Antaeus v0.7.0

Completed semantic uncertainty now returns review; evaluation and provider errors
remain failures. This minor release introduces Decision/Profile v0alpha2 and
regression ResultSet v0alpha2 while preserving published v0alpha1 contracts.
Upgrade validators, profiles and native/WASM consumers together; see the
migration guide.

Changed

• Breaking: introduce Decision and EvaluatorProfile v0alpha2. Completed indeterminate
  evidence returns review with evaluation.indeterminate_rule; failed evidence
  remains failure and matched deny retains highest precedence. Published
  v0alpha1 contracts remain immutable. The new runtime rejects legacy profiles
  and requests; generated regression result sets use v0alpha2. See the
  migration guide for profile digest,
  trust, validator, regression, native/WASM, and coordinated consumer changes.

• Give the built-in local fixture profile a new v0alpha2 identity and digest.

Security

• Update the pinned validation toolchains to Go 1.26.9 and 1.27.2 and the
  preferred development/release toolchain to Go 1.27.2 for upstream
  standard-library security fixes. Keep the Go 1.26.0 module language floor.
  See the advisory record
  for the ten reported GO-IDs and fixed-in versions.
• Update indirect golang.org/x/text to v0.41.0 for GO-2026-6629. The reported
  affected package was not imported in the scanned build configuration.

Antaeus v0.6.0

Adds opt-in provider token accounting for Drex evaluations, so applications can
reconcile consumption across retries, escalation, and fallback without treating
unknown usage as zero. Select System One adapter 0.4.0 in an evaluator profile
to receive the separate io.antaeus.usage Decision extension. Existing adapter
versions retain their behavior, and the execution trace and version-1 JSON host
interface keep their existing shapes. Accounting does not assign customer
charges or change policy outcomes. Public Go APIs and CLI behavior may still
change in minor releases before v1.0.0.

Install with brew install antaeusio/tap/antaeus (or brew upgrade antaeus),
go install github.com/antaeusio/antaeus/cmd/antaeus@v0.6.0,
docker pull ghcr.io/antaeusio/antaeus:0.6, or an archive from this release.
See provider usage reporting for the accounting
contract and System One setup for adapter selection.

Added

• Opt-in System One adapter io.antaeus.systemone@0.4.0, installed alongside
  versions 0.1.0 through 0.3.0 in the CLI and WebAssembly host. It reports
  Drex input tokens and optional output tokens per attempt. Other System One
  providers report unavailable usage until their accounting contracts are verified.
• Provider-neutral io.antaeus.usage Decision extension with a versioned schema
  and examples. Records align with execution-trace attempts, preserve bounded
  underlying adapter failure codes, and distinguish reported counters (including
  zero) from unavailable or invalid accounting. Usage survives invalid answers,
  failed attempts, and confidence routing without affecting policy reduction.
• Go API: evaluator.Result.Usage, typed usage statuses, and
  systemone.UsageIdentity / UsageRegistration. Existing Identity and
  Registration remain on 0.3.0; register the new identity explicitly to opt
  in. Update unkeyed evaluator.Result struct literals for the added field, or
  use keyed literals.
• Custom Go adapters' fixed public evaluator.Error.Code identifiers may
  appear as adapterFailureCode for any traced attempt when usage reporting is
  enabled. Keep input, credentials, and private diagnostics out of these codes.

Fixed

• scripts/build-wasm finds Go's license in Homebrew's package directory when
  it is absent from GOROOT, and checks for the license before resetting the
  output directory or compiling.

Antaeus v0.5.0

Adds an experimental WebAssembly build of the engine, so JavaScript hosts such
as Cloudflare Workers, browsers, and Node.js can evaluate policies with the
same engine as the CLI, without running it in a container. Remote evaluators
such as the hosted Drex API are called through the host's fetch. The build
ships as antaeus_0.5.0_js_wasm.tar.gz in this release, covered by
SHA256SUMS and build-provenance attestations. Its interface (version 1) may
still change in a minor release before v1.0.0, and its CPU, startup time, and
memory use have not yet been measured on Cloudflare's production runtime. The
CLI, native archives, and container image behave as in v0.4.0.

Install with brew install antaeusio/tap/antaeus (or brew upgrade antaeus),
go install github.com/antaeusio/antaeus/cmd/antaeus@v0.5.0,
docker pull ghcr.io/antaeusio/antaeus:0.5, or an archive from this release.
See docs/webassembly.md for the WebAssembly build.

