Custodian Kernel 0.4.4

Reconciles two independent feature sets that both targeted version 0.4.3 for unrelated reasons. Carries forward the vendor-neutral PaymentProcessor interface (custodian.processors.base, custodian.authority.ledger, entry-point discovery for external packages) from 0.4.3 unchanged, and adds the harness-neutral action-evaluation engine and Paladin credential-broker bridge moved out of custodian.codex_guard into custodian.guard_core, part of Kernel -- it already served every guard harness (Codex, Claude, OpenCode) via a harness keyword, but living inside codex_guard's own package meant every other guard adapter had to depend on custodian-codex-guard just to reach it. custodian.codex_guard.mcp_server/.paladin_bridge re-export the same names for backward compatibility; behavior is unchanged, only the canonical location moved. A new permanent architecture-boundary test enforces this going forward. v0.4.3 shipped only the payment-processor half and is genuinely incompatible with custodian-codex-guard>=0.1.4 and custodian-claude-guard>=0.1.0, both of which require custodian.guard_core.evaluation directly -- rather than rewrite the already-public v0.4.3 tag, this ships as 0.4.4; v0.4.3 stays as-is, superseded but not altered. The exact attached wheel and source archive passed the full 3,000+ test suite, the complete custodian-release.py prepare battery (fresh install, upgrade from the real published 0.4.2, managed two-slot install/reinstall/uninstall with data preservation, PEP 668 compliance), and were verified directly against both real downstream packages this fixes: custodian-codex-guard 0.1.4 (a genuine MCP initialize handshake) and custodian-claude-guard 0.1.0 (real PreToolUse allow/deny hook decisions), both installed fresh from their own GitHub tags. Not yet published to the real PyPI index.

Custodian Kernel 0.4.3

Custodian Kernel 0.4.3 adds a vendor-neutral PaymentProcessor interface (custodian.processors.base) so a payment vendor integration no longer needs to be bundled with the kernel to work with it, shared crash-safe ledger primitives (custodian.authority.ledger) available to any processor implementation, and importlib.metadata entry-point discovery so a separately-installed package can register its own skills and setup components with zero kernel code changes. The kernel is now mechanically forbidden from importing any payment vendor SDK directly. The exact attached wheel and source archive passed the full 3,000+ test suite, the complete custodian-release.py prepare battery (fresh install, upgrade from the real published 0.4.2, managed two-slot install/reinstall/uninstall with data preservation, PEP 668 compliance), a real end-to-end behavioral simulation against dashboard/api/operator.py's full demo arc compared side by side with 0.4.2, and a genuine TestPyPI upload-and-install round trip. Not yet published to the real PyPI index.

Custodian Kernel 0.4.2

Custodian Kernel 0.4.2 completes the cross-platform control-plane release for Linux and Windows. It adds authenticated approval wait/resume, granular shared harness gates, safer workspace and filesystem enforcement, approval and blocked-action cleanup, improved console status, PEP 668-safe installation, lifecycle recovery, and complete CLI help/man-page coverage. The exact attached wheel and source archive passed the full 3,062-test suite, strict artifact checks, and combined clean-install smoke testing. macOS qualification remains pending.

Custodian Kernel 0.4.1

Custodian Kernel 0.4.1 fixes installation and lifecycle problems found in 0.4.0.

This release supports Linux and macOS with Python 3.11 through 3.13. Windows support is planned for 0.4.2.

What changed:

• Added a managed installer that works with PEP 668 distributions, including openSUSE.
• Added data-preserving uninstall, reinstall, and rollback behavior.
• Fixed standalone commands that accidentally imported separately packaged agent adapters.
• Added Open and Protected gate modes, with optional notifications for automatic passes.
• Added clean-install and real 0.4.0 upgrade tests that preserve vault, ledger, Paladin, and Talaria data.

The attached wheel and source distribution are the same artifacts qualified before publication.

custodian-kernel 0.3.1

Kernel-enforced authority and spend platform for AI agents.

