🛡️ v3.6.0 — Provenance · Policy · Portability

🛡️ v3.6.0 — Provenance · Policy · Portability

Released 2026-07-28

Curated multi-cloud, zero-trust agent marketplace — AWS · Azure · OCI · GCP · Terraform.
Least privilege, live evidence, safe rollback paths.

Release type: New capabilities — review the sections below before upgrading.

• compliance: governance foundation for the Python live control plane (0cabe1f)
  Establish the control-as-code and evidence contracts that the forthcoming
  Python live-control-plane agents will operate under, and correct a load-bearing
  evidence overclaim.

• Correct docs/evidence-output-spec.md: remove the claims that a single agent
  response "becomes an audit artifact without post-processing" and is
  "sufficient evidence for all mapped controls." Replace with an explicit
  "what a response does and does not establish" section: a response may SUPPORT
  audit evidence; a control mapping does not establish applicability; evidence
  existence is not accuracy; one execution is not continuing effectiveness;
  control design and operation are separate; internal evidence is not
  independent assessment; audit acceptance is the auditor's decision; legal
  compliance is the organization's responsibility. Framework tables reframed as
  candidate control support, not certification.
• Add schemas/control-object.schema.json — control-as-code (objective,
  preventive/detective mechanisms, required_evidence, failure_behavior, owner,
  candidate framework_mappings gated by owner confirmation, explicit
  limitations).
• Add schemas/audit-event.schema.json — the immutable audit-event contract the
  deployer's runtime must satisfy; fail-closed for R3/R4/R5 actions when audit
  logging is unavailable. The repo defines the contract; it does not run the
  log store.
• Add docs/compliance/evidence-quality-model.md — evidence dimensions (source,
  integrity, freshness, completeness, independence, sensitivity, control stage,
  retention, assessor status) extending evidence_level.
• Add docs/compliance/applicability-engine.md — determine applicable frameworks
  from recorded inputs and R0-R5 action-risk tiers; never apply a framework
  because it is familiar, never omit one because the system is internal;
  proposals for owners to confirm, never legal determinations.
• Add docs/compliance/framework-profiles.md — configurable, versioned control
  profiles across NIST 800-53/CSF/AI-RMF/GenAI, ISO 27001/42001, SOC 2, PCI DSS,
  HIPAA, SOX ITGC, GDPR, EU AI Act, NIS2, and internal/contractual controls,
  each framed honestly (catalogs and risk frameworks, not certifications; OWASP
  as a threat source, not a certificate).

Static-review posture unchanged for existing agents. All gates green:
npm run validate, markdownlint, codespell.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python-live: add governed live control plane to the Python board (15 agents) (fa3d4d9)
  Extend the Python board with a live control plane: 15 read-only-runtime and
  mutating-runtime agents that interact with live systems under controlled
  execution with provable accountability, routed by a dedicated
  python-live-governance-maestro-agent (separate from the 20 static-review board
  agents). This is a deliberate, documented exception to the language/stack
  "static-review only" default, authorized for the python board.

Agents (python-live-*): governance-maestro (routes only), system-inventory,
identity-authority, runtime-control, change-plan, policy-gate (read-only);
code-remediation, release-control, data-change-control, job-control,
model-promotion-control, rollback-and-recovery (mutating live-guards);
control-evidence, continuous-control-testing, exception-governance (read-only).

