v0.3.0

The MVP described in the README. The package was declared 0.1.0 while every document
said MVP v0.3; they now agree on 0.3.0, which is what pyproject.toml,
src/agentfox/__init__.py, agentfox version and the API's /health all report.

Note for the maintainer: replace this heading with a release date when you tag
v0.3.0. .github/workflows/release.yml refuses to publish unless the tag, the
pyproject.toml version and __version__ all match.

Added

• Containment that does not depend on detection. Tools are declared with an impact
  tier (read, write, high_impact, irreversible), agents hold explicit capability
  grants with argument constraints, and every argument carries the provenance of where it
  came from. An irreversible tool called with an argument that originated in untrusted
  content is refused because of where the value came from, not because anything
  recognised the payload. Measured with every detector switched off; the result is in the
  README.
• Policy engine with three shipped packs, baseline, tool-containment and
  eu-ai-act-high-risk, each bindable in observe (records what it would have done) or
  enforce. agentfox policy simulate replays recorded traffic against a candidate
  policy and exits non-zero when the change would newly block production traffic.
• Detector and scorer pipeline across six surfaces (input, output, tool_args,
  tool_result, memory_write, agent_message), wrapping permissive OSS primitives as
  optional extras: Presidio for PII, NeMo Guardrails, Guardrails AI, Granite Guardian,
  garak and PyRIT for red-team probes, sqlglot for SQL action assurance. Every verdict
  carries the rule that produced it.
• Tamper-evident audit chain with a verifier (agentfox audit verify, exits 1 when
  broken) and signed checkpoints (agentfox audit checkpoint).
• Compliance layer: a control catalog, framework mappings, and evidence packages.
  Mappings ship labelled DRAFT, UNVERIFIED, NOT LEGAL ADVICE, because they were
  produced by engineers rather than reviewed by compliance counsel.
• Ways to run it: the auto() library patch, agentfox serve for the gateway and
  control-plane API, an MCP server, a LangGraph integration, and Docker Compose,
  Render and Fly deployment configs under deploy/.
• CLI covering setup and operation: init, demo, serve, version, doctor,
  check, scan, tools, policy, agents, audit, evidence, compliance,
  eval, redteam, access, proposals, db.
• Dashboard (Next.js, dashboard/) and a hosted playground that hands every visitor a
  throwaway sandbox running the same enforcement code.
• Benchmarks with committed result files: containment under total detector bypass,
  AgentDojo end to end, Crescendo trajectory, and PII. A nightly workflow re-measures the
  offline deterministic ones and fails when a published claim no longer matches.
• Drift checks that fail CI rather than rot: scripts/api_routes.py --check holds the
  API reference to the running app, scripts/claims.py --check holds every published
  number to its result file, and harness/scripts/check_harness.py holds the agent
  harness to the live command line.
• Agent harness (harness/) packaged as a Claude Code plugin.
• Phase 0 improvement loop: proposals, findings hygiene, label integrity and a
  scheduler, with scheduled red-teaming shipped disabled so a deployment opts in.
• Deferred job queue behind evidence export and red-team campaigns, and Alembic
  migrations, because a deployment that cannot be upgraded is not a deployment.

Known limits

The README lists these in full and the product measures them rather than hiding them:
detection is a speed bump and not a defence, compliance mappings are draft, containment is
exactly as good as the tool declarations behind it, multi-tenancy is single-org and
enforced at the session, there is no live IdP or SSO, and text is the only modality.
docs/status.md reports live coverage computed by probe rather than asserted.