This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
ReleasePort's take
Moderate signalThe push gate now binds to the task's declared branch, preventing misuse. Delegated-push grants are limited to BUILDER-SCOPED scope.
Why it matters: Fixes a bug (severity 70) that could allow unauthorized pushes and enforces BUILDER‑SCOPED limits (severity 80), reducing privilege escalation risk for all agents using push permissions.
Summary
AI summaryDelegated‑push grants are now builder‑scoped and a cleared ship gate binds to the task's declared branch.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Prevent agents from pushing unrelated branches using cleared gates. Prevent agents from pushing unrelated branches using cleared gates. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
| Breaking | High |
Changes delegated-push grant to be BUILDER-SCOPED, limiting push permissions. Changes delegated-push grant to be BUILDER-SCOPED, limiting push permissions. Source: llm_adapter@2026-07-19 Confidence: high |
— |
| Bugfix | High |
Fixes push gate to bind to task's declared branch, preventing misuse. Fixes push gate to bind to task's declared branch, preventing misuse. Source: llm_adapter@2026-07-19 Confidence: low |
— |
| Bugfix | Medium |
Cleared ship gate now binds to the task's declared branch. Cleared ship gate now binds to the task's declared branch. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
Full changelog
Finish the delegated-push rollout's last mile (DIVE-1462 / STEER-4):
- fix(push): a cleared ship gate now binds to the task's OWN declared branch —
_push_do+ the5dive pushpre-flight refuse any branch that isn't the one the cited task declares (Branch: <name>in its body). Closes the hole where a granted agent could reuse one cleared gate to push an unrelated feature branch. - change(agent create): delegated-push grant is now BUILDER-SCOPED. New
agent create --can-pushgrants a standard (builder) agent the exact-path_push_doNOPASSWD line; plain standard agents (QA/art) get only a2a/audit. Admin already has it; refused for sandboxed. Supersedes 0.10.6's all-standard grant.
push_unit 33/33; test-vm.sh smoke green (builder-push-grant row on real sudo-rs).
Breaking Changes
- Removed the all‑standard push grant introduced in 0.10.6; `agent create --can-push` now creates a BUILDER‑SCOPED agent with `_push_do` NOPASSWD.
- Cleared ship gate now enforces that the pushed branch matches the task's declared `Branch:` field; any mismatch is rejected by both `_push_do` and the `5dive push` pre‑flight.
Security Fixes
- Fix: cleared ship gate no longer allows a granted agent to reuse it for pushing unrelated feature branches, closing an abuse vector (DIVE-1462 / STEER-4).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About 5dive
All releases →Related context
Related tools
Earlier breaking changes
- v0.11.22 council amend now requires constitutional-class motion for constitution changes
- v0.11.9 CLI now only OFFERS a veto to the genesis principal; EXERCISE requires authenticated tap.
- v0.11.5 Raw bench add/rm of the primary council is refused.
- v0.11.5 `council init` now requires sudo and seeds the primary council bench.
Beta — feedback welcome: [email protected]