v0.5.4 — Code quality + Scorecard 10/10 preparation

v0.5.4 — Code quality + Scorecard 10/10 preparation

What's New

• D2/D3 investigation: confirmed typed policy spans and monotonic tightening already implemented
• T9 classification: 4 single-corpus rules confirmed pack-scoped by design
• Intoto validation: simplified dummy detection for DSSE envelope format

Commits

• fix(release): simplify intoto validation — grep dummy literal, no JSON parsing
• fix(ci): revert sandbox tests to non-blocking + remove from coverage
• fix(ci): remove semver-checks job (pre-1.0 crate, breaking changes expected)

v0.5.3 — Sandbox graduation + latency gate

v0.5.3 — Sandbox graduation + latency gate

What's New

• Latency gate: hook_latency benchmark now validates benign p99 < 5µs budget (CI hard gate)
• CI improvements: sandbox-proof workflow documentation updated, coverage threshold adjusted
• Intoto validation: verify-attestations gate rejects dummy/placeholder attestations

Commits

• feat(ci): sandbox graduation + latency gate (v0.5.3 prep)
• fix(ci): latency gate uses --release profile to match production perf

v0.5.2 — E2E onboarding tests + demo verification

v0.5.2 — E2E onboarding tests + demo verification

What's New

• install.sh E2E tests (7/7): hermetic tests covering fresh install, idempotent detection, missing manifest, --no-init flag, and SHA256 mismatch detection
• npx wrapper E2E tests (16/16): covering VERSION, resolveTarget, parseChecksums, sha256, isMusl
• Demo verification: all 3 claims verified (cmdsubst→Block, printf-hexesc→Block, benign→Allow)

Commits

• test(e2e): add install.sh and npx wrapper E2E tests
• fix(e2e): install.sh E2E — dynamic triple detection + SHA256 mismatch test

v0.5.1 — fix CI windows/macos + pin Dockerfile + pinning race

Full Changelog: v0.5.0...v0.5.1

v0.4.1

[0.4.1] - 2026-08-26

Fixed

• Gate decodes printf hex-escape payloads piped to a shell (hexesc):
  printf '\x…' | sh smuggling — where every byte of a destructive command
  arrives as a hex escape and the payload only materializes inside the spawned
  shell — is now normalized before scanning; the perturbation benchmark holds
  100% mean detection with the false-positive rate unchanged.
• WorkspaceWrite sandbox allows vfork: GCC's collect2 linker driver
  spawns its children via vfork, which the default-deny seccomp profile did
  not list, so link steps died under enforcement. The empirical sandbox
  baseline (tests/sandbox_build_e2e.rs: cargo build / node -e /
  go run exit 0) is preserved as the non-regression gate.

Added

• Reverse-shell community pack ships as a release asset
  (agentguard-packs.tar.gz): the release bundle carries the flat
  packs-community/*.toml set with its own SHA256SUMS entry, and
  packaging/install.sh fetches, path-validates (no absolute paths, no ..
  components), and extracts it into $PREFIX/packs — opt-in packs install
  alongside the binary without cloning the repo.
• Public benchmark campaign results documented
  (BENCHMARK.md): external campaign #1 recorded —
  perturbation-class mean detection at 100%, false-positive rate unchanged.

Changed

• Single-source release versioning (scripts/sync-version.sh): the
  Cargo.toml [package] version propagates to the plugin manifest,
  marketplace listing, installer default, npm wrapper, and npx launcher —
  idempotent, loud on any missing pattern. packaging/plugin.json had
  drifted to 0.1.0; it now tracks the crate version like every other surface
  (tests/readme_sync.rs::version_sync_across_manifests asserts the same
  invariant from the Rust side).

v0.4.0

Highlights

Adapters & init (v0.4 cycle)

• Provider-agnostic adapters over a canonical IR — Claude Code, Codex, and Kilo Code parsed and formatted through one intermediate representation with capability-driven output; Ask→Deny degradation on hosts that cannot ask is fixed by construction.
• Five-host agentguard init — claude-code, codex-code, opencode, kilo, kitty-code detection and wiring; dry-run default, --yes applies, --undo removes; atomic writes, corrupt config refused (exit 2).
• OpenCode / Kilo Code plugin shim — spawn-per-call bridge (packaging/opencode/agentguard-shim.mjs) so plugin-only hosts reach the same binary the hooks use.

