Skip to content

AgentCert v0.7.0

Choose a tag to compare

View all tags
@Kakarottoooo Kakarottoooo released this 23 Jul 07:42
v0.7.0
a8b2fa4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AgentCert v0.7.0

AgentCert v0.7.0 completes the first narrow action-assurance protocol from
declared capability through controlled browser execution and independently
verified outcome.

Changes

  • Adds universal capability manifests, normalized action semantics, five
    reference capability packs, coverage accounting, and reviewed corrections.
  • Adds immutable action mandates, policy decisions, outcome attestations, and
    signed action-assurance receipts.
  • Adds registered browser runtime identities, short-lived one-time execution
    grants, signed runtime claims, replay protection, and central evidence
    classification.
  • Ships a sandbox-only Customer-owned Browser Adapter Kit with exact origin,
    action, operation, and resource allowlists; separated write/read
    credentials; independent outcome probes; target-audit reconciliation; and a
    deterministic conformance command.
  • Adds TypeScript SDK methods for runtime identity and execution-grant
    lifecycle operations.
  • Serializes PostgreSQL migrations and records each applied file with an
    immutable SHA-256 checksum.

Database upgrade

The Hosted control plane applies migrations 022-024 inside a transaction under
a PostgreSQL advisory lock. On the first ledger-aware startup, existing
idempotent migrations are replayed and recorded; later startups skip recorded
files and reject checksum drift.

The rollback rehearsal is an application rollback, not a destructive schema
rollback: the v0.6.3 control plane can run its production acceptance suite
against the v0.7.0 schema while the new tables remain intact. Do not drop the
022-024 evidence tables during rollback.

Public packages

npx agentcert@0.7.0 --help
npx agentcert@0.7.0 browser-adapter init
npx agentcert@0.7.0 browser-adapter certify --adapter ./agentcert.browser-adapter.mjs
npm install agentcert-sdk@0.5.0

Dependency review

The release has no known critical or high-severity production dependency
advisories. @agentcert/mcp-adapter retains two npm-audit moderate findings
from @hono/node-server through MCP SDK 1.29.0. The affected Windows
serve-static path is not imported or exposed by AgentCert's stdio adapter.
Downgrading to MCP SDK 1.24.3 was rejected because that version carries known
high-severity shared-transport data-leak and ReDoS advisories.

See the two-hour browser adapter onboarding
and browser enforcement boundary.

Assets 2
Loading