Changelog

v0.8 closes the gap between what the guard rails claimed and what they enforced: sandbox failures now stop the action, the file-read path resists symlink swaps, every write path shares one canonical hash layout, and the demo stack states plainly that it is insecure by design.

Security

• Fail-closed sandboxing - Sandbox setup failure aborts the action instead of degrading to an unsandboxed run. The Unix pre_exec child hook returns an error, and the Firecracker → Docker isolation-tier chain stops rather than falling through. ECTO_SANDBOX_PERMISSIVE restores the old behaviour deliberately.
• Symlink TOCTOU defence - read_file no longer follows a leaf that is swapped for a symlink pointing outside the allowed root between validation and open.
• SP1 proving withdrawn - Removed experimental ZK proving and its vulnerable dependencies (RUSTSEC-2026-0387). Standard audit certificate export and verification remain available.
• Canonical v2 hash scheme - The PostgreSQL backend, the SQLite backend, and the SP1 guest all serialise events through one byte layout, closing replay and timestamp-tampering gaps. Ledgers written before v0.8 continue to verify through the v1 fallback.
• Receiver-bound webhook signatures - Deliveries now carry X-EctoLedger-Signature-V1, bound to one receiver URL so a delivery cannot be replayed to another. The pre-0.8 X-EctoLedger-Signature header is off unless WEBHOOK_LEGACY_SIGNATURE=true.

Verification

• Regression tests for both security fixes - Four tests pin both branches of ECTO_SANDBOX_PERMISSIVE, proving the child process never runs when the sandbox fails; five cover the symlink race, including the swap-after-validation case. Each was verified to fail when its fix is reverted.
• Demo mode labelled insecure by design - The compose file, Dockerfile, and a startup WARN line each name the specific weakenings in effect (guard disabled, dev mode, 0.0.0.0 bind, default credentials).
• docs/getting-started/running-securely.md - Contrasts the demo with a hardened deployment and the three variables that matter.

Fresh-clone fixes

• Documented entry points actually work - make start called launcher scripts that no longer existed; the targets now invoke cargo and npm directly, since the Tauri GUI starts its own backend in-process.
• The Docker demo starts - The Ollama healthcheck probed with curl, which that image does not ship, so the container stayed unhealthy forever and blocked everything behind it.
• Embedded PostgreSQL no longer kills processes it does not own - Startup used to SIGKILL whatever held port 5432, typically a developer's own database. Only instances EctoLedger started are reclaimed now.
• Honest Firecracker documentation - The setup script installs a connectivity-test rootfs with no guest agent, so it cannot execute intents out of the box. The script, README, and sandbox-parity doc all say so, and the guest image contract is now documented.

v0.5 turned EctoLedger into a full security and compliance platform: 3-layer semantic guard, Merkle proofs, Ed25519 signing, audit certificates, orchestration, and policy DSL.

Features implemented

• 3-layer semantic guard - Ledger goal anchoring; dual-LLM guard process (separate guard-worker binary) returning ALLOW/DENY; hybrid output scanner (regex + structural JSON/AST + base64 decode) for injection and goal-hijack detection.
• Tripwire expansion - Strict path canonicalization, symlink-escape detection, justification length checks, HTTPS enforcement, and configurable allowlists/blocklists.
• Ed25519 intent signing - Per-session keypair; every event’s content_hash signed for tamper-resistance.
• Merkle tree state verification - Binary Merkle tree over event content hashes; inclusion proofs for findings (O(log n) verification).
• EctoLedger Audit Certificate (.elc) - Self-contained, five-pillar verifiable record: Ed25519 signature, SHA-256 chain, Merkle proofs, OpenTimestamps/Bitcoin anchor, goal hash integrity. Standalone verify-cert binary for auditors.
• Policy DSL (TOML) - Allowed/forbidden actions, conditional command rules, observation content rules (redact/flag/abort), approval gate triggers. Policy hash stored in session.
• Approval gates - Policy-driven human-in-the-loop; POST /api/approvals and optional --interactive stdin flow.
• Orchestrate - Multi-agent Recon → Analysis → Verify with per-role policy and CrossLedgerSeal binding sessions.
• Report formats - SARIF 2.1, HTML, GitHub Actions annotations, GitLab Code Quality JSON, and certificate (.elc) export.
• OpenTimestamps / Bitcoin anchoring - anchor-session submits ledger tip to OTS for temporal non-repudiation.
• Replay and diff-audit - Replay sessions (with optional observation injection); diff two sessions for baseline vs current.
• Red-team - Adversarial agent that tests injection payloads against scanner and Tripwire; CI-ready exit code.
• Industry policy packs - SOC 2, PCI-DSS v4.0, OWASP Top 10 2021 in crates/host/policies/.
• Cloud credential injection - Ephemeral AWS/GCP/Azure/k8s credentials from JSON file; injected only into matching CLI child processes.
• Webhook / SIEM egress - Optional HTTP POST on flagged/abort outcomes (JSON, CEF, LEEF).