[{"data":1,"prerenderedAt":925},["ShallowReactive",2],{"docs-nav":3,"docs-\u002Fdocs\u002Freleases":78},[4,9,13,16,21,26,30,34,38,42,46,50,53,58,62,66,69,74],{"path":5,"title":6,"navTitle":6,"group":7,"order":8},"\u002Fdocs\u002Fcommands","Other commands","Guide",999,{"path":10,"title":11,"navTitle":12,"group":7,"order":8},"\u002Fdocs\u002Fcompaction","Context and compaction","Context & compaction",{"path":14,"title":15,"navTitle":15,"group":7,"order":8},"\u002Fdocs\u002Fconfiguration","Configuration",{"path":17,"title":18,"navTitle":18,"group":19,"order":20},"\u002Fdocs\u002Fenvironment","Environment variables","Reference",11,{"path":22,"title":23,"navTitle":23,"group":24,"order":25},"\u002Fdocs\u002Fflags","Flag reference","CLI",8,{"path":27,"title":28,"navTitle":28,"group":7,"order":29},"\u002Fdocs","Introduction",1,{"path":31,"title":32,"navTitle":32,"group":7,"order":33},"\u002Fdocs\u002Finstallation","Installation",2,{"path":35,"title":36,"navTitle":36,"group":19,"order":37},"\u002Fdocs\u002Fproviders","Providers",10,{"path":39,"title":40,"navTitle":40,"group":7,"order":41},"\u002Fdocs\u002Fquickstart","Quickstart",3,{"path":43,"title":44,"navTitle":45,"group":7,"order":8},"\u002Fdocs\u002Freleases","Releases and upgrading","Releases",{"path":47,"title":48,"navTitle":49,"group":7,"order":8},"\u002Fdocs\u002Frun","The run command","Running an audit",{"path":51,"title":52,"navTitle":52,"group":7,"order":8},"\u002Fdocs\u002Fsecurity","Security model",{"path":54,"title":55,"navTitle":56,"group":24,"order":57},"\u002Fdocs\u002Fsessions","Sessions and forking","Sessions",6,{"path":59,"title":60,"navTitle":61,"group":7,"order":8},"\u002Fdocs\u002Fskills-roles","Skills and roles","Skills & roles",{"path":63,"title":64,"navTitle":64,"group":19,"order":65},"\u002Fdocs\u002Ftools","Tool reference",12,{"path":67,"title":68,"navTitle":68,"group":7,"order":8},"\u002Fdocs\u002Ftroubleshooting","Troubleshooting",{"path":70,"title":71,"navTitle":72,"group":24,"order":73},"\u002Fdocs\u002Ftui","The interactive TUI","Interactive TUI",9,{"path":75,"title":76,"navTitle":77,"group":7,"order":8},"\u002Fdocs\u002Fweb-eval","Dashboard and evaluation","Dashboard & evaluation",{"id":79,"title":44,"body":80,"description":916,"extension":917,"group":7,"meta":918,"navTitle":45,"navigation":194,"order":8,"path":43,"seo":919,"stem":923,"__hash__":924},"docs\u002Fdocs\u002Freleases.md",{"type":81,"value":82,"toc":886},"minimark",[83,87,91,103,114,119,122,131,140,150,153,171,256,281,285,309,313,327,333,340,344,364,375,379,386,397,401,405,437,441,484,509,513,533,537,561,565,594,598,619,623,640,644,651,655,672,676,684,696,700,705,721,725,758,766,770,786,791,795,804,808,824,829,833,846,866,870,873,877,882],[84,85,44],"h1",{"id":86},"releases-and-upgrading",[88,89,90],"p",{},"Two kinds of change matter differently here.",[88,92,93,94,98,99,102],{},"A new ",[95,96,97],"strong",{},"feature"," you can ignore until you want it. A change to an ",[95,100,101],{},"evidence gate"," you cannot: it\ndecides which findings your next run is allowed to promote, and a session started under an older\nbuild can carry evidence the current build no longer accepts. Those are the ones this page leads\nwith.",[88,104,105,106,113],{},"Versioning is ",[107,108,112],"a",{"href":109,"rel":110},"https:\u002F\u002Fsemver.org\u002Fspec\u002Fv2.0.0.html",[111],"nofollow","semver",", with one caveat while locac is below\n1.0: a gate can tighten in a patch release. Tightening a gate never invents a finding, it only\ndeclines to promote one, so it is a fix rather than a feature - but it is still something you have to\nknow about before you resume a week-old session and wonder where its Criticals went.",[115,116,118],"h2",{"id":117},"upgrading-to-052","Upgrading to 0.5.2",[88,120,121],{},"This release changed what counts as proof. Three things follow from that, and all three can surprise\na resumed