v5.17.0 - Perpetual Runtime (opt-in)

Agent swarms can now run indefinitely, improve themselves, and fund their own work while humans keep control. A run continues only while an operator-signed policy keeps renewing its lease. Nothing starts automatically; u

Perpetual Runtime (opt-in)

Agent swarms can now run indefinitely, improve themselves, and fund their own work while humans keep control. A run continues only while an operator-signed policy keeps renewing its lease. Nothing starts automatically; unused integration points cost one check.

Three invariants hold whatever the configuration:

• I1: the external stop always works without agent cooperation. An out-of-process LeaseAuthority issues short-lived Ed25519 leases. LeaseGuard halts the run when its lease is revoked, paused, expired, or cannot be renewed (dead-man switch), and EgressProxy refuses all traffic without a live lease.
• I2: agents can modify themselves, never their limits. GuardedPaths makes governance files and blackboard keys writable only with a single-use, operator-signed approval of the exact content.
• I3: self-funding stays inside human-set ceilings. Ceilings live in the signed policy. Agents can lower but never raise them, and payments go only through the egress proxy with per-request and per-run caps.

What's included

• Leases and dead-man switch: LeaseAuthority and LeaseGuard, hooked into AgentRuntime, GovernedModelGateway and LockedBlackboard.
• Egress proxy: credentials are injected per route and scrubbed from responses; financial limits are enforced in the proxy process.
• Guarded paths: operator approvals are signed, single-use, and bound to the exact content.
• Sandbox: ContainerSandboxRunner defaults to gVisor, with a read-only root, no capabilities, and either no network or egress-proxy-only.
• Sentry swarm: read-only detectors for velocity, denied-access probing, prompt injection, blackboard poisoning, guarded-path attempts, canary leaks and goal drift. Each sentry has its own authenticated identity, and a sentryQuorum setting means one compromised sentry cannot stop or steer runs.
• Self-improvement pipeline: static checks, sandbox tests on a copy of the project, multi-model-family consensus, then a signed receipt bound to the patch hash. Tiers are auto, human, and operator (guarded paths always need the operator).
• Self-healing state: HMAC-signed, hash-chained snapshots. A canary failure stops renewal, rolls back to the last verified snapshot, and purges the session.
• Budget balancer: uses only operator-approved sources, picks the cheapest one with headroom, and throttles effort as the budget runs down.
• CLI: network-ai perpetual keygen | sign-policy | authority | proxy | sentry | status | pause | resume | revoke | tighten | install-policy | sign-guarded | sign-budget | snapshot | rollback

Also

• LockedBlackboard.write() / delete() now honour the lease option as well.
• Docs updated across README, ARCHITECTURE, SECURITY, THREAT_MODEL, DATA_LOCATIONS, SUPPLY_CHAIN, ENTERPRISE, AUDIT_LOG_SCHEMA, INTEGRATION_GUIDE, QUICKSTART, CONTRIBUTING and references/.
• 4,180 tests across 43 suites; tsc --noEmit clean.

Limits: the guarantees assume the operator key, role secrets and credentials stay outside the agents' reach, and that agents run sandboxed with network access only through the proxy.

Full details: CHANGELOG