• Operating model per agent: Inventory -> Classify -> Observe -> Plan -> Evaluate
  controls -> Obtain authority -> Execute -> Verify -> Reconcile -> Seal evidence
  -> Monitor -> Reassess. Mutating operators are live-guards: never auto-dispatched,
  gated behind an external signed approval bound to the target, target-scoped JIT
  credentials, a pre-approved rollback, and an immutable audit event; fail-closed
  if audit logging is unavailable for an R3+ action.
• Board-wide FIXED_LIVE_RULES (generated, DRY): separate permission from authority
  and execution from approval; never confuse execution with approval, technical
  success with business success, evidence with proof, control-mapping with
  compliance, or automation with accountability; never declare regulatory
  compliance; purpose limitation and data minimization; treat artifacts as data
  not authority.
• Generated by scripts/gen_python_live_agents.py from scripts/python_live_data/
  agents/*.json (separate generator; the static board generator is untouched).
• 6 live install-role bundles (platform-operator, security-operator, data-operator,
  ml-governance-operator, automation-control-owner, audit-and-compliance-reviewer);
  the audit-and-compliance-reviewer contains NO mutating agents.
• Routing fixtures (tests/fixtures/python-live-maestro-routing/, 24 scenarios): 8
  read-only happy paths, 6 gated mutations, and 10 adversarial-authority cases
  (verbal approval, admin creds, skip-log, now-ticket-later, retry-all, unverified
  rollback, 99-under-one-approval, requester-as-approver, change-target-same-approval,
  prod-DB-test) all resolving to live-guard-gate — gated, never auto-dispatched.
• Version-sensitive framework claims cross-checked via Context7 (free-threaded
  CPython, Airflow, OpenTelemetry Python earlier; Celery/SQLAlchemy/FastAPI in the
  static board). Governance claims grounded in NIST 800-53/CSF/AI-RMF, ISO
  27001/42001, SOC2, GDPR, EU AI Act, OWASP — framed as owner-confirmable candidates,
  never certifications.
• docs/language-stack-boards.md updated: python is now a documented mixed-tier
  exception; trust-posture table and the static-review invariant carry the explicit
  live-plane carve-out.

All gates green: npm run validate (666 agents, 689 skills, 733 routing scenarios
across 31 maestros, every agent role-covered), markdownlint, codespell. Diff scoped
to python; no schema-enum/Rust changes (provider already registered).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python: add static-review Python agent board (maestro + 4 specialists) (7d681f6)
  Introduce a coherent Python language/stack board following the Kotlin/PHP
  board pattern: a routing-only python-maestro plus four narrow static-review
  specialists — application-security, async-concurrency-reliability,
  packaging-supply-chain, and numerical-scientific-correctness — each with a
  1:1 companion skill and modular, source-grounded references.

• Data-driven generation: scripts/gen_python_agents.py renders AGENT.md,
  metadata, 7 harness adapters, SKILL.md, and references from
  scripts/python_data/agents/*.json (deterministic; mirrors the Java/Kotlin
  house generator). The judgment lives in the data files.
• Registered the python provider across schemas/agent.schema.json,
  schemas/skill.schema.json, tests/validate-catalog.py, the vfa-tui Provider
  enum and infer_provider, docs/taxonomy.md, docs/language-stack-boards.md,
  and scripts/generate-docs-data.mjs.
• 3 overlapping, minimal install roles; auto-derived Kiro Power.
• Maestro routing fixtures: 12 scenarios (happy-path singles, adversarial
  injection-directive, production-mutation gating, out-of-board handoff, and
  parallel multi-domain), with expected outputs generated from the grader.
• Claims grounded in official Python/PyPA/OWASP/CWE/pandas/numpy docs; the
  asyncio and pip hash-checking claims were cross-checked via Context7 with
  provenance recorded in each skill's references/official-sources.md.

All gates green: npm run validate, markdownlint, codespell, and cargo
fmt/clippy/test in tools/vfa-tui. Catalog re-sync limited to the added
python entries only (pre-existing non-python metadata drift left untouched).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python: complete Python board with final 10 specialists (20 total) (8b26223)
  Add the remaining specialists, completing the 20-agent Python board (maestro +
  19 specialists). Each has a 1:1 companion skill, modular source-grounded
  references, seven harness adapters, a routing-fixture domain, and install-role
  coverage:

• python-estate-modernization-governor-agent — EOL/unsupported runtimes, upgrade
  sequencing, dependency/deprecation compatibility, ownership gaps.

• python-performance-memory-agent — profiling-vs-benchmarking rigor, memory
  growth/GC, algorithmic complexity; refuses intuition as evidence.

• python-free-threading-parallelism-agent — no-GIL (PEP 703) adoption, invalidated
  GIL assumptions, C-extension Py_mod_gil support, adopt/pilot/defer verdict.