session.",[123,124,126,130],"h3",{"id":125},"execute-no-longer-proves-exploitability",[127,128,129],"code",{},"execute"," no longer proves exploitability",[88,132,133,135,136,139],{},[127,134,129],{}," mints an artifact, and that artifact is now labelled a ",[95,137,138],{},"diagnostic",":",[141,142,148],"pre",{"className":143,"code":145,"language":146,"meta":147},[144],"language-text","[diagnostic artifact: ev_… — NOT proof: execute did not evaluate an exploit assertion]\n","text","",[127,149,145],{"__ignoreMap":147},[88,151,152],{},"An exit code is not an oracle. A script exiting zero proves the script ran; a nonzero exit may just\nbe the script's own bug. Neither observed a security effect, so neither can promote a severity.",[88,154,155,156,158,159,162,163,166,167,170],{},"If your workflow built PoCs as ",[127,157,129],{}," scripts, move them to ",[127,160,161],{},"reproduce"," with a ",[127,164,165],{},"claim"," and either\na crash or a ",[127,168,169],{},"sentinel"," the PoC causes to appear:",[141,172,176],{"className":173,"code":174,"language":175,"meta":147,"style":147},"language-jsonc shiki shiki-themes vitesse-dark","\u002F\u002F before - recorded, auditable, and no longer proof\nexecute({ script: \"…\" })\n\n\u002F\u002F after — a claim, and an assertion the oracle checks\nreproduce({\n  cmd: \"…\",\n  sentinel: \"LOCAC-PWNED-8f21\",\n  claim: {\n    location: \"src\u002Fupload\u002Fhandler.ts\",\n    line: 143,\n    vuln_class: \"CWE-78\",\n    effect: \"attacker-controlled argument executed; sentinel printed\"\n  }\n})\n","jsonc",[127,177,178,185,190,196,202,208,213,219,224,229,234,239,244,250],{"__ignoreMap":147},[179,180,182],"span",{"class":181,"line":29},"line",[179,183,184],{},"\u002F\u002F before - recorded, auditable, and no longer proof\n",[179,186,187],{"class":181,"line":33},[179,188,189],{},"execute({ script: \"…\" })\n",[179,191,192],{"class":181,"line":41},[179,193,195],{"emptyLinePlaceholder":194},true,"\n",[179,197,199],{"class":181,"line":198},4,[179,200,201],{},"\u002F\u002F after — a claim, and an assertion the oracle checks\n",[179,203,205],{"class":181,"line":204},5,[179,206,207],{},"reproduce({\n",[179,209,210],{"class":181,"line":57},[179,211,212],{},"  cmd: \"…\",\n",[179,214,216],{"class":181,"line":215},7,[179,217,218],{},"  sentinel: \"LOCAC-PWNED-8f21\",\n",[179,220,221],{"class":181,"line":25},[179,222,223],{},"  claim: {\n",[179,225,226],{"class":181,"line":73},[179,227,228],{},"    location: \"src\u002Fupload\u002Fhandler.ts\",\n",[179,230,231],{"class":181,"line":37},[179,232,233],{},"    line: 143,\n",[179,235,236],{"class":181,"line":20},[179,237,238],{},"    vuln_class: \"CWE-78\",\n",[179,240,241],{"class":181,"line":65},[179,242,243],{},"    effect: \"attacker-controlled argument executed; sentinel printed\"\n",[179,245,247],{"class":181,"line":246},13,[179,248,249],{},"  }\n",[179,251,253],{"class":181,"line":252},14,[179,254,255],{},"})\n",[88,257,258,259,262,263,265,266,269,270,273,274,276,277,280],{},"The same applies to a plain ",[127,260,261],{},"replay_request"," (now diagnostic unless you pass ",[127,264,165],{}," + ",[127,267,268],{},"assertion","),\na ",[127,271,272],{},"run_module"," scan that confirmed nothing, and a ",[127,275,161],{}," run whose oracle did ",[95,278,279],{},"not"," trigger.\nAll are still recorded. None is proof.",[123,282,284],{"id":283},"a-high-or-critical-finding-must-say-where-it-is","A High or Critical finding must say where it is",[88,286,287,290,291,294,295,298,299,301,302,304,305,308],{},[127,288,289],{},"record_finding"," now requires ",[127,292,293],{},"file"," for anything at High, Critical or ",[127,296,297],{},"evidence_kind=proof",", and\nrequires ",[127,300,181],{}," too unless ",[127,303,293],{}," is an exact ",[127,306,307],{},"http(s)"," URL. Without a location there is nothing to\nbind the proof to, and an artifact that binds to nothing can