TokenFuse v0.4.0 - live-validation fixes, fail-closed hardening

Breaking change: the Cloud dev credential is now fail-closed (#114)

An unset or empty TOKENFUSE_CLOUD_KEYS no longer grants the built-in devkey admin access. The control plane now starts with an empty keyset and rejects all requests (401, with a loud error log) until you either configure real keys via TOKENFUSE_CLOUD_KEYS or explicitly opt in to the dev credential with TOKENFUSE_CLOUD_ALLOW_DEVKEY=1. Any deployment that relied on the implicit devkey must set one of these before upgrading.

Fixes found by live infrastructure validation (Hetzner, AWS, GCP)

• x-api-key forwarding: the gateway forwards Anthropic's native auth header upstream, so pointing TOKENFUSE_UPSTREAM at api.anthropic.com works out of the box (#100)
• raft ledger: a follower's lagging local snapshot of a just-opened run no longer panics a worker under burst load; enforcement stays with the linearized reserve() (#101)
• price book: 2026 models (claude-haiku-4-5 and friends) are priced exactly instead of via the conservative fallback; the book lives in pricebook.rs with 9 models (#102)
• Wardryx PEP: a first-turn request that merely declares a forbidden tool is denied, not only one that invokes it (#103)
• Wardryx PEP: the decision cache key includes the attestation method, so an unattested agent can no longer inherit a recently-attested allow within the cache TTL (#110)

Hardening

• semantic cache: array-shaped system prompts are folded into the partition key, closing a cross-context cache-serve risk (#115)
• the unreachable UnknownRun reserve arm fails closed instead of bypassing the budget, and the cache's single-tenant reality is documented honestly (#116)

Docs

• VALIDATION.md: the live-infrastructure validation record (3-node and 4-box raft consensus, real Anthropic traffic, cross-cloud cost accounting on Hetzner/AWS/GCP)
• LICENSE copyright holder unified to TAIPANBOX; CONTRIBUTING and SECURITY added

Images: ghcr.io/taipanbox/tokenfuse:v0.4.0 (plus the :v0.4.0-cluster raft-HA variant), tokenfuse-control-plane:v0.4.0, tokenfuse-dashboard:v0.4.0.

TokenFuse v0.3.0 — RBAC & alerts, mutual TLS, security hardening

Third release. Builds on v0.2.0 (HA cluster, hosted Cloud, MCP credential-broker) by clearing the entire optional-hardening backlog — the enforcement, security, HA, and Cloud layers are now feature-complete for a young project.

Highlights since v0.2.0

Hosted Cloud

• RBAC — API keys are now key:org[:role] with admin (default) / viewer roles. Reads and ingest work for any valid key; mutations (kill, set-budget) require admin → 403 for a viewer, 401 for an unknown key. Orgs stay isolated. (#51)
• Budget alerts — GET /v1/alerts flags runs that have spent ≥ a fraction of their central budget (TOKENFUSE_CLOUD_ALERT_PCT, default 0.8, or ?pct=). The dashboard shows an alert count and a ⚠ on near-budget runs. (#51)
• Durable store — control-plane state (aggregates, kills, budgets) survives a restart via a JSON snapshot + 2 s autosave, zero external deps (TOKENFUSE_CLOUD_DATA). (#49)

HA cluster

• Mutual TLS — on top of server TLS + bearer token, a node can require a CA-signed client certificate from every peer (rustls WebPkiClientVerifier, server::serve_mtls); each node presents its own cert via TOKENFUSE_CLUSTER_CLIENT_CERT/_KEY. Cryptographic peer authentication — an unauthenticated TCP client can't complete the handshake. Enable with TOKENFUSE_CLUSTER_MTLS_CA or serve --mtls-ca. (#52)
• Linearizable follower reads — read_run_linearizable / GET /api/read-linear/{run} / Client::read_linear. (#47)

MCP credential-broker

• Response redaction + stdio transport — secrets are redacted from tool responses so a result can't leak a credential into the model's context; a newline-delimited JSON-RPC stdio transport (mcp-broker --stdio) joins the HTTP one. (#50)
• Broker hardening — DLP on outgoing tool arguments (TOKENFUSE_MCP_DLP) and a rug-pull lockfile (TOKENFUSE_MCP_LOCK). (#46)

Security hardening pass (#53)

• Request-body size limit on the gateway and broker routers (DefaultBodyLimit, TOKENFUSE_MAX_BODY_BYTES, default 16 MiB).
• Upstream connect timeout (TOKENFUSE_UPSTREAM_CONNECT_TIMEOUT_SECS). No whole-request timeout — SSE responses may run for minutes.
• A cargo audit CI job (workspace + cluster).
• Optional wasmtime 27 → 43 (the wasm feature is off by default and not in the shipped image), clearing 15 advisories incl. two critical Cranelift/Winch sandbox-escape issues. cargo audit is now green (0 vulnerabilities).
• New threat model: docs/13-security-hardening.md — trust boundaries, implemented controls, the deliberate fail-open rationale, and an honest statement that this is an in-house hardening pass, not an independent third-party audit.

