, 14B, and 32B as the defaults for the three memory tiers; a unified concierge model-selector and a signed-digest provisioning path round out the surface, and an operator can point at a different signed manifest with --model-manifest <path>. See Capability bounds for what this verification does and does not cover (#1307, #1308, #1316-#1322, #1370).
• A fortress whose local-intelligence config record has become unreadable now has a recovery path. A corrupt record, or one written by a newer Sanctuary, fails config writes with a typed error naming the fix: sanctuary intelligence config-reset requires a typed confirmation, quarantines the unreadable record to a timestamped sidecar, and lets writes resume. A record that still reads correctly, or fails an integrity check, is refused rather than reset (#1369).
• Memory provenance now reports verified for passages that arrived through a memory archive import. An imported passage that read back fine still showed as unverified when checked for provenance; the tool now recognizes the signed import record that admitted it and reports the passage’s origin tier and transfer lineage instead of a generic denial (#1371).
• The signed macOS app’s CLI runtime carries the complete built tree, so fortress creation works through the signed launcher on a Mac with no Node installed. The sealed runtime bundled with the signed app is now complete enough to run the CLI on its own (#1372).
• A Team license can be issued in one command, as fleet licensing and node-count enforcement (#1338).
• Master-key rotation no longer refuses every fortress that has ever booted the MCP server. A pre-existing classifier gap treated a key an earlier release introduced as unrecognized; rotation now classifies the server-written config baseline under the new master and preserves the epoch witness’s anti-rollback latches across rotation (#1368).
• One shared linear-time helper normalizes a trailing slash everywhere the CLI, wrap, Castle Wall provisioning, egress gate, transparency client, and intelligence substrates previously each carried a copied regular expression (#1367).
• A broad internal hardening pass closed across audit, mesh/federation, state, file-grant, and admission paths, including freshness and replay handling in mesh/federation consumers, verified-read requirements before durable state writes, file-grant expiry and sibling reconciliation, admission-deadline write bounding, and audit checkpoint silent-downgrade detection. None of it is a currently open defect (#1199-#1272, #1337, #1326, #1327).

Install

Install the cooperative Sanctuary CLI:

npx @sanctuary-framework/mcp-server

or explicitly pinned:

npx -y -p @sanctuary-framework/mcp-server@1.8.0 sanctuary

Install the macOS Castle Wall enforcement app from the attached release asset:

• Asset: Sanctuary-CastleWall.app.zip
• SHA-256: cd65676ca6c15259dbfd1ebcc373724b434074f4ad0d866fa8ba29f396777c67
• Full install and arm path: Castle Wall macOS install and arm guide

Capability bounds

• Linux egress enforcement was not implemented at v1.8.0 release time. A later package, not part of v1.8.0, has this current bound: On Ubuntu 24.04 (x86-64), a fresh install of the shipped package enforces a signed operator policy per user account: blocked destinations stay blocked and allowed ones connect, through five reboots, on three fresh servers, with the evidence checked by two independent reviewers. Fault-injection witnesses, a real-agent harness, and every other distribution or architecture remain unproven.
• macOS reboot-survival evidence is attended, not unattended, and scoped to one host and build; it is not a per-flow rule-attributed audit trail.
• Rung 1 memory custody is a release candidate, not a proven capability. An operator confirms restart persistence on their own host before relying on it daily.
• Every agent connected to one fortress shares one memory scope. The one-owner guard refuses a second distinct wrapped identity where an identity resolver is wired, but per-agent memory isolation is not yet implemented.
• Master-key rotation still does not cover memory namespaces. While any memory records are present, rotation refuses at preflight and changes nothing; no shipped procedure yet rotates a fortress that holds memory records.
• Memory ingest, emit, transcode, and archive export/import fail closed off macOS. On Windows, every memory verb and memory/archive export or import refuses with a named remediation, because the reviewed local-human Tier 1 approval dialog is macOS-only; Windows is scoped to authenticated custody-envelope read only.
• Rung 2 local model-provisioning verification checks a signed manifest before any pull, with bounds. Provisioning verifies the Sanctuary-signed manifest shipped with the release against a pinned key before any pull. There is no network discovery of newer manifests yet; light assurance verifies the runtime-reported digest; the byte pin defends an altered asset inside an intact package, while release provenance defends a rewritten bundle; Ollama is installed by the operator on every platform in this release, and pulling the tier model with ollama pull first is the reliable path, after which the ceremony verifies the present model against the signed manifest and arms. On a fresh 16 GiB Mac running the released artifact, the signed-manifest verification, the digest checkpoints, and the fail-closed refusals (tampered, stripped, or foreign-signed records) were confirmed; a local cognition surface answering from the verified model was not, and is tracked.
• Fleet is licensing and node-count enforcement only. The multi-machine “Add Machine” enrollment flow and signed compliance-attestation export remain a draft, unmerged PR (#894); this release is not a multi-machine management console.
• Guardian quorum sign-off and fortress lockdown remain open, pre-existing bounds this release does not close. The optional M-of-N guardian gate on revoke/kill cannot be enabled on a shipped fortress, and fortress lockdown does not currently gate any write, egress, or tool call (IC-10, IC-11).
• Export/exit bundle and dashboard live refresh remain partial. Dashboard export omits the state re-key key, import hides skipped-entry counters, and an imported bundle from a fortress that rotated identity keys can lose pre-rotation state on some paths (IC-07, IC-08, IC-09); several dashboard inbox sources and status changes can go stale until reload (IC-12).

Not in this release

• Linux and Windows Castle Wall enforcement in the v1.8.0 release package. The later Ubuntu 24.04 (x86-64) Assurance Matrix claim came after v1.8.0 and does not change what this release carried.
• The multi-machine fleet “Add Machine” enrollment flow and compliance-attestation export (draft PR #894).
• SDW post-export deletion (sdw_export_delete): needs a backend-wide serialization boundary that does not exist yet.
• Memory-namespace-scoped master-key rotation and the per-flow, rule-attributed macOS audit trail.
• Per-agent memory isolation and network discovery of newer signed model manifests.