v0.5.3 — airlock breach: post-compromise reconstruction

What's new in the 0.5 line

airlock breach — reconstruct what to rotate after an incident

A read-only command that answers, from the audit log you already have: what did the agent touch, did any of it leave the machine, and which exact credentials do I rotate now?

• Reconstructs secret-read → egress flows across rotated log segments.
• Opens with an integrity banner — runs verify across every segment first, so the report proves the log it reasoned over was not edited or truncated.
• Grades evidence honestly: CONFIRMED only on payload-digest linkage; a known-collector hit is PROBABLE; a read with no egress is POSSIBLE. Time-proximity alone is never CONFIRMED.
• Surfaces gate-config changes and model-API egress ("leaked to model context") separately; the latter is never counted as exfil.
• States coverage every report; a clean window rotates nothing and says so.
• --simulate shows it on a canonical incident with no history needed.
• Exit codes for IR scripts: 0 clean, 1 burns found, 2 log untrustworthy.

pip install -U airlock-agent
airlock breach --simulate          # see it, no log needed
airlock breach --since 2d          # your last two days
airlock breach --markdown > ir.md  # report for a manager / insurer

Also in 0.4.7–0.4.8

• Headless fail-closed (AIRLOCK_UNATTENDED=block) for VM/CI/servers where guard would otherwise let an unanswered ask through.
• Fixed a non-atomic policy-write race and --version drift.

Hardening (0.5.1 → 0.5.3)

breach went through an adversarial deep-test pass; 9 findings fixed, most notably:

• CRITICAL timezone bug — off-UTC machines could report "clean" on a log holding a real incident. Log timestamps are now parsed as UTC end to end; verified identical across UTC / LA / Tokyo / Moscow / UTC+14.
• Concurrent-rotation FileNotFoundError in verify/breach, Windows credential paths, phantom egress from search queries, .env.sample false positives, silent --report, duplicate burns, ANSI/newline report spoofing, silent bad --since, and a URL-host parsing edge.

Full detail: CHANGELOG.md.

CI green on Linux / macOS / Windows × Python 3.11 / 3.12 / 3.13. test_breach is 37 checks.