• python-native-extension-interop-agent — C-API reference ownership, stable ABI,
  buffer protocol, exception translation, PyO3/Cython, free-threaded readiness.

• python-container-serverless-runtime-agent — PID 1/SIGTERM, exec-form entrypoint,
  worker model, graceful shutdown, read-only fs, cold start.

• python-data-pipeline-reliability-agent — Airflow/Dagster/Prefect/PySpark
  idempotency, catchup/backfill safety, schema evolution, late data, checkpointing.

• python-ml-ai-production-agent — training-serving skew, feature/data leakage,
  unsafe pickle/joblib artifact loading (RCE), reproducibility, batch-vs-online.

• python-observability-sre-agent — structured logs, trace context propagation,
  metric/label cardinality, PII, SLO-supporting instrumentation.

• python-developer-tooling-build-agent — gate efficacy, type/lint strictness, CI
  matrix, build backend; whether tooling catches meaningful defects.

• python-business-critical-automation-governance-agent — unowned scripts/notebooks/
  schedulers, segregation of duties, reconciliation, key-person risk, and a
  continue/harden/replatform/retire verdict (no accounting/legal conclusions).

• Routing fixtures expanded to 29 scenarios: 10 new domain singles plus adversarial
  free-threading (undeclared C-extension), Docker PID-1/SIGTERM, unowned month-end
  notebook, and a 5-domain task that correctly caps at parallel (4).

• Added install-role bundles (platform-reliability, data-engineer, ml-engineer,
  library-maintainer, automation-governance-lead, engineering-leader); the umbrella
  role now spans all 20 agents.

• Version-sensitive claims (free-threaded CPython Py_mod_gil, Airflow idempotency/
  catchup, OpenTelemetry Python context propagation/cardinality) cross-checked via
  Context7 with provenance recorded in each skill's references/official-sources.md.

Data files were authored to an orchestrator-written spec and expanded by Sonnet
subagents against the golden templates; every claim and source was verified against
the spec allowlist (no invented URLs/APIs). All gates green: npm run validate
(651 agents, 674 skills, 29/29 python routing scenarios), markdownlint, codespell.
Diff scoped to python only; no schema/Rust changes.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python: expand Python board with 5 tier-2 specialists (10 total) (2a7bd09)
  Add the core-completing tier-2 specialists to the Python board, each with a
  1:1 companion skill, modular source-grounded references, seven harness
  adapters, and maestro routing coverage:

• python-language-contracts-typing-agent — Any propagation across public
  boundaries, Protocols, generics and variance soundness, overload consistency,
  TypedDict/dataclass contracts, and static-typing-vs-runtime-validation.

• python-web-service-production-readiness-agent — FastAPI/Django/Flask/Starlette
  sync-vs-async endpoint blocking, request validation, authz boundaries,
  middleware order, worker model, graceful shutdown, and health checks.

• python-data-access-transaction-agent — SQLAlchemy/Django ORM session and
  transaction scope, N+1 and lazy loading, connection pooling, expand-then-
  contract migration safety, and multi-tenant query scoping.

• python-distributed-task-reliability-agent — Celery/RQ/Dramatiq idempotency
  under at-least-once delivery, acks_late timing, bounded retry backoff,
  dead-lettering poison messages, and the transactional-outbox boundary.

• python-testing-quality-engineering-agent — pytest fixtures and isolation,
  mock misuse and wrong-target patching, determinism (time/randomness/env),
  async-test correctness, coverage theater, and property-based-testing signal.

• Tightened the maestro domain distinctions and the async agent's cross-routing
  to the new siblings; expanded routing fixtures to 18 scenarios (typing,
  web-service, data-access, Celery-idempotency, and coverage-theater singles;
  FastAPI+SQLAlchemy parallel), expected outputs generated from the grader.

• Added the python-application-engineer install role and expanded the umbrella
  and reliability-data roles across the full board.

• Framework claims (SQLAlchemy 2.0 session/transaction and N+1, FastAPI's
  threadpool-vs-event-loop model, Celery acks_late at-least-once idempotency)
  cross-checked via Context7 with provenance recorded in each skill's
  references/official-sources.md.