be reused for the next bug in the same\nfile.",[123,310,312],{"id":311},"artifacts-from-before-052-are-not-grandfathered","Artifacts from before 0.5.2 are not grandfathered",[88,314,315,316,318,319,322,323,326],{},"The schema migration adds the ",[127,317,165],{}," and ",[127,320,321],{},"proof"," columns and loses no data. Old rows keep every byte\nthey had, and ",[127,324,325],{},"recall"," still finds them. But an old row has no structured claim and no checked\nassertion, so it is a diagnostic, and a finding citing one is refused at promotion:",[141,328,331],{"className":329,"code":330,"language":146,"meta":147},[144],"Cannot promote finding f_…: it has no semantic execution proof bound to this file\u002FURL.\n",[127,332,330],{"__ignoreMap":147},[88,334,335,336,339],{},"Re-run the proof under the current gate and attach the new artifact with\n",[127,337,338],{},"record_finding(artifact_ref=…)",". Honouring the old rows would have kept alive exactly the class of\nfinding the release exists to stop.",[123,341,343],{"id":342},"a-cross-verify-vote-must-name-the-finding-it-votes-on","A cross-verify vote must name the finding it votes on",[88,345,346,347,350,351,357,358,360,361,363],{},"A verifier's artifact now has to clear four checks, not one: minted during ",[95,348,349],{},"this"," round, bound to\nthe ",[95,352,353,354],{},"exact ",[127,355,356],{},"finding_id",", matching that finding's location, and distinct from the other two lenses'.\nA URL can host several bug classes at once, so a claim naming only the location would let one of them\nvouch for another. Re-verifying a DAST finding means calling ",[127,359,272],{}," with its ",[127,362,356],{},".",[88,365,366,367,370,371,374],{},"If you have written your own role that submits verdicts, its prompt needs to pass ",[127,368,369],{},"claim.finding_id","\nthrough. The built-in ",[127,372,373],{},"exploit-verifier"," already does.",[123,376,378],{"id":377},"confined-commands-now-serialize-across-roots","Confined commands now serialize across roots",[88,380,381,382,385],{},"Auditing two repositories in one process - which the dashboard allows, and which ",[127,383,384],{},"eval ab"," does by\ndesign - used to let the second root re-pin the process-global sandbox while the first root's command\nwas still running. A process-wide lease now covers the whole command lifetime. Confined commands from\ndifferent roots run one at a time. A single-root run is unaffected.",[88,387,388,389,393,394,363],{},"Details in ",[107,390,392],{"href":391},"\u002Fdocs\u002Ftools#proof-and-diagnostics-are-not-the-same-artifact","Tools"," and\n",[107,395,52],{"href":396},"\u002Fdocs\u002Fsecurity#confined-commands-serialize-across-roots",[115,398,400],{"id":399},"release-history","Release history",[123,402,404],{"id":403},"_0611-2026-08-15","0.6.11 - 2026-08-15",[88,406,407,410,411,414,415,418,419,424,425,428,429,432,433,436],{},[95,408,409],{},"Fixed."," The DAST egress guard now blocks a cloud-metadata IP hidden in the NAT64 well-known prefix.\nThe guard already recovered an IPv4-mapped IPv6 (",[127,412,413],{},"::ffff:169.254.169.254",") before range-checking it,\nbut a metadata address encoded in ",[127,416,417],{},"64:ff9b::\u002F96"," (",[107,420,423],{"href":421,"rel":422},"https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc6052",[111],"RFC 6052",") -\n",[127,426,427],{},"64:ff9b::a9fe:a9fe",", which a NAT64 gateway routes straight at ",[127,430,431],{},"169.254.169.254"," - slipped past as an\nordinary public IPv6. The embedded IPv4 is now decoded out of the prefix and faces the same\n169.254.0.0\u002F16 block, on both the IP-literal path and the DNS-resolved path (a hostname whose ",[127,434,435],{},"AAAA"," is\na NAT64-wrapped metadata address). Public and RFC1918 IPv4s wrapped in NAT64 stay reachable, matching\nhow a bare IPv4 is treated - authorized internal DAST still works; only the