minimal — The Cyber Toolchain

minimal release-6a01d5ae

Sat, 07 Nov 2026 10:36:11 GMT

minimal adds a Box Egress Proxy, secret management, OpenTelemetry tracing, and a vulnerability reporting flag across CLI and daemon components⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `min box audit` to read a box's audit trail, `min box audit --parent` to merge parent chains, `min doctor` to report an edited audit chain, and `min box spec` to list each store reference with its authorities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Report a suspected vulnerability to the project with `--security` on the `diag` command. • Sign in to GitHub and finish the OAuth flow on a real page with `min login`, with repository choice offered during sign-in. • Adds the `bep` crate implementing a Box Egress Proxy that issues leaf certificates under a name-constrained root and signing CA, holds proxy keys in the host Secure Enclave, maintains a hash-chained audit log per proxy decision, rotates the signing CA through a control socket, starts beside `gvproxy` so `git` and `gh` reach GitHub from inside VM boxes, and wires a client-key bound into `bep serve` via `--max-client-keys` to cap the registry size. • Name the QUIC block helper in `min finalize-install` for post-install network configuration. • Add opt-in OpenTelemetry export with local spooling across `mlog`, `min`, `minimald`, and `minvmd`, carrying one trace per request through CLI, daemon, and VM guest. • Give a project with no session entry an implicit default in `mfile`. • Keep box names answering across a reboot and a second VM. • Proxy runtime-published ports like a direct connection in `minimald`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-1e236070

Fri, 06 Nov 2026 10:33:46 GMT

minimal: Store, list, and remove secrets inside a box with `min secret` (subcommands: `set`, `list`, `remove`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Carry an edited-audit-chain warning into `min doctor`. • Carry telemetry spool and redact telemetry settings automatically when running `min bug`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-47eba5d3

Thu, 05 Nov 2026 10:36:59 GMT

minimal: Ship `minzoned` in a signed macOS app bundle with the app icon, and ship a signed, notarized `bep` binary beside `minvmd` on macOS. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-3c2b2a73

Thu, 05 Nov 2026 05:13:01 GMT

minimal: Control the client-key registry limit in `bep serve` with `--max-client-keys`. • Bundle the telemetry spool and redacted telemetry settings in `min bug` reports. • Sign in to GitHub through the published App and manage credentials with `min login`; logout deletes the sign-in and refuses every reference to it. • Ship a git credential helper inside grant boxes so agents can reach GitHub without a manually pasted PAT. • Block UDP port 443 for boxes whose QUIC stance is blocked, enforced both at the host and from a blocked cohort's own leaves. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-46d9e530

Thu, 05 Nov 2026 02:20:45 GMT

minimal: Introduces the new `bep` crate shipping the GitHub module and sealed-envelope proxy, with `bep serve` as the runtime entry point for egress control in the Box • Issue leaf certificates under a name-constrained root and signing CA; rotate the signing CA under an unchanged root, including rotation through the control socket. • Report non-Rust dependency pins and bump the `locked_commit` for packages in `scripts`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-f6fcbab7

Tue, 03 Nov 2026 10:35:23 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-2d06816e

Mon, 02 Nov 2026 10:35:58 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-e0fb6403

Sat, 31 Oct 2026 19:29:42 GMT

minimal: minimald now ships a git credential helper inside grant boxes so agents can reach GitHub without a manual PAT, delivers each GitHub grant's sealed value into its Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-79c50305

Sat, 31 Oct 2026 10:31:12 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-0be7561f

Fri, 30 Oct 2026 10:34:38 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-de32bd3d

Thu, 29 Oct 2026 10:42:44 GMT

Breaking changes: • `min login` now replaces the previous GitHub sign-in cert surfaces; retired cert surfaces are removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-fad7c721

Tue, 27 Oct 2026 10:50:47 GMT

minimal: Refuse Minimal's own infrastructure domains in the box CA and store rules. • Record a revocation when a live box is destroyed, and check minted box IDs against retained revocations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-5a93a07a

Mon, 26 Oct 2026 10:50:44 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-dd753658

Sun, 25 Oct 2026 10:39:01 GMT

minimal: Adds the `bep` crate with a GitHub module that signs in to GitHub under a published App with credentials kept in the host keychain, plus sealed envelope support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-608ab9c9

Fri, 23 Oct 2026 10:46:24 GMT

minimal adds a bound-proxy layer (bep), per-request OpenTelemetry tracing, audit trails, and GitHub keychain sign-in across the CLI and daemon⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-5378e56c

