emisar

Summary

emisar is an open-source infrastructure-access gateway that gives MCP-capable AI agents a catalog of declared actions instead of a shell, with policy deciding what runs, what waits for human approval, and what is denied. It runs as a hosted control plane paired with a small outbound-only runner installed on your own Linux hosts via systemd, so nothing listens on the host and the agent never gets raw access; a free tier covers three runners and one user. It's aimed at platform and infrastructure teams building or operating AI agents for incident response and operational tasks, who need audited, reversible actions rather than open shell access. The catalog spans 91 packs and 1,386 actions across cloud, network, and container diagnostics. Records show a single maintainer but heavy, continuous activity — over 2,700 commits and 35 releases in the past year, most recently two weeks ago.

An MCP that lets AI tools securely connect to your infrastructure, write IaaS code, debug issues, and assist during incidents - without risking production stability. Built for security teams to approve and infrastructure teams to experience like magic.

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. docs update Aug 30, 2026 · issue 011

   emisar agents now ship with starter packs and a sudo emisar status health-check command.

   └──▷ TRY IT
   Verify a newly installed runner is connected and advertising its full action catalog before relying on it in automation.
   copy

   $ sudo emisar status

   • ›Adds sudo emisar status command to inspect runner health, showing connection state, heartbeat timing, advertised pack/action counts, PID, uptime, in-flight runs, and local readiness checks.
   • ›Installer now bundles starter packs — ready-made action sets for common tools (Linux basics, nginx, Postgres, etc.) — pre-loading the agent's action catalog on first install.
2. v0.43.0 Aug 26, 2026 · issue 008

   emisar v0.43.0 binds role and runner-access mappings to immutable directory-group IDs, with a one-way migration required on upgrade.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.43.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.43.0

   • ›Role and runner-access mappings now bind to emisar's immutable directory-group ID, so same-name groups stay distinct, renames preserve grants, and delete/recreate never inherits old access.
   • ›Okta groups without an external ID can now be mapped directly.
   • ›OIDC convergence for Okta and Microsoft Entra ID now accepts only the exact active SCIM identity under the provider's configured identifier claim; unverified email claims are denied.
   • ›Provider setup guides for Okta, Entra, JumpCloud, Google Workspace, and Keycloak are updated to match current screens and document which OIDC and SCIM paths were live-tested.
   • ›Approval override flow now collects the audited reason once and clearly states which approval count is being bypassed and which policy and runner checks still apply.
   +1 moreshow less

   • ›Transactional emails now surface the next action first, link account context when available, express approval state in words as well as color, and keep HTML and plain-text variants aligned.
   └──▷ BREAKING ON UPGRADE

   • !v0.43.0 includes a one-way authorization-mapping migration: stop SSO/SCIM and mapping writes, drain every v0.42 Portal node, run the migration once, then start only the v0.43 image. After the migration commits, v0.42 is not a rollback candidate and the migration must not be run down; rollback requires an image that understands immutable directory-group mappings.
3. v0.42.0 Aug 25, 2026 · issue 007

   emisar v0.42.0 adds PKI-backed signed dispatch, MCP bridge commands, emisar pack diff/verify, and Windows ARM64 support

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.42.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.42.0

   • ›Adds emisar pack diff to show upgrade changes between pack versions.
   • ›Adds emisar pack verify to prove pack setup is correctly configured.
   • ›Extends pack suggest to accept a registry catalog URL as a source.
   • ›Signed dispatch now accepts certificates issued from your own PKI, with each certificate naming the runners it may target and runners verifying the chain against configured trust anchors.
   • ›Every MCP tool is now available as a bridge command, enabling scripts and clients without MCP support to invoke them directly.
   +8 moreshow less

   • ›The MCP Bridge now owns client connect and disconnect lifecycle, drains runbook output automatically, and returns actionable validation errors.
   • ›Windows support added to the MCP Bridge, including VS Code integration, native ARM64 binaries, direct authentication, and safer client-config replacement with symlink-safe backups.
   • ›Nomad namespaces are now supported in packs, with setup requirements surfaced in both the console and CLI.
   • ›Owners and administrators gain an audited break-glass override for unreachable approval quorums.
   • ›MFA, SSO, email, invitation, device-grant, session-revocation, and SCIM decisions are now rechecked within the transaction that commits the resulting authority.
   • ›Replaying a still-valid spent OAuth refresh token now revokes the backing connection and its active successors, requiring reconnection.
   • ›SCIM DELETE now retires the directory resource and its independent OIDC authority; an exact later POST revives only the directory resource.
   • ›Metrics, logs, and process diagnostics now carry explicit cost and disclosure bounds; the Redis Sentinel down-state probe is structurally read-only.
4. v0.41.0 Aug 18, 2026 · issue -001

   emisar v0.41.0 adds role-scoped consoles, live session reconnection on permission changes, and 100-pack catalog with new GCP, Consul, and HCP Terraform actions.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.41.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.41.0

   • ›Role and scope changes (member role, runner access, pack access) now take effect immediately in open web sessions, reconnecting the session before stale authority can be exercised.
   • ›Billing managers receive a finance-only console; operators can manage agents, approvals, and runbooks without gaining team or policy administration rights.
   • ›Scoped admins are blocked from delegating more reach than they hold or triggering account-wide pack cleanup.
   • ›Reads that expose every pack version or an exact run command now require a checked subject rather than relying on already-filtered callers.
   • ›The read-only staff console now requires MFA proof tied to the current enrollment.
   +7 moreshow less

   • ›Console navigation, actions, filters, and empty states adapt to the member's role and access; billing managers no longer see a dead Dashboard link, and absent runner access is surfaced as a permission state.
   • ›Restricted pack and action views now explain why results are limited.
   • ›SSO group mappings now paginate in both directions.
   • ›Pack catalog expands to 100 packs and 1,689 actions.
   • ›Consul pack gains the ability to snapshot registration churn; the debugging pack adds bounded process context, environment-key, argv, and connection reads.
   • ›GCP Monitoring pack adds Cloud Logging name and entry reads.
   • ›HCP Terraform pack exposes replacement paths in plan summaries.
5. v0.41.0 Aug 18, 2026 · issue 001

   emisar v0.41.0 adds role-aware console, new pack catalog entries, and immediate session enforcement on permission changes.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.41.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.41.0

   • ›Role, runner, and pack scope changes now take effect in open web sessions immediately, reconnecting the session before stale authority can be acted on.
   • ›Billing managers now receive a finance-only console; operators can own agents, approvals, and runbooks without gaining team or policy administration rights.
   • ›Scoped admins are blocked from delegating more reach than they hold or arming account-wide pack cleanup.
   • ›Reads that expose every pack version or an exact run command now require a checked subject rather than relying on already-filtered callers.
   • ›The read-only staff console now requires MFA proof tied to the current enrollment.
   +7 moreshow less

   • ›Console navigation, actions, filters, and empty states now adapt to the member's role and access — billing managers no longer see a dead Dashboard link, and missing runner access is surfaced as a permission state.
   • ›Restricted pack and action views now explain why results are limited.
   • ›SSO group mappings now paginate in both directions.
   • ›The pack catalog grows to 100 packs and 1,689 actions.
   • ›Consul gains the ability to snapshot registration churn; the debugging pack adds bounded process context, environment-key, argv, and connection reads.
   • ›GCP Monitoring adds Cloud Logging name and entry reads.
   • ›HCP Terraform plan summaries now expose replacement paths.
6. v0.41.0 Aug 18, 2026 · issue 001

   emisar v0.41.0 adds role-aware console, new pack catalog entries, and immediate session enforcement on permission changes.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.41.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.41.0