Added

• Experimental WebAssembly build of the engine for JavaScript hosts such as Cloudflare Workers, browsers, and Node.js: antaeus_<version>_js_wasm.tar.gz in each release, built with scripts/build-wasm. start() from its antaeus.mjs returns JSON validate and evaluate calls (interface version 1) that take credentials and an optional absolute deadline per call and return the same Decisions as the CLI. Each call runs in a fresh engine instance entered only from its own request's context, which keeps Cloudflare Workers from cancelling one request's timers and I/O on behalf of another; concurrent instances are capped, waiting calls are bounded (host.busy beyond 16 calls or 16 MiB) and settle at their own deadline. Remote evaluators use the host's fetch without following redirects and stream response bodies; unexpected host values become provider failures rather than stopping the engine. See docs/webassembly.md.

Antaeus v0.4.0

Adds the hosted Drex API by Nace.AI as a System One
provider, so you can evaluate semantic policies without running a model
yourself. Provider drex is available in System One adapter version 0.3.0
(adapter versions are numbered separately from releases). It reads its key from
DREX_API_KEY and sends policy conditions and unredacted input to Nace.AI.
Review Nace.AI's terms before sending personal or confidential data. Its quality on
policy tasks has not been measured on a published evaluation set, so use
confidence gating and review before relying on it. The profile runner now
honors provider Retry-After waits. Existing profiles keep working unchanged.
Go users who register the System One adapter themselves should read the
migration note below. Public Go APIs and CLI behavior may still change in minor
releases before v1.0.0.

Install with brew install antaeusio/tap/antaeus (or brew upgrade antaeus),
go install github.com/antaeusio/antaeus/cmd/antaeus@v0.4.0,
docker pull ghcr.io/antaeusio/antaeus:0.4, or an archive from this release.

Added

• System One adapter io.antaeus.systemone@0.3.0 with provider drex for the hosted Drex API by Nace.AI. It requires the drex-api-key credential (DREX_API_KEY) and endpoint https://drex.nace.ai, and sends policy conditions and unredacted input to Nace.AI. Version 0.3.0 also retries HTTP 529 as evaluator.unavailable, reports Retry-After-Ms and Retry-After waits to the runner, and records the provider's X-Request-Id in adapter metadata. Versions 0.2.0 and 0.1.0 stay installed and unchanged. Example profile: examples/drex/profile.json.
• Go API: evaluator.Error.RetryAfter lets an adapter report a provider-required wait, such as an HTTP Retry-After header. The profile runner never retries sooner than that wait, even when jitter or maxBackoffMs would shorten it, and skips a retry that cannot start before the total deadline so an eligible fallback can use the remaining time.

Changed

• Go API: systemone.AdapterVersion, Identity, Registration, and DefaultReferences now refer to version 0.3.0. To keep running 0.2.0 profiles in your own registry, also register systemone.PreviousIdentity: systemone.PreviousRegistration() and use systemone.PreviousDefaultReferences() for that identity. The CLI installs all three versions.

Antaeus v0.3.0

Adds a CPU-only semantic evaluator you can run yourself. The System One adapter
gains provider antaeus, which works with the open-source
antaeusio/nli-server and reads its
optional key from ANTAEUS_API_KEY. Its quality on policy tasks has not been
measured, so use confidence gating and review before relying on it. Existing
CLM profiles keep working unchanged. Go users who register the System One
adapter themselves should read the migration note below. Public Go APIs and CLI
behavior may still change in minor releases before v1.0.0.

Install with brew install antaeusio/tap/antaeus (or brew upgrade antaeus),
go install github.com/antaeusio/antaeus/cmd/antaeus@v0.3.0,
docker pull ghcr.io/antaeusio/antaeus:0.3, or an archive from this release.

Added

• System One adapter io.antaeus.systemone@0.2.0 with provider antaeus for Antaeus System One servers, such as the open-source CPU-only antaeusio/nli-server. It takes an optional antaeus-api-key credential (ANTAEUS_API_KEY), records the provider in Decisions, and also accepts contrastive-lm. io.antaeus.systemone@0.1.0 stays installed and unchanged, so existing CLM profiles keep working. Example profile: examples/antaeus/nli-server.json.

Changed

• Go API: systemone.AdapterVersion, Identity, Registration, and DefaultReferences now refer to version 0.2.0. To keep running 0.1.0 profiles in your own registry, also register systemone.LegacyIdentity: systemone.LegacyRegistration() and use systemone.LegacyDefaultReferences() for that identity. The CLI installs both versions.

