Skip to content

v1.3.0 — Human Approval Lifecycle

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 02:19
v1.3.0
1a53506
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Agentic Security Framework Lab v1.3.0

Human Approval Lifecycle release: governed mutable actions now treat human approval as bounded, single-use, revocable, source-isolated authority with process-local concurrency safety.

Highlights

  • Human approval evidence requires timezone-aware approved_at and expires_at timestamps.
  • GovernedActionRuntime enforces the half-open validity interval [approved_at, expires_at) through a trusted application clock.
  • Explicit claim outcomes distinguish missing, claimed, and revoked instead of overloading absence.
  • Single-use semantics prevent approval replay; invalid, temporal-failure, and executor-failure paths do not restore a claimed capability.
  • Trusted pre-claim revoke_approval(approval_id) makes withdrawal explicit and sticky without letting model-controlled input override policy.
  • Approval lookup is isolated by exact (caller_id, identity_source, action, resource, environment) scope.
  • A wrong-source request cannot dequeue approval authority issued for another trusted identity provenance.
  • One process-local synchronization boundary linearizes approval queue and lifecycle transitions under concurrent claim/revoke callers.
  • Barrier-based regressions prove eight simultaneous claims transfer one capability exactly once, claim-vs-revoke admits only linearizable outcomes, and eight concurrent approval-gated runtime attempts produce one mutable execution.

Security invariants

  • Model claim of approval != trusted human approval.
  • Policy deny + human approval = deny.
  • Valid approval time = approved_at <= trusted_now < expires_at.
  • Revoked unclaimed approval = no execution.
  • Same caller_id + different identity_source != same approval capability.
  • One approval capability + concurrent claims <= one claimed runtime attempt.
  • Consumed approval + retry = new approval required.

Evidence discipline

The v1.3 approval-lifecycle evidence is provider-free process-local/CI evidence. It does not claim durable or distributed approval storage/revocation, cross-process atomicity, multi-party approval workflow, retroactive cancellation after claim, external side-effect rollback, or transactional coupling between approval state and remote side effects.

The accepted v1.0 Phase 15 provider-backed evaluation artifacts and the v1.1/v1.2 release metadata remain unchanged.

Release-candidate validation includes 461 tests, 95.44% coverage, Pyright with zero errors, Bandit with no identified issues, pip-audit with no known non-ignored vulnerabilities, MCP base/governed/authenticated STDIO checks, and OpenTelemetry checks.

Documentation

  • docs/security/GOVERNED_AGENT_ACTIONS.md
  • docs/adr/0006-treat-human-approval-as-trusted-runtime-evidence.md
  • CHANGELOG.md
Assets 2
Loading