   • ›Role, runner, and pack scope changes now take effect in open web sessions immediately, reconnecting the session before stale authority can be acted on.
   • ›Billing managers now receive a finance-only console; operators can own agents, approvals, and runbooks without gaining team or policy administration rights.
   • ›Scoped admins are blocked from delegating more reach than they hold or arming account-wide pack cleanup.
   • ›Reads that expose every pack version or an exact run command now require a checked subject rather than relying on already-filtered callers.
   • ›The read-only staff console now requires MFA proof tied to the current enrollment.
   +7 moreshow less

   • ›Console navigation, actions, filters, and empty states now adapt to the member's role and access — billing managers no longer see a dead Dashboard link, and missing runner access is surfaced as a permission state.
   • ›Restricted pack and action views now explain why results are limited.
   • ›SSO group mappings now paginate in both directions.
   • ›The pack catalog grows to 100 packs and 1,689 actions.
   • ›Consul gains the ability to snapshot registration churn; the debugging pack adds bounded process context, environment-key, argv, and connection reads.
   • ›GCP Monitoring adds Cloud Logging name and entry reads.
   • ›HCP Terraform plan summaries now expose replacement paths.
7. v0.40.0 Aug 13, 2026 · issue -006

   emisar v0.40.0 adds self-updating runners, paginated MCP responses, and 5 new catalog integrations

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.40.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.40.0

   └──▷ TRY IT
   Keep a runner up to date in a verified, attestation-checked way from the host where it is installed.
   copy

   $ emisar update

   Capture machine-readable pack update output in CI even when post-update validation fails, so downstream automation can inspect the partial report.
   copy

   $ emisar pack update --json > pack-update-report.json || true

   • ›Adds emisar update subcommand for installer-managed runners to self-update, verifying release checksum and GitHub build attestation before executing stop, swap, restart, and rollback.
   • ›emisar pack update --json now emits its partial report before returning a post-update validation error, preserving machine-readable output for automation pipelines.
   • ›wait_for_run now pages large terminal runbook results as ordered 64 KiB chunks via an opaque continuation token when a result exceeds one MCP response, with small executions still completing in a single call.
   • ›Expands the catalog to 100 packs and 1,682 actions, adding JFrog Artifactory, Databricks, Sentry, Symbolicator, and NTPsec, with expanded Cassandra and Cloudflare coverage.
   • ›Runner, pack, action, approval, and audit discovery now enforces the member's current runner and pack scope across both the console and MCP.
8. v0.40.0 Aug 13, 2026 · issue 001

   emisar v0.40.0 adds self-updating runners, paginated large runbook results, and 100-pack catalog coverage.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.40.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.40.0

   └──▷ TRY IT
   Update an installer-managed runner in place — the runner validates the release checksum and GitHub build attestation before applying the stop/swap/restart transaction.
   copy

   $ emisar update

   Capture machine-readable pack update output even when post-update validation fails, so CI pipelines can parse the partial report before acting on the error.
   copy

   $ emisar pack update --json

   • ›Adds emisar update subcommand for installer-managed runners to self-update, with release checksum and GitHub build attestation verification before executing stop, swap, restart, and rollback.
   • ›Adds --json flag to emisar pack update that now emits a partial machine-readable report before returning a post-update validation error, preserving automation output on failure.
   • ›When a terminal runbook result exceeds one MCP response, wait_for_run now returns the summary in the first response and an opaque continuation token for ordered 64 KiB pages, removing the previous arbitrary total-step ceiling.
   • ›Catalog expands to 100 packs and 1,682 actions, adding JFrog Artifactory, Databricks, Sentry, Symbolicator, and NTPsec integrations, with expanded Cassandra and Cloudflare coverage.
   • ›Runner, pack, action, approval, and audit discovery now enforces the member's current runner and pack scope across both the console and MCP.
   +1 moreshow less

   • ›Catalog rows now require deployment on a runner the member can see, and malformed cross-account associations fail closed.
9. v0.40.0 Aug 13, 2026 · issue 001

   emisar v0.40.0 adds self-updating runners, paginated large runbook results, and 100-pack catalog coverage.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.40.0 https://github.com/AndrewDryga/emisar.git
   # already have the repo? check out this version:
   $ git checkout v0.40.0

   └──▷ TRY IT
   Update an installer-managed runner in place — the runner validates the release checksum and GitHub build attestation before applying the stop/swap/restart transaction.
   copy

   $ emisar update

   Capture machine-readable pack update output even when post-update validation fails, so CI pipelines can parse the partial report before acting on the error.
   copy

   $ emisar pack update --json

   • ›Adds emisar update subcommand for installer-managed runners to self-update, with release checksum and GitHub build attestation verification before executing stop, swap, restart, and rollback.
   • ›Adds --json flag to emisar pack update that now emits a partial machine-readable report before returning a post-update validation error, preserving automation output on failure.
   • ›When a terminal runbook result exceeds one MCP response, wait_for_run now returns the summary in the first response and an opaque continuation token for ordered 64 KiB pages, removing the previous arbitrary total-step ceiling.
   • ›Catalog expands to 100 packs and 1,682 actions, adding JFrog Artifactory, Databricks, Sentry, Symbolicator, and NTPsec integrations, with expanded Cassandra and Cloudflare coverage.
   • ›Runner, pack, action, approval, and audit discovery now enforces the member's current runner and pack scope across both the console and MCP.
   +1 moreshow less

   • ›Catalog rows now require deployment on a runner the member can see, and malformed cross-account associations fail closed.
10. v0.39.0 Aug 10, 2026 · issue -009

    emisar v0.39.0 overhauls runbook versioning into a publish/release model with diff-on-confirm, MCP slug-keyed drafts, and broader secret redaction.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.39.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.39.0

    • ›Adds get_runbook and update_runbook_draft MCP surface keyed by slug, so an agent replaces the single unpublished draft under the hash it read; publication remains human-only.
    • ›Runbook publishing now renders a line-level diff of what changed from the live release before confirming, using the canonical content hash as the definition's identity.
    • ›Introduces a single-draft model per runbook: only one unpublished change can exist at a time; the history list labels the live release on the Run button itself (e.g. Run v3) and marks a waiting draft with a dot.
    • ›Running an older release now returns not_live instead of silently dispatching current content; running an unpublished draft requires explicit consent plus the hash of exactly what was read.
    • ›Each execution snapshots the definition and release number it dispatched, making audit history immutable to later edits, publishes, or deletes.
    +3 moreshow less

    • ›Runner v0.19.0 expands secret redaction to cover connection strings, database URLs, key-derivation inputs (salt, pepper), cookie and session signing keys, and passphrase spellings — acting as a safety net beneath action-level redaction declarations.
    • ›pfSense pack gains resolver, NTP, and WireGuard peer reads (secrets excluded), plus a DHCP reservation write staged for operator approval.
    • ›Behavior harness in Packs now exercises a real service manager booted as PID 1, a per-case Docker daemon, iptables inside its own namespace, and a real dpkg database for install, remove, and autoremove scenarios.
    └──▷ BREAKING ON UPGRADE

    • !The portal migration collapses all per-save version rows into a single runbook record, renumbers published versions into releases, and repoints execution history — this runs automatically before the instance serves traffic on upgrade.
11. v0.39.0 Aug 10, 2026 · issue 001

    emisar v0.39.0 overhauls runbook versioning to track decisions not saves, adds MCP draft API, and broadens secret redaction.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.39.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.39.0

