Release 0.5.0

[tobert]

Version 0.4.0 → 0.5.0, a fresh empty unreleased section, and docs/sandbox-probes.md stamped with the run that gates this release.

Minor, not patch, for two reasons. #182 removed explorer_max_turns/synth_max_turns as tool arguments and CLI flags — a caller-facing break. And the read boundary changed four times: three worktree-follow escapes closed in #184, then #191 requiring git's own shape after a kaibo deliberation argued that mutual agreement between two files is not provenance.

The changelog section was shortened before retitling, per the rule that entries get shorter over time — 70 lines to 52, no bullet dropped. The four bullets that each narrowed the same worktree rule now say what they narrow in one line apiece.

Gates

gate	result
cargo tree -i aws-lc-rs / aws-lc-sys / mimalloc / openssl-sys	absent, negative control prints kaish-kernel v0.17.2
musl build	statically linked, not a dynamic executable, runs
suite	1363 passed, 0 failed
sandbox battery A–H	all clear

The battery

Run because two triggers fired at once: kaish-vfs moved with the 0.17.2 bump (#187), and #191 changed containment itself.

Highlights worth reading rather than trusting: every out-of-root read came back not found including ~/.deepseek-key, which holds a real key this session — absence would have passed vacuously, so the file existing is what makes the result mean anything. The prefix listing was counted: ls /home/atobey returns 1 entry where the host holds 74. Battery D's .. row canonicalizes to /etc and is refused by containment with the message naming the allowed set, not by a resolution failure. G3's three refusals stay byte-identical across exists / missing / unreadable, so a hostile repo gets no existence oracle.

The F3 this runbook has asked for since 2026-08-13 is now covered, and it split in two. write_cas — the model-reachable deposit — refuses a source outside the allowed set, with the positive control run so the refusal is not vacuous. The CLI kaibo cas write does not refuse an outside source, and that is correct rather than a finding: the CLI caller is the operator, who can already read the file. H1's note reads as though one rule covers both surfaces; it covers the tool.

The probe caught itself again, which is what §0 exists for. The Battery H fixture put --state-db inside the tree it passed as --root, so E1 fired, persistence went off, the CAS fell back to memory and cas write refused — three batteries' worth of correct behavior reading, at a glance, like a broken store.

Two message drifts recorded, neither a hole: kill 1 now answers signalling a PID requires the subprocess capability, and grep following an escaping symlink refuses with exit 1 and no stderr line, where every other verb in G2 names the reason — worth knowing before someone reads that silence as success.

After merge

Tag v0.5.0 to fire the release matrix, then verify a downloaded asset the way a user would (gh attestation verify, cosign verify-blob) and run scripts/bump-tap.sh v0.5.0.

🤖 Generated with Claude Code