IronVise v0.8.0

[0.8.0] - Unreleased

First release since 0.6.3. The product name is IronVise. Existing ledgers, signing keys, data directories, environment variables, and
signed formats remain compatible. CLI invocations and SDK imports move to the
IronVise names; the former executable and SDK import aliases are removed. See docs/reference/compatibility.md.

Added

• CLI: hook (Claude Code, Codex, and Antigravity CLI), mcp-proxy, proxy
  (recording only), verify-ledger, issuer-key, data-receipts,
  import-openshell, and webhook-key.
• SQLite parity for the cognitive loop, snapshots, certificate export,
  anchor-session, and live webhook delivery.
• verify_intent / verifyIntent in both SDKs: ask whether an action would
  be permitted without executing or recording it.
• Documented .elc certificate format and an independent verifier.
• Measured semantic-guard corpus, recorded in docs/reference/testing.md.

Changed

• Python distribution is now ironvise, with the complete implementation in
  ironvise_sdk. The legacy Python namespace is removed.
• The container image is now ghcr.io/ectospace/ironvise and the compose
  service is ironvise. Images up to 0.6.3 stay at ghcr.io/ectospace/ectoledger.
• LLM_PROVIDER replaces LLM_BACKEND (the old name still works as an alias).
• LedgerTool (LangChain) is removed in favour of the fail-closed
  LedgerCallbackHandler.
• Crate licence metadata matches the BUSL-1.1 LICENSE. Verification tooling
  is covered by the Additional Use Grant.
• GUARD_REQUIRED is resolved most-restrictive-wins between the environment
  and .ectoledger/settings.json.

Removed

• The legacy CLI executable and Windows launcher, Python import shims, and
  obsolete branding assets. Ship one CLI and one implementation per SDK.

• TypeScript's old npm package/API names; use ironvise and IronViseClient.

• EVM anchoring. anchor-session --chain accepts only bitcoin
  (OpenTimestamps). The evm feature, anchor contract, and EVM_* settings
  are gone.

• audit --auto-anchor-interval and --auto-anchor-chain (they never anchored).

Fixed

• Session lookup by ID now finds sessions beyond the newest 500 records.
• Token creation rejects expiry dates outside the supported range instead of
  panicking or creating unusable tokens.
• Demo resets roll back both data deletion and immutability-trigger changes
  if any step fails, on SQLite and PostgreSQL.
• Trusted-proxy rate limiting reads forwarding-header chains right to left,
  including repeated headers, instead of accepting a forged earlier address.
• Both SDKs handle CRLF/CR SSE frames, Unicode, and multiline data correctly, close
  streams when explicitly stopped, and reject invalid retry/timeout settings.
  Python's retry backoff remains bounded for large retry counts.
• History ignores stale filter and session responses and keeps certificate
  and report exports tied to the session that requested them. Queued callbacks
  from a replaced SSE connection cannot affect its replacement.
• A KeyRotation event could authorise the key that signed it (F-5).
• A session with its signatures deleted, or its key cleared, verified clean (F-4).
• Signatures could be detached from the events they covered (F-1), and a sealed
  session could be truncated without detection (F-2).
• Clients could append server-owned enforcement records.
• OS sandbox failures (Landlock, Seatbelt, Job Objects) now abort the action
  by default instead of continuing unsandboxed.
• A Windows cmd.exe builtin wrapper let &, |, and > run a second command.
• A SQLite path on Windows could lose its drive letter.
• Remote enclave attestation (COSE signature, certificate chain, nonce) is
  verified before the session key is trusted.
• Webhook signatures, hook and SDK requests, and provider reasoning are bound
  to one receiver or one session so they cannot be replayed elsewhere.
• The container image includes guard-worker and verify-cert, and its
  licence label is BUSL-1.1.

Security

• Dependency updates for rustls, zip (via the vendored pg-embed),
  rustls-webpki, webpki-roots, tokio, and pulldown-cmark.
• Removed experimental SP1 proving and the zk build feature to eliminate
  crypto-bigint 0.5.5 and RUSTSEC-2026-0387 from the dependency graph.
  prove-audit now refuses with an explanation and points to standard .elc
  certificate export. Existing certificate formats remain compatible.
• Fixed Rust compiler warnings in the vendored GLib backport so its optimized
  iterator regression and Linux builds pass with warnings denied.
• Bundled SQLite updated to 3.54.1 (libsqlite3-sys 0.39.1) for
  RUSTSEC-2026-0459, through a vendored sqlx-sqlite that only widens its
  version range. verify-ledger opens ledger files from other people, so the
  fix matters there. The optional sqlcipher build still bundles SQLite 3.53.4.