    • ›Adds get_runbook and update_runbook_draft MCP endpoints keyed by slug, letting agents replace the single unpublished draft under the exact hash they read while keeping publication human-only.
    • ›Publish confirmation now renders a diff of changed lines against the canonical text whose hash defines the release, so reviewers see exactly what will move the hash before approving.
    • ›Running an older (non-live) release now returns not_live instead of silently dispatching current content; running an unpublished draft requires explicit consent plus the hash of the draft as read.
    • ›Each execution snapshots the definition it dispatched, making the audit record immutable to later edits, publishes, or deletes.
    • ›The Run button in the history list names the live release directly (e.g., Run v3) and marks a waiting unpublished change with a visual indicator.
    +5 moreshow less

    • ›Runner v0.19.0 expands automatic secret redaction to cover connection strings, database URLs, key-derivation inputs (salt, pepper), cookie and session signing keys, and passphrase-pattern field names — acting as a safety net when actions omit their own redaction declarations.
    • ›pfSense pack gains resolver, NTP, and WireGuard peer reads that never expose private keys, plus a DHCP reservation action staged for operator approval.
    • ›pfSense certificate reads no longer emit the certificate's private key.
    • ›The fleet installer no longer places the reusable enrollment key on the process command line.
    • ›Behavior harness for packs now runs against a real service manager booted as PID 1, a per-case Docker daemon, iptables inside its namespace, and a real dpkg database for install, remove, and autoremove scenarios; uncovered cases are recorded with an explicit reason.
    └──▷ BREAKING ON UPGRADE

    • !The portal migration collapses each runbook's per-save version rows into a single runbook record, renumbers published versions into releases, and repoints all execution history — existing version numbers will change. The migration runs automatically before the instance serves traffic on upgrade.
12. v0.39.0 Aug 10, 2026 · issue 001

    emisar v0.39.0 overhauls runbook versioning to track decisions not saves, adds MCP draft API, and broadens secret redaction.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.39.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.39.0

    • ›Adds get_runbook and update_runbook_draft MCP endpoints keyed by slug, letting agents replace the single unpublished draft under the exact hash they read while keeping publication human-only.
    • ›Publish confirmation now renders a diff of changed lines against the canonical text whose hash defines the release, so reviewers see exactly what will move the hash before approving.
    • ›Running an older (non-live) release now returns not_live instead of silently dispatching current content; running an unpublished draft requires explicit consent plus the hash of the draft as read.
    • ›Each execution snapshots the definition it dispatched, making the audit record immutable to later edits, publishes, or deletes.
    • ›The Run button in the history list names the live release directly (e.g., Run v3) and marks a waiting unpublished change with a visual indicator.
    +5 moreshow less

    • ›Runner v0.19.0 expands automatic secret redaction to cover connection strings, database URLs, key-derivation inputs (salt, pepper), cookie and session signing keys, and passphrase-pattern field names — acting as a safety net when actions omit their own redaction declarations.
    • ›pfSense pack gains resolver, NTP, and WireGuard peer reads that never expose private keys, plus a DHCP reservation action staged for operator approval.
    • ›pfSense certificate reads no longer emit the certificate's private key.
    • ›The fleet installer no longer places the reusable enrollment key on the process command line.
    • ›Behavior harness for packs now runs against a real service manager booted as PID 1, a per-case Docker daemon, iptables inside its namespace, and a real dpkg database for install, remove, and autoremove scenarios; uncovered cases are recorded with an explicit reason.
    └──▷ BREAKING ON UPGRADE

    • !The portal migration collapses each runbook's per-save version rows into a single runbook record, renumbers published versions into releases, and repoints all execution history — existing version numbers will change. The migration runs automatically before the instance serves traffic on upgrade.
13. v0.38.0 Aug 8, 2026 · issue -011

    Emisar v0.38.0 adds policy override validation warnings and fixes session disconnect and runbook size reporting.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.38.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    • ›Adds a live validation warning when a policy override glob pattern cannot match any action ID — for example, regex-style patterns like cassandra\.drop_* — so deny rules that silently protect nothing are caught while writing, not after deployment.
    • ›Session termination now disconnects the active console session immediately, not only the backing cookie, so administrators ending sessions during an incident actually cut access.
    • ›Runbook size failures now report the actual size rather than appearing as a missing record, and character-limit bounds on title and description fields are now derived from the byte budget rather than assumed, preventing multibyte-encoded descriptions from silently vanishing from list_runbooks and get_runbook.
14. v0.38.0 Aug 8, 2026 · issue 001

    emisar v0.38.0 flags unmatched policy overrides, fixes session disconnect, and corrects runbook size reporting.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.38.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    • ›Policy overrides that cannot match any action ID — such as regex-style globs like cassandra\.drop_* — are now flagged with a warning while you write them, surfacing deny rules that silently protect nothing.
    • ›Runbook projection failures now report the actual size rather than returning a not-found response, so oversized runbooks are no longer silently dropped from list_runbooks or denied in get_runbook.
    • ›Ending a member's sessions now disconnects the live console session immediately, not only the cookie, closing the window where an active console remained usable after an administrator ended sessions mid-incident.
    • ›Character limits on runbook title and description now carry byte bounds derived from the projection budget, preventing multibyte-encoded descriptions (e.g. Japanese or accented Latin at the documented 4,096-character limit) from causing runbooks to vanish.
15. v0.38.0 Aug 8, 2026 · issue 001

    emisar v0.38.0 flags unmatched policy overrides, fixes session disconnect, and corrects runbook size reporting.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.38.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    • ›Policy overrides that cannot match any action ID — such as regex-style globs like cassandra\.drop_* — are now flagged with a warning while you write them, surfacing deny rules that silently protect nothing.
    • ›Runbook projection failures now report the actual size rather than returning a not-found response, so oversized runbooks are no longer silently dropped from list_runbooks or denied in get_runbook.
    • ›Ending a member's sessions now disconnects the live console session immediately, not only the cookie, closing the window where an active console remained usable after an administrator ended sessions mid-incident.
    • ›Character limits on runbook title and description now carry byte bounds derived from the projection budget, preventing multibyte-encoded descriptions (e.g. Japanese or accented Latin at the documented 4,096-character limit) from causing runbooks to vanish.
16. v0.37.0 Aug 8, 2026 · issue -011

    emisar v0.37.0 adds 90-day self-refreshing runner tokens, no_new_privs process isolation, multi-arch container images, and 95 packs with 1,498 actions.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.37.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.37.0

    └──▷ TRY IT
    Relabel an entire runner fleet to a new group and assign stable IDs without touching per-host config files.
    copy

    $ EMISAR_GROUP=prod-eu EMISAR_RUNNER_ID=runner-42 ./emisar-runner

    Verify the integrity and provenance of the official multi-arch runner container image before deploying it.
    copy

    $ gh attestation verify oci://ghcr.io/andrewdryga/emisar-runner:0.18.0 --owner andrewdryga

    • ›New EMISAR_GROUP and EMISAR_RUNNER_ID environment variables let operators relabel a fleet without editing configs on each host.
    • ›Official multi-architecture container image published at ghcr.io/andrewdryga/emisar-runner with build provenance and an SBOM.
    • ›Runner tokens now carry a 90-day bounded lifetime and self-refresh two-thirds of the way through over the existing connection, with no host access required; expired tokens are refused at connect.
    • ›Action children now start with no_new_privs, preventing execve inside a pack from picking up setuid or file-capability privileges the runner does not already hold.
    • ›Reads that can return credentials are now approval-gated; sensitive run values are masked in a single pass so one match cannot rewrite another's marker.
    +8 moreshow less