Antaeus v0.2.0

Adds a second, self-hosted semantic evaluator and a container image. The
experimental System One adapter runs policies against your own Contrastive
Language Model (CLM) server and returns confidence scores, so low-confidence
judgments can become an explicit failure for human review. The CLM model's
quality on policy tasks has not been measured. Antaeus is also published as a
small multi-architecture container image. Public Go APIs and CLI behavior may
still change in minor releases before v1.0.0.

Install with brew install antaeusio/tap/antaeus (or brew upgrade antaeus),
go install github.com/antaeusio/antaeus/cmd/antaeus@v0.2.0,
docker pull ghcr.io/antaeusio/antaeus:0.2, or an archive from this release.

Added

• Container image ghcr.io/antaeusio/antaeus for linux/amd64 and linux/arm64, built on a digest-pinned distroless base with CA certificates, running as numeric user 65532 and with build-provenance attestations. Tags are vX.Y.Z, plus X.Y and latest for the newest stable release; pre-releases get only their own tag. scripts/container-image builds it locally.
• Experimental System One semantic adapter io.antaeus.systemone@0.1.0 for a self-hosted Contrastive Language Model (CLM) server. It asks one yes/no question per rule, returns confidence scores for confidence routing, requires https (or loopback http) endpoints, follows no redirects, and takes an optional clm-api-key credential (CLM_API_KEY). CLI evaluate-profile runs System One profiles and semantic profiles that combine it with the OpenAI adapter; any semantic profile selected by project configuration requires saved project trust, even without a credential, because the profile decides where input is sent. Example profiles are in examples/clm/, and the adapter guide covers setup.
• README with the brand lockup for light and dark themes, a worked marketplace-moderation example with real output, a "how it works" diagram, and a documentation index. The example inputs are in examples/marketplace/. docs/assets/social-preview.png is the repository's link-preview image.

Antaeus v0.2.0-rc.2

Adds a second, self-hosted semantic evaluator and a container image. The
experimental System One adapter runs policies against your own Contrastive
Language Model (CLM) server and returns confidence scores, so low-confidence
judgments can become an explicit failure for human review. The CLM model's
quality on policy tasks has not been measured. Antaeus is also published as a
small multi-architecture container image. Public Go APIs and CLI behavior may
still change in minor releases before v1.0.0.

Install with brew install antaeusio/tap/antaeus (or brew upgrade antaeus),
go install github.com/antaeusio/antaeus/cmd/antaeus@v0.2.0,
docker pull ghcr.io/antaeusio/antaeus:0.2, or an archive from this release.

Added

• Container image ghcr.io/antaeusio/antaeus for linux/amd64 and linux/arm64, built on a digest-pinned distroless base with CA certificates, running as numeric user 65532 and with build-provenance attestations. Tags are vX.Y.Z, plus X.Y and latest for the newest stable release; pre-releases get only their own tag. scripts/container-image builds it locally.
• Experimental System One semantic adapter io.antaeus.systemone@0.1.0 for a self-hosted Contrastive Language Model (CLM) server. It asks one yes/no question per rule, returns confidence scores for confidence routing, requires https (or loopback http) endpoints, follows no redirects, and takes an optional clm-api-key credential (CLM_API_KEY). CLI evaluate-profile runs System One profiles and semantic profiles that combine it with the OpenAI adapter; any semantic profile selected by project configuration requires saved project trust, even without a credential, because the profile decides where input is sent. Example profiles are in examples/clm/, and the adapter guide covers setup.
• README with the brand lockup for light and dark themes, a worked marketplace-moderation example with real output, a "how it works" diagram, and a documentation index. The example inputs are in examples/marketplace/. docs/assets/social-preview.png is the repository's link-preview image.

Antaeus v0.1.0

First public release. Antaeus turns human-written policies into versioned,
testable decisions (allow, review, deny, or failure) and runs locally
without an account. It includes a credential-free deterministic quickstart and
an experimental bring-your-own-key OpenAI semantic evaluator. The semantic
evaluator has not been measured on a frozen corpus and is not suitable for
enforcement. Public Go APIs and CLI behavior may still change in minor
releases before v1.0.0; see compatibility.

Install with brew install antaeusio/tap/antaeus, with
go install github.com/antaeusio/antaeus/cmd/antaeus@v0.1.0, or by downloading
an archive from this release and checking it against SHA256SUMS. Archives
carry GitHub build-provenance attestations
(gh attestation verify <archive> --repo antaeusio/antaeus).

Added

• Release archives for macOS (amd64, arm64), Linux (amd64, arm64), and Windows (amd64) with SHA-256 checksums and build-provenance attestations, plus a Homebrew tap. antaeus version reports the module version for go install builds.