Full Changelog: v0.6.3...v0.8.0

v0.6.3

v0.6.3 - Website & Readme Clarity Release

Improved main README, website, and SDK descriptions.
Non-technical people now instantly understand: EctoLedger is the dashcam + emergency brake for AI agents (blocks unsafe actions + creates provable audit trails).

🚀 New Functionality

🗄️ Pluggable Ledger Backends

Introduced the LedgerBackend trait to decouple the agent runtime from specific storage engines.

• PostgreSQL: Primary backend for production, high-throughput, and multi-agent deployments. Required for audit, orchestrate, diff-audit, red-team, prove-audit, and anchor.
• SQLite: Ideal for local development, CI pipelines, and single-machine audits. Supports serve, replay, report, verify-certificate, and verify-vc.
• Configuration: Switch backends seamlessly via the DATABASE_URL environment variable.

🖥️ Tauri 2 Management GUI

A new glassmorphic desktop application for macOS, Windows, and Linux.

• Observer Panel: Real-time monitoring of active cognitive loops and event sequences.
• Policy Editor: Integrated TOML editor for authoring and deploying governance logic.
• Tripwire Config: Visual management of path, command, and domain protection constraints.
• Additional Modules: Dashboard, Prometheus metrics, RBAC tokens, HMAC webhooks, and an automated Setup Wizard.

🛠️ Official SDKs (Python & TypeScript)

Production-ready, typed REST clients for seamless integration into existing AI workflows.

• Python: Includes the LedgerTool for LangChain and LedgerHook for AutoGen frameworks.
• TypeScript: Native fetch implementation with zero external dependencies for maximum portability.

🔐 4-Layer Semantic Guard

A unified security fabric that evaluates every proposed intent before execution.

• Pipeline: Policy Engine → Dual-LLM Guard → Strict Schema Validation → Tripwire.
• Strict Schema: Catches adversarial hijack keys like override_goal or system_prompt using StrictAgentOutput validation.

🏗️ Hardware-Level Isolation (Firecracker)

Hardware execution isolation for run_command on Linux using Firecracker microVMs.

• Scripts included: setup-firecracker.sh and provision-firecracker.sh for streamlined sandboxing.

⛓️ Cryptographic Anchoring & ZK Proofs

• EVM Anchoring: Publish ledger tips to any EVM-compatible chain via the EctoLedgerAnchor contract using anchor-session --chain ethereum.
• SP1 ZK Proofs: Generate provable policy compliance artifacts using prove-audit without exposing raw event payloads (requires --features zk).

📜 Compliance & Credentials

• W3C Verifiable Credentials: VC-JWTs issued on session completion, signed via Ed25519 and anchored using did:key.
• ISO 42001:2023: Machine-readable policy pack covering 14 security controls, accompanied by a technical compliance whitepaper.

---

🛠️ Operational Hardening

• Webhooks: Added X-EctoLedger-Signature: sha256=<hex> for receiver verification; added specific events for GuardDenial and TripwireRejection.
• Key Rotation: Automatic rotation of agent signing keys via AGENT_KEY_ROTATION_STEPS.
• Connection Pooling: Hardware-aware pooling via DATABASE_POOL_SIZE (defaults to 2×CPU).
• Zero-Config Demo: Launcher --demo mode with embedded Postgres and auto-LLM detection for instant evaluation.

v0.6.2

For Details, Screenshots and Videos check out the Ecto Ledger Website

Release v0.6.0 — The Enterprise Security Update

This release represents a significant architectural evolution for EctoLedger, transitioning from a CLI-centric audit tool to a comprehensive platform for verifiable AI agent execution.

🚀 New Functionality

🗄️ Pluggable Ledger Backends

Introduced the LedgerBackend trait to decouple the agent runtime from specific storage engines.

