Skip to content

v0.6.0

Choose a tag to compare

View all tags
@imran-siddique imran-siddique released this 25 Sep 23:10
v0.6.0
372dcf0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

cmcp-runtime 0.6.0. Full detail is in CHANGELOG.md.

Kill switch

  • Blocks survive a restart and live in the audit database. The close that trips the switch returns its signed claim, and later calls get 403 KILL_SWITCH_TRIPPED (#665).
  • A session stops at the call that trips the switch, not at session close (#666).
  • Claims carry a gateway.kill_switch block, each refused call returns a signed receipt, and cmcp_verify.verify_kill_switch_refusal checks one against the other. kill_switch.enabled with no Agent Manifest now stops startup (#667).
  • A compromised policy signing key can be revoked without a restart through CMCP_POLICY_SUCCESSOR_SIGNING_KEY and signing-key-revocations.json (#668).
  • agent_manifest.revocation_list_path makes startup refuse a revoked Agent Manifest; a missing or malformed list stops startup instead of reading as empty (#689).

Also in this release

  • Verifier-owned SNP platform policy in native, Azure and TRACE verification (#656).
  • Opt-in exact-output disclosure bound to scoped owner signatures (#672).
  • Monotonic session boundary, and session close and reset release stdio children and upstream caches (#629, #634).
  • Two tool names that derive the same Cedar action are refused at catalog load (#671).
  • Operator sensitivity ceilings at tool and response sinks.
  • Linux agent confinement reference (#663).
  • Paginated tools/list is read to the end before drift and provenance checks (#633).
  • session_state_path is accepted and wired at startup, so the session sensitivity value can live in a shared SQLite store. An unopenable path stops startup with SESSION_STATE_STORE_UNAVAILABLE (#661).
  • verify_audit_bundle requires a recorded session_reset at every session change, and code_digest refuses an installed file whose bytes differ from its RECORD entry (#689).

Behaviour changes

  • A tools/call carrying _cmcp.execution_id is refused with execution_correlation_unavailable until execution correlation ships (#606).
  • Session reset and catalog exception take CMCP_OPERATOR_TOKEN, required outside dev mode. Where it is unset they still accept the bearer token.
Assets 5
Loading