Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Evidence record / unreal-agent

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.

2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-is

v0.3.1 moves installs to an unsigned Homebrew cask that strips macOS quarantine; v0.3.0 is a tag with no release or image. GoReleaser v2.18.2 now builds and publishes everything in one job (release.yml L46-L53 at v0.3.1). Archives are renamed unreal-agent_<ver>_<os>_<arch>.tar.gz and contain both binaries. The new cask unreallabsai/tap/unreal-agent installs the runner and the TUI and aliases the TUI as unreal-agent and uat. On macOS it runs a postflight step, xattr -dr com.apple.quarantine, which the config explains as clearing quarantine “only for this unsigned package” (.goreleaser.yaml L67 and L73). The release configuration describes the package as unsigned, and the cask removes the macOS quarantine attribute; the per-archive sha256 pins are the integrity check. No installed-binary signing, notarization or Gatekeeper behavior was tested. The Docker image keeps the unrea1labs/unreal-agent name (L43). It holds only the runner (Dockerfile.release copies unreal-agent-runner) and is tagged v0.3.1 and latest. v0.3.0 has a tag and a Go proxy entry, but no release object and no image. No release body describes the v0.3.0 work. One correction belongs here: the profile said the look-alike unreallabs namespace “was unclaimed on 23 September”. The registry shows unreallabs has been a Docker Hub user account since 2026-07-21, with an empty profile and no public repositories; what returns 404 is the repository unreallabs/unreal-agent. The vendor’s own organization, unrea1labs, was created on 2026-09-22.

Channel: tagged-release. Half: both. Date: 2026-10-06.

Operator consequence: Install with brew install unreallabsai/tap/unreal-agent, which pins 0.3.1 by sha256, or download the archive and check SHA256SUMS yourself. On macOS, the cask removes the quarantine attribute from the package described as unsigned, so review your trust in the tap repository (pushed by the release job’s deploy key) and the GitHub release. If your fleet requires notarized or allowlisted binaries, use the archive and your own signing. Scripts that fetch unreal-agent-runner_<ver>_* break at 0.3.1. Pin the image by digest. For archives or Docker, use v0.3.1: v0.3.0 is a Go tag without a GitHub release or image. Read the compare, not the release body, to learn what changed. The look-alike name is held by an account that nothing on the record ties to the vendor, and that account could publish unreallabs/unreal-agent at any time. Copy the image name from the README, or use the cask and avoid the image name altogether.

Receipt

Finding metadata

Confidence
high

Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0

Finding ID: 2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-is

Profile citations

Source links

Primary links, including exact changelog lines when available.

  1. Unreal Agent
    tagged commit file2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isunreallabsai/unreal-agent / .goreleaser.yaml#L28-L87tagged commit file2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isunreallabsai/homebrew-tap / Casks/unreal-agent.rbofficial docs2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isgithub.com/unreallabsai/unreal-agent/actions/runs/37487295997official docs2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-ishub.docker.com/v2/repositories/unrea1labs/unreal-agent/tagsofficial docs2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-ishub.docker.com/v2/users/unreallabs/github release2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isunreallabsai/unreal-agent / v0.3.1official docs2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isproxy.golang.org/github.com/unreallabsai/unreal-agent/@latesttagged commit file2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isunreallabsai/unreal-agent / Dockerfile.releasetagged commit file2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isunreallabsai/unreal-agent / cmd/unreal-agent-runner/README.mdgit compare2026-10-13-unreal-agent-v0-3-1-moves-installs-to-an-unsigned-homebrew-cask-that-strips-macos-quarantine-v0-3-0-isgithub.com/unreallabsai/unreal-agent/compare/v0.3.1...a5f3fd13032737142916523ae4344c392292f9d5

Versioned source: run artifact