Tool Guard Core v0.8.1

Tool Guard Core v0.8.1

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• 86e63bd: release: v0.8.1 (#57) (@dimaggi-admin)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.8.1

Multi-arch manifest covering linux/amd64 and linux/arm64, signed
keyless with cosign by the release workflow. Verify:

cosign verify ghcr.io/dimaggi-ai/tool-guard-core:0.8.1 \
  --certificate-identity-regexp '^https://github\.com/dimaggi-ai/tool-guard-core/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt

Tool Guard Core v0.8.0

Tool Guard Core v0.8.0

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• f8212fe: Merge remote-tracking branch 'origin/ci/080-release-verification' into integration-preview (@dimaggi-admin)
• cd2fd73: Merge remote-tracking branch 'origin/docs/080-staleness-guards' into integration-preview (@dimaggi-admin)
• ef546e0: Merge remote-tracking branch 'origin/feat/080-api-diff' into integration-preview (@dimaggi-admin)
• d3add92: Merge remote-tracking branch 'origin/feat/080-audit-export' into integration-preview (@dimaggi-admin)
• 818754c: Merge remote-tracking branch 'origin/feat/080-audit-provenance' into integration-preview (@dimaggi-admin)
• 6d92aaa: Merge remote-tracking branch 'origin/feat/080-conformance-corpus' into integration-preview (@dimaggi-admin)
• c4b96eb: Merge remote-tracking branch 'origin/feat/080-conformance-hardening' into integration-preview (@dimaggi-admin)
• 63cbd18: Merge remote-tracking branch 'origin/feat/080-decision-receipt-api' into integration-preview (@dimaggi-admin)
• 19dc7db: Merge remote-tracking branch 'origin/feat/080-nightly-throughput' into integration-preview (@dimaggi-admin)
• e953a12: Merge remote-tracking branch 'origin/feat/080-pathological-nightly' into integration-preview (@dimaggi-admin)
• 59d4cac: Merge remote-tracking branch 'origin/feat/080-pypi-publish' into integration-preview (@dimaggi-admin)
• a505ee0: build(sdk): publish the Python SDK to PyPI as tool-guard-core (@dimaggi-admin)
• 43aa5ac: chore(release): reconcile v0.8 integration (@dimaggi-admin)
• dd7a698: ci: gate releases on full verification (@dimaggi-admin)
• 51033d6: feat(api): gate exported Go surface changes (@dimaggi-admin)
• ce03214: feat(audit): add filtered JSONL export (@dimaggi-admin)
• 29b7b23: feat(audit): stamp record provenance (@dimaggi-admin)
• 80de6cf: feat(llm_classify): System One backend (Jev / self-hosted judge) (@dimaggi-admin)
• ac3c82d: feat(proxy): emit audit decision receipts (@dimaggi-admin)
• 3c2579d: feat(sdk): prepare trusted PyPI publishing (@dimaggi-admin)
• 1504eec: fix(api): document past-due escalation conflicts (@dimaggi-admin)
• cb7dc97: fix(audit): align proxy writes with verifier limits (@dimaggi-admin)
• 060ace2: fix(audit): allow rollback on Windows (@dimaggi-admin)
• f26261a: fix(audit): bind evaluated amount provenance (@dimaggi-admin)
• d8845f5: fix(audit): complete advisory lock portability (@dimaggi-admin)
• 33b2e4d: fix(audit): delimit resumed JSONL records (@dimaggi-admin)
• 100c4a0: fix(audit): enforce trace record boundaries (@dimaggi-admin)
• e9a2846: fix(audit): harden indeterminate rotation recovery (@dimaggi-admin)
• 5ce5ec0: fix(audit): make durability rollback transactional (@dimaggi-admin)
• 33c6ffb: fix(audit): make escalation resolution transactional (@dimaggi-admin)
• ceab330: fix(audit): make rotation and expiry transactional (@dimaggi-admin)
• 95029c7: fix(audit): poison uncertain durability failures (@dimaggi-admin)
• 880ad20: fix(audit): poison uncertain rotation barriers (@dimaggi-admin)
• b9cd7f9: fix(audit): preserve atomic append rollback on Windows (@dimaggi-admin)
• d39510f: fix(audit): preserve hook evaluation provenance (@dimaggi-admin)
• 2621ae1: fix(audit): preserve hook evidence boundaries (@dimaggi-admin)
