Eve
Sourced signals for Eve: release changes, governance moves, runtime shifts, and operator consequences. Each links to the run that produced it. The Eve profile carries the current evergreen state.
October 2026
-
Eve approvals stop lending the approver's credentials to the requester
- Deployments admitting other approval responders or anonymous requesters with user-scoped connections: upgrade to 0.79.0; the credential repair first ships in 0.78.0. Inspect approval.settled events where responderPrincipalId differs from the requester, then audit effects under the approver's credentials, including later turn calls on 0.70.0 through 0.71.2.
- Rework flows that intentionally borrowed an IT or release approver's access. They stop working under consent-only execution; the proposed explicit credential-delegation API was unmerged at the 2026-10-13 cutoff. The human keeps responsibility for consent while tool policy owns execution authority.
- A requester lacking access must still be denied after an authorized second person approves. Record that test with both identities and the dispatched credential owner; it would establish the deployed boundary. The pre-0.70.0 affected range is unverified, and this fix does not close the separately signaled queued-text path.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
-
A queued reply can approve a later Eve prompt; the repair was on main at cutoff
- Chat-approval owners: keep consequential effects off this affected typed-reply path until a containing release passes the exact sequence. A held turn and requester-owned credentials do not establish that the person saw the request they appeared to approve.
- Watch for a tag containing 0dea0ded869be7db30ae90ed8072d29e6e57df61. Queue approve before the prompt, verify no settlement or tool execution, then send a new answer after the prompt and verify the intended effect. Record delivery, hold and settlement order; main alone is not delivery.
- Retaining an application gate costs review attention now. Remove it only after the installed release passes the timing test; the patch does not establish closure of every default-steer timing case.
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
September 2026
-
Queued messages from different users ran under the last sender's authorization
- If you set turnPolicy queue on a multi-user channel, run eve@0.52.5 or later; before it, one user's message could run with another's authority.
- Rotate any BYOK provider key served by an eve deployment older than 0.52.5.
- Evidence that would settle residual: the first version that exposed the BYOK key, which the release notes do not state.
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
August 2026
-
turnPolicy queue did not bind from 0.34.0 through 0.39.2
- If you set queue after 0.33.0, 0.39.3 is the first tag that actually queues. Re-test Slack and custom channels. Pin eve@0.42.0; do not take unpinned npm.
- A documented control that does not bind is the same class as a classifier in the tag and off: the setting is present, the default path ignores it. Evidence that would settle residual: a runtime dump from 0.39.3 showing compiled channel.turnPolicy equal to the configured queue value.
July 2026
-
The governance-first platform had four human gates that did not bind
- Platform-hosted governance is not a substitute for testing the gate. If you chose a managed runtime specifically for its approval and budget controls, verify each one behaves as documented on the version you run, including what a denial actually does.
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0