v0.1.0-rc.3

Third release candidate for v0.1.0. It holds the fixes from a security review of the query path and from an audit of the docs against the code. Interfaces may still change before v0.1.0, so pin this exact version.

Several changes break an existing setup. Read "Breaking changes" below before an upgrade from v0.1.0-rc.2.

Install

Container image (linux/amd64 + arm64):

docker pull ghcr.io/bino-bi/sluice:0.1.0-rc.3
docker run --rm ghcr.io/bino-bi/sluice:0.1.0-rc.3 version

Binary: download the archive for your platform below, then:

tar -xzf sluice_0.1.0-rc.3_linux_amd64.tar.gz
./sluice version

New

• Keyed audit chain. With audit.chainKeyRef each new hash is an HMAC-SHA256, so someone who can write the audit files cannot compute the chain again. sluice audit verify --key-ref <ref> checks it.
• Result size limit. limits.maxResultBytes (default 64 MiB) bounds the size of one result, next to the row limits.
• Audit record for a failed login. A 401 on REST, MCP over HTTP or the admin API writes an auth-event record.
• TLS for MCP over HTTP. The new block mcp.tls takes the keys of rest.tls.
• Rate limit before login for MCP over HTTP. limits.globalRps and limits.perIpRps now also count requests to the MCP listener.

Security

This candidate closes many ways to get around a policy. The main groups:

• Row filters and column masks. SQL masks are now applied at the table, through a subquery that lists the columns. This closes reads of a masked column under another name, through USING and NATURAL joins, select aliases, positions, quoted names in another letter case, two-part table names and names longer than 63 bytes.
• Access policies. An allow policy no longer admits a whole statement when only one of its tables matches. A ReBAC member no longer grants access on its own. A tag-only selector no longer matches every table.
• Statements. SET, RESET and SHOW are refused. A SELECT that writes is stopped before DuckDB. EXPLAIN on a filtered or masked table is refused. Function calls are denied by default, only a reviewed list runs.
• Rewrites. A rewritten statement is checked so it means the same in DuckDB as in the parser. A $n in a query can no longer read the values a policy binds, such as a hash salt.
• Identity and transport. The JWT iat claim is checked. Over MCP HTTP, a tool call runs as the caller of each request, not as the subject that opened the session. An approval link decides only on POST. A SLUICE_* variable is read for every scalar key, so SLUICE_ADMIN__TOKEN alone now protects the admin API.
• Toolchain. Go 1.26.9 and dependency updates for known vulnerabilities.

Breaking changes

• MCP over HTTP needs mcp.listen. Without it Sluice no longer starts (it listened on port 80 of every interface).
• Manifest fields that had no effect are refused: the kind AuditSink, DataSource fields schemas, tables and healthCheck, SubjectBinding.groupsSource, and RelationshipPolicy backend.cacheTtl and backend types other than openfga.
• datasources.directory is refused. Remove the key.
• The API key pepper and the audit genesis are trimmed at the end. If your pepper file ends with a newline, every API key gets 401 after the upgrade and each hashRef must be made again. An existing audit log is not affected. Read the changelog entry before the upgrade.
• sluice policy test needs a schema: block for masked tables, and rewrittenSql matches change.
• GET /openapi.json is removed.
• A dotted pattern such as tables: ["shop.main.customers"] no longer loads. Use the catalogs, schemas and tables fields.

Many other entries are marked "Behavior change" in the changelog, for example new error codes (ERR_QUERY_FAILED, ERR_POLICY_UNAVAILABLE), subjects.ipRanges that now matches, and sluice audit verify that exits with 4 on an empty directory.

Artifacts

Archives	linux amd64/arm64, darwin amd64/arm64
Images	ghcr.io/bino-bi/sluice:0.1.0-rc.3 (multi-arch manifest), plus -amd64 and -arm64
Supply chain	checksums.txt with a keyless cosign signature, a CycloneDX SBOM per archive, and SLSA v1.0 provenance

There is no Windows archive. Build from source there. Pre-releases are never tagged latest.

Verify the container image:

cosign verify ghcr.io/bino-bi/sluice:0.1.0-rc.3 \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Documentation: https://bino-bi.github.io/sluice/

See CHANGELOG.md for the full list of changes.

See CHANGELOG.md for the full list of changes.

---

Verify artefact signatures with cosign:

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

v0.1.0-rc.2

Sluice is a policy-enforcing SQL and MCP gateway. Every query is parsed, checked against declarative policy, rewritten (row filters, column masks, limits), executed, and recorded in a hash-chained audit log. Access exists only where a policy grants it — an empty policy directory denies everything.

This is the first tagged release, and a release candidate. The full query path works end to end across REST, MCP, and the admin plane, but interfaces may still change before v0.1.0. Pin this exact version rather than tracking a floating tag.