• PostgreSQL: Primary backend for production, high-throughput, and multi-agent deployments. Required for audit, orchestrate, diff-audit, red-team, prove-audit, and anchor.
• SQLite: Ideal for local development, CI pipelines, and single-machine audits. Supports serve, replay, report, verify-certificate, and verify-vc.
• Configuration: Switch backends seamlessly via the DATABASE_URL environment variable.

🖥️ Tauri 2 Management GUI

A new glassmorphic desktop application for macOS, Windows, and Linux.

• Observer Panel: Real-time monitoring of active cognitive loops and event sequences.
• Policy Editor: Integrated TOML editor for authoring and deploying governance logic.
• Tripwire Config: Visual management of path, command, and domain protection constraints.
• Additional Modules: Dashboard, Prometheus metrics, RBAC tokens, HMAC webhooks, and an automated Setup Wizard.

🛠️ Official SDKs (Python & TypeScript)

Production-ready, typed REST clients for seamless integration into existing AI workflows.

• Python: Includes the LedgerTool for LangChain and LedgerHook for AutoGen frameworks.
• TypeScript: Native fetch implementation with zero external dependencies for maximum portability.

🔐 4-Layer Semantic Guard

A unified security fabric that evaluates every proposed intent before execution.

• Pipeline: Policy Engine → Dual-LLM Guard → Strict Schema Validation → Tripwire.
• Strict Schema: Catches adversarial hijack keys like override_goal or system_prompt using StrictAgentOutput validation.

🏗️ Hardware-Level Isolation (Firecracker)

Hardware execution isolation for run_command on Linux using Firecracker microVMs.

• Scripts included: setup-firecracker.sh and provision-firecracker.sh for streamlined sandboxing.

⛓️ Cryptographic Anchoring & ZK Proofs

• EVM Anchoring: Publish ledger tips to any EVM-compatible chain via the EctoLedgerAnchor contract using anchor-session --chain ethereum.
• SP1 ZK Proofs: Generate provable policy compliance artifacts using prove-audit without exposing raw event payloads (requires --features zk).

📜 Compliance & Credentials

• W3C Verifiable Credentials: VC-JWTs issued on session completion, signed via Ed25519 and anchored using did:key.
• ISO 42001:2023: Machine-readable policy pack covering 14 security controls, accompanied by a technical compliance whitepaper.

---

🛠️ Operational Hardening

• Webhooks: Added X-EctoLedger-Signature: sha256=<hex> for receiver verification; added specific events for GuardDenial and TripwireRejection.
• Key Rotation: Automatic rotation of agent signing keys via AGENT_KEY_ROTATION_STEPS.
• Connection Pooling: Hardware-aware pooling via DATABASE_POOL_SIZE (defaults to 2×CPU).
• Zero-Config Demo: Launcher --demo mode with embedded Postgres and auto-LLM detection for instant evaluation.

v0.5.3

What's Changed

Official rebranding from Ironclad into Ecto Ledger

🚀 Features

• Multi-Agent Orchestration: Introduced the orchestrate command to run sequential Recon → Analysis → Verify sub-agents in independent ledger sessions, cryptographically bound by a CrossLedgerSeal.
• IronClad Audit Certificates (.iac): New self-contained audit record format featuring Ed25519 signatures, SHA-256 hash chains, Merkle inclusion proofs, and Bitcoin anchoring.
• SP1 Zero-Knowledge Proofs: Added the prove-audit command (feature-gated zk) to generate cryptographic validity proofs over the full event chain and policy commitment, allowing compliance verification without raw data exposure.
• Red-Team Mode: New adversarial agent that tests defense layers by generating and injecting LLM-based payloads into existing sessions to identify bypasses.
• Cloud Credential Injection: Support for short-lived AWS, GCP, Azure, and Kubernetes credentials via AGENT_CLOUD_CREDS_FILE, injected only into matching CLI child processes.
• Bitcoin Anchoring: Integration with OpenTimestamps to submit ledger tip hashes to the Bitcoin timechain for temporal non-repudiation.
• Terminal-Native Approvals: Added --interactive flag for stdin-based approval gate decisions, enabling use in local environments without the dashboard.