Install

pip install custodian-kernel==0.3.1
custodian-verify

Tool layer — 102 governed tools

custodian tools list              # show all 102 tools grouped by band
custodian tools run http-get --url https://example.com
custodian tools summary           # JSON band breakdown

Change from 0.3.0

• Credential broker package renamed warden → caduceus (import path, CLI entry point, vault file locations). No functional change.

Full source is in this repo at tag v0.3.1.

custodian-kernel 0.3.0

Kernel-enforced authority and spend platform for AI agents.

Install

pip install custodian-kernel
custodian-verify

Tool layer — 102 governed tools

custodian tools list              # show all 102 tools grouped by band
custodian tools run http-get --url https://example.com
custodian tools summary           # JSON band breakdown

Full source, including the credential broker (warden/) shipped in this
release, is in this repo at tag v0.3.0.

custodian-kernel 0.2.0

custodian-kernel 0.2.0 — kernel as fabric

Kernel-enforced authority and spend platform for AI agents.

Install

pip install custodian-kernel
custodian-verify

custodian-verify runs a zero-credential, zero-clone check: a planted-lie case through the deterministic verifier, a live audit feed pull, and a checkout-or-skip proof.

What's new in 0.2.0

• @govern decorator — wrap any function with implicit kernel enforcement. Band, cap, kill switch — all automatic. Zero kernel imports in user code.
• CustodianMiddleware — drop-in ASGI middleware for FastAPI/Flask/Starlette. Governed routes return 402 on escalation, 403 on denial.
• GovernedReceipt — SHA-256 fingerprint of every governed action. Verifiable and cannot be forged.
• EventBus — pub/sub hooks for kernel lifecycle events (Twilio SMS, Slack alerts, or any consumer).
• CustodianSession — sub-session band inheritance; a child session cannot exceed the parent.
• Authority bands L0–L4 — per-action caps, daily envelopes, margin gates, no-self-dealing, all opt-in.
• Operator-only kill switch — denies every request regardless of amount, band, or policy.

Changes from 0.1.2

• Kernel primitives promoted to first-class fabric (@govern, CustodianSession, GovernedReceipt, EventBus, CustodianMiddleware) instead of CLI-only usage
• custodian-verify console script added for no-credential, no-clone verification
• Expanded pyproject.toml packaging (package-data globs for bundled skills/packs, pytest network-marker config)

custodian-kernel 0.1.2

custodian-kernel 0.1.2

Kernel-enforced authority and spend platform for AI agents.

Install

pip install custodian-kernel

What's in this release

• Bundled all 100 governed tools into the package (payments, cloud, communication, monitoring, database, scheduling, security, and more)
• Added custodian demo-verify CLI command
• Added custodian-verify installable entry point for zero-credential verification
• Resolved failing tests found before PyPI publish

Changes from 0.1.1

• Restructured policy packs (refunds/purchasing/cloud) into bundled_skills/ with per-tool SKILL.md + policy + scripts
• Added authority.py, earn.py, notify.py, kill-switch toggle, and v2 approve/spend recipes to the Stripe spend tool
• Expanded test suite

custodian-kernel 0.1.1

custodian-kernel 0.1.1

Kernel-enforced authority and spend platform for AI agents.

Install

```bash
pip install custodian-kernel
```

What's in this release

• Clean public release — private endpoint references removed from inference router
• Proper authors and LICENSE metadata
• 100 governed tools across L0–L4 authority bands
• Policy packs: Refunds, Purchasing, Cloud
• Hermes-compatible SKILL.md tool registry
• NemoClaw inference router (DGX Spark → NVIDIA hosted API fallback)
• Twilio Verify escalation backend
• Full test suite (1,176 tests)

Changes from 0.1.0

• Removed private LAN endpoint from NemoClawRouter default endpoints
• Added LICENSE file (MIT)
• Added authors field to package metadata
• Fixed README install instruction