Aegis Latent Core v3.0.1
Aegis Latent Core v3.0.1
Release scope
This patch release closes the production-observed error-path gap identified by realistic loopback execution. Upstream non-200 responses, circuit-open responses, and forwarding exceptions now require durable signed request-response evidence before a terminal error is returned. Governed successful and error responses expose X-Aegis-Evidence-Status: durable together with request/session identifiers.
The release also hardens RFC 3161 and TAXII urllib fallbacks with explicit HTTP(S), hostname, port, userinfo, query, and fragment validation; updates the diagnostic health check to the same fail-closed URL contract; synchronizes Python, Rust, maturin, Docker, Helm, installer, documentation, and visual assets to 3.0.1; and regenerates the Samples gallery from the versioned generator.
Verification
The exact published checkout was verified with:
| Gate | Result |
|---|---|
| Pytest | 5374 passed, 80 skipped, 47 warnings |
| Ruff lint | exit 0 |
| Ruff format | 405 files already formatted |
| Bandit | exit 0; zero reported findings in the final scan |
| pip-audit | exit 0; no known vulnerabilities reported |
| Helm lint | 1 chart(s) linted, 0 chart(s) failed |
| Coverage | 93% line coverage |
| Realistic traffic/fault runs | zero missing durable-evidence headers in recorded valid runs |
Assets and integrity
The release assets include the hardened source ZIP, SPDX 2.3 SBOM, machine-readable provenance envelope, release-gate record, and SHA-256 manifest. The provenance envelope binds the published repository tree to the recorded gates and explicitly states that local workload results are bounded measurements, not a production SLO or proof of absence of untested defects.
Deployment boundary
Production rollout remains conditional on deployment-specific validation of kernel/LSM/Seccomp attachment, Redis/HSM availability, TLS and storage policy, image digest/signature verification, and operator review of the residual-risk section in DEPLOYMENT_GUIDE.md.