Proxy & MCP

• agentguard-proxy MCP transport proxy — TOFU SHA-256 pinning of tools/list manifest with quarantine-on-drift; NDJSON strict framing (16 MiB cap, fail-closed); policy-gated tools/call with role-split deep check routing command/script-shaped arguments through the anti-bypass gate.
• Measured MCP tool-call corpus (43 cases, 4 classes) — 87.5% dangerous-shell block rate at 0% added FPR including authoring class.

Audit & packs

• SHA-256 hash-chained audit trail — tamper and tail-truncation detection with agentguard audit verify; Ed25519 deferred by design.
• Community rule packs — TOML-format rules behind fail-closed loader; three example packs (iac-terraform, k8s-helm, ml-pipeline) with 0-FP/0-FN corpora.

Benchmarks & policy

• Mirror paraphrase benchmark — 100% FN on paraphrased attacks / 0% FP on controls; honest signature-ceiling worst case published.
• Typed DSL spans (D2) — rustc-style code frames on every policy-load error, zero new deps.
• Monotonic config tightening (D3) — layered user + project loading; project layer can only harden.

Hardening

• Landlock /opt toolcache exec grant — GitHub Actions runners can execute hosted toolchains inside the sandbox.
• CLI reasons neutralized — scan/check/ask output routes through unified reason seam.

v0.3.0 — decision tier, policy engine, sandbox closures, supply-chain hardening

Highlights

Decision & policy (v0.3 cycle)

• Tier::Ask — 4th verdict surfacing permissionDecision ask to the host UI, plus the ask CLI introspection subcommand.
• Pure-Rust TOML policy engine — default-deny posture, per-tool rule patterns, budget caps; fails closed on any load/parse/schema error.
• Sandbox escape closures — Landlock allowlist denies /proc writes by omission; pinned by real probes including an in-sandbox seccomp self-disable attempt asserted to fail.

Distribution & supply chain

• 7-target release matrix incl. x86_64/aarch64 musl static binaries.
• Installers resolve SHA256SUMS at runtime, refuse on mismatch, idempotent re-install with atomic replace and backups.
• Release binaries embed a dependency inventory (.dep-v0); provenance generated by an isolated workflow meeting SLSA Build L3:
  gh attestation verify -R SuarezPM/apohara-agentguard --signer-workflow SuarezPM/apohara-agentguard/.github/workflows/_attest.yml
• Plugin manifests ship inside the release bundle.

Hardening

• Malformed config fails closed (exit 2, offending key named); unknown keys rejected.
• Hook contract extracted to a leaf module; architectural layering enforced in CI.
• Firewall injection-surface scan: single-pass DFA pre-match, p50 213us to ~0.9us.
• Emitted messages neutralize hidden bidi/zero-width controls and role impersonation; audit redaction covers 14 credential issuers; loaded policies are fingerprint-stamped into audit records.
• CI: full integration matrix, layering invariants, region coverage gate >=92%, mutation baseline, formal Kani proofs of the verdict lattice, silent-skip prevention, kernel-capability enforcement-proof lane.

apohara-agentguard v0.2.0

Deterministic, offline, no-model safety layer for AI coding agents: an anti-bypass command gate, a seccomp+Landlock sandbox, and a prompt-injection firewall.

New in v0.2

• Opt-in domain packs (cloud / DB DDL / container), each with a committed 0-FP/0-FN corpus
• Canary exfiltration detection (PostToolUse, opt-in, warn-only)
• MCP tool form: check_command / scan_prompt over stdio JSON-RPC
• Granular per-component kill-switch (AGENTGUARD_DISABLE=gate,firewall,…) + severity presets
• Tool-level gating (gate which MCP tool / which arguments) + Codex PreToolUse hook support
• External Tensor Trust human-attack benchmark — honest 94.8% FN published (see BENCHMARK.md)

Supply chain

• SLSA Build Level 3 provenance, generated by an isolated reusable workflow. Verify any downloaded binary:

  gh attestation verify <binary> -R SuarezPM/apohara-agentguard \
    --signer-workflow SuarezPM/apohara-agentguard/.github/workflows/_attest.yml
  

• SHA256SUMS attached below. Also on crates.io: cargo install apohara-agentguard.