v0.3.0 — hardening + findings

Aegis is a research instrument for secure agent tool execution. What follows describes
what the instrument gained or measured — see docs/findings.md
for what the evidence does and does not support.

Full entry: CHANGELOG.md

Added

• Fuzz harness for the policy YAML parse surface (AILAB-601). fuzz/ is a sibling
  cargo project, excluded from the workspace because libFuzzer needs nightly while the
  workspace pins 1.86 with unsafe_code = forbid. One target, policy_yaml, drives
  PolicyEngine::from_yaml and performs exactly one evaluate on a successful parse;
  6 tracked seeds; a weekly bounded smoke run. First recorded campaign: 10m 30s,
  5,893,498 runs, no crash — hardware and toolchain cited in fuzz/README.md.
• Stress suite proving audit exactly-once under concurrency (AILAB-602).
  tests/stress drives one shared Runtime from many threads across every outcome
  class and asserts the exactly-once contract by set equality on the JSONL sink — one
  intent and one outcome per call, gap-free call-id sets, every outcome parsing as
  frozen schema v1. No timing assertions.
• Supply-chain gates (AILAB-603). deny.toml with recorded scope and advisory
  ignores, SHA-pinned GitHub Actions, a weekly advisory-only workflow, and an MSRV job
  running cargo +1.86 check --workspace --locked.
• Findings report and evidence bundle (AILAB-606). docs/findings.md synthesizes
  what the runtime is observed to guarantee and what it explicitly does not;
  scripts/evidence-bundle.sh reproduces the bounded evidence subset in one command.
• Release artifacts (AILAB-608). A changelog and docs/release-checklist.md,
  recording the manual publish order and the standing rules that keep the workspace
  publishable.

Changed

• All eight publishable crates reconciled to a single lockstep version (AILAB-608).
  botzr-aegis-core and botzr-aegis-sandbox no longer override [workspace.package].
• Corrected the unfuzzed-surface statement in the findings report (AILAB-608). Two
  previously deferred fuzz surfaces are dropped because neither exists: host-argument
  decoding has no in-tree decoder (the sandbox is component-model-native, so wasmtime
  lifts host-import arguments before they reach Aegis), and ToolManifest is a Rust
  builder with no serde implementation and no on-disk format. Of the three parse
  surfaces named in early planning, policy YAML is the only one that exists, and it is
  fuzzed.

Versioning note

Crate versions are unified at 0.3.0. Version 0.2.0 was a partial release: only
botzr-aegis-core was published under it (and botzr-aegis-sandbox under 0.1.1), while
the rest of the workspace stayed at 0.1.0. Both crates have changed since, so 0.2.0
could not be reused. From 0.3.0 the whole workspace moves as one version.

cargo install botzr-aegis-cli