v0.3.3

What's Changed

• feat(sdk): surface agent guards on the manifest for platform governance by @quanghexa94 in #283
• feat(sdk): add the guards policy block to enable/disable declared guards by @quanghexa94 in #298
• feat(sdk): apply the guard policy stance in the guarded runner, closed-world by @quanghexa94 in #285
• feat(sdk): lint the guards policy block against the agent manifest by @quanghexa94 in #286
• docs(sdk): add a guarded-agent platform demo notebook by @quanghexa94 in #289
• docs: remove committed agent-policy-dimension design doc by @quanghexa94 in #277
• feat(sdk): add a skills block to the compose policy.yaml grammar by @guillaume-hexamind in #302
• feat(sdk): run every policy check through one entry point by @victorludvig in #306
• feat(clickhouse): record an agent_run row for every admitted run by @guillaume-hexamind in #310
• feat(sdk): add a process-local per-agent usage ledger by @guillaume-hexamind in #308
• feat(platform-api): route policy preview, check and validate through analyze_policy by @victorludvig in #304
• refactor(cli): route policy validate through analyze_policy by @victorludvig in #318
• feat(sdk): check gate args, skill names and constraint roots in analyze_policy by @victorludvig in #321
• refactor(sdk): fetch policy and bans concurrently at the run boundary by @guillaume-hexamind in #309
• feat(sdk): lint each agent's roles column against its own manifest by @victorludvig in #322
• feat(sdk): flag reach targets and roles columns that name no agent by @victorludvig in #324
• feat(clickhouse): roll usage up per agent per minute, deduped across polls by @guillaume-hexamind in #317
• feat(evals): score a policy-writing workspace with the hexgate sdk by @victorludvig in #287
• feat(platform-api): add the oauth scope registry and token tables by @victorludvig in #327
• fix(sdk): canonicalize the native agent's name at every identity site by @guillaume-hexamind in #325
• feat(evals): score role-wide cases on every roles.yaml column (land #299) by @victorludvig in #337
• feat(sdk): make agent_usage.* paths loadable, read from the local ledger by @guillaume-hexamind in #314
• feat(platform-api): serve agent usage windows from the minute rollup by @guillaume-hexamind in #326
• feat(evals): load the policy-writing cases, one directory per case by @victorludvig in #288
• feat(evals): check a case's dry-run calls against its agent by @victorludvig in #330
• feat(evals): add the single-file starting project and the first case by @victorludvig in #339
• feat(evals): run the policy-writing cases in Inspect on our own answers by @victorludvig in #342
• feat(sdk): add the platform usage source behind agent_usage.* by @guillaume-hexamind in #331
• feat(sdk): add the usage.on_unavailable policy key, signed into the bundle by @guillaume-hexamind in #335
• feat(evals): run Claude Code in a Docker sandbox for agent=claude by @victorludvig in #343
• build(evals): install OPA in the Claude sandbox image per architecture by @victorludvig in #345
• feat(sdk): enforce agent_usage.* across processes at the run boundary by @guillaume-hexamind in #338
• feat(evals): add input-level cases l0, l1 and l5 by @victorludvig in #348
• feat(evals): add the sub-agent and modules starting projects by @victorludvig in #341
• feat(evals): add input-level cases l2 and l2b by @victorludvig in #352
• docs(sdk): document agent_usage.* as a soft cross-process quota by @guillaume-hexamind in #340
• fix(sdk): percent-encode the agent name in get_agent's url by @Dev-next-gen in #359

New Contributors

• @Dev-next-gen made their first contribution in #359

Full Changelog: v0.3.2...v0.3.3