ContextFence v0.2.0 is live — permission matrices, generators, and provenance

[devanchohan]

ContextFence is an Apache-2.0 CLI for turning RAG identity × source boundaries into deterministic regression tests.

What is new

• Permission matrices — express a boundary once, expand it across identities and sources, and keep it in reviewable YAML.
• Access-manifest generation — bootstrap a starter contract from a declared identity/source map, then run it locally or in CI.
• A clearer live lab — reproduce one concrete cross-principal cache leak, inspect the evidence path, then apply the fixes.
• Release integrity — the published npm package includes SLSA provenance; the GitHub Release includes a verified tarball and SHA-256 checksum.

Start in 60 seconds

npm install -g contextfence@0.2.0
curl -fsSLO https://raw.githubusercontent.com/devectorio/contextfence/v0.2.0/examples/contracts/mock.boundary.yaml
contextfence test mock.boundary.yaml

• Read the v0.2.0 release notes
• Try the interactive lab
• Use the GitHub Action in CI

If your team operates a real RAG system, Devector also offers a fixed-scope ContextFence Boundary Baseline: identity × source mapping, safe canaries, deterministic checks, and a handover-ready CI gate.

Feedback, adapters, and real-world boundary patterns are welcome in Discussions. If ContextFence is useful, a GitHub star helps more engineers find it.