Install

Container image (linux/amd64 + arm64):

docker pull ghcr.io/bino-bi/sluice:0.1.0-rc.2
docker run --rm ghcr.io/bino-bi/sluice:0.1.0-rc.2 version

Binary — download the archive for your platform below, then:

tar -xzf sluice_0.1.0-rc.2_linux_amd64.tar.gz
./sluice version

Or run the example stack — no build step and no Go toolchain, it pulls the published image:

git clone https://github.com/bino-bi/sluice.git
cd sluice/examples/hello-sluice
sqlite3 data/shop.db < seed.sql
docker compose up

What's in it

• 7 datasource drivers — Postgres, MySQL, SQLite, S3 (Parquet/CSV/JSON/Excel), HTTP(S) files, DuckDB file, MotherDuck.
• Policy enforcement — access control, row filters, column masks (partial, hash, regex, truncate, fpe, jitter, fake), query rejects and rewrites, CEL conditions, and a human-approval workflow.
• Pluggable policy engines — built-in YAML, embedded OPA/Rego, and ReBAC via OpenFGA, composable.
• MCP server — 9 tools over stdio or Streamable HTTP.
• Tamper-evident audit — hash-chained JSONL, fail-closed by default, verifiable with sluice audit verify.
• Offline DuckDB extensions — the linux/amd64 binary and both container images attach every datasource type without reaching extensions.duckdb.org at runtime.

Artifacts

Archives	linux amd64/arm64, darwin amd64/arm64
Images	ghcr.io/bino-bi/sluice:0.1.0-rc.2 (multi-arch manifest), plus -amd64 and -arm64
Supply chain	checksums.txt with a keyless cosign signature, a CycloneDX SBOM per archive, and SLSA v1.0 provenance

No Windows archive: DuckDB's prebuilt Windows libraries reference pthread_* symbols that the Go bindings never link, so the mingw cross-link fails. Native go build on Windows works and is covered by CI — build from source there.

Pre-releases are deliberately never tagged latest — that tag appears with the first stable release.

Verify the container image:

cosign verify ghcr.io/bino-bi/sluice:0.1.0-rc.2 \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Known limitations

• No Helm chart yet.
• The postgres and otlp audit sinks are not implemented. Syslog and S3 (Object Lock) forwarding are best-effort secondaries — the hash-chained file sink remains the record of truth.
• The approval broker is single-instance; state is not replicated.
• Arrow output is not implemented.
• MotherDuck has not yet released support for DuckDB 1.5.5, so motherduck attach fails with a version error until they ship it.

Documentation: https://bino-bi.github.io/sluice/

See CHANGELOG.md for the full list of changes.

---

Verify artefact signatures with cosign:

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

v0.1.0-rc.1

Sluice is a policy-enforcing SQL and MCP gateway. Every query is parsed, checked against declarative policy, rewritten (row filters, column masks, limits), executed, and recorded in a hash-chained audit log. Access exists only where a policy grants it — an empty policy directory denies everything.

This is the first tagged release, and a release candidate. The full query path works end to end across REST, MCP, and the admin plane, but interfaces may still change before v0.1.0. Pin this exact version rather than tracking a floating tag.

Install

Container image (linux/amd64 + arm64):

docker pull ghcr.io/bino-bi/sluice:0.1.0-rc.1
docker run --rm ghcr.io/bino-bi/sluice:0.1.0-rc.1 version

Binary — download the archive for your platform below, then:

tar -xzf sluice_0.1.0-rc.1_linux_amd64.tar.gz
./sluice version

Or run the example stack — no build step and no Go toolchain, it pulls the published image:

git clone https://github.com/bino-bi/sluice.git
cd sluice/examples/hello-sluice
sqlite3 data/shop.db < seed.sql
docker compose up

What's in it

• 7 datasource drivers — Postgres, MySQL, SQLite, S3 (Parquet/CSV/JSON/Excel), HTTP(S) files, DuckDB file, MotherDuck.
• Policy enforcement — access control, row filters, column masks (partial, hash, regex, truncate, fpe, jitter, fake), query rejects and rewrites, CEL conditions, and a human-approval workflow.
• Pluggable policy engines — built-in YAML, embedded OPA/Rego, and ReBAC via OpenFGA, composable.
• MCP server — 9 tools over stdio or Streamable HTTP.
• Tamper-evident audit — hash-chained JSONL, fail-closed by default, verifiable with sluice audit verify.
• Offline DuckDB extensions — the linux/amd64 binary and both container images attach every datasource type without reaching extensions.duckdb.org at runtime.

Artifacts

Archives	linux amd64/arm64, darwin amd64/arm64
Images	ghcr.io/bino-bi/sluice:0.1.0-rc.1 (multi-arch manifest), plus -amd64 and -arm64
Supply chain	checksums.txt with a keyless cosign signature, a CycloneDX SBOM per archive, and SLSA v1.0 provenance

No Windows archive: DuckDB's prebuilt Windows libraries reference pthread_* symbols that the Go bindings never link, so the mingw cross-link fails. Native go build on Windows works and is covered by CI — build from source there.

Pre-releases are deliberately never tagged latest — that tag appears with the first stable release.

Verify the container image:

cosign verify ghcr.io/bino-bi/sluice:0.1.0-rc.1 \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Known limitations

• No Helm chart yet.
• The postgres and otlp audit sinks are not implemented. Syslog and S3 (Object Lock) forwarding are best-effort secondaries — the hash-chained file sink remains the record of truth.
• The approval broker is single-instance; state is not replicated.
• Arrow output is not implemented.
• MotherDuck has not yet released support for DuckDB 1.5.5, so motherduck attach fails with a version error until they ship it.

Documentation: https://bino-bi.github.io/sluice/

See CHANGELOG.md for the full list of changes.

---

Verify artefact signatures with cosign:

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt