v2.0.0-rc.2

This prerelease hardens attestation dependency checks and adds a guarded macOS debug path.

Included:

• Loopback-only --debug-simple A2A mode with signed simulated evidence and explicit non-production warnings.
• Package-level vulnerability gates for the root, SNP, TDX, and Cocos modules.
• A fail-closed guard that rejects any golang.org/x/crypto/openpgp production or test import.
• OpenTelemetry core modules updated to v1.44.0.
• Cocos updated to the published SNP v0.1.1 and TDX v0.1.2 module tags.

Limitations:

• This is an experimental prerelease, not a production-readiness claim.
• Live SNP, TDX, and TPM hardware qualification has not been performed.
• A TDX strict-collateral success fixture is still missing.
• GO-2026-5932 remains visible at module scope through transitive x/crypto use. The OpenPGP packages are not imported, and the upstream advisory has no fixed version.

v2.0.0-rc.1

Release candidate only. SNP, TDX, and Cocos hardware qualification is incomplete; no production-ready claim is made.

v1.1.1

Security hardening

• Fail closed when replay, trust-source, or attestation interfaces contain typed nil values.
• Make the built-in memory and SETNX replay caches reject nil receivers instead of silently accepting replay state.
• Require iat and a verifier-local maximum token lifetime for both Manager grants and Agent session proofs in the supported production compositions.
• Add bounded clock-skew policy to production JWT verification.
• Require a verified mTLS client-certificate chain in the protected-change reference consumer.
• Bind reference outcome records to the accepted identity projection and reject conflicting identity reuse.

Upgrade requirement

Set both production authority roles explicitly:

managerAuthority.MaxTokenLifetime = 10 * time.Minute
managerAuthority.ClockSkew = 5 * time.Second
agentAuthority.MaxTokenLifetime = 2 * time.Minute
agentAuthority.ClockSkew = 5 * time.Second

An omitted or non-positive MaxTokenLifetime now fails closed. The Direct-Agent v1 claim names and token profile remain unchanged.

Verification

• CI: all lint, build, package, race, integration, bounded fuzz, and govulncheck gates passed.
• Security Red Team passed.
• Redis Sentinel Failover passed with a real primary stop and replica promotion in the CI topology.

This release does not add Redis discovery, a zero-loss replication guarantee, hardware-attestation qualification, or a complete application transaction. Durable outcome reconciliation remains consumer-owned.

v1.1.0

Summary

• Add the supported attestation-free production.SoftwareOnlyProfile with a distinct request type and replay domain.
• Add live mTLS protected-change E2E and negative coverage through a non-Split-Knowledge consumer.
• Add optional same-connection Redis/Valkey WAIT acknowledgement and the supported two-phase failover qualification tools.

Qualification

• Release commit 754b348e6e463ce7807be18b29fac050b51f5cb2 is GitHub verified-signed.
• CI run 30877005508 passed, including product-security, race, E2E, bounded fuzz, and govulncheck.
• Security Red Team run 30877005526 passed.
• Redis Sentinel Failover run 30877005523 passed with TLS 1.3, one primary, two replicas, and three Sentinels. The seeded replay remained rejected after automatic promotion and an ASB process restart; a fresh post-promotion write received replica acknowledgement.

Supported compatibility

The Direct-Agent v1 token shape remains unchanged. The supported v1.1 surface is defined in docs/API_COMPATIBILITY.md and includes pkg/production software-only composition plus replica-acknowledged replay and the documented failover qualification helpers.

Boundaries

• The Redis result qualifies the tested self-operated Sentinel topology only. It does not qualify a managed-provider endpoint, persistence configuration, network-partition behavior, RTO, or SLA.
• The Azure SEV-SNP bridge remains experimental. Live hardware attestation and managed KMS/HSM custody are optional deployment qualifications and are not required by the software-only profile.
• This is a stable verifier-side library/substrate release, not a claim that a complete end-user SaaS product or managed HA service has been delivered.

v1.0.0

Agent Secure Binding v1.0.0 establishes the supported Direct-Agent verifier surface.

Highlights:

• Production verifier profile with role-separated trust keys and current trust/revocation snapshots.
• Signed attestation-result policy bound to the accepted TLS session and exact action.
• TLS-only Redis/Valkey SETNX replay adapter with fail-closed behavior.
• Independent protected-change consumer application with real TLS 1.3 mTLS E2E and negative tests.
• Published API compatibility and support policy for pkg/production, the Direct-Agent v1 subset of pkg/clients, and pkg/atls/identitypolicy.

Evidence:

• Signed source commit: f29de34 (GitHub verification: valid).
• Final main CI: 30784814370 (success).
• Final main Security Red Team: 30784814359 (success).
• Proto Consistency: 30782322014 (success on the last protobuf-changing product merge).

