Assistant v0.6.7 — from denylist to fail-closed allowlist

If you’ve ever shipped an agent to someone else’s machine, you know the moment: the deployment needs fewer tools than the demo, and the config format you reach for is a denylist. “Disable the shell, disable the browser, disable…” — and now your config has to stay correct forever, against a growing set of tools you didn’t write.

v0.6.7 throws the denylist away. Native tools are now an allowlist with a hard ceiling: tools.native.mode: all | selected | none.

The three modes

tools:
  native:
    mode: selected            # all | selected | none
    enabled:
      - memory.*              # case-sensitive exact and glob patterns
      - files.search
      - web.fetch

• all — the default posture for a local, trusted install
• selected — only what you list; everything else is invisible, not just blocked
• none — no shipped native tools at all, including the runner’s meta-tools (your own per-tool TOOL.md definitions and MCP servers stay independent — the policy governs what we ship, not what you bring)

That last clause is the important one. A denylist with a hole lets a tool survive by accident. An allowlist with none has nothing to survive with.

The part that makes it real

Policy that isn’t enforced everywhere is policy you’ll eventually bypass. v0.6.7 enforces the same allowlist across registry creation, live refresh, ranked persisted search, lazy loading, direct execution, and prompt guidance — meaning a trimmed tool doesn’t exist in the model’s tool list, can’t be discovered by search, and can’t be invoked by name. Six enforcement points, one policy.

And the precedence rules are the ones operators actually need:

• process environment > .env > YAML — a deployment can override an image’s defaults without editing files
• invalid native-policy configuration fails closed — a typo in your glob doesn’t mean “allow everything by default,” it means the deployment refuses to run with the policy you didn’t specify

Why this is the release that matters

v0.6.3 made governance terminal. v0.6.6 made telemetry isolated and content-free. v0.6.7 makes the surface itself the deployment’s choice — which is what “runs on the machine that owns the data” has to mean in practice: not just where the agent runs, but exactly how much of it runs. Full suite: 2,897 passed, 26 skipped.

The stack: CoreMem for memory, HybridDB for storage, ConnectKit for connectors, ModelPanel for models — and the assistant product page if you want to see it running in one container.