Clavenar Lite status

Current release, proof commands, and deploy readiness.

The page operators check before pointing an agent at the single-binary OSS proxy. It separates the latest tagged release from what is already documented on main, then gives the install, verify, smoke, and rollout checks in one place.

Docs verified for site v1.245.7 Release facts checked July 27, 2026 GitHub releases CHANGELOG.md

Latest tagged release

clavenar-lite v0.12.1

Released July 27, 2026. This cut adds the explicit fail-closed hosted profile, durable storage requirements, bounded upstream I/O, and the MCP JSON-RPC adapter.

Image: ghcr.io/clavenar/clavenar-lite:0.12.1
Binary: clavenar-lite-0.12.1-x86_64-linux-musl.tar.gz
License: Apache-2.0
Smoke: 20 HTTP checks

1 · Release pulse

Install the exact protected tag.

Pinned deploys make evaluation handoffs reproducible. The protected publisher does not publish a mutable :latest tag.

Container

Pull or run the published multi-arch image.

# Pull the pinned release image
docker pull ghcr.io/clavenar/clavenar-lite:0.12.1

# Start in observe mode for first traffic
docker run --rm -p 8088:8088 \
  -e CLAVENAR_LITE_MODE=observe \
  -e CLAVENAR_LITE_UPSTREAM_URL=https://mcp.your-company.com/rpc \
  ghcr.io/clavenar/clavenar-lite:0.12.1

Static binary

Fetch the release asset when Docker is not available.

# Download and run the linux x86_64 musl asset
VERSION=0.12.1
curl -fsSLO "https://github.com/clavenar/clavenar-lite/releases/download/v${VERSION}/clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz"
curl -fsSLO "https://github.com/clavenar/clavenar-lite/releases/download/v${VERSION}/clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz.sha256"
sha256sum -c "clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz.sha256"
tar xzf "clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz"
./clavenar-lite --help

v0.12.1 release notes → All releases →

2 · Verify this release

Check the binary, image, and day-1 surface before traffic.

These checks are deliberately copyable. They prove the asset checksum, the image manifest, the runtime version, and the operator smoke path.

Binary checksum

VERSION=0.12.1
curl -fsSLO "https://github.com/clavenar/clavenar-lite/releases/download/v${VERSION}/clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz"
curl -fsSLO "https://github.com/clavenar/clavenar-lite/releases/download/v${VERSION}/clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz.sha256"
sha256sum -c "clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz.sha256"
tar xzf "clavenar-lite-${VERSION}-x86_64-linux-musl.tar.gz"
./clavenar-lite --help

Image manifest

VERSION=0.12.1
docker buildx imagetools inspect ghcr.io/clavenar/clavenar-lite:${VERSION}
docker manifest inspect ghcr.io/clavenar/clavenar-lite:${VERSION}

Operator smoke

git clone https://github.com/clavenar/clavenar-lite.git
cd clavenar-lite
git checkout v0.12.1
scripts/smoke-e2e.sh

3 · v0.12.1 · what shipped

Fail-closed hosted operation for a running proxy.

The release makes durable storage, separate authority, bounded traffic, and protocol-compatible upstream behavior explicit startup requirements.

Area	What changed	Operator impact	Upgrade risk
Ledger reads	SQLite WAL plus `busy_timeout=5000` on ledger open.	`clavenar-lite audit` can read while the proxy is writing.	Low. `:memory:` falls back to memory-mode journaling.
Triage queue	`pending list` sort controls and TTY color.	Parked work defaults oldest-first; history views default newest-first.	Low. Plain text stays plain under pipes or `NO_COLOR`.
Smoke gate	`scripts/smoke-e2e.sh` exercises 20 live HTTP checks.	Operators can prove allow, deny, park, decide, token gating, and audit concurrency.	Low. The script cleans up its dedicated Docker network on exit.

4 · Release lineage through v0.12.1

The cumulative public capability path.

The current tag includes the earlier operational slices and the hosted-profile boundary.

Changelog section	Capability	What to watch before upgrading
`0.5.0`	Multi-agent registry, online backup, atomic restore, async-HIL callback allowlist.	Token uniqueness, DNS-validated and address-pinned callback target boundaries, backup destination overwrite behavior.
`0.6.0`	Outbound verdict webhook for SIEM, Datadog HTTP ingest, and generic webhook receivers.	Receiver timeout behavior, event-name stability, and observability volume in observe mode.
`0.12.1`	Exact external-install documentation bound to an immutable source tag, static asset set, and multi-architecture image tag.	Use the 0.12.1 archive, checksum, or image tag below; the runtime behavior is unchanged from 0.12.0.
`0.12.0`	Explicit fail-closed hosted profile, durable Fly volume, bounded per-agent rates and upstream I/O, and a compatible MCP JSON-RPC adapter.	Hosted startup now refuses anonymous or overlapping auth, observe mode, ephemeral SQLite, scale-to-zero templates, placeholder/non-HTTPS upstreams, and the legacy raw-JSON adapter.

5 · Deployment readiness

The checklist before a Lite proxy fronts a real agent.

The automated smoke proves the HTTP surface. This checklist covers the operational choices that make the result repeatable after the first boot.

Pin the image or binary

Use exact 0.12.1 release assets or the protected image digest. Do not substitute a mutable tag.

Select the hosted profile

Set CLAVENAR_LITE_DEPLOYMENT_PROFILE=hosted. Keep enforce mode and the mcp-jsonrpc-v1 adapter selected.

Separate both auth planes

Configure distinct agent and operator credentials of at least 32 bytes. Anonymous access, ambiguous registries, and overlapping tokens are refused.

Bound traffic and upstream I/O

Set per-agent QPS and burst limits. The compatible adapter caps requests and responses at 1 MiB, enforces a 30-second maximum, matches JSON-RPC response IDs, and never retries effects.

Persist the ledger

Mount /data, use an absolute file-backed SQLite path beneath it, keep at least one machine running, and verify pending decisions and the hash chain after restart.

Archive release evidence

Save release notes, the checksum file, the image digest, and SBOM/license assets with the deployment evidence.

6 · Known operational notes

Small details that change how a rollout behaves.

These are not blockers, but they are the items that commonly explain day-1 surprises.

Topic	Current behavior	Operator action
Naming	Current assets, binary, and image consistently use `clavenar-lite`.	Use the exact v0.12.1 names and checksum shown above.
Docker vs binary	The image is multi-arch. The static asset is linux x86_64 musl.	Use Docker for arm64 hosts unless a matching static asset is published.
SQLite WAL	File-backed ledgers permit concurrent audit reads; memory ledgers use memory-mode journaling.	Persist the ledger path before real traffic and verify the chain after restart.
Decide endpoint	Operator decisions are gated by `CLAVENAR_LITE_DECIDE_TOKEN` when configured.	Keep the decide token distinct from the agent bearer token.
Hosted template	The explicit hosted profile validates auth, enforce posture, bounded rates, durable storage, HTTPS upstream, adapter compatibility, and timeout before binding.	Do not replace the checked-in Fly bounds with local developer defaults. A placeholder upstream intentionally prevents readiness until configured.
Slack webhook	Park alerts are fire-and-forget; failures log warnings and never block the agent's `202`.	Monitor webhook delivery separately; the ledger remains the durable source of truth.

7 · Next