Skip to content

Releases: NexusClawHQ/nexusclaw-agent-governance

Release list

v0.5.0-community: governance core for any agent framework

v0.5.0-community: governance core for any agent framework Latest
Latest

Choose a tag to compare

View all tags
@NexusClawHQ NexusClawHQ released this 17 Aug 11:59
v0.5.0-community
a998cee

What's in this release

  • /console browser closed loop (since v0.2.0): run a governed task, watch L1 pass, approve the paused L3 tool, inspect the audit chain
  • governance/ — the framework-neutral governance library (9 packages, Apache-2.0): contracts, governor, outbox, audit-chain, permission, guardrail, approval, executor, sidecar — with the per-call gate API (POST /gate) for external frameworks
  • adapters/: python client (wrap_tool / run_approved + verified LangGraph/CrewAI recipes in examples/), n8n nodes (Governance Gate / Approve / Pending), dify OpenAPI custom-tool schema

Install the python client (works today, no PyPI needed)

pip install "git+https://github.com/NexusClawHQ/nexusclaw.git#subdirectory=governance/adapters/python"
from agent_governance import GovernanceClient
gov = GovernanceClient("http://127.0.0.1:7899")
update_customer = gov.wrap_tool(update_customer)   # deny by default, L2/L3 pauses for approval

Wheel and sdist are attached below. PyPI (agentgovernance) follows.

n8n nodes — published on npm

Install by name in n8n → Settings → Community Nodes:
n8n-nodes-nexusclaw-governance (or the tarball below for manual install).

Verify everything yourself

git clone https://github.com/NexusClawHQ/nexusclaw.git && cd nexusclaw/governance
pnpm install && pnpm verify   # build + 58 tests + sidecar HTTP closed loop (needs local Postgres)

Provenance: source 5b68ee45, seal nexusclaw-community-c212d591, tree sha256:c212d591, tarball sha256:c3ae9090.

Assets 5
Loading

NexusClaw Community v0.1.0

NexusClaw Community v0.1.0

Choose a tag to compare

View all tags
@NexusClawHQ NexusClawHQ released this 15 Aug 12:20
v0.1.0-community
4ab074d

First public Community snapshot of NexusClaw — AI-native CRM + Agent Governance Layer.

Digital employees execute real business tasks inside governed boundaries: unauthenticated execution is denied by default, every agent execution leaves a full audit trail (executions, reasoning steps, outbox events), and human corrections are captured — through a release gate — as reviewable, rollback-able capability assets.

Quick start

cp .env.example .env   # replace every replace-with-... value with a new local secret
docker compose up --build

The backend listens on http://localhost:3000 (COMMUNITY_PORT overrides the host port). Full requirements, the source build and the source-compliance contract: see the README.

Why this snapshot is different

  • 🛡️ Governance-first agents — deny-by-default autonomy; verify by reading the permission and execution paths in the source, or by probing a self-hosted instance.
  • 🔍 Auditable open-source release — every snapshot is exported deterministically and passes multi-layer leakage scans; SBOM, third-party licenses and the corresponding-source record ship in-tree; running instances expose a GET /source compliance endpoint.
  • ⚡ Fast to try — single-host Docker Compose reached full-stack readiness in 35 seconds in a recorded measurement (application listening in under 1 second; measured 2026-08-15 on a single-machine Docker environment). No general startup-time promise is made beyond that measurement.

Capability boundary (Community v0.1)

✅ Included ⏳ Not included (roadmap, not promises)
Workspace & member authentication Visual builder
Governed agent execution (deny-by-default autonomy) Packaging & template marketplace
Execution audit chain Enterprise modules
AGPL source compliance (GET /source) Billing & commercial capabilities

Integrity

  • Commit: 4ab074d2bb02b27884121ac0eaa256dc8ef85058
  • Candidate tree: sha256:b493009c3eb5af63463b9c166dd17e60c99489771fc9b593cc543358315cc5d5
  • Sealed tarball: sha256:ca31bbf85e09bff61d8231b2e5a80f96a18934c30a11fe9a2e6a00adf7af5d61
  • Approved seal record: sha256:1dbd0dbff1de58d194bd7ed90c15d07ca0733d1e0d3b93ee216bec1e2821c1cf
  • The tag is SSH-signed (ED25519). This release does not rebuild the tree; it points at the verified public commit above.

Ships in-tree

  • SBOM (sbom.cdx.json), dependency and file license reports, third-party notices (THIRD_PARTY_NOTICES.md), and the public source record (.nexusclaw-public-source.json).
  • AGPL-3.0-only LICENSE with source-disclosure instructions in docs/source-compliance.md and the GET /source endpoint of any running instance.

Capabilities (Community v0.1)

  • Workspace/member authentication (bcrypt + HS256), governed agent execution with deny-by-default autonomy, agent-execution audit trail (executions, react steps, outbox events), and AGPL source compliance endpoints. Builder/packaging, enterprise modules and billing remain out of scope for this snapshot.

Security

  • Report privately via GitHub Private Vulnerability Reporting, or support@nexusclaw.cn (see SECURITY.md).

Notes extended 2026-08-17 with quick-start and capability-boundary guidance for discoverability. All integrity and provenance statements above are unchanged.

Loading