    • ›MFA enrollment and recovery-code regeneration now require proof of the current inbox; credential step-up codes are rate-limited across the cluster rather than per node.
    • ›Every pack's curl is confined to an explicit protocol with globbing off, preventing URLs arriving in API responses from expanding into extra transfers or exfiltrating credentials.
    • ›Signed MCP dispatch now signs the narrative a human approver actually reads (attestation v5), and the bridge verifies that narrative rather than a reconstruction of it.
    • ›MCP bridge signing key now comes from a pinned credential directory instead of the environment.
    • ›Runbook targets can name a runner group in the model contract, and an agent can revise and test a runbook draft before a human publishes it.
    • ›Catalog now carries 95 packs and 1,498 actions, adding Apache Airflow, Spark, Google Cloud billing, and BunnyCDN.
    • ›Console runbook target selection adds a stable trigger naming chosen targets, a searchable roster of dense one-line rows, and scope icons encoding cardinality.
    • ›Backlogged run output ships as one frame instead of one per line, and the connection lease renews at half its life instead of on every heartbeat.
    └──▷ BREAKING ON UPGRADE

    • !Action children now start with no_new_privs, so a setuid or setgid helper in a runner's process tree no longer elevates. For example, postqueue (setgid postdrop) can no longer grant access to the Postfix queue — the runner user must own the queue directly or be a postdrop member.
17. v0.37.0 Aug 8, 2026 · issue 001

    emisar v0.37.0 adds 90-day auto-rotating runner tokens, no_new_privs enforcement, multi-arch container image, and 95 packs with 1,498 actions.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.37.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.37.0

    └──▷ TRY IT
    Relabel all runners in a fleet to a named group and assign unique IDs without touching per-host config files.
    copy

    $ EMISAR_GROUP=prod-eu EMISAR_RUNNER_ID=runner-42 ./emisar-runner

    Verify the integrity and provenance of a downloaded runner binary and the official container image before deploying.
    copy

    $ gh attestation verify emisar-0.18.0-linux-amd64.tar.gz --owner andrewdryga
    sha256sum -c SHA256SUMS
    gh attestation verify oci://ghcr.io/andrewdryga/emisar-runner:0.18.0 --owner andrewdryga

    • ›Adds EMISAR_GROUP and EMISAR_RUNNER_ID environment variables to relabel a fleet runner without editing per-host configs.
    • ›Publishes an official multi-architecture container image at ghcr.io/andrewdryga/emisar-runner with build provenance and an SBOM.
    • ›Runner tokens now carry a 90-day bounded lifetime and self-refresh two-thirds of the way through over the existing connection, with expired tokens refused at connect.
    • ›Action children now start with no_new_privs, preventing execve inside a pack from gaining setuid or file-capability privileges the runner does not already hold.
    • ›Every pack's curl is confined to an explicit protocol with globbing disabled, blocking URL expansion or credential exfiltration from API-supplied URLs.
    +9 moreshow less

    • ›MFA enrollment and recovery-code regeneration both require proof of the current inbox; credential step-up codes are now rate-limited cluster-wide rather than per node.
    • ›Credential-returning reads are approval-gated rather than classified low risk; sensitive run values are masked in a single pass so one match cannot rewrite another's marker.
    • ›MCP signed dispatch now signs and verifies the narrative a human approver actually reads (attestation v5) rather than a reconstruction of it.
    • ›MCP bridge signing key is now sourced from a pinned credential directory instead of the environment.
    • ›Runbook targets can now name a runner group in the model contract, and agents can revise and test a runbook draft before a human publishes it.
    • ›Catalog now carries 95 packs and 1,498 actions, adding Apache Airflow, Spark, Google Cloud billing, and BunnyCDN.
    • ›Each pack's structured output is bounded to fit the runner's cap at its advertised worst case; jq filters are restricted to core builtins for compatibility with minimal hosts.
    • ›Runbook target selection in the console scales to large fleets with a stable trigger, a searchable dense roster, and cardinality-encoding scope icons.
    • ›Backlogged run output now ships as one frame instead of one per line, and the connection lease renews at half its life instead of on every heartbeat.
    └──▷ BREAKING ON UPGRADE

    • !Action children now run with no_new_privs, so any setuid or setgid helper in a runner's process tree no longer elevates. For example, postqueue (setgid postdrop) can no longer grant access to the Postfix queue — the runner user must own the queue directly or be a postdrop member.
18. v0.37.0 Aug 8, 2026 · issue 001

    emisar v0.37.0 adds 90-day auto-rotating runner tokens, no_new_privs enforcement, multi-arch container image, and 95 packs with 1,498 actions.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.37.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.37.0

    └──▷ TRY IT
    Relabel all runners in a fleet to a named group and assign unique IDs without touching per-host config files.
    copy

    $ EMISAR_GROUP=prod-eu EMISAR_RUNNER_ID=runner-42 ./emisar-runner

    Verify the integrity and provenance of a downloaded runner binary and the official container image before deploying.
    copy

    $ gh attestation verify emisar-0.18.0-linux-amd64.tar.gz --owner andrewdryga
    sha256sum -c SHA256SUMS
    gh attestation verify oci://ghcr.io/andrewdryga/emisar-runner:0.18.0 --owner andrewdryga

    • ›Adds EMISAR_GROUP and EMISAR_RUNNER_ID environment variables to relabel a fleet runner without editing per-host configs.
    • ›Publishes an official multi-architecture container image at ghcr.io/andrewdryga/emisar-runner with build provenance and an SBOM.
    • ›Runner tokens now carry a 90-day bounded lifetime and self-refresh two-thirds of the way through over the existing connection, with expired tokens refused at connect.
    • ›Action children now start with no_new_privs, preventing execve inside a pack from gaining setuid or file-capability privileges the runner does not already hold.
    • ›Every pack's curl is confined to an explicit protocol with globbing disabled, blocking URL expansion or credential exfiltration from API-supplied URLs.
    +9 moreshow less

    • ›MFA enrollment and recovery-code regeneration both require proof of the current inbox; credential step-up codes are now rate-limited cluster-wide rather than per node.
    • ›Credential-returning reads are approval-gated rather than classified low risk; sensitive run values are masked in a single pass so one match cannot rewrite another's marker.
    • ›MCP signed dispatch now signs and verifies the narrative a human approver actually reads (attestation v5) rather than a reconstruction of it.
    • ›MCP bridge signing key is now sourced from a pinned credential directory instead of the environment.
    • ›Runbook targets can now name a runner group in the model contract, and agents can revise and test a runbook draft before a human publishes it.
    • ›Catalog now carries 95 packs and 1,498 actions, adding Apache Airflow, Spark, Google Cloud billing, and BunnyCDN.
    • ›Each pack's structured output is bounded to fit the runner's cap at its advertised worst case; jq filters are restricted to core builtins for compatibility with minimal hosts.
    • ›Runbook target selection in the console scales to large fleets with a stable trigger, a searchable dense roster, and cardinality-encoding scope icons.
    • ›Backlogged run output now ships as one frame instead of one per line, and the connection lease renews at half its life instead of on every heartbeat.
    └──▷ BREAKING ON UPGRADE

