Changelog
Two streams. They version independently.
The agent binary and the action library ship on separate channels, because a fix to a remediation should not require a fleet-wide agent update, and an agent update should not silently change what actions exist.
quarry-bundle 2026.07.3
2026-07-28
Quarry actions
- addedquarry.smb.credential.refresh — Tier 0, reversible. Re-establishes a mapped drive against the stored credential and refreshes the Kerberos ticket.
- changedquarry.disk.logrotate risk tier raised from 0 to 1. Truncation is not reversible and the tier now says so.
- fixedquarry.printspool.restart no longer reports success when the spooler restarts into a stopped state. This produced four false resolutions in the sandbox fleet and would have produced them on customer machines.
talon 1.8.2
2026-07-24
Talon binary
- fixedmacOS: privilege token was held for the duration of a multi-step action rather than per step. Now escalates and drops per step, as documented. Anyone running 1.8.0 or 1.8.1 should update.
- changedBells heartbeat interval is now adaptive: 30s when an incident is open on the device, 5m otherwise. Reduces idle traffic on large fleets by roughly 80%.
platform 2026.07
2026-07-19
Platform
- addedCreance simulator now replays 90 days rather than 30 where Flightlog retention allows it.
- addedFlightlog evidence packs: export every autonomous execution in a date range with the authorizing policy version attached.
- changedDevice correlation match rate is now shown during connector setup rather than after the first sync. A 40% match rate is something you need to know before you finish, not in month two.
talon 1.8.0
2026-07-02
Talon binary
- addedLinux: deb and rpm repositories, systemd unit, Ansible role.
- addedRecall now acknowledges over the independent stand-down channel, so it works when orchestration is unavailable. Verified by taking Stoop fully offline in staging.
- known issueWindows: agent version reported to Cadge lags by one heartbeat after a Mews update. Cosmetic, fixed in 1.8.1.