docs(changelog): runner GA hardening — fail-closed egress, secret redaction, SSRF pin

[indykish]

Changelog <Update> for the M100 runner general-availability hardening (agentsfleet repo, branch feat/m100-runner-ga-hardening).

Leads with the operator-facing behavior change under Upgrading: egress now fails closed by default — an unset RUNNER_NETWORK_POLICY no longer shares the host network (set allow_all explicitly for the interim open posture). Then the secret-redaction (incl. cross-chunk), Server-Side Request Forgery (SSRF) tenant-pin, bounded-reliability, and real-kernel enforcement-proof changes.

Pairs with the code PR in the agentsfleet repo.

🤖 Generated with Claude Code

Greptile Summary

This PR adds a changelog entry for the M100 runner general-availability hardening, covering the breaking egress-policy change and four security/reliability improvements. The new <Update> block is correctly placed at the top of the file and follows the existing MDX structure and Mintlify conventions.

• Fail-closed egress (breaking) — documents that RUNNER_NETWORK_POLICY unset now denies network access by default, with an explicit allow_all upgrade path; the Upgrading section communicates this prominently.
• Secret redaction, SSRF pin, bounded retries, kernel proof — four companion items in the What's new section accurately describe the security hardening changes paired in the implementation PR.

Confidence Score: 5/5

Documentation-only change that adds a new changelog entry; no executable code or configuration is modified.

The change is a single <Update> block inserted at the top of the MDX changelog. The MDX structure is valid, the new entry follows the same conventions as surrounding entries, the breaking-change upgrade path is clearly documented, and two entries sharing the same Jun 25, 2026 date is intentional and benign. No regressions are possible in a docs-only PR of this scope.

No files require special attention.

Important Files Changed

Filename	Overview
changelog.mdx	Adds a new <Update> block documenting the M100 runner GA-hardening security changes, including fail-closed egress, cross-chunk secret redaction, SSRF protection, bounded retries, and proven kernel enforcement; content is well-structured and follows existing changelog conventions.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Runner starts] --> B{RUNNER_NETWORK_POLICY set?}
    B -- "unset / unrecognized" --> C[Fail closed: no egress]
    B -- "allow_all" --> D[Egress permitted]

    A --> E[Progress frame emitted]
    E --> F{Secret value in frame?}
    F -- "no" --> G[Send frame]
    F -- "yes / split across chunks" --> H{Redaction successful?}
    H -- "yes" --> I[Replace with placeholder & send]
    H -- "no / memory failure" --> J[Drop frame — never sent raw]

    A --> K[Tool dials tenant-configured host]
    K --> L[Resolve address]
    L --> M{Private / loopback / link-local?}
    M -- "yes (incl. cloud metadata)" --> N[Reject before connection]
    M -- "no" --> O[Connect]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Runner starts] --> B{RUNNER_NETWORK_POLICY set?}
    B -- "unset / unrecognized" --> C[Fail closed: no egress]
    B -- "allow_all" --> D[Egress permitted]

    A --> E[Progress frame emitted]
    E --> F{Secret value in frame?}
    F -- "no" --> G[Send frame]
    F -- "yes / split across chunks" --> H{Redaction successful?}
    H -- "yes" --> I[Replace with placeholder & send]
    H -- "no / memory failure" --> J[Drop frame — never sent raw]

    A --> K[Tool dials tenant-configured host]
    K --> L[Resolve address]
    L --> M{Private / loopback / link-local?}
    M -- "yes (incl. cloud metadata)" --> N[Reject before connection]
    M -- "no" --> O[Connect]

Loading

_{Reviews (2): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
agentsfleet	🟢 Ready	View Preview	Jun 25, 2026, 8:33 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.