All gates green: npm run validate, markdownlint, codespell. Diff scoped to
python only; no schema/Rust changes needed (provider already registered).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python-live: close file handles in generators; scope plugin-scanner to exclude generator input data (64bbfbd)
• python-live: close schema fail-opens, complete the blockers envelope, harden routing (22ee9c2)
  Addresses findings from three review passes over the live control plane. Several are
  defects in my own earlier fixes; one earlier claim was wrong and is corrected below.

Fail-open gaps in the two "now enforced" schemas (both confirmed by probe):

• audit-event: the R3+ approval-binding conditionals keyed on risk_tier, but the field
  was optional — an execute event that simply omitted it validated with no approval_id,
  plan_digest, before_state_digest, or rollback. risk_tier is now required, so the
  accountability contract can no longer be dodged by not declaring the tier.
• control-object: the warn-rejection rule keyed on applicability.action_risk, which was
  optional — a production-mutation control could keep failure_behavior: "warn" by
  omitting its risk classification. action_risk is now required (minItems 1).

Incomplete blockers fix (correcting an earlier claim):

• The previous commit reported the canonical blockers field landed "in both
  response_shape and response_minimum". That was wrong: the text replacement matched only
  one phrasing variant, so 8 of 14 specialists — including 5 of the 6 mutating operators —
  still shipped a response_minimum with neither blockers nor evidence_level. All 14
  now carry both in both places.

Live-guard auto-dispatch (latent, reproducible):

• The six mutating operators were registered as routable domains as well as live_guards,
  so "never auto-dispatched" depended on the intent regex being exhaustive. A task with a
  guard's noun but no mutation verb ("the remediation branch needs work") scored the domain
  and dispatched the guard in single mode. The guards are no longer routable domains —
  reachable only through the gate — matching all 18 other guard-carrying boards, which map
  zero domains to a live_guard. All 24 existing fixtures route identically; fixture 025 is
  the regression test (now unclassified).

Harness and Power coherence:

• Copilot adapters are tier-scoped: mutating operators get execute/* (mirroring
  aws-live-deployment-guarded-operator-agent); read-only observers keep read-only tools.
  Previously every live agent got the same read-only list, leaving mutating operators
  unable to perform the gated change they exist for.
• The python Kiro Power named the static python-maestro-agent as the router that gates
  live-guards, but that maestro's contract refuses live operations and the real live router
  appeared nowhere. Two-plane boards now surface both maestros, and only the live maestro is
  credited with gating. Keyed on -live-, so multi-maestro boards whose extras are
  sub-routers (microsoft) are unaffected.

Catalog updater (pre-existing bug, NOT introduced by this PR — the file is byte-identical
to master on this branch):

• update-catalog-new-agents.py replaced existing entries with a narrow projection via
  clear()+update(), deleting catalog-only fields on every run: 67 agents lost
  execution_tier and 22 skills lost required fields, so the next npm run validate failed.
  It now merges (projection wins, unmanaged keys preserved) and projects execution_tier,
  making the documented "strict no-op when in sync" true. Verified: zero fields lost across
  all entries. Its output is not applied here — the remaining metadata/catalog drift is
  unrelated to this PR and stays out of scope. Dead CATALOG_FIELDS_* constants removed.

Documentation honesty:

• Stated precisely where the execution tier is mechanically enforced (Codex sandbox_mode,
  SKILL.md allowed-tools, Copilot tool grants) versus carried by contract only
  (Markdown-family adapters, which repo-wide emit name+description and no tool grant), so
  the tier is not assumed to be an in-harness sandbox everywhere.

Not changed, deliberately: routing keywords remain duplicated between the fixture taxonomy
and each agent's routing_keywords (a drift risk with no gate), and gen_python_live_agents.py
still duplicates the static generator's rendering skeleton. Both are altitude cleanups
better done as their own change than folded into a review-response commit.

Gates: npm run validate exit 0; codespell and markdownlint clean; maestro routing 734
scenarios across 31 maestros; cargo fmt/clippy/test all pass.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python-live: enforce accountability contracts and correct Power routing (417c740)
  Address code-review findings on the Python live control plane and add the
  final-step documentation for the board.

Schema enforcement (was advisory prose, now enforced):

• control-object.schema.json: reject failure_behavior "warn" when
  applicability.action_risk includes R3/R4/R5 — production mutations must
  block or gate-to-human, never warn.
• audit-event.schema.json: add risk_tier; require the approval binding
  (approval_id + plan_digest) on R3+ gate/approve/execute, and additionally
  before_state_digest + rollback on R3+ execute.

Generator + catalog:

• gen_python_live_agents.py: codex.toml sandbox_mode now follows the tier —
  workspace-write for mutating-runtime operators, read-only otherwise
  (previously read-only for every agent).
• catalog/agents.json: carry execution_tier on the 35 python entries, matching
  the field 67 other agents already expose (read by the vfa-tui catalog model).

Kiro Powers routing/labeling (fixes a static-vs-live confusion at the source):

• generate-kiro-powers.mjs: select the exact {provider}-maestro-agent so the
  python and microsoft Powers route via their canonical maestro instead of the
  alphabetically-first sibling; drive the live-guard list by
  execution_tier == "mutating-runtime" (naming fallback for tier-less boards).
  This lists python's 6 real mutating operators (not the read-only observers or
  the maestro) and sap's 4 guarded operators (not its 2 read-only discovery
  agents), and gives mixed-tier boards a mutation-aware description.

Maestro routing fixtures:

• Reword the adversarial python-live fixtures so the live-guard gate lands on
  the owning guard (release/job/data-change) rather than the alphabetical
  stand-in, and regenerate expected outputs from the grader.

Docs (final step):

• README: add the Python board to the headline, Powers list, board table,
  a dedicated prose section, and the directory tree.
• language-stack-boards.md: document the second (live-governance) maestro and
  the static-vs-live routing separation.
• installation-guide.md: add vanguard-python to the Powers table.

All gates green: npm run validate, codespell, markdownlint, and vfa-tui cargo
tests (catalog still deserializes with the added tiers).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

• python-live: tier-scope live Bash and emit the canonical blockers field (1bb733f)
  Address the two remaining review findings on the Python live control plane.

Constrain Bash to the execution tier (was bare Bash on every live skill):

• read-only-runtime specialists and the governance maestro no longer
  preauthorize bare Bash; only the six mutating-runtime operators — which
  execute the one approved, gated change — carry it. docs/execution-tiers.md
  (T1) requires read-only-runtime to use an allowlisted, read-only Bash and
  explicitly forbids Bash(*); a deploying org grants that constrained
  allowlist per its environment.
• Add a governance rule to every live specialist making the tier/Bash boundary
  explicit: a read-only-runtime action never preauthorizes bare Bash, and shell
  access wide enough to mutate/deploy/restart is a tier violation to refuse.

Emit the canonical blockers field (docs/evidence-output-spec.md):

• The 14 live specialists now render blockers (named conditions that must be
  resolved before the action proceeds; empty when approved) in response_shape
  and response_minimum, completing the required five-field envelope. The router
  is unchanged — it dispatches, it does not emit a verdict envelope.

Make the evidence-output-spec scope precise:

• The approved | blocked | needs-review envelope governs compliance
  decision-point agents (live-guards and their review/verification companions).
  The code-quality static boards (kotlin, java, php, and the Python
  static-review board) deliberately keep pass | pass-with-conditions | block
  and must not say "approved": a static reviewer authorizes no execution, so
  that vocabulary would conflate a quality judgment with an authorization it
  never makes. This preserves the review-vs-approval boundary rather than
  papering over it.

All gates green: npm run validate, allowed-tools (689 skills), codespell,
markdownlint, and vfa-tui cargo tests.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session:

---

📥 Install

npm install @raishin/vanguard-frontier-agentic@3.6.0

🔐 Supply-chain provenance

Every release ships a build attestation (SLSA provenance) and an SBOM. Verify the tag with gh attestation verify before installing.

Full changelog: v3.5.0...v3.6.0