    • !Action children now run with no_new_privs, so any setuid or setgid helper in a runner's process tree no longer elevates. For example, postqueue (setgid postdrop) can no longer grant access to the Postfix queue — the runner user must own the queue directly or be a postdrop member.
19. runner-v0.17.2 Aug 7, 2026 · issue -012

    emisar runner 0.17.2 adds BunnyCDN operations, explicit runbook targets, and zone-aware MIG rollout placement.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch runner-v0.17.2 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout runner-v0.17.2

    • ›Adds BunnyCDN operations and explicit runbook targets.
    • ›Allows production MIG rollout placement in available zones.
20. runner-v0.17.2 Aug 7, 2026 · issue 001

    emisar runner v0.17.2 adds BunnyCDN operations, explicit runbook targets, and production MIG rollout zone placement.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch runner-v0.17.2 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout runner-v0.17.2

    • ›Adds BunnyCDN operations and explicit runbook targets.
    • ›Allows production MIG rollout placement in available zones.
21. runner-v0.17.2 Aug 7, 2026 · issue 001

    emisar runner v0.17.2 adds BunnyCDN operations, explicit runbook targets, and production MIG rollout zone placement.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch runner-v0.17.2 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout runner-v0.17.2

    • ›Adds BunnyCDN operations and explicit runbook targets.
    • ›Allows production MIG rollout placement in available zones.
22. v0.36.0 Jul 31, 2026 · issue -019

    emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCP 2026-07-28 routing support, and hardened OIDC/SCIM identity controls.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.36.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.36.0

    • ›Adds staged runbooks where typed inputs bind once, stages run sequentially or in parallel against selected runner groups, and steps can extract named outputs, test success conditions, and wait within explicit bounds.
    • ›Adds a single pre-execution approval that freezes the complete runbook execution plan before work begins; Canonical JSON uses the same definition shape across the console and MCP.
    • ›Adopts the 2026-07-28 MCP routing headers and dual-era endpoint in the bridge and portal, including OAuth Client ID Metadata Documents.
    • ›Expands the action catalog to 91 packs and 1,386 actions, adding bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCP, and Docker Compose.
    • ›Adds a unified bounded address policy covering OIDC discovery, JWKS refresh, and redirects that rechecks the response actually received; changing an issuer now clears credentials tied to the old one.
    +2 moreshow less

    • ›Adds atomic wire-order application of SCIM group patches with body bounding before authentication; disabling a SCIM connection now retires the sessions and pending identity links it vouched for.
    • ›Missing source commands and HTTP error responses now fail pack actions instead of silently reporting empty success through a downstream pipe or successful transport.
    └──▷ BREAKING ON UPGRADE

    • !Disabling a SCIM connection retires all sessions and pending identity links it vouched for, which will terminate active sessions for affected users on upgrade.
23. v0.36.0 Jul 31, 2026 · issue 001

    emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCP 2026-07-28 routing, and hardened OIDC/SCIM identity controls.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.36.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.36.0

    • ›Runbooks now support typed inputs bound at declaration time, with stages that run sequentially or in parallel against selected runner groups, and steps that extract named outputs, test success conditions, and wait within explicit bounds.
    • ›A single approval freezes the complete runbook execution plan before any work begins; execution pages show attempts, outputs, waits, and terminal causes in order.
    • ›Canonical JSON for runbook definitions uses the same shape across the console and MCP, enabling programmatic construction and review of execution plans.
    • ›The MCP bridge and portal adopt the 2026-07-28 MCP routing headers and dual-era endpoint, including OAuth Client ID Metadata Documents.
    • ›The action catalog expands to 91 packs and 1,386 actions, with new bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCP, and Docker Compose.
    +1 moreshow less

    • ›Missing source commands and HTTP error responses now fail pack actions instead of silently passing through an empty success via downstream pipes or successful transport.
24. v0.36.0 Jul 31, 2026 · issue 001

    emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCP 2026-07-28 routing, and hardened OIDC/SCIM identity controls.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.36.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.36.0

    • ›Runbooks now support typed inputs bound at declaration time, with stages that run sequentially or in parallel against selected runner groups, and steps that extract named outputs, test success conditions, and wait within explicit bounds.
    • ›A single approval freezes the complete runbook execution plan before any work begins; execution pages show attempts, outputs, waits, and terminal causes in order.
    • ›Canonical JSON for runbook definitions uses the same shape across the console and MCP, enabling programmatic construction and review of execution plans.
    • ›The MCP bridge and portal adopt the 2026-07-28 MCP routing headers and dual-era endpoint, including OAuth Client ID Metadata Documents.
    • ›The action catalog expands to 91 packs and 1,386 actions, with new bounded diagnostics for GCP, Pure FlashArray, Terraform, Nomad, OIDC/JWKS, nftables, TCP, and Docker Compose.
    +1 moreshow less

    • ›Missing source commands and HTTP error responses now fail pack actions instead of silently passing through an empty success via downstream pipes or successful transport.
25. mcp-v0.5.0 Jul 31, 2026 · issue -019

    Emisar mcp-v0.5.0 expands its infrastructure diagnostics catalog.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch mcp-v0.5.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout mcp-v0.5.0

    • ›Expands the infrastructure diagnostics catalog with additional checks.
26. mcp-v0.5.0 Jul 31, 2026 · issue 001

    Emisar mcp-v0.5.0 expands its infrastructure diagnostics catalog.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch mcp-v0.5.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout mcp-v0.5.0

    • ›Expands the infrastructure diagnostics catalog with additional checks.
27. mcp-v0.5.0 Jul 31, 2026 · issue 001

    Emisar mcp-v0.5.0 expands its infrastructure diagnostics catalog.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch mcp-v0.5.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout mcp-v0.5.0

    • ›Expands the infrastructure diagnostics catalog with additional checks.
28. v0.35.0 Jul 27, 2026 · issue -023

    Runner identity now derives from hostname; pack retention protects versions active runners still advertise.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.35.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.35.0

    • ›A runner with no explicit runner.id now presents its hostname as its identity, so a rebooted host reconnects as the same runner and a replaced ephemeral host auto-enrolls as a new one — no generated identity file required.
    • ›Pack retention no longer sweeps a version that a connected runner still advertises, preventing dispatch from failing with pack_untrusted during quiet weeks of inactivity.
    • ›The hosted admin runner bootstraps from a version-pinned release download with retries instead of querying the GitHub API, preventing anonymous rate limits from blocking control-plane VM startup.
    • ›Every high or critical pack action now requires either a successful behavior case or a machine-readable risk exception (requires_cluster, requires_external_service, …), enforced by CI on every change.
    • ›The snmp pack's OSPF adjacency fixture now builds its network namespace on AppArmor-confined hosts.
    +1 moreshow less

    • ›Behavior matrix reporting now completes in less than half the previous wall-clock time via pre-pulled images, slow-suite sharding across CI rows, and concurrency caps on heavyweight services.
29. v0.34.0 Jul 26, 2026 · issue -024

    emisar v0.34.0 adds streaming run output via wait_for_run cursor paging and authoring-time enforcement of pack argument substitution bounds.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.34.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.34.0

    • ›Adds wait_for_run MCP call that accepts an output cursor and returns the next one, reading the event log forward; supports paging a finished run's trimmed output and fragments oversized events.
    • ›Pre-run dispatch rejections (contract changes, refusals, rate limits) now log bounded, allowlisted fields, making rejected calls visible in operations without writing model input to the log.
    • ›Pack-trust conflict UI now names the specific runners that disagree about an action instead of failing generically.
    • ›Adds an llms.txt index and a Keycloak setup guide to the documentation site.
    • ›Operator input (approval notes, grant scopes, policy overrides) now survives a console re-render triggered by a co-approver broadcast or a refused submit.
30. v0.34.0 Jul 26, 2026 · issue 001

    emisar v0.34.0 adds streaming run output via wait_for_run cursor paging and authoring-time enforcement of pack argument boundaries.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.34.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.34.0

