Tracekit 0.3.0

First release published on PyPI, as tracekit-ai (pip install tracekit-ai; the import and the command stay
tracekit). The name tracekit on PyPI belongs to an unrelated project: do not install it.

Breaking changes

• Niche modules moved to contrib/ as separate packages: proof packs (tracekit-proofpack, also tracekit-report),
  SQL over the ledger (tracekit-sql), Causeway, on-chain guards and Stagehand. The old tracekit proofpack, report,
  sql and causeway subcommands print where they went. Entries below that mention them describe the contrib
  packages.
• Proof packs no longer contain a verifier (verify.pyz and SHA256SUMS are gone): auditors verify with a
  Tracekit release they install themselves. A bundled replay.html never affects a verdict.
• The ingest gateway, the Anthropic model proxy and the OTLP receiver need --experimental; they are being rebuilt
  for server-hosted agents.
• GitHub Action: require-anchor defaults to true, so an unanchored bundle fails the step.
• System mode runs only from a root-owned virtualenv at /opt/tracekit, installed from PyPI (tracekit-ai, the
  same version) or from a root-owned clone, with a root-owned Python. tracekit migrate --system refuses installs that
  predate it: re-run sudo /usr/bin/python3 -m tracekit init --user <agent-user>.
• tracekit cost reads the ledger directly; --index was removed.
• tracekit verify output: besides Integrity: and Assurance:, --json now carries integrity, assurance
  and notes. Assurance is separate-user only where the signer itself attested it.

Security and correctness

• Signer: stamps signer_isolation on run.start itself; records an approval before it takes effect; validates
  approval requests (types, sizes, caller owns a started run, bounded wait_s, per-user cap); decides approvals only
  from facts it observes (peer uid, the approving process's terminal); runs first seen without run.start get an owner.
• Hooks and client: an untrusted or unreadable /etc/tracekit/client.json fails closed instead of falling back;
  subagent transcript paths are confined to the session; payloads without ids are not merged and leave a signed gap;
  a signer-rejected tool call blocks under fail_mode: closed, also when an approval was given; client state files use
  collision-free names (existing state carries over); Codex, Cursor and Gemini sessions keep their run.start when
  reasoning_capture is on.
• Redaction: linear time on adversarial input; long connection-string passwords are redacted; a .env mention no
  longer hides the command being run; lone surrogates are recorded instead of breaking capture.
• Verifier: honest exports are no longer failed by a single missed witness publish (a warning instead); a malformed
  or deeply nested bundle is a FAIL, never a crash; the witness-coverage detail names only checkpoints the witness holds.
• Installer: every file write is safe against symlinks and races; reinstalling never leaves an empty runtime (the new
  virtualenv is swapped in only once it imports); the system-mode hook blocks if it cannot run; re-running init keeps
  the policy pin and registered harnesses and restarts the signer; tracekit doctor checks the whole runtime without
  following symlinks; the GitHub Action passes inputs to the shell only through the environment.
• Network servers (witness, ingest): TLS handshakes per connection with timeouts, an overall per-connection
  deadline, bounded threads and a per-client cap; the witness log is locked against a second server and rolls back a
  failed write; witness and Rekor URLs are validated and redirects refused; Rekor read-back includes the signature.
• Observer and replay: all event-derived content is escaped; nonce-based CSP; the observer's token becomes an
  HttpOnly cookie; static exports carry a CSP.
• SDKs: a crashing or slow TypeScript bridge never crashes or hangs the host process, and fail-open lets model calls
  through; bridge requests that time out leave no unfinished signed records; abandoned Python streams are recorded
  before run.end.
• Packaging: contrib packages depend on tracekit-ai; the sdist ships what its tests need.

Added

• tracekit observe polish and a reproducible interface video (docs/demo/observer_scene.py,
  record_observer.mjs).
• Golden verifier corpus (tests/golden/): frozen v0.1 and v1 evidence with the verifier's recorded verdicts.
• Known-gap tests (tests/test_known_gaps.py): strict expected failures for gaps the next evidence format closes.
• eval/e8_insider.py --require-harness, SECURITY.md, CONTRIBUTING (sign-off for contributions from forks).

Install: pip install tracekit-ai · Full history: CHANGELOG.md