• Experimental OpenAI Responses semantic adapter io.antaeus.openai@0.1.0 with strict structured output, store: false, a digest-pinned instruction template, a fixed origin without redirects, bounded bodies and typed retryable failures. CLI evaluate-profile now runs OpenAI profiles using the OPENAI_API_KEY adapter default or explicit bindings, requiring saved project trust for project-supplied credential configuration. See the adapter guide.

• Profile-driven execution with bounded retries, deadlines, confidence escalation, operational fallbacks, and portable attempt traces.

• CLI configuration inspection, credential checks, and project-scoped digest trust/revocation with strict local manifests.

• Local profile and credential-reference precedence with immutable snapshots, project-digest trust checks, and redacted source summaries.

• Initial repository foundation.

• Go module and thin command foundation with version reporting.

• Locked local validation and supported-target cross-build entry points.

• Pre-v1 compatibility and planned platform-support documentation.

• Portable v0alpha1 policy, decision request, Decision, and Problem Details schemas.

• OpenAPI 3.1.2 description, examples, and offline conformance fixtures.

• Public Go policy and decision types, canonical policy digests, validation, and deterministic reduction.

• Provider-neutral evaluator types plus a digest-bound deterministic fixture-set contract and adapter.

• Local evaluator execution that attaches policy outcomes after evidence, reduces deterministically, and records explicit fixture identity in Decision metadata.

• Constrained JSON and YAML 1.2 policy loading with resource limits, stable parser errors, and language-neutral rejection fixtures.

• CLI policy validation and exact, credential-free local fixture evaluation with RFC 8785 input canonicalization.

Changed

• CLI evaluate-profile no longer requires --fixture-set and --case for semantic profiles; fixture profiles still require both, and semantic profiles reject them. The diagnostic for uninstalled adapters changed from "only the deterministic fixture adapter is installed" to name both installed adapters.
• Preserve UTF-8 character boundaries when truncating valid profile validation messages, retaining the 512-byte message cap, ASCII output, error codes and wrapped causes. This does not sanitize malformed adapter text or change policy/profile identity, Decisions or published schemas.
• Publish complete CLI trust markers atomically without overwriting existing entries, reject dangling intermediate configuration symlinks, and check user/trust directory containment by filesystem identity. Existing marker keys and published schemas remain unchanged; granting trust now requires same-directory hard-link support. See the configuration migration.
• Align execution metadata and Decision adapter/fixture versions with the existing ECMA-262 nonblank patterns: reject U+FEFF-only text and accept U+0085 as nonblank. Add Go/JavaScript conformance without changing published schemas or other fields' explicit whitespace rules. This affects result/Decision validation, both Go execution paths, regression.Run, and CLI evaluate, test and evaluate-profile with unusual fixture versions. A U+FEFF-version fixture still loads but fails later result validation on single-attempt/regression paths; see the field-specific migration.
• Go profile-runner and CLI evaluate-profile failure Decisions expose the terminal operational code, append it after the generic unresolved reason, and classify transient retryability only when all unresolved rules failed solely for that cause. Deny precedence, the standalone reducer, legacy commands and published schemas are unchanged. See the Go/CLI migration note.
• Retries no longer sleep away the final budget when the next jittered delay leaves no time to retry. Eligible fallback evidence can now produce a policy judgment where the old runner failed at the deadline; without recovery, transient trace/rule codes can replace the deadline code. Published schemas and the reducer are unchanged. Cancellation and exhausted deadlines retain precedence. See the Go/CLI migration note.
• Profile-runner Go callers must explicitly set AllowSyntheticFixtures for non-enforcement fixture execution. Enforcement still rejects fixtures. The fixture-only CLI opts in internally; its flags/output and published schemas are unchanged. See the migration note.
• Documented existing adapter panic propagation, deferred cleanup and embedding-host isolation responsibilities; panics do not produce a Decision or completed trace.
• Tightened the unreleased v0alpha1 evaluator metadata so mode and synthetic status are explicit and deterministic fixtures carry exact set and adapter versions.

Fixed

• scripts/with-build-lock keeps the lock until an interrupted command's whole process group has stopped (escalating to KILL after a bounded wait), serializes stale-lock takeover, waits for owners that have not yet written metadata, and no longer treats another user's process as dead. scripts/test-build-lock covers these cases (#42).
• scripts/cross-build pins GOAMD64=v1 and GOARM64=v8.0 instead of inheriting the caller's environment.