    • ›Adds wait_for_run MCP call that accepts an output cursor and returns the next one, reading the event log forward; fragments oversized events, wakes on new progress, and can page a finished run's trimmed output back to the caller.
    • ›Pre-run dispatch rejections (contract changes, refusals, rate limits) now log bounded, allowlisted fields so rejected calls are visible in operations.
    • ›Curl-backed API actions now fail on 4xx and 5xx responses instead of reporting transport success.
    • ›Device grant claiming writes an audit row per minted key, naming the approver.
    • ›Adds an llms.txt index to the website.
    +2 moreshow less

    • ›Console operator input (approval notes, grant scope selections, policy overrides) now survives re-renders caused by co-approver broadcasts or refused submits.
    • ›Pack-trust conflict messages now name the specific runners that disagree about an action instead of failing generically.
31. v0.34.0 Jul 26, 2026 · issue 001

    emisar v0.34.0 adds streaming run output via wait_for_run cursor paging and authoring-time enforcement of pack argument boundaries.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.34.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.34.0

    • ›Adds wait_for_run MCP call that accepts an output cursor and returns the next one, reading the event log forward; fragments oversized events, wakes on new progress, and can page a finished run's trimmed output back to the caller.
    • ›Pre-run dispatch rejections (contract changes, refusals, rate limits) now log bounded, allowlisted fields so rejected calls are visible in operations.
    • ›Curl-backed API actions now fail on 4xx and 5xx responses instead of reporting transport success.
    • ›Device grant claiming writes an audit row per minted key, naming the approver.
    • ›Adds an llms.txt index to the website.
    +2 moreshow less

    • ›Console operator input (approval notes, grant scope selections, policy overrides) now survives re-renders caused by co-approver broadcasts or refused submits.
    • ›Pack-trust conflict messages now name the specific runners that disagree about an action instead of failing generically.
32. v0.33.0 Jul 21, 2026 · issue -029

    emisar v0.33.0 adds uninstall/reset runner identity flags, trust-gated action dispatch, and a new incident-response skill.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.33.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.33.0

    └──▷ TRY IT
    Cleanly remove a decommissioned runner's identity and token without wiping its logs or config, so the runner can be re-enrolled fresh.
    copy

    $ install.sh --uninstall

    Reset a runner's external identity in an automated pipeline when rotating enrollment keys, skipping the interactive prompt.
    copy

    $ install.sh --reset-identity

    • ›Adds --uninstall flag to install.sh to remove the cached token, legacy token file, and generated runner identity while preserving configuration, local evidence, and logs.
    • ›Adds --reset-identity flag to install.sh for unattended runner identity resets when supplying a different enrollment key.
    • ›Adds --purge flag to install.sh that extends --uninstall by also removing the retained configuration, evidence, and log files.
    • ›MCP catalog, search, exact lookup, runner inspection, and runbook recovery now filter out pending, rejected, revoked, retired, hash-mismatched, and incomplete pack versions from model-visible results.
    • ›Runner UI locks the Run button and surfaces a diagnostic explanation when an advertised action's pack is untrusted or retired; dispatch revalidates the contract so stale pages or tool calls cannot execute after trust changes.
    +5 moreshow less

    • ›Runbook recovery now fails closed if trust changes between action inspection and execution, preventing hidden pack version leakage through recovery results.
    • ›ChatGPT tool annotations now distinguish read-only calls from mutations, and domain verification accepts OpenAI's text challenge.
    • ›Adds a new public respond-to-production-incidents skill providing customer agents a bounded observe-diagnose-act-verify workflow.
    • ›The Packs page now follows the live catalog and gives unadvertised versions one day to disappear before cleanup.
    • ›OAuth return targets now preserve their original local query string through SSO and registration flows.
33. v0.33.0 Jul 21, 2026 · issue 001

    emisar v0.33.0 adds --uninstall, --reset-identity, and --purge runner lifecycle flags plus trust-gated action dispatch and ChatGPT/Claude MCP conformance.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.33.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.33.0

    └──▷ TRY IT
    Cleanly decommission a runner — wiping its cached token and generated identity — without losing its config, logs, or local evidence.
    copy

    $ install.sh --uninstall

    Force an unattended identity reset when re-enrolling a runner with a different enrollment key, for use in automation or CI pipelines.
    copy

    $ install.sh --reset-identity

    • ›Adds --uninstall flag to install.sh to remove the cached token, legacy token file, and generated runner identity while preserving configuration, local evidence, and logs.
    • ›Adds --reset-identity flag to install.sh for unattended runner identity resets when supplying a different enrollment key during reinstall.
    • ›Adds --purge flag to install.sh to remove all retained files including those preserved by --uninstall.
    • ›MCP catalog, search, exact lookup, runner inspection, and runbook recovery now exclude pending, rejected, revoked, retired, hash-mismatched, and incomplete pack versions from model-visible results.
    • ›Dispatch revalidates the action contract at execution time so a stale page or tool call cannot execute after trust changes — runner UI also locks the Run button for unavailable actions with an explanation.
    +6 moreshow less

    • ›Runbook recovery fails closed if trust changes between action inspection and execution, preventing hidden pack version disclosure through recovery results.
    • ›ChatGPT tool annotations now distinguish read-only calls from mutations, and domain verification accepts OpenAI's text challenge.
    • ›Claude conformance evals select MCP authentication by mode and skip interactive permission prompts during headless runs.
    • ›Adds a new public respond-to-production-incidents skill giving customer agents a bounded observe, diagnose, act, and verify workflow.
    • ›The Packs page now follows the live catalog and grants unadvertised versions one day to disappear before cleanup.
    • ›Interactive reinstall with a different enrollment key prompts whether to preserve the existing external identity or reset it.
34. v0.33.0 Jul 21, 2026 · issue 001

    emisar v0.33.0 adds --uninstall, --reset-identity, and --purge runner lifecycle flags plus trust-gated action dispatch and ChatGPT/Claude MCP conformance.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.33.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.33.0

    └──▷ TRY IT
    Cleanly decommission a runner — wiping its cached token and generated identity — without losing its config, logs, or local evidence.
    copy

    $ install.sh --uninstall

    Force an unattended identity reset when re-enrolling a runner with a different enrollment key, for use in automation or CI pipelines.
    copy

    $ install.sh --reset-identity

    • ›Adds --uninstall flag to install.sh to remove the cached token, legacy token file, and generated runner identity while preserving configuration, local evidence, and logs.
    • ›Adds --reset-identity flag to install.sh for unattended runner identity resets when supplying a different enrollment key during reinstall.
    • ›Adds --purge flag to install.sh to remove all retained files including those preserved by --uninstall.
    • ›MCP catalog, search, exact lookup, runner inspection, and runbook recovery now exclude pending, rejected, revoked, retired, hash-mismatched, and incomplete pack versions from model-visible results.
    • ›Dispatch revalidates the action contract at execution time so a stale page or tool call cannot execute after trust changes — runner UI also locks the Run button for unavailable actions with an explanation.
    +6 moreshow less

