Sekisho

Codename: Sekisho (関所)

SEKISHO

Sekisho (関所) were the checkpoint stations of Edo-period Japan, where travelers, documents, and goods were inspected before being allowed to pass. LunarWing v2.0.8.0 posts checkpoints over its own borders: signed marketplace trust gates and revocation enforcement for MCP packages, hard cgroup boundaries between tenants, health-gated sidecars, and fail-closed activation paths that stop suspect cargo at the barrier.

LunarWing v2.0.8.0 is a multi-tenant hardening, MCP marketplace-security, and agent-resilience release. It brings hard cgroup v2 resource ceilings to OpenRC tenant hosts, wires the MCP part 2 trust stack into real activation paths, streams SSE through the bundled MCP gateway, makes every agent termination path tell the model what would unlock each call, adds opt-in cross-tenant knowledge sharing, and ships a proper prometheus health endpoint metrics exporter with an early warning threshold layer.

Highlights

  • OpenRC/Gentoo tenants now get hard cgroup v2 memory/CPU/task ceilings,
    closing the gap where only systemd had hard enforcement. A new
    mt-admin setup-cgroups command automates the pre-delegated subtree and
    PAM hook design; tenant builds run bounded on every OpenRC host, with a
    loud fallback reason when delegation is denied.
  • The MCP marketplace trust stack is enforced, not just library code: ed25519 publisher signatures, signed dependency lockfiles, and signed revocation lists are checked fail-closed on config load and startup activation. The bundled gateway control plane can actually be enabled, and the gateway data plane now streams SSE properly with separate permit pools so notifications can’t starve tool calls.
  • Agent failures now come with next steps: recoverable provider failures get one bounded recovery turn, denied approvals resume the loop with per-call results, and disabled/not-found/auth-required/rate-limited errors all state what unlocks the call.
  • “Always allow” finally sticks: Engine V2 persists tool-level grants even when the approved invocation fails (ssh excepted), so flaky tools like the GitLab WASM tool stop re-prompting on every call.
  • Missions gain a configurable daily thread budget with remaining-budget visibility, loud exhaustion logs, and trigger-level deduplication — daemon restarts and listener re-deliveries are now zero-cost skips instead of re-firing stale missions. And SKILL_SELF_IMPROVEMENT=0 really means disabled now.
  • Fixed WeeChat outbound integrity: multi-line tool results no longer lose everything after the first newline, and lines starting with / are escaped instead of executing as commands in the operator’s client.
  • Fixed XMPP image attachments: the send endpoint’s hidden 2 MiB body limit was rejecting ordinary photos with HTTP 413. The limit is now an explicit 70 MiB scoped to the send route, with authorization checked before any body is buffered.
  • New healthpoint metrics exporter: the host health pipeline emits a Prometheus textfile exposition after every check, with per-check durations, graduated warn/crit early-warning thresholds, deduplicated Gotify notifications, and an optional loopback-only HTTP listener.
  • Opt-in cross-tenant knowledge sharing: KNOW: room records propagate one
    durable finding into every watching tenant’s shared study-notes scope as needs-verification, behind publisher allowlists and ingest budgets.
  • The built-in study-notes layer reaches full seven-tool parity with the restarts and listener re-deliveries are now zero-cost skips instead of
    re-firing stale missions. And SKILL_SELF_IMPROVEMENT=0 really means
    disabled now.
  • You can now watch tool calls land over XMPP, WeeChat, and DarkIRC — the
    global tool_activity flag routes tool status events to WASM channels
    instead of only delivering the final answer.
  • External workers bumped: opencode v1.18.18 and Kimi Code 0.37.2, both
    pinned into their images and visible on /health.

Upgrading

No new SQL migrations; the port registry migrates v15 → v16 automatically to allocate the host-global health_metrics slot. OpenRC/Gentoo multi-tenant hosts should run setup-cgroups once, then re-render tenants. Marketplace trust enforcement and cross-tenant knowledge sharing are both opt-in — populate the new marketplace section in mcp-servers.json for the former,
set COORD_KNOWLEDGE_PUBLISH=1 per tenant for the latter. Rebuild both
external-worker images, and note the rebuilt Kimi image now defaults to the
LunarWing TensorZero gateway as its provider, so provision
TENSORZERO_API_KEY (or KIMI_API_KEY) if your gateway requires a token. If
you previously set SKILL_SELF_IMPROVEMENT=0, be aware it now also pauses
the skill-extraction and skill-maintenance missions — re-enabling resumes
exactly those, and your own pauses stay paused.

The pinned Rust toolchain remains 1.96.1.

For full release notes, check the repository as always.