[1.60.0] - 2026-08-04

Boundary hardening for the MCP proxy. Closes the two gaps between what the
proxy does and what its audit trail says, both found by review rather than by
tests.

Added

• The Streamable HTTP transport takes an API key (--api-key, or
  VAARA_PROXY_API_KEY). When set, every /mcp request must carry
  Authorization: Bearer <key> or it is rejected with 401. The check runs
  before any route handler, so X-Vaara-Tenant and X-Vaara-Upstream are
  never read from an unauthenticated caller. Keys are compared in constant
  time. GET /health stays open so load balancers keep working.
• --allow-unauthenticated for operators whose bind is protected by other
  means, such as mTLS or a private network segment.

Fixed

• vaara-mcp-proxy --transport http now refuses to bind a non-loopback host
  when no API key is configured. X-Vaara-Tenant selects the tenant a call is
  attributed to and X-Vaara-Upstream selects the upstream, and therefore the
  policy, that governs it. Read from an unauthenticated caller on a reachable
  bind, those headers allow tenant spoofing and weakest-policy shopping. This
  mirrors the guard vaara serve already applies. Loopback binds are
  unaffected and still need no key.
• A credential-gateway denial is now recorded as a blocked outcome against the
  same action_id as the policy decision. For a constrained tool the policy
  decision can be allow while the gateway then refuses, most often because
  runtime arguments no longer match the digest the grant was minted for. The
  trail previously kept the allow and carried nothing showing the call never
  executed, so the record and the behaviour disagreed. A failure to write the
  outcome is logged and never masks the denial.

Upgrading

Operators running vaara-mcp-proxy --transport http on a non-loopback host
without an API key will see the process refuse to start. Set --api-key or
VAARA_PROXY_API_KEY, or pass --allow-unauthenticated if the port is
protected another way.

[1.59.0] - 2026-08-03

macOS app consolidation release. Pulls the 1.58.x macOS fixes into one
coherent release and corrects the settings layout regression.

Added

• clients/macos/Package.swift declares the VaaraMenuBar executable
  product, so swift build actually links a runnable binary.

Fixed

• The menu-bar footer reads the installed engine version via vaara version
  (the CLI rejects --version), so the on-screen version matches the binary
  no matter how the app was installed.
• The update-check User-Agent is derived from the installed version instead
  of a hardcoded value.
• Footer bottom padding is 20pt, matching the app-wide standard, so the
  footer no longer hugs the window edge.
• Settings screen is a plain Grid with 20pt padding — the bounded
  ScrollView introduced in 1.58.4 (which added an unwanted scrollbar) is
  removed; tall enterprise content no longer clips to the window edge.
• Bumped BUILD_STAMP to b57 · 2026-08-03.

[1.58.4] - 2026-08-03

macOS Settings screen: the Grid was the one screen without the bounded
ScrollView every other tab uses, so tall content (enterprise rows) clipped
against the popover's bottom edge and text hugged the border. It now scrolls
inside a maxHeight: 560 container like Overview and History, and the footer
keeps the app-wide 20pt bottom padding instead of 14pt.

Also fixes the SPM manifest: VaaraMenuBar was declared as an executable
target but never listed under products:, so swift build compiled the code
but never linked a runnable binary.

Fixed

• macOS Settings screen: bounded ScrollView (maxHeight 560) + 20pt footer bottom padding.
• clients/macos/Package.swift: added the VaaraMenuBar executable product.

[1.58.3] - 2026-08-03

macOS footer spacing: the footer hugged the window's bottom edge at 12pt
vertical padding while every other element uses 16-22pt. It now uses 14pt
plus a subtle wash so it reads as a footer with breathing room, matching the
"unhurried spacing" of the rest of the popover.

Fixed

• macOS footer vertical padding 12pt -> 14pt, with a hairline background wash.

[1.58.2] - 2026-08-03

Fixes the macOS version probe: the menu-bar footer ran vaara --version,
which the CLI does not accept (the flag is vaara version), so the version
display silently failed on every install. The footer now calls vaara version
and correctly shows the installed engine version.

Fixed

• macOS footer version probe: vaara --version -> vaara version.

[1.58.1] - 2026-08-03

Small macOS app release: the menu-bar footer no longer shows a stale,
hand-edited build stamp. It now reads the actually-installed vaara engine
version from vaara --version at runtime, so the on-screen version always
matches the binary regardless of how the app was installed (IDE/XcodeGen,
Homebrew, or a copied /Applications build). The GitHub update-check
User-Agent is derived from the same live version instead of a hardcoded
1.56.0.

Fixed

• macOS app footer shows the live installed engine version (was a frozen
  BUILD_STAMP constant that predated the release).
• checkForUpdates sends User-Agent: VaaraMenuBar/<installed> instead of a
  hardcoded 1.56.0.
• Bumped BUILD_STAMP to b57 · 2026-08-03.

[1.58.0] - 2026-08-03

Post-audit hardening release: the evidence core verified production-grade;
this release closes the boundary findings.

