Changelog
Dated milestones from the enforcement-kernel build. Follow progress from kernel proof to full platform.
Website and claim surfaces realigned to Mode A truth: package baseline v1.2.0, maturity quiet-open-core, validation locally-verified. Stage 3 / v1.1.0 language is not the Mode A public maturity baseline. Site: /v1 · Truth: release-maturity-truth.json
Past engineering note for the public releases tree: multi-tenant foundation, gVisor isolation, STS broker, Object Lock evidence, SIEM connectors were implemented under tests in the artifact repo. Historical only — not Mode A public baseline and not production-qualified multi-tenant platform. Current public identity remains Quiet Open-Core v1.2.0.
New practical guide for teams: portable test, Compose install, coding-agent path, policy dry-run, approvals (web/Slack/webhook), day-2 dashboards, optional OIDC, and a one-week rollout checklist. Site: /blog/how-to-use-actantos-at-work
Stage 2 done under ship rule (built + tests pass): ops filters and metrics home, policy dry-run, webhook approval channels, optional OIDC ops auth, Compose hosted path. Marketing matrix marks S2-1…S2-5 done.
A single npm run quickstart command now installs, builds, starts an isolated in-memory ActantOS server, tests a simulated agent through allow, deny, approval_required, and audit-evidence paths, then shuts down cleanly. Node.js 22+ is the only runtime requirement for the first test; Docker and Postgres remain available for persistent self-host operation.
Public Quiet Open-Core ship of the Enforcement Kernel. Frozen /v1 API, self-host free surface (web approval, dashboard, optional Slack, Balanced/Strict templates, Pi primary path, optional MCP gateway), release packaging, and automated smoke demo (35/35). Stage 1 complete by ship rule: built + tests pass. Release: github.com/kotobuki09/actantos-releases/releases/tag/v1.2.0 · Site: /v1
Kernel packaging milestone with tests, policy regression, and smoke path. Superseded for public tagging by Quiet Open-Core v1.2.0 (same enforcement stack, corrected artifact identity).
actantosd and Pi adapter verified end-to-end: 51 unit tests passing, demo script 29/29. MCP gateway, manual approval API, Docker sandbox, and Postgres hash-chain audit all exercised against real HTTP/Postgres surfaces.
MCP tool versions persist in Postgres. Drifted schemas deny with schema_hash_mismatch. Approval route promotes pending MCP versions to baseline.
Allow tokens now bind decision_id, tenant_id, agent_id, session_id, tool_call_id, scope_hash, constraints_hash, and exp. /v1/tool-result rejects expired or mismatched tokens.
URL-bearing tool requests fail closed against loopback, metadata, and RFC-1918 targets before Cedar evaluation.
Published /mvp page, updated docs and API reference to reflect actantosd contracts. Marketing site keeps full OS vision; MVP documented as first shipping slice.