Release v1.8.0

🚀 AGNTCY Dir v1.8.0 Release

This release lets publishers prove who an agent is and who owns it, and lets a node check every record against its own content policies before serving it. It also adds runtime workload filters, a faster record listing, a WinGet package for dirctl, and reconciler prune and sync jobs, with two breaking removals (naming.v1 and dirctl mcp serve) and security updates across the images.

🌟 Key highlights

• Identity and ownership claims: Sign a claim with dirctl identity claim and the reconciler verifies it against the subject's current keys (DNS, HTTPS, did:web, did:key, SPIFFE). Read the result with dirctl identity status or filter search by it. A rotated key or revoked certificate flips a claim to failed on the next run.
• ANS identities: ans:// claims verify through the Agent Name Service. The claim's certificate is trusted once a transparency log you list in reconciler.identity.ans.trusted_log_hosts attests it for the agent.
• Content policies: Write rules in OPA (Rego) or CEL and the node evaluates every record against them as soon as it is pushed. Try a rule on your real records first with dirctl daemon policy dry-run.
• Policy enforcement: Switch search and fetch from off to shadow to see what a policy would hide, then to enforce. Excluded records are withheld from search, pulls, the peer RPC and publication, and named auditors can still read them through the new PolicyAuditService.
• Reconciler jobs: prune-untrusted, with a signature status filter (verified, failed, unsigned), and sync-netsec now run in the reconciler instead of Kubernetes CronJobs.
• Runtime workloads: List running workloads by agent name, skills, domains, authors, runtime type, protocol or reachability. Workloads now carry locators, and addresses and ports are deprecated.
• Faster listing and sharing: ListRecordSummaries pages through records straight from the database, without pulling each one from the OCI store. The AI Catalog keeps its filters, sort and page in the URL, so views can be shared.
• dirctl: Available on WinGet as AGNTCY.dirctl. Sigstore sign and verify settings can be set per client context, and Ed25519 signatures from dirctl sign --key now verify.
• Security: Go 1.27.2, zot v2.1.22, grpc-health-probe v0.4.59 and updated golang.org/x/net, containerd, golang.org/x/crypto and grpc clear the fixable findings from the dir-apiserver, dir-ctl and dir-reconciler images.
• Breaking changes:
  • naming.v1 and dirctl naming are removed. Identity claims replace domain-name verification, and the name_verifications table is dropped on upgrade.
  • dirctl mcp serve is removed. Install dir-mcp separately; dirctl import with the LLM enricher now needs it on PATH.
  • Registry credentials are granted only to authorization rules that name a peer's SPIFFE ID. Add a rule per peer that syncs from your node.
  • The oasf_api_validation setting is replaced by validators under policy, and the content_policies ConfigMap is now policies.

Full Changelog: v1.7.1...v1.8.0

🤝 Community & Support

• Repository
• Discussions
• Documentation
• Quick Start

🙏 Acknowledgments

Thank you to all contributors who made this release possible! Special thanks to the community for feedback, bug reports, and feature requests that helped shape this release.

New Contributors

@kperry-godaddy made their first contribution in #2300
@vansh-nagar made their first contribution in #2269