• eea042d: fix(audit): preserve signed zero provenance (@dimaggi-admin)
• 6f8c9ee: fix(audit): preserve unsupported target builds (@dimaggi-admin)
• f79a1d0: fix(audit): roll back partial proxy writes (@dimaggi-admin)
• 392df11: fix(audit): rotate before committing trace (@dimaggi-admin)
• 857994f: fix(audit): use ownership-safe hook lock (@dimaggi-admin)
• 7133462: fix(audit): verify hook chain before append (@dimaggi-admin)
• 1f0380e: fix(ci): ignore api tool download diagnostics (@dimaggi-admin)
• 2a45d8f: fix(conformance): reject empty policies and pin matched rules (@dimaggi-admin)
• 087847c: fix(engine): make per-policy shadow mode authoritative (@dimaggi-admin)
• 70ca011: fix(engine): propagate applied action semantics (@dimaggi-admin)
• 781ae4c: fix(engine): separate applied action provenance (@dimaggi-admin)
• c7f8588: fix(escalation): block approval after expiry (@dimaggi-admin)
• b8042a1: fix(review): anchor audit genesis and rule identity (@dimaggi-admin)
• 9c8670c: fix(review): harden audit migration and policy identity (@dimaggi-admin)
• 9e4a5d6: fix(runtime): close applied-action audit gaps (@dimaggi-admin)
• da438c0: fix(runtime): harden audit and simulation edges (@dimaggi-admin)
• 2b4d718: fix(stress): compare nightly throughput to release (@dimaggi-admin)
• 9e348e3: fix(stress): count all successful responses (@dimaggi-admin)
• 49daf31: fix: bind publication gates to successful verifier steps (@dimaggi-admin)
• 01ba0de: fix: close final release review gaps (@dimaggi-admin)
• 8fd4a49: fix: close v0.8 integrated release blockers (@dimaggi-admin)
• f10e71b: fix: compare fresh stress targets before warmup (@dimaggi-admin)
• cb64864: fix: enforce exact-head release invariants (@dimaggi-admin)
• 05a85ee: fix: guard every irreversible release publication (@dimaggi-admin)
• 7739d60: fix: harden release publication gates (@dimaggi-admin)
• c88fe3c: fix: harden v0.8 release finalization (@dimaggi-admin)
• d11a62f: fix: make release artifacts and stress gates non-vacuous (@dimaggi-admin)
• 8ed37ac: fix: make release recovery behavior verifiable (@dimaggi-admin)
• 85a48fb: fix: make v0.8 release reruns recoverable (@dimaggi-admin)
• 9f8956e: fix: pin release builders and classify overload rejection (@dimaggi-admin)
• 4503489: fix: reject all publisher step condition variants (@dimaggi-admin)
• 1c89d8e: fix: verify tags before every publication path (@dimaggi-admin)
• 357edc9: llm_classify/systemone: close remaining review nits (@dimaggi-admin)
• 5c5dd7f: llm_classify/systemone: compare the whole key for echo redaction; tighten redirect test (@dimaggi-admin)
• 089a632: llm_classify/systemone: gate on P(choice), validate the distribution, dedupe (@dimaggi-admin)
• 5ae995b: llm_classify/systemone: no keep-alive; fold keys the way encoding/json does (@dimaggi-admin)
• 2c283c6: llm_classify/systemone: redact a reported model name that echoes the key (@dimaggi-admin)
• e25d596: llm_classify/systemone: reject null probabilities; audit-detail wording (@dimaggi-admin)
• 13677da: llm_classify/systemone: reject repeated keys anywhere, keep response text out of errors (@dimaggi-admin)
• 7f6c967: llm_classify/systemone: reject repeated probability keys (@dimaggi-admin)
• ba822db: llmguard: map WSAECONNREFUSED to "connection refused"; exact redaction wording (@dimaggi-admin)
• 712e7df: llmguard: match key echoes without regard to case; scope the redaction claim (@dimaggi-admin)
• 10e6ebf: test(audit): close rotated Windows handle (@dimaggi-admin)
• 0131085: test(audit): cover shared writer boundaries (@dimaggi-admin)
• a58d3b1: test(conformance): enforce complete corpus coverage (@dimaggi-admin)
• 2b873b3: test(engine): isolate pathological SQL latency checks (@dimaggi-admin)
• 330c2aa: test(escal...

