v1.8.1 (2026-09-04)

Not published to npm. v1.8.1 was tagged but never released. Its changes ship in v1.8.4, the current latest release.

Patch release: the Rung 2 local-intelligence activation path works end to end on a fresh Mac. Same capability claims as v1.8.0; no new surface.

Why this release exists

The activation drill run on the released v1.8.0 artifact on a fresh 16 GiB Mac confirmed the signed-manifest verification, the digest checkpoints, and the fail-closed refusals, and showed two gaps: the ceremony could not finish its own model download on a host that had never stored a model, and the built-in concierge did not answer from the verified local model. This release closes both and makes the armed state visible to the operator.

What changed

• Setup completes its own model download on a fresh host. The pull streams progress, bounded by a stall deadline and an overall ceiling rather than a fixed request timeout; only the runtime’s own completion signal counts; a host with Ollama but no models yet reaches the plan and consent instead of stopping early. Unreadable, foreign-owned, or world-writable model directories are still refused.
• Integrity is checked at every startup, on every approval channel. A stored local-model state that does not verify or cannot be read refuses startup and names the recovery command; a fortress that never armed local intelligence starts as before.
• The concierge reaches the verified local model, with a bounded prompt. Sanctuary’s own instructions and the fortress records are compiled as separate parts; the records are capped and screened as untrusted; screening decisions are reported and audited as such.
• Local intelligence is set up only when asked. A headless run without the opt-in flag records nothing.
• The armed state is visible. sanctuary intelligence diagnose reports armed state, manifest version, bound models and digests; setup prints its verification line; concierge status names the bound model.

Install

npx -y -p @sanctuary-framework/mcp-server@1.8.1 sanctuary

Install the macOS Castle Wall enforcement app from the attached release asset:

• Asset: Sanctuary-CastleWall.app.zip
• SHA-256: APP_SHA256_PLACEHOLDER
• Full install and arm path: Castle Wall macOS install and arm guide

Capability bounds

All v1.8.0 bounds stand. Ollama is installed by the operator on every platform in this release. Light assurance verifies the runtime-reported digest against the signed manifest at the documented checkpoints, not every model byte on disk. There is no network discovery of newer signed manifests.