v0.3.0

The agent firewall: inspection of agent tool calls (Claude Code hooks, MCP, and tool blocks in
API traffic), plus output moderation, and the first signed release.

Added

• Agent firewall library (llm-firewall-agent): one AgentEvent schema, facet projection
  into the existing detectors, winnowed fingerprinting, taint tracking, action classification,
  egress extraction, subagent authority containment, and an agent policy engine returning
  Allow / Ask / Deny.
• agentfw daemon: agentfw serve wired into Claude Code's native hooks, agentfw install,
  agentfw replay; ships in shadow mode.
• Local-model judge tier: an escalate policy action with a required fallback that asks a
  loopback-only local model one narrow question, and may only tighten a verdict. Off by default.
• MCP supply-chain collector: agentfw mcp stdio proxy pinning each server's tool manifest
  and catching manifest drift, tool-name shadowing, and description poisoning. Off by default.
• API collector: the proxy inspects tool_use / tool_result blocks in OpenAI/Anthropic
  traffic (agent_inspection config block, off by default, shadow-first).
• Output moderation in the proxy (output_moderation config block): harmful replies flagged
  or refused regardless of backend. Off by default, flag before block.
• Benchmarks: agent-attack corpus and --agent scorecard mode; --direction and
  --moderation-threshold for output-path measurement.
• Release artifacts: prebuilt llm-firewall + agentfw archives for Linux (x86_64,
  aarch64) and macOS (x86_64, arm64), with SHA256SUMS, keyless Sigstore signature bundles,
  SLSA build provenance (GitHub artifact attestation) and CycloneDX SBOMs. See "Verifying a release" in the README.

Fixed

• Injection policy rules are now scoped to the input path, so they no longer run on (and
  over-block) model replies.

Security

• Dependency advisories resolved (h2, rustls, unsafe-libyaml).
• CI hardening: SHA-pinned actions, cargo-deny, gitleaks, CodeQL, ClamAV, OpenSSF Scorecard, and
  keyless-signed container images with SLSA provenance and SBOM attestations.

Verifying this release

Every archive, SBOM and SHA256SUMS has a keyless Sigstore signature bundle
(<file>.sigstore.json), and llm-firewall-v0.3.0.intoto.jsonl is SLSA build provenance for
the archives and SBOMs. The container image ghcr.io/carbon-evolution/llm-firewall:0.3.0 is signed the same way.
See Verifying a release for the commands.

What's Changed

• feat(agent): agent-loop inspection library + README rewrite (phase 08) by @carbon-evolution in #11
• docs: rendered agent data-flow diagram (replaces Mermaid) by @carbon-evolution in #12
• docs: commit the agent layer to recognized public benchmarks by @carbon-evolution in #13
• feat(agentfw): daemon + Claude Code hook collector (phase 09) by @carbon-evolution in #14
• docs: audit logs are never published — state the data handling rule by @carbon-evolution in #15
• feat: local judge tier (phase 10) by @carbon-evolution in #16
• feat: MCP collector — handshake supply-chain defenses (phase 11a) by @carbon-evolution in #17
• feat: API collector — agent inspection in the proxy (phase 11b) by @carbon-evolution in #18
• feat: agent-attack benchmark & scorecard (phase 12) by @carbon-evolution in #19
• feat: model-agnostic output moderation (phase 13) by @carbon-evolution in #20
• docs: phase 14 plan — evasion by register (planned, not started) by @carbon-evolution in #21
• fix(deps): resolve RustSec advisories (h2, rustls, unsafe-libyaml) by @carbon-evolution in #22
• ci: security hardening (pinned actions, cargo-deny, gitleaks, CodeQL, ClamAV, Scorecard, signed images) by @carbon-evolution in #23
• build(deps): bump rand from 0.8.7 to 0.10.2 by @dependabot[bot] in #26
• build(deps): bump sha2 from 0.10.9 to 0.11.1 by @dependabot[bot] in #28
• docs(security): OWASP LLM Top 10 2025 + OWASP Top 10:2025 assessment by @carbon-evolution in #30
• ci(release): signed GitHub Releases — binaries, SBOMs, Sigstore bundles, SLSA provenance (v0.3.0) by @carbon-evolution in #31

New Contributors

• @dependabot[bot] made their first contribution in #26

Full Changelog: v0.2.0...v0.3.0