Release 0.4.8

Permission-posture fast-follow: launch posture is configurable, the deny set is clobber-resistant, and dangerous ops are bounded by an honest prefix-gate.

Launch posture: the hardcoded `--permission-mode acceptEdits` launch
flag is replaced by a configurable posture defaulting to `dontAsk`. This
kills the ask-hang / freeze class that could park an autonomous seat on
a modal permission prompt with nobody to click through it. `dontAsk` is
the default because it matches what an autonomous seat can actually
respond to; `acceptEdits` remains selectable when a seat needs the
prior behavior; a deliberate `bypassPermissions` is preserved untouched
across writes.

Clobber-resistant deny set: the posture writes to user-level
`~/.claude/settings.json` instead of the project-local one-off approval
surface, so deny wins over project-local approvals. Writes are additive
(never destructive to sibling keys) and forward-migrate a legacy
`acceptEdits` value into the new schema. A deliberate
`bypassPermissions` value is preserved verbatim.

Bounded-dangerous deny set: `git push`, `gh pr create`, `npm publish`,
and `rig down` are the four bounded-dangerous ops gated by default.
`rig down` in particular is gated via the prefix superset
`Bash(rig down:*)` — harness rules at Claude 2.1.220 are prefix-only
(flag-only patterns provably fail to gate target-first forms such as
`rig down <rig> --force`, which were slipping through), so the prefix
gate is the only shape that actually holds. Plain `rig down` is gated
in 0.4.8; selective allowance (e.g. `rig down <rig>` for a specific
target) is deferred to 0.5.0 server-side enforcement.

`rig up` un-gated: the prior release's ask-gate on `rig up` is
superseded — `rig up` is a reversible op and does not warrant an
interactive gate.

DEPLOYMENT INVARIANT (documented): for the posture writes to reach
seats, the daemon's HOME must equal the seat's tmux HOME. This is a
2.1.220 settings-path class invariant that operators need to know for
the remote-host leg of any upgrade.

Formal CHANGELOG entries for 0.4.7 and 0.4.8 plus
`docs/releases/v0.4.7.md` + `docs/releases/v0.4.8.md` follow as a
combined post-cut docs pass.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "openrig",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "openrig",
-      "version": "0.4.7",
+      "version": "0.4.8",
       "license": "Apache-2.0",
       "workspaces": [
         "packages/daemon",
@@ -7449,7 +7449,7 @@
     },
     "packages/cli": {
       "name": "@openrig/cli",
-      "version": "0.4.7",
+      "version": "0.4.8",
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -7481,7 +7481,7 @@
     },
     "packages/daemon": {
       "name": "@openrig/daemon",
-      "version": "0.4.7",
+      "version": "0.4.8",
       "license": "Apache-2.0",
       "dependencies": {
         "@hono/node-server": "^1.13.0",
@@ -7506,7 +7506,7 @@
     },
     "packages/ui": {
       "name": "@openrig/ui",
-      "version": "0.4.7",
+      "version": "0.4.8",
       "license": "Apache-2.0",
       "dependencies": {
         "@fontsource-variable/jetbrains-mono": "^5.2.8",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "openrig",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/cli",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "type": "module",
   "description": "Local control plane for multi-agent coding topologies",
   "keywords": [

packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/daemon",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/ui",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",