Thu, 22 Oct 2026 10:40:34 GMT

minimal adds opt-in OpenTelemetry tracing across the CLI, daemon, and VM host, plus a new `bep` proxy subsystem with certificate issuance, audit chaining, and egress enforcem⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds the `bep` crate for proxied access control, including a GitHub module and sealed-envelope support, storing and publishing proxy key identities from the host keychain, hash-chained audit records for every proxy decision, leaf certificate issuance under a name-constrained root and signing CA, wiring redemption decisions and each box's declared egress into `bep serve`, refusing undeclared egress, host mismatches, off-port, off-set authorities, and expired values, and accepting only box connections while terminating TLS for module hosts over HTTP/1.1. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-248b259c

Wed, 21 Oct 2026 10:42:55 GMT

minimal adds opt-in OpenTelemetry tracing, a new BEP proxy layer with certificate issuance, and a `min box audit` command for reading a box's audit trail⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-d67d78ee

Mon, 19 Oct 2026 11:03:02 GMT

minimal adds opt-in OpenTelemetry tracing across the CLI, daemon, and VM host, plus a signed macOS app bundle for minzoned⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • minimal now exports OpenTelemetry spans from `mlog` with opt-in switches and a local spool, grounded in `DO_NOT_TRACK` opt-out support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • minimal now traces each request end-to-end with one trace per request across both `min` and `minimald`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-6c6c39ae

Fri, 16 Oct 2026 10:39:02 GMT

minimal adds opt-in OpenTelemetry export, `min diag upload`, `min finalize-install`, and staged-version installs via `--version`⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Install a specific staged version of minimal with `--version` on the installer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Upload diagnostic bundles directly to the portal for analysis with `min diag upload`. • Replace `min net setup` with `min finalize-install` for host DNS and network setup; `--show --script` replaces `--print`. • Warn within a minute when the switch datapath is lost. • End a task run's box daemon-side. • Give an absent egress destination list no network reach once layers merge. Breaking changes: • The `[harness]` table in `minimal.toml` no longer loads a stack and now fails to load; rename it to `[stack]`. • `--token` is removed from `min bug`, `min diag collect`, and `min diag upload`; passing it is now a parse error. The `Status:` line is no longer printed after an upload. • `min net setup` is removed with no alias; run `min finalize-install` instead (`--show --script` replaces `--print`). • The own-ip deny-all egress default is now enforced for sessions and `minvmd`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-a3f2fa97

Thu, 15 Oct 2026 10:46:58 GMT

minimal: Collect and redact telemetry spool in `min bug` reports as part of the OpenTelemetry tracing integration. Breaking changes: • `min net setup` is removed with no alias; use `min finalize-install` instead (`--show` and `--script` replace `--print`). • `--token` is removed from `min bug`, `min diag collect`, and `min diag upload`; passing it is now a parse error. The `Status:` line is no longer printed after an upload. • A `minimal.toml` that spells the stack table `[harness]` now fails to load; rename the table to `[stack]`. • The own-ip deny-all egress default is now enforced in sessions and `minvmd`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal v0.7.0

Thu, 15 Oct 2026 03:23:35 GMT

minimal adds per-session network isolation with egress rules, named addresses, port publishing, a root-setup command, multi-VM support, and CLI bug reporting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds session network control: `min session activate --network ` sets the network mode (`host_ip` shares the host network, `own_ip` gives the session its own IP, `none` removes all network access), `--allow-dns-hosts `, `--allow-subnets `, `--deny-subnets `, `--allow-protocols `, and `--deny-all-egress` flags restrict what an `own_ip` session can reach, and `min session policy ` (also shown in the detail pane of `min dash`) inspects the effective network policy for a running session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds session port management: `--ingress :` publishes ports when a session starts, `--dynamic-ingress ` and `--dynamic-range ` control runtime port requests, `min net expose ` requests a port from inside a session, and `min net forward :` forwards a session port to localhost from outside. • Every session gets a `.min.internal` hostname reachable via a local HTTP proxy, and via full DNS resolution after `min finalize-install`. • Collect and upload a diagnostic bundle in one step with `min bug --upload`, which prints a shareable report link and a delete command; upload a previously collected bundle with `min diag upload `, and remove it later with `min diag delete ` (bundles auto-expire after 7 days). • Collect all root-requiring setup into one reviewable `sudo` call with `min finalize-install`; preview what is missing with `--show`, print the exact script with `--show --script`, and undo the installation with `--undo`. • Run multiple named VMs alongside the default with `--vm ` on `min session activate`. Breaking changes: • `[harness]` in `minimal.toml` no longer loads — rename the table to `[stack]`. • `min ssh-forward` is removed — use `min net forward :` instead. • The daemon's HTTPS reverse proxy and client certificates are removed, and `min login` no longer issues a certificate — reach sessions via `.min.internal` or `min net forward`. • Session names must now be valid hostnames (letters, digits, hyphens only; case-insensitive; `host`, `local`, `localhost`, and `minimald` are reserved; names shaped like a session id are refused) — rename non-conforming sessions with `min session rename`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-f5bb38c2

