Every release, newest first.

1. v1Current releaseOctober 2026

   The first release anyone outside the fleet can run.

   • The vault — keys encrypted at rest with AES-256, each one under its own one-time data key, wrapped twice: your passphrase and an off-site recovery key printed once at init.
   • The gate — four checks in order: identity, sensitivity, lease, then a human verdict. Every refusal comes back with its reason.
   • Identity — a keypass per profile, minted with keygen, stored as a hash. No keypass, or someone else’s keypass, is denied and logged. ACCESS SNEAK is the name the code gives that move.
   • Sensitivity — credential-minting, database and admin endpoints are refused outright, even under a live lease, so permission to call a service can never turn into permission to mint new access.
   • Leases — permission stays narrow and short: one agent, exact key names, a clock. Entries are purged the moment they expire, so there is no growing list of stale access to audit.
   • The call — the vault substitutes the real token in memory, makes the HTTPS request itself, and returns only the result. Provider-agnostic: whatever headers and body you hand it, with [redacted] where the key goes.
   • The record — access, leases and pending are signed, so a hand-edit fails closed instead of quietly resetting. The ledger is append-only and holds no secrets.
   • The leak guard — the server refuses to start with the passphrase sitting in the environment, so it can never show up in ps -E or a shell history.
   • The proof — a regression suite runs the whole thing end to end: encryption at rest, the identity gate, tamper fail-closed, lease purge, the sensitivity gate, and a check that no plaintext ever reaches disk.
2. v0Internal — never releasedSeptember 2026

   The build: the data model, the store, the decision gate.

   • The encrypted store, the off-site recovery key, and a passphrase change that re-wraps only the outer lock — your stored keys are never re-encrypted.
   • The decision gate, the pending index with its unique request key, and the resolve step an agent uses to collect a verdict.
   • The call path: substitute a held token into a request and send it, proven against a local stub before any real API was involved.
   • Never shipped to anyone. v1 is the first release you can download, and the vault format it writes is the format the gate reads.

One entry per release. The version you get from the repo is the version at the top of this list — there is nothing to upgrade from and nothing stale sitting in a download folder.