link-local\u002Fmetadata escape\ncloses.",[123,438,440],{"id":439},"_0610-2026-08-13","0.6.10 - 2026-08-13",[88,442,443,446,447,450,451,454,455,458,459,463,464,467,468,471,472,475,476,479,480,483],{},[95,444,445],{},"Added."," ",[127,448,449],{},"ask_user"," lets the agent hand a decision back to the operator instead of guessing: which\nlead to chase first, whether a behaviour is in scope, which credential set to assume. A call carries\nup to four questions, each with 2-4 options and an optional ",[127,452,453],{},"multiSelect",", plus an always-present\nfree-text \"Other\" row for an answer none of the options cover. In the TUI it renders as a modal that\nblocks the turn until answered, the same way the dangerous-tool approval prompt does. Run without an\ninteractive terminal - piped, ",[127,456,457],{},"--print",", a role child, CI - there is no operator to ask, so it\ndegrades deterministically: it auto-selects each question's first option, notes that it did, and the\nrun never stalls waiting on input that will not arrive. It is orchestrator-only, so a subagent role\n(which has no operator) never sees it. See the ",[107,460,462],{"href":461},"\u002Fdocs\u002Ftools#ask-user","tool reference",". A mid-session\n",[127,465,466],{},"\u002Fmodel"," switch is now also remembered per session and restored on resume - the TUI ",[127,469,470],{},"\u002Fresume"," and the\ncross-process ",[127,473,474],{},"locac resume \u003Cid>"," both reopen on the session's stored model, while an explicit\n",[127,477,478],{},"--model","\u002F",[127,481,482],{},"--provider"," still wins.",[88,485,486,488,489,491,492,318,495,498,499,501,502,504,505,508],{},[95,487,409],{}," A round of resume fixes so a session comes back whole. In-TUI ",[127,490,470],{},", ",[127,493,494],{},"\u002Fnew",[127,496,497],{},"\u002Ffork","\nnow rebind the research tool state (",[127,500,325],{},", findings, memory, the coverage\u002Fverdict\u002Fevidence repos),\nnot just the transcript - previously the run was re-driven while recall stayed blind to the resumed\nsession's rows, the \"resumed but lost context\" operators reported. Resume also repaints tool calls and\ntheir results, not only prose, so a resumed hunt shows the grep\u002Fread\u002F",[127,503,289],{}," work instead of\ntwo lonely prose bubbles; only calls with a persisted result are replayed, so an interrupted turn\nleaves no spinner that never resolves. Separately, a Vietnamese IME burst (char + backspace + char in\none stdin read) no longer sticks characters in the editor, and the web Providers form keeps its cost\n",[127,506,507],{},"\u002F1M"," row inside the panel border.",[123,510,512],{"id":511},"_069-2026-08-13","0.6.9 - 2026-08-13",[88,514,515,517,518,521,522,525,526,528,529,532],{},[95,516,409],{}," Ctrl+C in the TUI stopped tearing the process down mid-turn. Ink's default ",[127,519,520],{},"exitOnCtrlC","\nintercepted the keystroke and unmounted before any handler ran, so a Ctrl+C during a running turn\nslammed locac shut with no confirmation and abandoned the in-flight turn - the message-boundary abort\nwas wired only to Esc. It is now disabled and handled in the input box: while the agent runs, Ctrl+C\naborts the turn the way Esc does (the session is preserved); idle, it clears a non-empty draft, and on\nan empty draft it quits only on a ",[95,523,524],{},"second"," press, with a \"press Ctrl+C again to exit\" hint - the same\ncourtesy the headless SIGINT path already had. Ctrl+D remains an immediate quit. Separately, ",[127,527,470],{},"\nno longer lists empty sessions: persistence is transactional per message, so an interrupt only ever\ndrops the single in-flight turn, but relaunching created a fresh empty session that sorted to the top of\nthe picker by ",[127,530,531],{},"updated_at"," and shadowed the session the operator came back for - which read as lost\ncontext. The picker now draws only sessions with at