Release v0.9.0 - Monitor Mode, Verified Attestation & Control-Plane Auth · LuD1161/agentjail

TL;DR

Monitor mode - a new mode where the daemon evaluates every tool call and enforces nothing, recording the verdict that would have fired; agentjail monitor shows what a rule set would allow, deny, or ask about, so you can try it against your real workflow before turning it on (ADR 0091).
Attestation now verifies the daemon end to end - the status line pings the policy daemon rather than assuming it, shows UNSECURED when not shielded, and defaults to a degraded posture instead of silent-allow when the daemon is unreachable, so a green badge is a verified claim.
Control-plane token auth - every privileged control-socket verb (daemon reload, netproxy session register, secrets broker, grant approval) now requires a token the shield withholds from the sandboxed agent, so the guarded agent cannot reach the guard's control plane to weaken it (ADR 0067-0069).
agentjail doctor --fix repairs what it diagnoses (dangling PATH shim, stale supervisor, missing symlinks), not just reports it (ADR 0086).

Monitor mode: the daemon evaluates everything and enforces nothing, recording the would-have-fired verdict; agentjail monitor surfaces it (ADR 0091).
Control-plane token authentication across the daemon, netproxy, and secrets broker; the shield withholds the token from the sandboxed agent (ADR 0067, 0068, 0069).
agentjail doctor --fix repairs what it diagnoses rather than only reporting it (ADR 0086).
Status line attestation verifies the policy daemon end to end by pinging it, and shows UNSECURED when not shielded (ADR 0064, 0085).
The store redacts secrets by value, not only by key name (ADR 0084).
Rego input is type-checked against the HookInput schema, and policy add fails closed on an unknown input.* reference (ADR 0080).
Dropped decisions are visible in the audit log (ADR 0072).

Degraded is the default posture when the daemon is unreachable, not silent allow (ADR 0074).
Uninstall is total: it stops the daemon before unhooking, verifies it stopped, aborts rather than tearing down half-way, and restores any chained status line (ADR 0063, 0065).
AGENTJAIL_SHIELDED=1 now means actually sandboxed, not merely that the shield ran (ADR 0087).
Policy reload moved off the agent-reachable socket onto the privileged control socket (ADR 0066).
Daemon durability: WAL checkpoint instead of VACUUM-on-start, SIGHUP reloads coalesced and rate-bounded, and buffered decisions survive shutdown (ADR 0075).

The status line no longer reports secured while the daemon is down and enforcing nothing; it pings the daemon, so a wedged one is not badged as secured.
The fail-open notice now surfaces where the user can see it (systemMessage), and Codex users are warned during a daemon-down window too.
Shield: canonicalizes aliased paths in the control-socket guard, works from a git worktree, never launches silently unrecorded, and emits macOS control-socket denies last with SSH_AUTH_SOCK preserved.
Install repairs the deployed supervisor, not just the template, and the Linux daemon restarts after the auto-updater's clean exit (ADR 0070).
Dropped two Landlock grants measured as connect() no-ops.

Control-plane token auth closes a privilege-escalation path: a sandboxed agent could previously reach the daemon, netproxy, and secrets control sockets. Every verb but the fingerprint challenge now requires a token the shield withholds from the agent.
Secrets are redacted by value, not just key name, so a secret pasted into an unexpected field is still masked in the audit log (ADR 0084).
Verified attestation: the status line reports UNSECURED or degraded instead of a green badge when enforcement is not actually running (ADR 0074, 0087).