Boundaries:

• Hardware evidence acquisition, multi-node replay-store operations/failover, draft-06 v2 adapters, gateway runtime wiring, and inherited agent/manager runtime are not part of the supported v1 surface.
• This release is a verifier component and reference deployment profile, not a complete standalone agent-security platform.

v0.5

Summary

v0.5 publishes the updated Session-Bound Agent Identity profile documents and
release PDFs from main at commit 923c199.

Changes

• Update the SSOT draft to the v0.5 review line and rebuild docs/SSOT.pdf
  with a cover page.
• Add docs/live-red-team-report.pdf as a release artifact with a cover page.
• Add copyright and a verification notice to the live red-team report stating
  that AI-generated draft text remains under human verification.
• Keep the report's security conclusions provisional until referenced checks are
  independently confirmed.

Testing

• GitHub Actions passed on commit 923c199: CI run 28026252616.
• GitHub Actions passed on commit 923c199: Security Red Team run
  28026253160.
• Local document checks run before release: pdflatex, pdfinfo, pdftoppm,
  visual PDF inspection, and git diff --check.

Notes

• Existing inherited CoCos tags such as v0.5.0 through v0.9.0 remain in the
  repository history, but this release follows the Agents Secure Binding release
  series v0.1, v0.3, v0.4, v0.5.
• The live red-team report is explicitly marked as under verification because
  it includes AI-generated draft text.

v0.4

Summary

v0.4 updates the Session-Bound Agent Identity profile with local gateway-route validation, deterministic acceptance invariants, and TLS resumption red-team coverage.

Changes

• Add a TLS 1.3 resumption harness that rejects old Session Binding Statements on a resumed session and rejects pre-binding material without tls_exporter_sha256.
• Synchronize SSOT, README, citation metadata, PDF, and live red-team report for v0.4.
• Keep gateway-routed mode separate from direct-Agent mode with Gateway Route Assertion and final-Agent holder-of-key boundaries.
• Record implemented local validation versus remaining runtime gateway, gRPC, real 0-RTT, fuzz/property, and hardware-attestation work.

Testing

• GitHub Actions passed on main: CI run 27905179146 and Security Red Team run 27905179117.
• Local checks passed: go test -race -count=1 ./pkg/agtp; go test -count=1 ./pkg/agtp ./pkg/atls/identitypolicy ./pkg/clients ./pkg/agtp/gatewayroute; git diff --check; latexmk; pdfinfo docs/SSOT.pdf.

Notes

• Real 0-RTT early-data transport coverage remains future work because the local harness uses Go standard TLS.
• Full gateway-routed network wiring and hardware-generated confidential-VM attestation replay remain outside this release.

v0.3

Summary

v0.3 hardens the Session-Bound Agent Identity profile around byte-level L2 binding, replay handling, key namespace rules, and conservative authorization comparison.

Changes

• Define the L2 binding construction with TLS exporter hash, exporter label, context bytes, attestation binder semantics, reuse rules, and negative cases.
• Require replay cache configuration for JWT/CWT one-shot acceptance APIs.
• Include TLS exporter and request-context hashes in replay keys.
• Default L6 set comparison to exact matching.
• Split gateway-routed and HTTP cache guidance into separate profile documents.
• Add an L2 binding test vector and borrowed TLS exporter red-team coverage.
• Stabilize environment-sensitive local test paths and regenerate SSOT.pdf.

Testing

• GitHub Actions passed for PR #28 before merge: lint, live-red-team, matrix tests, and upload-coverage.
• Local checks included go test -count=1 ./..., git diff --check, pdflatex, pdfinfo, and PDF render inspection.

Notes

• Gateway-routed mode remains post-v0.3 design work.
• Hardware-generated confidential-VM evidence remains outside the dependency-free local test profile.

v0.1

Summary

Initial public release of the hardware-aware TLS identity-binding profile.

Highlights

• Defines the SSOT for binding upper-layer identity and authorization material to an accepted TLS 1.3 and attestation session.
• Documents Identity Grant and Session Binding Statement roles, Manager/Agent/TLS key separation, replay handling, canonical semantic references, and cache-safety rules.
• Includes live-style red-team coverage notes for replay, relay, grant substitution, wrong-Agent, key-role confusion, attestation-binder failures, and caller-dependent cache behavior.
• Adds the SSOT PDF as a release artifact.

Verification

Focused local checks passed before release:

env GOCACHE=/tmp/go-build-cocos go test -count=1 ./pkg/agtp ./pkg/atls/identitypolicy ./pkg/clients

Notes

This is a repository security-hardening profile, not an IETF consensus document and not an AGTP/A2A core protocol change.