Skip to content

v0.4

Choose a tag to compare

View all tags
@thinksyncs thinksyncs released this 23 Jun 06:40
· 139 commits to main since this release
v0.4
37d8b3c

Summary

v0.4 updates the Session-Bound Agent Identity profile with local gateway-route validation, deterministic acceptance invariants, and TLS resumption red-team coverage.

Changes

  • Add a TLS 1.3 resumption harness that rejects old Session Binding Statements on a resumed session and rejects pre-binding material without tls_exporter_sha256.
  • Synchronize SSOT, README, citation metadata, PDF, and live red-team report for v0.4.
  • Keep gateway-routed mode separate from direct-Agent mode with Gateway Route Assertion and final-Agent holder-of-key boundaries.
  • Record implemented local validation versus remaining runtime gateway, gRPC, real 0-RTT, fuzz/property, and hardware-attestation work.

Testing

  • GitHub Actions passed on main: CI run 27905179146 and Security Red Team run 27905179117.
  • Local checks passed: go test -race -count=1 ./pkg/agtp; go test -count=1 ./pkg/agtp ./pkg/atls/identitypolicy ./pkg/clients ./pkg/agtp/gatewayroute; git diff --check; latexmk; pdfinfo docs/SSOT.pdf.

Notes

  • Real 0-RTT early-data transport coverage remains future work because the local harness uses Go standard TLS.
  • Full gateway-routed network wiring and hardware-generated confidential-VM attestation replay remain outside this release.
Assets 3
Loading