Changelog
Two streams. They version independently.
The agent binary and the action library ship on separate channels, because a fix to a remediation should not require a fleet-wide agent update, and an agent update should not silently change what actions exist.
playbook-bundle 2026.07.3
2026-07-28
Playbook actions
- addedkoop.smb.credential.refresh — Tier 0, reversible. Re-establishes a mapped drive against the stored credential and refreshes the Kerberos ticket.
- changedkoop.disk.logrotate risk tier raised from 0 to 1. Truncation is not reversible and the tier now says so.
- fixedkoop.printspool.restart no longer reports success when the spooler restarts into a stopped state. This produced four false resolutions in the sandbox fleet and would have produced them on customer machines.
agent 1.8.2
2026-07-24
Agent binary
- fixedmacOS: privilege token was held for the duration of a multi-step action rather than per step. Now escalates and drops per step, as documented. Anyone running 1.8.0 or 1.8.1 should update.
- changedSignals heartbeat interval is now adaptive: 30s when an incident is open on the device, 5m otherwise. Reduces idle traffic on large fleets by roughly 80%.
platform 2026.07
2026-07-19
Platform
- addedGuardrail simulator now replays 90 days rather than 30 where Ledger retention allows it.
- addedLedger evidence packs: export every autonomous execution in a date range with the authorizing policy version attached.
- changedDevice correlation match rate is now shown during connector setup rather than after the first sync. A 40% match rate is something you need to know before you finish, not in month two.
agent 1.8.0
2026-07-02
Agent binary
- addedLinux: deb and rpm repositories, systemd unit, Ansible role.
- addedHalt now acknowledges over the independent stand-down channel, so it works when orchestration is unavailable. Verified by taking Act fully offline in staging.
- known issueWindows: agent version reported to Fleet lags by one heartbeat after a Updater update. Cosmetic, fixed in 1.8.1.