Wed, 14 Oct 2026 10:42:26 GMT

minimal: Deny all egress by default for sessions with no declared egress destination list. Breaking changes: • `min net setup` is removed with no alias; run `min finalize-install` instead (`--show` and `--script` replace `--print`). • A `minimal.toml` that spells the stack table `[harness]` now fails to load; rename it to `[stack]`. • `--token` is removed from `min bug`, `min diag collect`, and `min diag upload`; passing it is now a parse error. The `Status:` line is no longer printed after an upload. • Sessions now enforce a deny-all egress default for own-IP traffic once network layers merge. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-1e32c2b0

Mon, 12 Oct 2026 10:46:09 GMT

minimal: Deliver each accepted box connection to the proxy with the box identity attached. Breaking changes: • `[harness]` in `minimal.toml` no longer loads a stack and now fails to load; rename it to `[stack]`. • `--token` is removed from `min bug`, `min diag collect`, and `min diag upload`; passing it is now a parse error. The `Status:` line is no longer printed after an upload. • `min net setup` is removed with no alias; use `min finalize-install` instead (`--show --script` replaces `--print`). • The own-ip deny-all egress default is now enforced for sessions and minvmd. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-5cd498c2

Sun, 11 Oct 2026 18:54:37 GMT

minimal: Make host DNS setup opt-in with a reviewable `min net setup` script and `--undo` support. Breaking changes: • `[harness]` table in `minimal.toml` no longer loads a stack and now fails to load; rename it to `[stack]`. • `--token` is removed from `min bug`, `min diag collect`, and `min diag upload`; passing it is now a parse error. The `Status:` line is no longer printed after an upload. • `min net setup` is removed with no alias; run `min finalize-install` instead. `--show` and `--script` replace `--print`. • Own-ip deny-all egress default is now in force for sessions and minvmd. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-4732e714

Sun, 11 Oct 2026 10:38:27 GMT

Breaking changes: • `[harness]` table in `minimal.toml` no longer loads a stack and now fails to load; rename it to `[stack]`. • `--token` is removed from `min bug`, `min diag collect`, and `min diag upload`; passing it is now a parse error. The `Status:` line is no longer printed after an upload. • `min net setup` is removed with no alias; use `min finalize-install` instead (`--show` and `--script` replace the former `--print` flag). • Own-ip deny-all egress default is now enforced for sessions and minvmd. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-f90c2617

Sat, 10 Oct 2026 10:38:28 GMT

minimal: Add the macOS app icon built from the minimal mark. Breaking changes: • `minimal.toml` files using `[harness]` to name the stack table no longer load a stack; rename the table to `[stack]`. • `--token` is removed from `min bug`, `min diag collect`, and `min diag upload`; passing it is now a parse error. The `Status:` line is no longer printed after an upload. • `min net setup` is removed with no alias; use `min finalize-install` instead (`--show` and `--script` replace `--print`). • Sessions and minvmd now enforce a deny-all egress default for the own-IP by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-ea1b0154

Fri, 09 Oct 2026 14:45:07 GMT

minimal: Bind declared ports before name resolution and refuse unpublished ports at startup in `minimald`. Breaking changes: • The `[harness]` table in `minimal.toml` no longer loads a stack; rename it to `[stack]` or the file will not load. • The own-ip deny-all egress default is now enforced in sessions and `minvmd`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal

minimal release-5ec43856

Fri, 09 Oct 2026 10:40:05 GMT

Breaking changes: • The `[harness]` table in `minimal.toml` no longer loads a stack and will be refused if a task has two actions — rename it to `[stack]`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/minimal