Agent v1.18.0 — May 18, 2026
Enhancements:
Credential management: cloud-native authentication
The agent now reads an
AUTH_TYPEfield from its config file at startup, controlling how it authenticates with the Lucidity orchestration layer. Three modes are available:OLD_AUTH: config-file credentials only. This is the default and preserves existing behavior exactly. Any instance that does not receive an updated config continues to behave as before.
CP_OLD_AUTH: the agent calls your cloud provider's instance metadata service (IMDS) at startup to obtain an instance identity document, then exchanges it with Lucidity for credentials. If that call fails for any reason, it falls back silently to config-file credentials. This is the mode being rolled out.
CP_AUTH: cloud provider credentials only, no fallback. The agent will not start if credential fetch fails. Not deployed in this rollout.
When running in CP_OLD_AUTH, the agent makes one additional outbound read-only call to the cloud IMDS endpoint (169.254.169.254 on AWS/Azure, metadata.google.internal on GCP) at startup. No credentials are written to disk.
Security:
Code security hardening
22 issues identified by static analysis tooling have been resolved, including insecure pseudorandom number generation patterns.