OpenGuardrail v0.1.0-alpha.1

OpenGuardrail v0.1.0-alpha.1

Development preview: evidence-based action guardrails for AI agents.
The HTTP API is v1alpha1; APIs, CLI, policies and storage may change.

Included

• Standalone service, guardrailctl, management UI, local administrator setup
  and scoped machine credentials.
• Versioned policies, Runs with frozen policy/context, structured evidence,
  accepted Submissions, expiry and auditable ALLOW/DENY decisions.
• SQLite and PostgreSQL, with one service instance per database.
• Exact resource-to-Policy bindings, active/fixed Revision selection and binding
  audit. Trusted integrations provide resource references; the public package
  does not include an external resource resolver or a public permission plugin.
• A browser cleanup demo with a predefined runner and real disposable files.
• One pi/DeepSeek Harness plugin bundling the file-cleanup policy, worker,
  controlled tools and Skill. Go 1.27.4 is the build toolchain.

Download and verify

This packaging update publishes six user assets:

• Four native open-guardrail-0.1.0-alpha.1-PLATFORM.tar.gz archives, for Linux
  and macOS on amd64 and arm64.
• openguardrail-agent-plugins-preview-0.1.0-alpha.1-install.tar.gz, containing
  the unchanged npm plugin archive, installer and matching version/hash manifest.
• SHA256SUMS, covering those five archives.

Choose the native archive for your platform. Plugin users also download the
complete plugin installation archive. GitHub adds its standard source archive
links. API and storage behavior are unchanged by this packaging update.

The workflow verifies SPDX 2.3 SBOMs and GitHub OIDC provenance/SBOM attestations
for the tested native and inner npm archives. It repeats installation from only
the six final user assets, signs all six and then creates a draft. The proof
files remain CI audit material; GitHub's attestation service supports online
verification without downloading each detached proof.

The signer is alibaba/open-guardrail/.github/workflows/release.yaml, on
refs/tags/v0.1.0-alpha.1. Verify signer, tag and expected public source commit
before extracting archives or running their scripts. Follow the
artifact verification instructions.
The Release workflow creates a draft only after every native platform job passes;
check the actual workflow and attached assets for this release. Cross-compilation
and a historical model trial do not establish current native/model acceptance.

First experience

The native server and CLI need no Go, Node.js or Python runtime. For the browser
demo, extract the verified native archive into an empty directory and run from
that directory with Python 3.9+:

python3 examples/cleanup-demo/demo.py

Choose a console password at startup. Open the printed Demo URL; it needs no
login. The separate Console uses username demo and your chosen password.
Another browser requires a separate login. The initial four-file request is
denied; a new narrower Run allows only the two temporary files to be deleted.
This path uses a predefined runner without an AI model. Ctrl-C stops the private
services and removes their temporary files, credentials and Run history.

For the plugin, authenticate the complete -install.tar.gz from this release,
then extract it beside your selected native archive. It includes install.py,
plugin-release.json and the inner npm .tgz used by the hosts.
pi 1.5.0 requires Node.js 22+; DeepSeek Harness
0.2.2-rc.1 requires Node.js 24.9+ and pnpm. Both need Python 3.9+, matching native
binaries and your own host model login. Follow the
versioned installation guide.
The plugin is distributed as a release archive, not an npm registry publication.
DSH users upgrading from @openguardrail/cleanup-preview must remove that old
package from the same profile before registering @openguardrail/agent-plugins-preview.

Storage and upgrade

New databases initialize at schema 3. For compatible version-1/2 databases from
this source lineage, database.migrations: auto applies the bundled additions:
the binding table, optional Run selection and audit details. Existing Runs keep
their policy Revision and do not acquire invented historical selection evidence.
external requires the exact current schema to be prepared beforehand.

Stop writers and take a consistent backup before upgrading. An older server
rejects a schema newer than its bundled migrations. Roll back by restoring the
pre-upgrade backup with its matching old server; this preview provides no
automatic downgrade command. Arbitrary older development schemas and transfer
between databases are unsupported.

Boundaries

The server validates evidence structure/completeness, not the truth of the
observations. Execution tools must independently verify the authoritative Run,
accepted evidence, target, parameters and current state before acting. Missing or
entirely unbound resource references use the Scene default; do not treat caller
references as ownership verification. Explicit Revision selection is a privileged
override. See the binding contract.

The cleanup scenario operates only on its own four temporary sample files and
does not intercept other host tools. Model access and host compatibility require
their own trial. Execution Claims, ActionResults, a general OS sandbox,
multi-instance operation and stable public Go provider/composition APIs are not
included. Remote deployments require the documented HTTPS reverse proxy.