least one entry, so a still-empty session can never\noutrank real work.",[123,534,536],{"id":535},"_068-2026-08-10","0.6.8 - 2026-08-10",[88,538,539,446,541,544,545,548,549,552,553,556,557,560],{},[95,540,445],{},[127,542,543],{},"trace_callees"," traces a symbol ",[95,546,547],{},"down"," the call graph toward sinks (forward BFS) - the\nmirror of ",[127,550,551],{},"trace_callers",". From a function, each hop groups the callees invoked inside it, so an\nuntrusted source can be walked down to a dangerous sink in one call instead of hand-chaining\n",[127,554,555],{},"grok_sink",". It is read-only, budget- and coverage-wrapped, and realpath-confined to the target root\nlike every name-based edge in the harness. It joins the read-only tool set, the role read-only\nallow-list and the compaction evidence set, and the bundled ",[127,558,559],{},"srcwalk"," skill now drives\nmeet-in-the-middle with the two tracers as a pair.",[123,562,564],{"id":563},"_067-2026-08-10","0.6.7 - 2026-08-10",[88,566,567,569,570,573,574,577,578,581,582,585,586,589,590,593],{},[95,568,445],{}," The DAST module runner injects beyond query and form params: JSON body leaves (dotted and\nindexed paths like ",[127,571,572],{},"user.roles[0]","), a curated set of request headers, and cookie pairs - a JSON\nprobe re-serializes only the targeted leaf and a cookie probe rewrites only the targeted pair, so a\nmutated request is never corrupted. Two active modules join it. ",[127,575,576],{},"ssti"," (CWE-1336) injects arithmetic\nin the four common template syntaxes and confirms only when the computed product appears in the\nresponse while the raw payload does not, so a page that merely echoes the payload is never flagged.\n",[127,579,580],{},"cmdi"," (CWE-78) times a benign baseline, then requires two ",[127,583,584],{},"sleep","-bearing sends to each exceed it by\na wide margin, rejecting a one-off stall and skipping an already-slow baseline. Authenticated scans\nread static same-host credentials (bearer headers, cookies) from ",[127,587,588],{},"LOCAC_HOME"," config only - never the\ntarget repo - attach them only to their listed hosts (never an off-host redirect or SSRF target), and\nregister them as operator secrets so the output guard scrubs them from probe evidence. ",[127,591,592],{},"locac sarif","\nexports a session's findings as SARIF 2.1.0 for GitHub code scanning.",[123,595,597],{"id":596},"_066-2026-08-07","0.6.6 - 2026-08-07",[88,599,600,602,603,606,607,610,611,614,615,618],{},[95,601,409],{}," A file a scanner skips - oversized, binary, or unreadable - can no longer pass for clean\ncoverage. Every source scanner threads a coverage record through its walk, so a skipped file is\nreported in-band with the reason, persisted as a ",[127,604,605],{},"note_coverage_gap",", and folded into a\n",[127,608,609],{},"⚠ PARTIAL COVERAGE"," warning; gaps are relativized from the canonical target root, so a macOS\n",[127,612,613],{},"\u002Fvar → \u002Fprivate\u002Fvar"," or a Windows junction is not mistaken for an escape and dropped. ",[127,616,617],{},"read"," streams\na file of any size in bounded pages that each name what remains unchecked, sniffing only the head for\na binary marker before any line offset.",[123,620,622],{"id":621},"_065-2026-08-06","0.6.5 - 2026-08-06",[88,624,625,627,628,631,632,635,636,639],{},[95,626,445],{}," A key-toggled live subagent overlay (",[127,629,630],{},"Ctrl+T","): a fullscreen view of every running\nsubagent with its status, role, turn count, token spend, current activity, and elapsed time. Up and\ndown move the selection, ",[127,633,634],{},"s"," steers the selected agent a one-line message, and ",[127,637,638],{},"x"," aborts it. The\nview is display-only and its elapsed clock is injected at the manager boundary, so the deterministic\nverdict path is never touched by a wall-clock read.",[123,641,643],{"id":642},"_060-2026-08-06","0.6.0 - 2026-08-06",[88,645,646,446,648,650],{},[95,647,445],{},[127,649,605],{}," - a voluntary self-report an agent files when it declines or cannot\nfully analyze a region of the target (too large, binary, unparseable, refused, out of scope), so a\nsilent skip cannot read as clean coverage. It is a diagnostic only: it never promotes, blocks, or\ndowngrades a finding and takes no part in the proof gates. Available to the orchestrator and every\nsubagent (each gap is tagged with the agent that logged it), deduplicated on location and category,\nand surfaced as a count-only segment on the run-state digest and in full on the session-detail API.\nThe model- and target-authored note is stored but never reaches an unfenced harness surface.",[123,652,654],{"id":653},"_053-2026-08-06","0.5.3 - 2026-08-06",[88,656,657,659,660,663,664,667,668,671],{},[95,658,445],{}," An opt-in ",[127,661,662],{},"thinkingTokenBudget"," for vLLM-style ",[127,665,666],{},"openai-completions"," endpoints, where the\nreasoning phase and the answer draw from the same output-token cap. Without it, an unbounded reasoning\nturn can spend the entire budget and return no answer and no tool call; with it locac sends a top-level\n",[127,669,670],{},"thinking_token_budget",", derived from the reasoning level and clamped to leave room for the answer. Off\nby default (a plain OpenAI endpoint rejects the field) and effective only alongside a reasoning level.",[123,673,675],{"id":674},"_052-2026-08-05","0.5.2 - 2026-08-05",[88,677,678,680,681,683],{},[95,679,409],{}," A successful command was accepted as proof of exploitability; evidence now carries a\nstructured vulnerability claim plus a machine-checked assertion, bound to the same session and the\nexact file\u002FURL and line. Cross-verifiers could cite proof unrelated to the candidate; every counted\nvote must now mint a fresh artifact, name the exact ",[127,682,356],{},", and stay distinct from the other\nlenses. Concurrent audits could re-pin the process-global sandbox underneath a running child.",[88,685,686,689,690,692,693,695],{},[95,687,688],{},"Changed."," DAST proof is detection-scoped rather than scan-scoped: ",[127,691,272],{}," emits one artifact\nper confirmed detection and can re-verify an existing finding without recording a duplicate;\n",[127,694,261],{}," proves something only when a marker appears in the mutated response and not in its\nbenign baseline.",[123,697,699],{"id":698},"_051-2026-08-04","0.5.1 - 2026-08-04",[88,701,702,704],{},[95,703,445],{}," Drag a file into the terminal and it attaches - the other half of image support, since a\ndrop arrives as a pasted path rather than as its own input channel. A 3 MiB ceiling on an attachment,\nrefused rather than resized.",[88,706,707,446,709,712,713,716,717,720],{},[95,708,409],{},[127,710,711],{},"allowRead"," confined nothing on macOS or Linux: the profile emitted a blanket\n",[127,714,715],{},"(allow file-read*)"," on macOS and re-bound allowed paths over a tmpfs mask on Linux, so target code\ncould read ",[127,718,719],{},"~\u002F.locac\u002Fconfig.json"," and the API key in it. Reads are deny-first now.",[123,722,724],{"id":723},"_050-2026-08-04","0.5.0 - 2026-08-04",[88,726,727,729,730,491,733,491,736,491,739,491,742,745,746,749,750,753,754,757],{},[95,728,445],{}," The editor keys that were missing (",[127,731,732],{},"Home",[127,734,735],{},"End",[127,737,738],{},"Delete",[127,740,741],{},"Ctrl+D",[127,743,744],{},"Ctrl+L",",\n",[127,747,748],{},"Shift+Tab","), ",[127,751,752],{},"Alt+Up"," to pull queued messages back into the editor, clipboard images, and ",[127,755,756],{},"\u002Ftree"," to\ndraw the session picker as the fork tree.",[88,759,760,762,763,765],{},[95,761,409],{}," The Delete key deleted backwards. ",[127,764,752],{}," destroyed a queued attachment-only message.",[123,767,769],{"id":768},"_040-2026-08-04","0.4.0 - 