v1.6.0 — Agent Behavior Protocol + Supply Chain Security

Note

Historical audit snapshot. This release belongs to the v1.0–v1.12 line that
shipped during the post-audit remediation sprint (2026-04-15 → 2026-04-29).
Per docs/RELEASING.md
these tags are immutable historical snapshots; the active public release line
is now v0.x
hardening, with v1.0.0 reserved for the first verified GKE+EKS cloud E2E rollout.
See CHANGELOG.md for the reclassification rationale.

---

Release date: 2026-04-23

Closes two latent gaps: agents now know when to pause and ask, and
the supply chain has first-class controls (Cosign signing + SBOM +
admission policy).

Backfilled release notes (Fase F, produced 2026-04-24).

Highlights

Agent Behavior Protocol (3 modes)

• AGENTS.md — new Agent Behavior Protocol section: AUTO / CONSULT / STOP
• Canonical Operation → Mode mapping table (21 operations)
• Escalation triggers: automatic STOP even from AUTO/CONSULT (marginal
  fairness, drift PSI > 2× threshold, cost > 1.2× budget, credential
  detected, etc.)
• Structured [AGENT MODE: X] signal format for handoffs

Authorization checkpoints in skills

• deploy-gke/SKILL.md, deploy-aws/SKILL.md — authorization_mode
  frontmatter (dev=AUTO, staging=CONSULT, prod=STOP)
• model-retrain/SKILL.md — train=AUTO, to_staging=CONSULT,
  to_production=STOP, plus automatic STOP on D-06 / marginal fairness /
  regression > 5%

Agent-SecurityAuditor (Layer 2)

• Runs BEFORE Agent-DockerBuilder and Agent-K8sBuilder
• Blocks pipeline on findings (never silent)
• Chains to /secret-breach on secret leaks
• Capability matrix: "Blocked" entries cannot be bypassed by human insistence

Agent Handoff Schema

• templates/common_utils/agent_context.py — AgentMode, Environment,
  EDAHandoff, TrainingArtifact, BuildArtifact, SecurityAuditResult,
  DeploymentRequest, AuditEntry — all frozen=True, fail-fast
• DeploymentRequest refuses to construct with env=production +
  audit.passed=False

Audit Trail Protocol

• Every agentic operation → ops/audit.jsonl (append-only)
• Mirrored to GitHub Actions step summary
• CONSULT/STOP additionally open a GitHub issue tagged audit
• Failures open issue tagged audit + incident

Supply chain security (SLSA L2)

New anti-patterns:

• D-17 — Hardcoded credentials / direct os.environ for secrets in prod
• D-18 — Static AWS keys or GCP JSON keys in production
• D-19 — Unsigned images or missing SBOM in production

Rule + helper + CI + admission policy:

• .windsurf/rules/12-security-secrets.md (always_on)
• templates/common_utils/secrets.py — cloud-native secret loader;
  refuses to fall through to os.environ in staging/prod
• ci.yml — security-audit job (gitleaks + grep + IRSA/WI check);
  build renamed to "Build, Sign & Attest" with Syft SBOM + Cosign
  keyless sign + Cosign attest
• templates/k8s/policies/kyverno-image-verification.yaml —
  ClusterPolicy rejects unsigned images in prod namespaces; requires
  CycloneDX SBOM attestation < 90 days

Incident response

• .windsurf/skills/security-audit/SKILL.md — pre-build/pre-deploy scans
• .windsurf/skills/secret-breach-response/SKILL.md — 7-phase playbook
• .windsurf/workflows/secret-breach.md — /secret-breach slash command

ADR

• ADR-005 — Agent Behavior Protocol + security: why 3 modes, keyless
  Cosign, Kyverno over Gatekeeper, refuse os.environ in prod, why NOT
  Vault (ADR-001 deferred), JSONL audit over GH issues per op, dataclasses
  over JSON Schema, revisit triggers

See also

• CHANGELOG entry [1.6.0]
• ADR-005