What's Changed

• feat(dir): refactor OASF validator config by @csirmazbendeguz in #2158
• chore(dir): update changelog and readme to v1.7.1 by @csirmazbendeguz in #2178
• chore(dirctl): update brew formula to v1.7.1 by @build-agntcy in #2179
• chore(deps): update module github.com/containerd/containerd/v2 to v2.3.6 [security] by @agntcy-automation[bot] in #2185
• chore(deps): update busybox:1.38.0-musl docker digest to ea2b991 by @agntcy-automation[bot] in #2186
• chore(deps): update golang:1.27.1-bookworm docker digest to 69a7b97 by @agntcy-automation[bot] in #2187
• chore(deps): update postgresql by @agntcy-automation[bot] in #2188
• chore(deps): update python:3.13-slim docker digest to 7c61056 by @agntcy-automation[bot] in #2189
• chore(deps): update go patches by @agntcy-automation[bot] in #2190
• chore(deps): update helm release zot to v0.1.125 by @agntcy-automation[bot] in #2191
• chore(deps): update module github.com/spiffe/go-spiffe/v2 to v2.8.2 by @agntcy-automation[bot] in #2192
• chore(deps): update gateway ui by @agntcy-automation[bot] in #2193
• chore(deps): update github actions by @agntcy-automation[bot] in #2194
• chore(deps): update module github.com/sigstore/sigstore to v1.11.0 by @agntcy-automation[bot] in #2195
• chore(deps): update module github.com/zitadel/oidc/v3 to v3.51.3 by @agntcy-automation[bot] in #2200
• chore(deps): update module golang.org/x/crypto to v0.57.0 by @agntcy-automation[bot] in #2201
• chore(deps): update module golang.org/x/term to v0.46.0 by @agntcy-automation[bot] in #2202
• chore(deps): update module google.golang.org/grpc to v1.84.0 by @agntcy-automation[bot] in #2203
• feat(dir): add OPA validators by @csirmazbendeguz in #2204
• refactor(dir): rename content_policies ConfigMap to policies by @csirmazbendeguz in #2210
• feat(dir): add prune-untrusted job by @csirmazbendeguz in #2220
• feat(api): add identity.v1 claim types by @ramizpolic in #2221
• feat(client): add identity.v1 claim signing and verification by @ramizpolic in #2223
• feat(dir): add CEL validator by @csirmazbendeguz in #2224
• chore(deps): bump sigstore/rekor to v1.5.4 [GO-2026-5932] by @lgecse in #2225
• feat(dir): persist per-record policy-compliance verdicts by @muscariello in #2226
• chore(deps): update sigstore kms modules to v1.11.0 by @lgecse in #2230
• chore(deps): update testenv postgresql and zot images [security] by @lgecse in #2236
• chore(renovate): scan testenv compose and helm image pins by @lgecse in #2239
• feat(client): add identity key resolvers and safefetch by @ramizpolic in #2242
• fix(client): verify Ed25519ph signatures from dirctl sign by @akijakya in #2243
• fix(ci): fail the Success gate explicitly and report on merge groups by @muscariello in #2247
• fix(dir): recognize registry not-found and unsupported errors by type by @muscariello in #2252
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /docs/mkdocs by @dependabot[bot] in #2254
• fix(tests): match timeout status code in event stream timeout test by @tkircsi in #2255
• feat(server): add claims storage, identity status API and claim search filters by @ramizpolic in #2257
• feat(cli): read Sigstore sign/verify settings from client context by @akijakya in #2260
• fix(client): disable gRPC service config resolution by @vansh-nagar in #2269
• chore(deps): bump brace-expansion to 5.0.12 [security] by @lgecse in #2272
• fix(docs): exclude okta.com from the link check by @ramizpolic in #2273
• refactor(dir): refactor scan severities by @csirmazbendeguz in #2274
• feat(dir): try a candidate content policy before deploying it by @muscariello in #2275
• docs(dir): add the OpenSSF Best Practices badge to the README by @muscariello in #2276
• chore(deps): update docker/dockerfile:1 docker digest to 4edf897 by @agntcy-automation[bot] in #2278
• chore(deps): update nginx:latest docker digest to abe4772 by @agntcy-automation[bot] in #2279
• chore(deps): update postgresql by @agntcy-automation[bot] in #2280
• chore(deps): update python:3.13-slim docker digest to 3dd7cc1 by @agntcy-automation[bot] in #2281
• chore(deps): update gateway ui by @agntcy-automation[bot] in #2282
• chore(deps): update go patches by @agntcy-automation[bot] in #2283
• chore(deps): update github actions by @agntcy-automation[bot] in #2284
• chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.31.0 by @agntcy-automation[bot] in #2285
• chore(deps): update module github.com/libp2p/go-libp2p to v0.50.0 by @agntcy-automation[bot] in #2286
• chore(deps): update module github.com/open-policy-agent/opa to v1.21.0 by @agntcy-automation[bot] in #2287
• chore(deps): update module k8s.io/apimachinery to v0.37.1 by @agntcy-automation[bot] in #2288
• docs(dir): document identity and ownership claims by @ramizpolic in #2289
• chore(deps): bump source-map-js from 1.2.1 to 1.2.2 in /server/gateway/ui by @dependabot[bot] in #2296
• refactor(dirctl): remove mcp server and fix import by @arpad-csepi in #2297
• feat(dir): add sync-netsec job by @csirmazbendeguz in #2298
• feat(client): add the ans identity key resolver by @kperry-godaddy in #2300
• feat(api): add locators to runtime workloads by @akijakya in #2302
• refactor(dir): nest validators config in policy by @csirmazbendeguz in #2303
• feat(dir): verify ans:// identity claims by @kperry-godaddy in #2304
• docs(dir): add GoDaddy to CONTRIBUTORS.md by @muscariello in #2305
• chore(deps): update module golang.org/x/net to v0.60.0 [security] by @agntcy-automation[bot] in #2306
• feat(ui): sync AI Catalog state with URL parameters (fixes #1937) by @vijit-vishnoi in #2311
• feat(reconciler): add signature status filter to prune job by @vivekkrishna in #2312
• chore(deps): update docker.io/bitnami/postgresql:latest docker digest to ec3840d by @agntcy-automation[bot] in #2313
• chore(deps): update golang:1.27.1-bookworm docker digest to 8d48e12 by @agntcy-automation[bot] in #2314
• chore(deps): update nginx:latest docker digest to f9ea18b by @agntcy-automation[bot] in #2315
• chore(deps): update python:3.13-slim docker digest to 70729b4 by @agntcy-automation[bot] in #2316
• chore(deps): update go patches by @agntcy-automation[bot] in #2317
• chore(deps): update codelytv/pr-size-labeler action to v1.12.0 by @agntcy-automation[bot] in #2318
• chore(deps): update module github.com/mikefarah/yq/v4 to v4.54.1 by @agntcy-automation[bot] in #2321
• docs(dir): add AWS to CONTRIBUTORS.md by @lgecse in #2323
• feat(gateway-ui): rebuild static on Renovate and warn in pre-commit by @lgecse in #2324
• chore(deps): update helm release zot to v0.1.126 by @agntcy-automation[bot] in #2326
• feat(dir): add DB-backed SearchService.ListRecordSummaries by @akijakya in #2328
• fix(ui): fix vite.config.ts by @csirmazbendeguz in #2331
• feat(api): filter runtime workloads by agent, runtime and reachability by @akijakya in #2332
• feat(dir): publish dirctl to WinGet by @muscariello in #2335
• fix(dir): match annotation key and value on the same row by @vivekkrishna in #2356
• fix(api): treat a nil request in MatchesFilters as matching everything by @akijakya in #2360
• fix(deps): resolve open code scanning CVEs by @ramizpolic in #2362
• release(dir): prepare api release v1.8.0 by @ramizpolic in #2363
• release(dir): prepare server release v1.8.0 by @ramizpolic in #2364