Images (GHCR, all public)

• ghcr.io/taipanbox/tokenfuse:v0.3.0 · :latest — the gateway (drop-in proxy)
• ghcr.io/taipanbox/tokenfuse:cluster — gateway + raft HA (--features cluster)
• ghcr.io/taipanbox/tokenfuse-control-plane:v0.3.0 — the Cloud control plane
• ghcr.io/taipanbox/tokenfuse-dashboard:v0.3.0 — the Next.js dashboard

Tests

Workspace 100 · cluster 12 (incl. mTLS) · Python SDK 11 · cargo audit 0 vulnerabilities · clippy/fmt clean.

Known limits (deferred, not blockers)

SQL/columnar Cloud store for scale; automated cert rotation / SPIFFE identity for the mesh; an independent third-party security audit before any "GA" claim.

TokenFuse v0.2.0 — HA cluster, hosted Cloud, MCP credential-broker

TokenFuse — runtime control for AI agents. Since v0.1.0 this release adds high-availability, a hosted Cloud with a real dashboard, and an MCP credential-broker — all shipped as container images that run anywhere.

Run it

# gateway (drop-in proxy)
docker run -p 4100:4100 -e TOKENFUSE_MODE=enforce ghcr.io/taipanbox/tokenfuse

# the whole Cloud stack (dashboard :3000 + control plane :8080 + gateway :4100)
cd cloud && docker compose up

New since v0.1.0

🧬 High-availability raft cluster (crates/cluster, feature cluster / tokenfuse:cluster)

• Budget ledger replicated via openraft — Reserve/Settle are log entries, so the affordability check is linearized across gateways (no cross-node double-spend) and budgets survive a node crash.
• Hierarchical sub-agent budgets + per-run steps in the replicated state machine.
• Durable redb storage — budgets survive a process restart (verified live: destroy + recreate a container on the same volume, state intact).
• Membership changes — add/remove nodes on a running cluster (init-single / add-learner / change-membership).
• Security — shared-token auth (TOKENFUSE_CLUSTER_TOKEN) on every endpoint except /healthz, and native TLS/HTTPS (rustls; TOKENFUSE_CLUSTER_TLS_CERT/_KEY, optional self-signed CA).
• In-process + HTTP transports; gateway integration via an async LedgerBackend behind the cluster feature.

☁️ Hosted Cloud (cloud/)

• Control plane (Go, single static binary): ingests gateway telemetry, per-org aggregates, embedded dashboard. Image tokenfuse-control-plane.
• Next.js dashboard (cloud/dashboard): cards, spend-by-run chart, runs table, auto-refresh. Image tokenfuse-dashboard.
• Fleet-wide kill-switch — kill a run from the dashboard, every gateway of the org hard-stops it (402 killed).
• Central budgets — set/tighten a run's cap centrally; gateways enforce it, overriding the client header.
• Gateway CloudSink ships telemetry; kill + budget pollers pull control back down.

🔑 MCP credential-broker (tokenfuse mcp-broker)

• Agents hold only handles ({{secret:NAME}}); the broker injects the real secret at the boundary before the MCP server — secrets never touch the prompt, trace, or agent memory. Live tool-poisoning scan (off｜warn｜block).

🚀 Portability & ops

• TOKENFUSE_MODE = shadow｜warn｜enforce — the shipped image can actually enforce (402), not just observe.
• Four public GHCR images: tokenfuse, tokenfuse:cluster, tokenfuse-control-plane, tokenfuse-dashboard.
• Portable benchmark harness (bench/) + a GitHub Actions bench workflow. Networked overhead: ~1 ms p50 / ~2 ms p99.

Verified

CI green across fmt/clippy/test (Rust), Go, Next.js build, eBPF radar, and the raft-HA suite. Multiple features validated live on a Linux VPS via the published images (enforce → 402, durable HA across restart, the full Cloud stack with the dashboard).

🤖 Generated with Claude Code

TokenFuse v0.1.0 — first public release

TokenFuse — runtime control for AI agents. A drop-in proxy that enforces per-run budgets, catches runaway loops, and cuts the circuit before the bill — with a live kill-switch. Observability shows the fire; TokenFuse is the extinguisher.

Run it

# observe only (safe drop-in)
docker run -p 4100:4100 ghcr.io/taipanbox/tokenfuse
# actually enforce (return 402 on a breach)
docker run -p 4100:4100 -e TOKENFUSE_MODE=enforce \
  -e TOKENFUSE_UPSTREAM=https://api.anthropic.com/v1/messages \
  ghcr.io/taipanbox/tokenfuse

Point your agent at http://localhost:4100, add x-fuse-run-id + x-fuse-budget-usd headers. Full Get started.

Highlights

• Per-run + hierarchical sub-agent budgets (reserve→settle, integer microdollars); 402 on breach. TOKENFUSE_MODE = shadow|warn|enforce.
• Loop/runaway detection; policy modes; optional sandboxed WASM policies.
• Security: agent firewall/taint, DLP secret scanning, MCP scanner + rug-pull lockfile.
• Semantic cache, backtesting, Parquet trace + tokenfuse sql, OTel, tokenfuse top TUI, Python SDK.
• eBPF Radar for shadow-agent discovery (Linux).
• HA: raft-replicated budget ledger (openraft) — survives node crash, linearized enforcement across gateways.
• Portable container image on GHCR; sub-ms decision path (~1 ms p50 / ~2 ms p99 on the wire).

🤖 Generated with Claude Code