    • ›Runbook recovery fails closed if trust changes between action inspection and execution, preventing hidden pack version disclosure through recovery results.
    • ›ChatGPT tool annotations now distinguish read-only calls from mutations, and domain verification accepts OpenAI's text challenge.
    • ›Claude conformance evals select MCP authentication by mode and skip interactive permission prompts during headless runs.
    • ›Adds a new public respond-to-production-incidents skill giving customer agents a bounded observe, diagnose, act, and verify workflow.
    • ›The Packs page now follows the live catalog and grants unadvertised versions one day to disappear before cleanup.
    • ›Interactive reinstall with a different enrollment key prompts whether to preserve the existing external identity or reset it.
35. v0.32.0 Jul 20, 2026 · issue -030

    emisar v0.32.0 adds real-agent MCP conformance evals, symptom-language search, and a justification chain on run_action.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.32.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.32.0

    • ›Extends run_action to accept optional evidence (observed state) and expected (predicted outcome) fields alongside a reason that now supports up to 2000 characters, surfacing the full justification chain on the approval screen and run details.
    • ›Paginated MCP reads now return a copy-ready next call object instead of a bare cursor, so an agent continues pagination by echoing a single object.
    • ›Adds list_runners to the MCP API, inlining each runner's dispatchable pack IDs so one call reveals what a named host can execute.
    • ›Actions can opt into typed JSON results dispatched against a pinned trusted descriptor.
    • ›Introduces real-agent conformance evals that drive live Claude Code and Codex CLIs through a fail-closed loopback relay — hard-failing on policy-blocked calls, invalid mutation arguments, a run_action without a prior get_action for the same action, placeholder reasons, and runs not driven to a terminal status.
    +3 moreshow less

    • ›Registry now serves the catalog compact and gzip-encoded behind a CDN, reducing transfer to roughly one-tenth of the previous size; pack tarballs remain unencoded to preserve content-hash pinning.
    • ›Runner access is now explicit: a member is scoped to only the runners and groups they are permitted to use.
    • ›A missing client binary is reported as separate host readiness evidence — the action stays advertised for manifest verification but is not offered for dispatch.
36. v0.32.0 Jul 20, 2026 · issue 001

    emisar v0.32.0 adds real-agent conformance evals, symptom-language action search, and a justification chain for run_action.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.32.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.32.0

    • ›Extends run_action to accept optional evidence and expected fields alongside reason (now up to 2000 characters), letting an agent carry its full reasoning chain; the approval screen and run details render evidence, expected outcome, and reason together for reviewers.
    • ›Adds paginated MCP reads that return a copy-ready next call (echoing one object) instead of a bare cursor, so agents can continue pagination without parsing a raw cursor value.
    • ›Adds list_runners to the MCP API, inlining each runner's dispatchable pack IDs so a single call reveals what a named host can do.
    • ›Enables actions to opt into typed JSON results, dispatched against the pinned trusted descriptor.
    • ›Introduces real-agent conformance evals: a scheduled workflow drives the live Claude Code and Codex CLIs through a fail-closed loopback relay against a live stack, hard-failing on policy-blocked calls, invalid mutation arguments, a run_action without a prior get_action for the same action, placeholder reasons, and runs not driven to a terminal status.
    +2 moreshow less

    • ›Serves the registry catalog compact and gzip-encoded behind a CDN, reducing transfer to roughly one-tenth of the previous size.
    • ›Makes runner access explicit: a member is now scoped to only the runners and groups they are permitted to use.
37. v0.32.0 Jul 20, 2026 · issue 001

    emisar v0.32.0 adds real-agent conformance evals, symptom-language action search, and a justification chain for run_action.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.32.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.32.0

    • ›Extends run_action to accept optional evidence and expected fields alongside reason (now up to 2000 characters), letting an agent carry its full reasoning chain; the approval screen and run details render evidence, expected outcome, and reason together for reviewers.
    • ›Adds paginated MCP reads that return a copy-ready next call (echoing one object) instead of a bare cursor, so agents can continue pagination without parsing a raw cursor value.
    • ›Adds list_runners to the MCP API, inlining each runner's dispatchable pack IDs so a single call reveals what a named host can do.
    • ›Enables actions to opt into typed JSON results, dispatched against the pinned trusted descriptor.
    • ›Introduces real-agent conformance evals: a scheduled workflow drives the live Claude Code and Codex CLIs through a fail-closed loopback relay against a live stack, hard-failing on policy-blocked calls, invalid mutation arguments, a run_action without a prior get_action for the same action, placeholder reasons, and runs not driven to a terminal status.
    +2 moreshow less

    • ›Serves the registry catalog compact and gzip-encoded behind a CDN, reducing transfer to roughly one-tenth of the previous size.
    • ›Makes runner access explicit: a member is now scoped to only the runners and groups they are permitted to use.
38. v0.31.0 Jul 18, 2026 · issue -032

    emisar v0.31.0 adds browser-based device-flow agent connect, operator pack catalog controls, and 13 MCP clients out of the box.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.31.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.31.0

    • ›Adds RFC 8628 device-flow browser approval for agent connect: the installer opens a consent page, mints per-client keys, and writes them directly into each client's config — no clipboard, shell history, or process-argument exposure.
    • ›Supports 13 MCP clients configured out of the box: Claude Code, Claude Desktop, Cursor, Gemini CLI, Codex CLI, OpenClaw, OpenCode, Windsurf, Pi, Copilot CLI, Zed, Hermes, and Goose, each in its own format.
    • ›Adds emisar doctor color output and a service-supervisor state check.
    • ›Adds operator pack catalog controls: delete a pack or a single version, revoke trust on a version, and auto-remove versions no runner has advertised for a configurable number of days.
    • ›Retired pack versions are now surfaced as 'retired' to lagging runners (with an upgrade pointer) instead of appearing as unknown packs — preventing inadvertent re-authorization of vulnerable bytes.
    +4 moreshow less

    • ›Adds Nomad 0.2.0 pack with deployment control (list, pause, resume, fail), metadata-filtered discovery, node-pool and CSI plugin reads, and a uniform TLS path for API calls.
    • ›Gates three container/process environment-dump actions — where secrets such as database passwords live — behind explicit approval.
    • ›Runner CLI now reloads the daemon automatically after a pack install, update, or uninstall.
    • ›Under-permissioned roles now receive a clean denial instead of a server error on detail routes.
    └──▷ BREAKING ON UPGRADE

    • !Self-hosted runners: the config key auth_key_env is renamed to enrollment_key_env — update your config and re-mint any enrollment keys that were never used.
39. v0.30.0 Jul 17, 2026 · issue -033

    emisar v0.30.0 enforces tenant isolation in the database and adds signed-pack visibility over MCP

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.30.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.30.0

    • ›Signed-pack enforcement is now visible over MCP: a runner that requires signed packs announces that requirement to MCP clients.
    • ›Database-enforced tenant isolation: every runner-owned child row carries a composite foreign key to its account, so cross-tenant writes are refused at the database row level rather than only in application code.
    • ›CHECK constraints added for security-relevant enums so the database rejects out-of-range values that gate trust and dispatch, independent of the application layer.
    • ›Content-Security-Policy headers now applied to public unauthenticated pages and error responses, matching the rest of the site.
    • ›Sentry named as a subprocessor; events scrubbed of personal data before leaving the process.
    +3 moreshow less

    • ›Trigram index added to speed run search on large accounts, replacing three now-covered indexes.
    • ›Steadier dispatch: a runner at capacity redelivers refused dispatches, the stale-dispatch sweep drains oldest-queued entries first, and stuck pending runs advance instead of stranding.
    • ›Severe database and load-balancer conditions now page directly; point-in-time recovery drill measures actual RTO.
40. v0.29.0 Jul 16, 2026 · issue -034