Tool Guard Core v0.7.0

Tool Guard Core v0.7.0

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• 4b5a2d1: build: sign ghcr images with cosign, align pins, commit-derived timestamps (#21) (@dimaggi-admin)
• df25b8c: ci: back out the coding-agent-guard lint gate; it needs warn tolerance (@dimaggi-admin)
• a1de9a8: feat: add strict versioned policy loader (@dimaggi-admin)
• e92d2a5: fix(security): bump Go toolchain 1.25.12 -> 1.25.13 (5 stdlib CVEs) (@dimaggi-admin)
• 48c6861: fix(stress-test): assert the real fail-open invariant, not a stale amount oracle (@dimaggi-admin)
• 22cb456: fix: address cross-model review findings on the evidence PR (@dimaggi-admin)
• 96bb5a6: fix: address cross-model review findings on the schema-freeze PR (@dimaggi-admin)
• 0710d78: fix: address second-cycle panel findings on the evidence PR (@dimaggi-admin)
• c722dbc: fix: address second-cycle panel findings on the schema freeze (@dimaggi-admin)
• 07292b6: refactor: share strict policy loading across binaries (@dimaggi-admin)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.7.0

Multi-arch manifest covering linux/amd64 and linux/arm64, signed
keyless with cosign by the release workflow. Verify:

cosign verify ghcr.io/dimaggi-ai/tool-guard-core:0.7.0 \
  --certificate-identity-regexp '^https://github\.com/dimaggi-ai/tool-guard-core/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt

Tool Guard Core v0.6.0

Tool Guard Core v0.6.0

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• 2361749: Fix CI: gofmt, option-token false positive in protected paths, floor lint (@maggienanyonga)
• c1b1dc9: Harden reversibility gating after eight adversarial QA rounds + fuzzing (@maggienanyonga)
• 2ff08a8: feat(engine): reversibility-aware gating with irreversibility floor (@maggienanyonga)
• 8759056: feat: add cross-platform Claude protection (@dimaggi-ai)
• 75047bf: fix: a symlinked legacy root is not install evidence (@dimaggi-ai)
• 2a8ae47: fix: address review blockers — pin installs to state, evidence-based legacy discovery (@dimaggi-ai)
• 1ee9eea: fix: close reversibility floor bypasses (@dimaggi-ai)
• b93e891: fix: drop root resolution from status/unprotect; symlinks are not legacy evidence (@dimaggi-ai)
• 900accb: fix: fail safe on HTTP calls without a method (@dimaggi-ai)
• 619104a: fix: harden managed Claude protection (@dimaggi-ai)
• 45de1ea: fix: protect explicit Claude config paths (@dimaggi-ai)
• bc847c3: fix: resolve managed root via platform config dirs with legacy discovery (@dimaggi-ai)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.6.0

Multi-arch manifest covering linux/amd64 and linux/arm64.

