Upgrades

A fix to Warden reaches your accounts as a new signed release. Nothing updates itself: an approver adopts each release with a passkey, the adoption waits, and then the install gate applies it, step by step, after showing you what it changes.

How you learn of a release

• The release index. Every release is signed and listed in the release index at https://wardensec.ai/releases/index.txt, which the installer verifies against the root key it carries. warden releases lists them in your terminal.
• Your console. The Install page, under Version, lists the releases available to your install with each one’s trust delta (any change in who signs releases) and the custody of every key that signed it.
• A flaw in the release you run. The advisory feed is how a running install is told that the release it runs has a known flaw. Version and warden releases list every newer release. A problem you find in Warden itself goes to the address on the security page.

Adopting a release

1. Fetch the release. On the machine you ran setup from, run the install line again: it verifies the new release and installs its warden. Then run warden setup once, which verifies the release and stores it. The installer and setup use a release only 72 hours after it was signed; --now turns that floor off, and nothing else, when you choose to.
2. Adopt it. In the console, under Install and Version, an approver chooses Adopt and signs it with a passkey. The adoption waits 24 hours, or 72 when the release widens who can sign, changes the code that guards Warden (the verifier, the fence writer or Defend’s enclave image), adds anything Warden may do, removes a detection, changes a trust-path file, raises a schema, or cannot be compared with the release you run. It can be vetoed while it waits.
3. Apply it. warden upgrade --plan prints one card per step, with the change in what Warden may do and detects, and applies nothing. warden upgrade then walks the same steps through the install gate, one card and one typed stack name per step, and does nothing before approvers have signed for the release.
4. Watch it settle. The gate watches the console’s health for 30 minutes. If it fails, the gate puts the previous release back by itself and says so to the owner address; if it cannot prove the console healthy or cannot go back, it holds the release and your approvers decide.

Going back

warden rollback --to <version> uses the same engine to go back to a release your approvers adopted before, one card per step through the install gate. Only adopted rollback floors bind, so a release that raised its floor cannot be rolled back below it. warden refresh re-applies what your approvers signed when the console or its door is broken; see Recovery.

Why the waits

A release needs as many release signatures as root 1 requires, from keys root 1 lists; when root 1 also requires keys of different custody (its distinct-custody line), the installer refuses a release whose signatures do not meet that too. The waits give anyone time to see it before it runs: the 72 hours after signing before an install fetches it, and the adoption’s own wait before it applies. So a stolen release key cannot ship a release into your accounts unnoticed. See Concepts.