Three months of the agent, in nine releases

The Go agent shipped its first build on 13 May 2026 and has had eighty-nine releases since. Most of those are the ordinary business of software: a filter that needed a timeout, an installer flag, a verification target with no behaviour change at all. This is the shorter list. Nine releases where the agent became able to do something it could not do the day before.

If you are running Wegweiser today, your endpoints are on the far side of all of this.

0.3.0, 13 May: one binary, four packages

The Go agent replaced the Python one, and with it came a release pipeline that produces an MSI, a .deb, an .rpm and a macOS .pkg from a single build. That sounds like plumbing, and it was, but everything below depends on being able to ship a new agent to four platforms without hand-assembling anything.

0.3.45 to 0.3.54, June: remote control, and then the logon screen

Remote control arrived in slices over about a week. First a screen stream from a Session-0 helper, then input, then a consent banner, then multi-monitor, and finally the two that make it usable on real servers: the helper follows the active input desktop, so it works on an RDP'd box and at the Windows logon screen, and Ctrl+Alt+Del can be injected properly through SendSAS.

The consent banner is not optional and never has been. Somebody is told when their screen is being watched.

0.3.55 and 0.3.57, June: inventory that means something

Binary inventory produces a cross-platform SHA-256 inventory of executables, skipping container-layer noise so the result is about the machine rather than its images. Windows security posture reads the real Defender state rather than assuming it. Both exist so a question like "is this endpoint actually protected, and what is running on it" has an answer that is not a guess.

0.3.59-rc1, 23 June: the first signed build

The first release through Azure code signing. Before this, a Wegweiser agent was an unsigned binary asking to be installed with administrative rights, which is precisely the thing we tell customers to be suspicious of.

0.3.60, 29 June: the scanner grows up

YARA-X moved from 1.16 to 1.19 and gained a CPU throttle, then delta scanning so a rescan only looks at what changed, then a fix to surface failed scans rather than quietly reporting nothing. A scanner that fails silently is worse than no scanner, because it produces a clean result you believe.

0.3.64, 21 July: hardening, and key rotation that works

TLS and credential hardening on the command channel, and NATS key rotation that propagates: an agent told its keys changed refetches and reconnects rather than logging the event and carrying on with the old ones. Before this, narrowing an agent's permissions was invisible to a running agent until it happened to restart.

0.3.65, 26 July: the first signed release manifest

The release gained a manifest signed with a key that lives offline and never touches the server that distributes the bytes. This is the foundation of the update channel below, and it is the reason a compromised Wegweiser server cannot make your endpoints run arbitrary code.

0.3.68 to 0.3.81, late July: the fleet learns to update itself

The most careful sequence in the agent's history, and deliberately slow. The self-update client shipped first in observe-only mode: it checked, reported what it would do, and installed nothing. The apply engine came two releases later, still off by default. Then rollback, then a run of verification targets whose only job was to be something to update to, then to roll back from.

0.3.81 is the one worth naming: the release where the fleet moved by itself, end to end, with no hands on any endpoint.

What makes that safe rather than alarming is what surrounds it. The agent verifies an Ed25519-signed manifest against keys compiled into the binary before it will parse it, addresses the download by hash, checks the Authenticode publisher on Windows, only ever moves forward, and rolls back if the new build cannot prove itself. The rollout is supervised: if too many endpoints fail, or go quiet after installing, the channel halts itself and waits for a human. And it is off until a tenant turns it on, because pushing software onto your machines without you asking is not something we are willing to do by default.

0.3.82, 29 July: notarised for macOS

Apple notarisation and stapling, so the macOS package installs without a user being told the developer cannot be verified.

0.3.84 to 0.3.86, 11 August: watching a machine live

Ten-second live sampling with per-process attribution for CPU, memory, network and disk, including queue depth, which is the number behind most "everything is slow but nothing is wrong" tickets. Then a real bandwidth test with the ramp charted. All of it renders as charts in the conversation, computed from the series rather than described by the model.

Every one of those verbs reads. None of them write.

0.3.87 and 0.3.88, 12 August: a deliberate attack on ourselves

We spent a day attacking Wegweiser from the source and from the outside, and fixed everything it found the same day. The endpoint half arrived in these two: file-read paths canonicalised before they are checked, queries validated as queries, terminal sessions that always expire, private temporary files, and agent credentials locked down on Windows.

0.3.88 closed the last of it. The agent fetches three third-party tools, and each one is now verified against a digest compiled into the binary before it runs. That anchor is the point: a checksum served from the same host as the file proves the transfer, not the source. The full write-up is in the hardening note.

Where this leaves things

An agent that is signed end to end, updates itself under supervision and refuses to run anything it cannot verify, while still being unable to change a single thing on the machine it watches without a human pressing enter.

Both August releases are rolling out now. If automatic updates are on for your tenant, your endpoints will take them within the hour and there is nothing to do.