Skip to content

Agent Trust Plane v0.4.0

Latest
Latest

Choose a tag to compare

View all tags
@TimelessVisions TimelessVisions released this 10 Nov 06:14
v0.4.0
ec18e9a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Agent Trust Plane v0.4.0

ATP is a pre-action authorization layer for AI agent tool calls over MCP. It checks each call's arguments against a human-to-agent delegation chain, issues single-use execution grants, records a hash-chained trace, and replays decisions as CI regression tests.

v0.4.0 is the first release since 0.3.2 and it is breaking. Run atp migrate PATH... to bring your config files up to date; a 0.3.x home upgrades itself on first use.

Highlights

  • Signed delegation roots. A root grant must be signed by the human's own Ed25519 key. The operator key alone can no longer create authority for a human.
  • Ed25519 execution grants with key IDs and rotation (atp keygen --rotate). The old public key verifies for one grant lifetime after rotation.
  • Tool-definition pinning. atp mcp init hashes each tool's name, description and schema. A changed definition is hidden and denied (TOOL_DEFINITION_CHANGED), which closes the "rug-pull" route.
  • Human approval that works. REQUIRE_APPROVAL decisions are resolved with atp approve; the approval is bound to the exact action hash, signed, and yields exactly one grant.
  • Cumulative spend budgets with reserve, settle and release semantics.
  • Versioned file formats and atp migrate; evidence bundles are now bundle_version: 2.
  • New rule kind argument_subset_of, with exact-type comparison (1, "1" and true are different values).

Fixes found by review

  • A UTF-8 byte-slice-before-decode crash in argument_allowed_values on non-ASCII input (also present in 0.3.2).
  • Optional rules now treat an explicit null like an absent argument; argument_max_length no longer measures null as the string "null".
  • The MCP proxy ignored the configured tool name, so rules targeting a mapped tool never matched.
  • Lockfile bumped past four published advisories (certifi, opentelemetry-api, pyjwt).

Verification

733 root tests (732 passed, one opt-in third-party skip), ruff, mypy and demos on Linux CI; pinned-binary checks against agentgateway and ToolHive; 226 benchmark harness tests. See docs/release-v1/RELEASE_GATES.md for what is not measured (live-agent runs, public competitive rates, Docker MCP Gateway behaviour).

Not in this release

No audit, no production-financial-actions claim, and no published benchmark rates. Those wait for the 1.0 gates.

Assets 4
Loading