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt

Tool Guard Core v0.5.2

Tool Guard Core v0.5.2

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• ac97ca0: 0.5.2: narrow the tool-name case-fix, fix CI (gofmt CRLF, CVE) (@dimaggi-ai)
• 3535eae: Fix Windows .exe binary naming and POSIX-only syscalls in integration tests (@dimaggi-ai)
• 8f32826: Fix canonicalCandidates mishandling POSIX-absolute paths on Windows (@dimaggi-ai)
• b280f88: Fix multi-slash edge case + test-fixture JSON escaping on Windows (@dimaggi-ai)
• 544c75a: Fix shell-command-text path mangling in the last Windows test (@dimaggi-ai)
• 7008188: Fix the same Windows POSIX-path bug in path_classify + shell_classify (@dimaggi-ai)
• df1c172: Fix two pre-release bugs found by independent Fable + Codex review (@dimaggi-ai)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.5.2

Multi-arch manifest covering linux/amd64 and linux/arm64.

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt

Tool Guard Core v0.5.0

Tool Guard Core v0.5.0

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• d82873f: 0.5.0 fixups: tg hook shadow-mode bug, SDK metadata/doc consistency (@dimaggi-ai)
• 2510a84: 0.5.0: Python SDK + partial 1.0-roadmap progress, on top of reliability/accountability fixes (@dimaggi-ai)
• 3678c9a: 0.5.0: fail-closed evaluator errors, full-chain audit verify, unknown-tools-deny for tg hook, real shell tokenizer (@dimaggi-ai)
• d5219e7: Harden v0.5.0 audit coverage and policy lint (@dimaggi-ai)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.5.0

Multi-arch manifest covering linux/amd64 and linux/arm64.

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt

Tool Guard Core v0.4.0

Tool Guard Core v0.4.0

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• 810f2ef: 0.4.0: Windows path-separator correctness fix + release-process guard (@dimaggi-ai)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.4.0

Multi-arch manifest covering linux/amd64 and linux/arm64.

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt

Tool Guard Core v0.3.0

Tool Guard Core v0.3.0

The policy decision point for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• cb2903e: 0.3.0: govern the workload agents actually have (write/http classify + hook audit) (@dimaggi-ai)
• 63bd492: 0.3.0: write/http classifiers, tg coverage, hardened symlink allow-list (@dimaggi-ai)
• bb062be: Add tg coverage — measure policy governance coverage over real traffic (@dimaggi-ai)
• 287a50a: Harden 0.3.0 classifiers + hook audit (pre-release review fixes) (@dimaggi-ai)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.3.0

Multi-arch manifest covering linux/amd64 and linux/arm64.

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt

Tool Guard Core v0.2.0

Tool Guard Core v0.2.0

The runtime policy firewall for AI agents — Apache 2.0.

Highlights & upgrade notes: Release-Notes.md
· full change log in CHANGELOG.md.

Changelog

• e64c282: Add 0.2.0 release notes doc + link from README/docs, refresh limitations heading (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• c2898f4: Add coding-agent-guard example: one policy gating Claude Code, Codex, and Antigravity (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• b0d4924: Add concurrency/scale stress tests; docs cleanup (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• e0fd24f: Add tests and docs for tg hook, protect-paths, and writable-scope lint (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• 29204b1: Add tg hook verb, unconditional protected-path self-protection, writable-scope lint (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• 53d39f4: Bump doc image tags to v0.2.0 for release (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• 5eb0b3a: Consolidate release notes into root Release-Notes.md (0.2.0 + 0.1.0) (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• 458b79b: Fix velocity clock source (client-timestamp bypass) + remove dead code (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• 5c7b064: Harden self-protection after adversarial review (codex findings) (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• 140a185: Merge release/v0.2.0 — Tool Guard Core 0.2.0 (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• c08cea9: Tool Guard Core 0.2.0 — velocity mitigation, operators, tg simulate (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)
• e383254: Tool Guard Core v0.1.0 — initial public release (DIMAGGI AI 266338701+dimaggi-ai@users.noreply.github.com)

Container image

docker pull ghcr.io/dimaggi-ai/tool-guard-core:0.2.0

Multi-arch manifest covering linux/amd64 and linux/arm64.

Verify the binaries

Every release ships a checksums.txt. Verify with:

sha256sum -c checksums.txt