v0.3.0 — hardening + findings

Aegis is a research instrument for secure agent tool execution. What follows describes
what the instrument gained or measured — see docs/findings.md
for what the evidence does and does not support.

Full entry: CHANGELOG.md

Added

• Fuzz harness for the policy YAML parse surface (AILAB-601). fuzz/ is a sibling
  cargo project, excluded from the workspace because libFuzzer needs nightly while the
  workspace pins 1.86 with unsafe_code = forbid. One target, policy_yaml, drives
  PolicyEngine::from_yaml and performs exactly one evaluate on a successful parse;
  6 tracked seeds; a weekly bounded smoke run. First recorded campaign: 10m 30s,
  5,893,498 runs, no crash — hardware and toolchain cited in fuzz/README.md.
• Stress suite proving audit exactly-once under concurrency (AILAB-602).
  tests/stress drives one shared Runtime from many threads across every outcome
  class and asserts the exactly-once contract by set equality on the JSONL sink — one
  intent and one outcome per call, gap-free call-id sets, every outcome parsing as
  frozen schema v1. No timing assertions.
• Supply-chain gates (AILAB-603). deny.toml with recorded scope and advisory
  ignores, SHA-pinned GitHub Actions, a weekly advisory-only workflow, and an MSRV job
  running cargo +1.86 check --workspace --locked.
• Findings report and evidence bundle (AILAB-606). docs/findings.md synthesizes
  what the runtime is observed to guarantee and what it explicitly does not;
  scripts/evidence-bundle.sh reproduces the bounded evidence subset in one command.
• Release artifacts (AILAB-608). A changelog and docs/release-checklist.md,
  recording the manual publish order and the standing rules that keep the workspace
  publishable.

Changed

• All eight publishable crates reconciled to a single lockstep version (AILAB-608).
  botzr-aegis-core and botzr-aegis-sandbox no longer override [workspace.package].
• Corrected the unfuzzed-surface statement in the findings report (AILAB-608). Two
  previously deferred fuzz surfaces are dropped because neither exists: host-argument
  decoding has no in-tree decoder (the sandbox is component-model-native, so wasmtime
  lifts host-import arguments before they reach Aegis), and ToolManifest is a Rust
  builder with no serde implementation and no on-disk format. Of the three parse
  surfaces named in early planning, policy YAML is the only one that exists, and it is
  fuzzed.

Versioning note

Crate versions are unified at 0.3.0. Version 0.2.0 was a partial release: only
botzr-aegis-core was published under it (and botzr-aegis-sandbox under 0.1.1), while
the rest of the workspace stayed at 0.1.0. Both crates have changed since, so 0.2.0
could not be reused. From 0.3.0 the whole workspace moves as one version.

cargo install botzr-aegis-cli

v0.1.0

Summary

First tagged packaging of Aegis as a research instrument for testing what agent tool isolation actually guarantees. OQ-15 Part A (T1–T7) and Part B Ship signals are met on main @ c663550.

Every tool call walks the same pipeline: POLICY → CAPABILITY → SANDBOX → AUDIT, with audit wrapping all three and emitted on every exit path including denials and traps.

Evidence

• Demo: DamageBot — six adversarial Model A/B cases (write-under-readonly, .. traversal, symlink escape, http exfil) refused through Runtime::execute_tool_call. Reproduce: ./scripts/build-fixtures.sh && cargo test -p aegis-adversarial-demo
• Benchmarks: hot-path Criterion results — policy evaluation in tens of nanoseconds, combined policy + capability hot path ~2.7 µs, on cited hardware (WSL2, AMD Ryzen AI 5 340, rustc 1.96.0, Criterion 0.5.1)
• Threat model: docs/threat-model.md — trust boundaries, named non-goals, residual risks
• Audit schema freeze: docs/audit-schema.md (schema_version: 1)
• Deny suite: tests/deny-suite — golden-backed denial records, gated in CI via cargo test --workspace
• Part B review: OQ-15 peer review (#19) — structured packaging review; solo-maintainer exception logged (not a third-party security audit)

Two trust models (do not conflate)

• Model A — WASM tool: logic runs inside wasmtime; strong isolation
• Model B — host function: the effect runs in host Rust. Capability check + audit only — the sandbox gives zero protection for host-side effects

Non-goals for this tag

• crates.io publish (AEG-31)
• Layer 2 governance expansion
• output_digest and OpenTelemetry / OTLP export — deferred, not shipped; see the audit schema doc