Agent Guard 0.2.10

Agent Guard 0.2.10 is a bounded Broker reliability and security maintenance release.

Repairs

• One-use grants acquire a permanent exclusive consumption marker before any grant read/archive operation. Concurrent patched consumers cannot claim the same ID; failures and interruption do not revive it. Windows approval-ledger access retains the permissions required by its existing lock.
• Broker Git operations use a finite shared budget per preview and execution (default 300 seconds, configurable 1–3600). Human confirmation is excluded. Managed process cleanup and bounded output capture avoid ordinary unbounded child/pipe waits.
• A lost push acknowledgement is recorded as indeterminate, not definitely refused. The exact transaction and consumed grant are retained, without an automatic retry. CLI exit 3 means the remote may already have changed.
• Packaged locks include Tokio 1.51.6 for RUSTSEC-2026-0386. Existing downstream lockfiles still need their own update.
• Python async audit tests now wait for queued-record visibility within a finite budget. Production audit durability/overflow behavior is unchanged.

Upgrade before using an existing grant store

Stop all old Broker consumers first. Preserve spent/claim-<id>.consumed and archived grant JSON together. Empty/partial markers already mean consumed; they are not stale locks. Never remove markers, restore pending grants or roll back a store to retry. A new approval requires a new ID. Mixed old/new consumers and whole-store rollback are outside the guarantee.

Broker receipt schema v1 adds attempt.outcome: indeterminate. Existing pushed/refused bytes and signing preimages remain stable, but Rust exhaustive matches and JSON readers must handle the new value or reject it explicitly. For exit 3, reconcile the exact URL/ref/OID using trusted read-only operator tooling before considering any fresh approval. Timeout is not rollback; do not automatically push again.

Scope

The budget needs a live supervisor and does not forcibly cancel physical snapshot I/O or uninterruptible OS/filesystem/spawn work. It is not containment for malicious detached trusted helpers. Grant storage must be protected; arbitrary network filesystems, writable parents and power-loss durability are not promised. Windows ambient handles and general shared-hard-link containment remain open. The hook remains fail-open/advisory, and unsigned receipts do not prove credential isolation.

Source, compatibility and regression details: CHANGELOG, operations guide, preparation.

Delivery verification

Eight Rust crate archives, all five Python wheel platforms and the dependency-free npm plugin were independently downloaded and checked. Critical Rust repair files and npm installer/preset bytes match the release source; packaged locks, wheel build logs and wheel dependency SBOMs contain the reviewed versions. npm registry-signature and attestation verification passed and binds this tag, commit and release workflow.

All three CLIs installed from crates.io at exact 0.2.10 with --locked into a fresh prefix. Installed-binary decision/corpus checks and 13 synthetic authenticated loopback Broker tests passed. The actual hash-pinned PyPI macOS arm64 wheel passed fresh-environment import and decision checks. Other wheel platforms received archive/build-log checks, not installed execution on this host.

The linked preparation document and tag documentation retain their dated prepublication checkpoint. They do not override this verified release's availability. No old tag or security advisory was changed.