🛡️ Security & Policy

• Enhanced Policy DSL: Introduced conditional command_rules (regex matching), observation_rules (redact/flag/abort), and approval_gates based on action types and parameters.
• Industry Policy Packs: Pre-configured audit templates for SOC 2, PCI-DSS v4.0, and OWASP Top 10 now included in policies/.
• Hybrid Output Scanner: Added a secondary structural JSON/AST pass to detect goal-hijacking keys and base64-encoded payloads that bypass regex.
• Layer A Content Scanning: 18 regex patterns covering Unicode homoglyphs, zero-width characters, and role-injection markers.

🛠️ Architecture

• Self-Deploying Infrastructure: The framework now automatically detects, starts, and migrates local PostgreSQL Docker containers if DATABASE_URL is unset.
• Cross-Platform Sandboxing: Integrated Linux Landlock, macOS Seatbelt (FFI), and Windows Job Objects for executor process isolation.
• Webhook/SIEM Egress: Added an async worker for dispatching flagged policy outcomes to external endpoints in JSON, CEF, or LEEF formats.
• Workspace Reorganization: Split logic into crates/core (zkVM-compatible), crates/guest (RISC-V guest), and crates/host (CLI/Server).

📊 Observer Dashboard

• Security Metrics API: New /api/metrics/security endpoint providing real-time counts of injection attempts caught by scanner or tripwire layers.
• Interactive Approval API: Fully functional /api/approvals endpoints to pause/resume the agent loop from the web UI.

v0.5.1

Changelog - v0.5.1 "The Verifiable Auditor"

This major update transforms Ironclad from a single-agent loop into a cryptographically verifiable framework for high-assurance security auditing. Version 0.5.0 introduces multi-agent orchestration, Zero-Knowledge proofs, and an enhanced policy engine.

[0.5.1] - 2026-02-19

🚀 Features

• Multi-Agent Orchestration: Introduced the orchestrate command to run sequential Recon → Analysis → Verify sub-agents in independent ledger sessions, cryptographically bound by a CrossLedgerSeal.
• IronClad Audit Certificates (.iac): New self-contained audit record format featuring Ed25519 signatures, SHA-256 hash chains, Merkle inclusion proofs, and Bitcoin anchoring.
• SP1 Zero-Knowledge Proofs: Added the prove-audit command (feature-gated zk) to generate cryptographic validity proofs over the full event chain and policy commitment, allowing compliance verification without raw data exposure.
• Red-Team Mode: New adversarial agent that tests defense layers by generating and injecting LLM-based payloads into existing sessions to identify bypasses.
• Cloud Credential Injection: Support for short-lived AWS, GCP, Azure, and Kubernetes credentials via AGENT_CLOUD_CREDS_FILE, injected only into matching CLI child processes.
• Bitcoin Anchoring: Integration with OpenTimestamps to submit ledger tip hashes to the Bitcoin timechain for temporal non-repudiation.
• Terminal-Native Approvals: Added --interactive flag for stdin-based approval gate decisions, enabling use in local environments without the dashboard.

🛡️ Security & Policy

• Enhanced Policy DSL: Introduced conditional command_rules (regex matching), observation_rules (redact/flag/abort), and approval_gates based on action types and parameters.
• Industry Policy Packs: Pre-configured audit templates for SOC 2, PCI-DSS v4.0, and OWASP Top 10 now included in policies/.
• Hybrid Output Scanner: Added a secondary structural JSON/AST pass to detect goal-hijacking keys and base64-encoded payloads that bypass regex.
• Layer A Content Scanning: 18 regex patterns covering Unicode homoglyphs, zero-width characters, and role-injection markers.

🛠️ Architecture

• Self-Deploying Infrastructure: The framework now automatically detects, starts, and migrates local PostgreSQL Docker containers if DATABASE_URL is unset.
• Cross-Platform Sandboxing: Integrated Linux Landlock, macOS Seatbelt (FFI), and Windows Job Objects for executor process isolation.
• Webhook/SIEM Egress: Added an async worker for dispatching flagged policy outcomes to external endpoints in JSON, CEF, or LEEF formats.
• Workspace Reorganization: Split logic into crates/core (zkVM-compatible), crates/guest (RISC-V guest), and crates/host (CLI/Server).

📊 Observer Dashboard

• Security Metrics API: New /api/metrics/security endpoint providing real-time counts of injection attempts caught by scanner or tripwire layers.
• Interactive Approval API: Fully functional /api/approvals endpoints to pause/resume the agent loop from the web UI.

v0.1.1

Full Changelog: v0.1.0...v0.1.1