v0.1.0

Summary

First tagged packaging of Aegis as a research instrument for testing what agent tool isolation actually guarantees. OQ-15 Part A (T1–T7) and Part B Ship signals are met on main @ c663550.

Every tool call walks the same pipeline: POLICY → CAPABILITY → SANDBOX → AUDIT, with audit wrapping all three and emitted on every exit path including denials and traps.

Evidence

• Demo: DamageBot — six adversarial Model A/B cases (write-under-readonly, .. traversal, symlink escape, http exfil) refused through Runtime::execute_tool_call. Reproduce: ./scripts/build-fixtures.sh && cargo test -p aegis-adversarial-demo
• Benchmarks: hot-path Criterion results — policy evaluation in tens of nanoseconds, combined policy + capability hot path ~2.7 µs, on cited hardware (WSL2, AMD Ryzen AI 5 340, rustc 1.96.0, Criterion 0.5.1)
• Threat model: docs/threat-model.md — trust boundaries, named non-goals, residual risks
• Audit schema freeze: docs/audit-schema.md (schema_version: 1)
• Deny suite: tests/deny-suite — golden-backed denial records, gated in CI via cargo test --workspace
• Part B review: OQ-15 peer review (#19) — structured packaging review; solo-maintainer exception logged (not a third-party security audit)

Two trust models (do not conflate)

• Model A — WASM tool: logic runs inside wasmtime; strong isolation
• Model B — host function: the effect runs in host Rust. Capability check + audit only — the sandbox gives zero protection for host-side effects

Non-goals for this tag

• crates.io publish (AEG-31)
• Layer 2 governance expansion
• output_digest and OpenTelemetry / OTLP export — deferred, not shipped; see the audit schema doc