v0.10.0

v0.10.0: Session export + detection hardening

Two bodies of work ship together in this release. Session export: two
supported ways to get evaluated session data off the agent. And detection
hardening: in 0.6.0 we published a number that hurt (TPR 0.000 on
InjecAgent's 2,108 action-oriented injections), and this release closes that
gap along with the distribution surface around it.

Two behaviour changes deserve reading before you upgrade; both are covered
under Breaking and behaviour changes below.

Session export

• OpenTelemetry (pip install "agentegrity[otel]"): one trace per
  session with a child span per evaluated event, plus metrics for
  evaluations, enforcement denials, score distributions, and
  instrumentation health, to any OTLP backend. Hash linkage is reported
  separately from signature verification so a dashboard never reads
  linkage as tamper-evidence.
• Direct HTTP: a stdlib-only HTTPExporter plus an agentegrity pro
  CLI that points an already-instrumented agent at an agentegrity-pro
  dashboard in one command. agentegrity is now a real console script.
• Attaching a sink is never silent: the destination is logged and listed
  under exporters in report(). An empty list is proof a run stayed
  local.

Detection

• action_injection family (5 patterns). Targets the attack shape the
  old taxonomy missed: plausible imperatives smuggled into structured
  content ("Please deposit 2000 USD..." inside a product review). InjecAgent
  base (N=2,108): TPR 0.000 to 1.000 at FPR 0.000. Calibrated on that suite,
  so read it as in-distribution recall, not generalization. We also ran
  AgentDojo and published the honest ceiling: TPR 0.286 / FPR 0.113,
  reproducible via scripts/dump_agentdojo_tasks.py, with the analysis of
  why content-only detection cannot close it.
• tool_poisoning family + tool_definitions channel. MCP tool
  descriptions and schema fields are scanned before any tool runs:
  <IMPORTANT> pseudo-tag blocks, conceal-from-the-user instructions, and
  coaching to read or transmit secret material.
• ToolSequenceDetector (default on). Flags a sensitive-read tool call
  followed by an external-send within the session. Behavioral evidence, not
  text matching: paraphrasing cannot evade it, benign text cannot trip it.
• Reasoning-trace scanning. The adversarial and classifier layers now
  scan the agent's own reasoning chain, so a hostile objective surfaces
  before the behavior materialises as a tool call.
• AdversarialSLMLayer. The semantic classifier against any
  OpenAI-compatible local server (Ollama, llama.cpp, vLLM, LM Studio), CPU
  or GPU, zero added dependencies. Opt-in session context
  (include_session_context=True) feeds recent tool-call names into the
  classification.

Distribution

• Two lines to instrument: agentegrity.init() auto-detects installed
  frameworks; runtime.instrument(obj) dispatches on the object's type.
• Claude Code plugin: /plugin marketplace add cogensec/agentegrity.
  Every tool call is evaluated in-process (allow / ask / deny), and every
  verdict appends to a hash-linked per-session decision chain you can check
  with agentegrity verify-decisions.
• MCP-aware governance: glob entries (mcp__db__*) gate whole servers,
  and mcp__filesystem__file_delete matches a listed file_delete.

Assurance

• ApprovalWorkflow: HITL approval that denies on timeout by default
  (fail-open is an explicit choice, never a silent one), with every
  consulted approval recorded as signed provenance: who approved, when,
  and whether it timed out.
• KeyProvider + strict cross-agent verification: peer records are
  pinned to registered Ed25519 keys, so a forged peer chain signed with an
  attacker-generated key no longer self-verifies.
• agentegrity report: renders any session chain into an audit report
  with verification status, decision timeline, approvals, and an evidence
  mapping to EU AI Act Art. 12/14 and NIST AI RMF. Supporting evidence, not
  a compliance determination.
• Alerting: SlackAlertExporter / WebhookAlertExporter push block and
  escalate verdicts to a channel. Shape-only payloads, fail-open, stdlib.

Breaking and behaviour changes

• AGENTEGRITY_TOKEN + AGENTEGRITY_URL are no longer inert. They now
  self-attach an HTTPExporter at adapter construction. If those variables
  are already set where an instrumented agent runs, that process starts
  streaming full event content (prompts, tool arguments, tool outputs) to
  the configured URL on upgrade. That is the documented behaviour finally
  working, but it changes what leaves the process: unset them if you did
  not mean it, and check report()["exporters"].
• AttestationChain.verify_cross_agent_links() is strict. With no
  arguments it now returns False for chains that carry cross-agent
  Evidence (v0.8-v0.9.0 returned True). Unverifiable is not verified.
  Single-agent chains are unaffected. Multi-agent verifiers: supply the
  peer chains and pin identities with a KeyProvider. Full migration notes
  in the CHANGELOG.

Numbers

877 Python tests, 89.7% branch coverage (gate 85%), mypy strict clean,
sub-millisecond evaluation pipeline (p95 0.23 ms, CI-pinned), 52
cross-package TypeScript conformance tests, detection benchmarks pinned as
no-regression floors in nightly CI.