Security

• HTTP server authentication (C1): vaara serve now accepts
  --api-key (or VAARA_SERVER_API_KEY). When set, every endpoint except
  GET /v1/health requires Authorization: Bearer <key> (constant-time
  compare). Non-loopback binds without a key are REFUSED unless
  --allow-unauthenticated is passed: an unauthenticated reachable server
  allowed policy hot-swap to allow-all (POST /v1/policy/reload), forged
  audit-event append (POST /v1/audit/events), and calibration poisoning
  (POST /v1/score/outcome). docs/openapi.yaml gains a bearerAuth
  security scheme; docs/adapters.md documents the contract.
• Prior-approval auto-allow (C2): the argument-shape guard is now real.
  ESCALATION_SENT and ESCALATION_RESOLVED records carry the
  args_digest, find_prior_approval requires an exact digest match
  (records without one never match a digested query — fail closed), is
  tenant-scoped, and reads under the chain lock. Approving tx.transfer
  amount=10 no longer auto-allows amount=999999.
• MCP server API-key check is now constant-time (secrets.compare_digest).
• vaara keygen writes private keys with O_CREAT mode 0600 from the
  start (no umask window before chmod).

Fixed

• Trail/behaviour divergence on auto-allow: the prior-approval check
  now runs BEFORE the decision is recorded, so an auto-allowed action's
  chain shows decision=allow with the auto-allow reason — never a
  dangling escalate with no ESCALATION_SENT behind it. The record and
  the behaviour always agree.
• Notch approval panel on the MCP path: vaara-mcp-server's
  vaara_intercept now runs the file-based approvals handshake
  (~/.vaara/approvals) on a gated escalate — the same protocol as the
  Claude Code hook — so MCP-governed agents get the human-in-the-loop
  surface. VAARA_PLUGIN_APPROVALS=0 disables; deny/timeout fail closed.
• macOS app settings window widened to 760pt on the settings screen
  (the two-column Grid's segmented pickers clipped at 520pt).
• macOS GATE picker now writes BOTH the Claude Code plugin config and
  the unified ~/.vaara/config.json; the status read normalises legacy
  vocabularies (shadow/enforce). Previously the picker flipped only
  the plugin config while non-hook runtimes kept the old mode.
• dry_run_evaluate applies the cloud-metadata SSRF content floor, so
  vaara_check / /v1/score previews cannot say allow where
  vaara_intercept denies.
• Policy validation warns when sequences.*.window_seconds is declared:
  matching is count-based lookback, so the seconds value was silently
  ignored (potential policy bypass by misconfiguration).
• /v1/score/outcome writes OUTCOME_RECORDED to the hash chain
  (outcomes reported over HTTP previously left no evidence record).
• Server schema: _EventType accepts anchor_gap, key_lifecycle,
  disclosure_recorded; /v1/audit/events payload capped at 64KB;
  OutcomeRequest.notes capped.
• macOS false "path traversal detected" warning on every tempdir DB
  (macOS /var → /private/var symlink): warning now fires only on real
  .. segments.
• Article 50 auto-disclosure failure in @govern logs at debug instead
  of swallowing silently.

Documentation

• docs/formal_specification.md corrected to match the code: scorer
  defaults 0.4/0.7 (not 0.3/0.7), seeded ±0.19 starting interval, the
  sequence signal is an MWU expert (not an additive boost), the hash
  chain commits previous_hash inside the record payload, and cold start
  is calibrated-from-birth (seeded prior) with the strict behaviour
  behind pre_seed_calibration=False.
• bench/latency.py + bench/README.md: the benchmark constructs an
  explicit in-memory trail and says so; the library default is the
  SQLite-backed trail at ~/.vaara/trail/audit.db (persistent I/O grows
  with DB size and is out of scope for the hot-path number).
• README quick-start: records are hash-chained/tamper-evident (signing
  happens at export), and the default persistent trail location is named.
• CAPABILITIES.md current-line version refreshed (v1.37.0 → v1.57.4).
• docs/eu-ai-act-august-2026.md: Omnibus timing sentence updated —
  Regulation (EU) 2026/1744 published 24 July 2026, in force 27 July 2026.

[1.57.4] - 2026-08-02

Fixed

• macOS AccessibilityObserver: fix pid_t type annotation in attachTo and
  detachObserver that broke Swift compilation.

[1.57.3] - 2026-08-02

Fixed

• Cross-process outcome reporting: pending outcomes now persist to SQLite
  (pending_outcomes table, schema v5) so vaara outcome works when called
  from a separate process than vaara check.
• macOS AccessibilityObserver rewrite: proper multi-app focus tracking via
  NSWorkspace notifications, correct Safari URL extraction through toolbar
  AX hierarchy, broader AI site detection, and cleanup of stale observers.
• Remove accidentally committed temporary release artifacts
  (.commit_msg_v1.53.0_release.txt, .pr_body_v1.53.0.md).

[1.57.2] - 2026-08-02

Fixed

• macOS app: remove invalid --format json flag from PolicyServiceDelegate
  that caused the WebKit governance extension to fail open (every web flow
  was allowed by default).
• Infer proxy gate: test isolation — use fresh in-memory AuditTrail to
  prevent prior approval records from the default SQLite DB from leaking
  between test runs.