2026-08-04",[88,771,772,774,775,393,778,781,782,785],{},[95,773,445],{}," An installed skill remembers where it came from, which is what ",[127,776,777],{},"skills update \u003Cname>",[127,779,780],{},"--all"," needed to exist. ",[127,783,784],{},"skills add \u003Curl> --all"," installs a whole repo behind one gate.",[88,787,788,790],{},[95,789,409],{}," A source tree could forge its own provenance sidecar and choose what a later update\ncloned from.",[123,792,794],{"id":793},"_031-2026-08-03","0.3.1 - 2026-08-03",[88,796,797,799,800,803],{},[95,798,688],{}," Release artifacts ship compressed - 116 MB becomes 39 MB - byte-reproducibly, and both\ninstallers verify the checksum ",[95,801,802],{},"before"," extracting rather than after.",[123,805,807],{"id":806},"_030-2026-08-03","0.3.0 - 2026-08-03",[88,809,810,812,813,816,817,820,821,363],{},[95,811,445],{}," The Agent Skills format as published, verified against all 17 skills in\n",[127,814,815],{},"anthropics\u002Fskills","; a skill's bundled ",[127,818,819],{},"scripts\u002F"," actually runs (read-only grants, never write);\n",[127,822,823],{},"locac skills add \u003Curl>",[88,825,826,828],{},[95,827,409],{}," Four of those 17 skills loaded mangled. The sandbox pin ignored everything but the root,\nso skill read grants silently never applied.",[123,830,832],{"id":831},"_020-2026-08-03","0.2.0 - 2026-08-03",[88,834,835,837,838,841,842,845],{},[95,836,445],{}," Cross-compilation from one host to all three OS artifacts, ",[127,839,840],{},"locac --version",", and the\nprovider's own ",[127,843,844],{},"rawStopReason"," when the five-member enum lost information.",[88,847,848,850,851,854,855,858,859,862,863,865],{},[95,849,409],{}," The Linux sandbox lost its seccomp layer in a compiled binary, so a shipped Linux binary\nran at ",[127,852,853],{},"sandbox=os"," with the ",[127,856,857],{},"AF_UNIX"," block absent. ",[127,860,861],{},"appendMessage"," wrote three rows untransacted,\nleaving entries ",[127,864,325],{}," could not see.",[123,867,869],{"id":868},"_010-2026-08-01","0.1.0 - 2026-08-01",[88,871,872],{},"Initial release: the harness, the evidence gate, the five invariants, the tool set, the provider\nmatrix, the sandbox, the TUI, the web dashboard, sessions and forking, skills and roles.",[115,874,876],{"id":875},"next","Next",[88,878,879,881],{},[107,880,68],{"href":67}," has the message-by-message index, including the exact error\neach tightened gate prints.",[883,884,885],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":147,"searchDepth":41,"depth":41,"links":887},[888,896,915],{"id":117,"depth":33,"text":118,"children":889},[890,892,893,894,895],{"id":125,"depth":41,"text":891},"execute no longer proves exploitability",{"id":283,"depth":41,"text":284},{"id":311,"depth":41,"text":312},{"id":342,"depth":41,"text":343},{"id":377,"depth":41,"text":378},{"id":399,"depth":33,"text":400,"children":897},[898,899,900,901,902,903,904,905,906,907,908,909,910,911,912,913,914],{"id":403,"depth":41,"text":404},{"id":439,"depth":41,"text":440},{"id":511,"depth":41,"text":512},{"id":535,"depth":41,"text":536},{"id":563,"depth":41,"text":564},{"id":596,"depth":41,"text":597},{"id":621,"depth":41,"text":622},{"id":642,"depth":41,"text":643},{"id":653,"depth":41,"text":654},{"id":674,"depth":41,"text":675},{"id":698,"depth":41,"text":699},{"id":723,"depth":41,"text":724},{"id":768,"depth":41,"text":769},{"id":793,"depth":41,"text":794},{"id":806,"depth":41,"text":807},{"id":831,"depth":41,"text":832},{"id":868,"depth":41,"text":869},{"id":875,"depth":33,"text":876},"[object Object]","md",{},{"title":44,"description":920},{"What changed in each locac release and what an upgrade asks of you":921,"group":19,"order":922},"the breaking changes, the ones that silently change a verdict, and the exact call that clears each new gate.",18,"docs\u002Freleases","LzwVe9qQ2AOzQLMkqcEd-Woqos4Ee4fJ4VK3Ytqc-J8",1786794387382]