Agent Trust Plane v0.4.0

Agent Trust Plane v0.4.0

ATP is a pre-action authorization layer for AI agent tool calls over MCP. It checks each call's arguments against a human-to-agent delegation chain, issues single-use execution grants, records a hash-chained trace, and replays decisions as CI regression tests.

v0.4.0 is the first release since 0.3.2 and it is breaking. Run atp migrate PATH... to bring your config files up to date; a 0.3.x home upgrades itself on first use.

Highlights

• Signed delegation roots. A root grant must be signed by the human's own Ed25519 key. The operator key alone can no longer create authority for a human.
• Ed25519 execution grants with key IDs and rotation (atp keygen --rotate). The old public key verifies for one grant lifetime after rotation.
• Tool-definition pinning. atp mcp init hashes each tool's name, description and schema. A changed definition is hidden and denied (TOOL_DEFINITION_CHANGED), which closes the "rug-pull" route.
• Human approval that works. REQUIRE_APPROVAL decisions are resolved with atp approve; the approval is bound to the exact action hash, signed, and yields exactly one grant.
• Cumulative spend budgets with reserve, settle and release semantics.
• Versioned file formats and atp migrate; evidence bundles are now bundle_version: 2.
• New rule kind argument_subset_of, with exact-type comparison (1, "1" and true are different values).

Fixes found by review

• A UTF-8 byte-slice-before-decode crash in argument_allowed_values on non-ASCII input (also present in 0.3.2).
• Optional rules now treat an explicit null like an absent argument; argument_max_length no longer measures null as the string "null".
• The MCP proxy ignored the configured tool name, so rules targeting a mapped tool never matched.
• Lockfile bumped past four published advisories (certifi, opentelemetry-api, pyjwt).

Verification

733 root tests (732 passed, one opt-in third-party skip), ruff, mypy and demos on Linux CI; pinned-binary checks against agentgateway and ToolHive; 226 benchmark harness tests. See docs/release-v1/RELEASE_GATES.md for what is not measured (live-agent runs, public competitive rates, Docker MCP Gateway behaviour).

Not in this release

No audit, no production-financial-actions claim, and no published benchmark rates. Those wait for the 1.0 gates.

Agent Trust Plane v0.3.2

Agent Trust Plane v0.3.2

Distribution-readiness patch release. No product features: the
authorization kernel, policies, CLI commands and wire formats are unchanged
from v0.3.1.

What changed

• PyPI-ready README rendering: all documentation links and the hero image
  are absolute GitHub URLs.
• Improved package metadata: descriptive summary, keywords, classifiers,
  project URLs.
• agent-trust-plane console entry point (same CLI as atp) so
  uvx agent-trust-plane … can work once the package is on PyPI.
• PyPI Trusted Publishing workflow (.github/workflows/publish.yml, GitHub
  OIDC, no stored token) with tag/version/artifact gates, plus the
  scripts/check_dist.py distribution gate that CI runs on every push.
• Build backend pinned so wheels built from this tag are byte-identical
  across machines.
• Linux dependency-license verification and a dependency vulnerability
  audit with no known advisories in the tested resolution
  (docs/release/licensing.md, docs/release/verification.md).

Try locally

From the attached artifacts (or a wheel you build from this tag with
uv build):

uvx --from agent_trust_plane-0.3.2-py3-none-any.whl agent-trust-plane --help
uvx --from agent_trust_plane-0.3.2-py3-none-any.whl atp demo mcp

Once the package is published to PyPI (not yet done at the time of this
release):

uvx agent-trust-plane demo mcp

Status

• Experimental. Not production software. No users yet.
• Not independently security audited.
• macOS is not verified (not in the CI matrix).
• No IDE MCP client (Claude Desktop, Cursor, VS Code, Claude Code) has
  been tested.
• Only the mediated path is protected: an agent that can reach a tool
  without the proxy is not stopped (docs/security/enforcing-the-boundary.md).
• Agent credentials are bearer tokens with expiry and revocation, no proof
  of possession; the operator key and .atp/keys.env are omnipotent.
• Single-use grants prove one release, not exactly-once external effects.

Full lists: docs/security/threat-model.md, docs/security/security-review.md.
Changelog: CHANGELOG.md (0.3.2).

Agent Trust Plane v0.3.1

Patch release following the first public CI run. No new features. Experimental software; not production software; not independently security audited.

What changed

• atp demo wrap --out <relative path> no longer resolves the output directory twice (the demo's own atp subprocesses run from that directory). Found by the first GitHub Actions run on ubuntu and windows.
• A regression test for that shape (test_demo_wrap_accepts_a_relative_out_dir).
• Compatibility matrix and verification record now reflect the remote CI results instead of "not run on a remote".

Verified

GitHub Actions on the tagged commit (https://github.com/TimelessVisions/agent-trust-plane/actions/runs/35259397172):

• ubuntu-latest, Python 3.12 — PASS
• ubuntu-latest, Python 3.13 — PASS
• windows-latest, Python 3.13 — PASS
• package (wheel build, isolated uvx run, pip-audit, SBOM) — PASS
• dashboard (typecheck, production build) — PASS

Locally (Windows 11, Python 3.14): the full release checklist in docs/release/verification.md, plus the previously failing invocation atp demo wrap --out <relative dir> from a clean temporary directory.

Install

Not published to PyPI. Either install from the repository at this tag:

uvx --from "git+https://github.com/TimelessVisions/agent-trust-plane@v0.3.1" atp demo wrap

or use the attached artifacts, rebuilt from a clean export of this tag and smoke-tested in an isolated environment (uvx --isolated --from <wheel> atp doctor):

• agent_trust_plane-0.3.1-py3-none-any.whl — sha256 cc5bd8dd94dc42273bc63a7b2f52cfce9588d3eeb2ae0a3cbdb08523739d2731
• agent_trust_plane-0.3.1.tar.gz — sha256 dec67508021fdb7957e4f603c8823e98d2a47d0a33ceba3523878f856038b7fe

Known limitations

• macOS is not verified (not in the CI matrix).
• No IDE MCP client (Claude Desktop, Cursor, VS Code, Claude Code) has been tested; the compatibility matrix lists them as not verified.
• Not published to PyPI.
• Only the mediated path is protected: an agent that can reach a tool without the proxy is not stopped (docs/security/enforcing-the-boundary.md).
• Agent credentials are bearer tokens with expiry and revocation, no proof of possession; the operator key and .atp/keys.env are omnipotent.
• Single-use execution grants prove one release, not exactly-once external side effects.
• Not independently security audited. Not production software.

Full lists: docs/security/threat-model.md, docs/security/security-review.md. Changelog: CHANGELOG.md (0.3.1 and 0.3.0).