    Emisar v0.29.0 tightens MCP argument coercion, sharpens error messages, and trims run summary payloads.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.29.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.29.0

    • ›MCP now coerces scalar arguments sent as canonical strings — e.g. "limit": "50" or "dry_run": "true" — instead of failing the call, while true type mismatches name the field and the JSON type it was sent as (e.g. limit must be a JSON integer from 1 to 100; it was sent as a string.).
    • ›MCP argument fault messages now name the offending field in every case: malformed refs advise copying the exact value from a prior tool result, enum faults list allowed values, and unknown arguments are spelled out against the allowed set.
    • ›MCP run summaries drop zero-information fields: streams with no bytes omit stdout/stderr, byte-count, and truncation fields; output_complete appears only when false; and per-stream SHA-256 digests are removed from the MCP projection (they remain on the run detail page and audit record), shrinking a typical terse summary by about a third.
    • ›Disabling two-factor authentication now requires a fresh step-up challenge, preventing a hijacked session from quietly weakening an account.
    • ›Production session cookies now always carry the Secure flag.
    +3 moreshow less

    • ›Secret-dense config and environment dumps — cloud-init user/vendor data and cloud-config, pm2 env, nginx and caddy config dumps — are reclassified from risk level low to medium, matching linux.sudoers_dump, so they no longer ride the ungated low-read path.
    • ›Redis ACL password hashes are redacted from acl_list and acl_getuser output, preventing ungated reads from leaking crackable material.
    • ›Exec-style arguments across docker, systemctl, podman, minio, and related tools now anchor their first character to an alphanumeric, blocking hostile values from being parsed as leading-dash flags.
    └──▷ BREAKING ON UPGRADE

    • !Per-stream SHA-256 digests are removed from the MCP run summary projection; any client parsing those fields from summary responses will find them absent (they remain on the run detail page and audit record).
    • !MCP run summary response no longer includes stdout/stderr, byte-count, truncation, or output_complete fields when they carry no information; clients that treat the absence of these fields as an error condition will need to be updated.
    • !Secret-dense config/environment dump packs (cloud-init user/vendor data and cloud-config, pm2 env, nginx and caddy config dumps) are reclassified from risk low to medium and no longer ride the ungated low-read path; workflows relying on ungated access to these dumps will require elevated authorization.
41. v0.28.0 Jul 16, 2026 · issue -034

    emisar v0.28.0 adds dispatch-log verification, fleet diagnostics in MCP, SSO/MFA route coverage, SCIM rate-limiting, and GDPR erasure tasks.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.28.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.28.0

    └──▷ TRY IT
    Check dispatch-log health in a post-upgrade CI or runbook script to catch bad state before the service goes live.
    copy

    $ emisar state check-dispatch-log

    Automatically quarantine a corrupt dispatch log during an unattended upgrade so the host does not crash-loop.
    copy

    $ QUARANTINE_DISPATCH_LOG=1 bash install.sh

    Inspect runner health — dispatch log state, degraded packs, and last cloud rejection — from a single operator command.
    copy

    $ emisar doctor

    • ›Adds QUARANTINE_DISPATCH_LOG=1 environment variable to install.sh to automatically quarantine an unreadable dispatch log during upgrades instead of leaving a host crash-looping.
    • ›emisar doctor now checks the dispatch log, reports degraded packs, and surfaces the last cloud rejection.
    • ›Adds emisar state check-dispatch-log subcommand for scripted dispatch-log verdict checks.
    • ›install.sh now verifies dispatch state with the staged binary before touching a running service, aborting with remediation options on failure.
    • ›Degraded packs now surface as named 'pack X failed to load on runner Y' entries in MCP list_runners output and as an amber notice with reinstall remedy on the runner detail page.
    +10 moreshow less

    • ›Denied runs now return a bounded policy reason in MCP summaries.
    • ›find_actions supports natural multi-term queries.
    • ›Console-created runbooks are now visible and executable over MCP.
    • ›Outbound connections now enforce a TLS 1.2 floor.
    • ›Sign-in enforcement for Require SSO and Require MFA now covers every controller route.
    • ›SCIM, audit-export, and runner-register endpoints are now rate-limited.
    • ›Account and user erasure (GDPR delete) is available as an operator-run release task.
    • ›Adds direct alerts for database-down, zero-healthy-backend, and portal VM saturation conditions.
    • ›docs/COMPATIBILITY.md now documents on-host runner state (dispatch log, installed pack trees) as a compatibility surface with migration rules.
    • ›Runner binary ships as runner-v0.13.0 with SLSA-3 build provenance and SHA256SUMS.
42. v0.27.0 Jul 16, 2026 · issue -034

    Runner v0.12.0 adds durable dispatch journaling, startup integrity checks, and clearer MCP failure reporting.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.27.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.27.0

    • ›Corrupt durable dispatch state now halts the runner before it connects to the control plane, preventing split-brain dispatch records.
    • ›Failure causes redact sensitive action arguments before they reach local audit records or the portal.
    • ›MCP run summaries include a bounded terminal failure message when the runner provides one, surfacing failure detail directly in the portal.
    • ›OAuth consent now lets a person choose which account to connect during connector setup.
    • ›Key-bearing connector commands are kept out of shell history.
    +2 moreshow less

    • ›A newer non-destructive production plan supersedes an older pending plan, with Terraform confirmation as the single human apply gate.
    • ›Unsigned installations no longer open or lock signing nonce state during startup.
    └──▷ BREAKING ON UPGRADE

    • !Runner v0.12.0 starts a new durable dispatch journal and does not import older unacknowledged entries; upgrade directly to runner-v0.12.0 with no pending dispatches in flight.
    • !Downgrading to an earlier runner is unsupported once runner-v0.12.0 has written new dispatch records.
43. v0.26.0 Jul 16, 2026 · issue -034

    Emisar v0.26.0 recovers in-flight runs after runner reconnects and flags out-of-date MCP bridge versions in the console.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.26.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.26.0

    • ›Control plane now recovers runs that were in-flight when a runner drops and reconnects, instead of stranding them.
    • ›LLM agents list in the console now groups connections by the operator behind each key, shows the emisar-mcp bridge version inline per connection, and flags an out-of-date bridge one step from the upgrade command.
    • ›Runner version-upgrade notice now scopes its count to the current page (e.g., '1 runner on this page is below the supported range') rather than implying a single runner across the whole list.
    • ›Runner binary runner-v0.11.0 ships with SLSA-3 build provenance and SHA256SUMS published by its release workflow.
44. v0.24.0 Jul 12, 2026 · issue -038

    emisar v0.24.0 adds a pack registry at registry.emisar.dev, a public status page, and lists its MCP server in the official MCP registry.

    └──▷ GET THIS VERSION
    copy

    $ git clone --branch v0.24.0 https://github.com/AndrewDryga/emisar.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

    • ›Pack registry now serves from registry.emisar.dev/v1/catalog.json with anonymous access scoped to exact object reads and end-to-end tarball verification on publication.
    • ›Hosted MCP server (dev.emisar/emisar) is now listed in the official MCP registry.
    • ›Public status page at status.emisar.dev provides external availability monitoring with on-call escalation.
    • ›Portal releases are now pinned by digest with provenance and SBOM attestations; fixable HIGH/CRITICAL vulnerabilities block publication.
    • ›Binary releases are immutable and reproducible, with signed and verified release tags gating publication.
    +1 moreshow less

    • ›Production infrastructure plans queue in order and never replace a review an operator already has open.