Skip to content

v9.2.1 — audit-verify endpoint telemetry fix (carries the full v9.2.0 feature set)

Choose a tag to compare

View all tags
@saurabhjain1592 saurabhjain1592 released this 23 Jun 23:19
v9.2.1
347dc4c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v9.2.1 - maintenance patch on v9.2.0

v9.2.1 is a maintenance patch on v9.2.0. It registers the three audit-verification endpoints introduced in v9.2.0 in the platform's request-path normalization table, so their telemetry and metrics report a stable templated path. There are no API, schema, configuration, or behavior changes, and it is a drop-in upgrade from v9.2.0. Because v9.2.0 was the substantive release in this train, its full feature set is reproduced below and ships unchanged in v9.2.1.

Fixed in v9.2.1

  • Audit-verification endpoints normalized in telemetry. v9.2.0 introduced three read-only audit-verification endpoints (GET /api/v1/audit/chains/{chainID}/verify, GET /api/v1/audit/records/{recordID}/verify, and GET /api/v1/audit/signing-key). They route and respond exactly as in v9.2.0; v9.2.1 registers them in the request-path normalization table used for metrics and telemetry, so each reports a stable templated path instead of one carrying an inline chain or record identifier. This keeps metric cardinality bounded and dashboards consistent. Telemetry-hygiene fix only: endpoint routing, responses, and authorization are unchanged.

The remainder reproduces the v9.2.0 release in full. v9.2.1 ships all of it unchanged.

v9.2.0 - read-only MCP posture, tamper-evident audit signing, turnkey SIEM export, compliance-category enforcement

v9.2.0 hardens governance and audit assurance: a one-config read-only MCP posture enforced down to the database, per-record cryptographic signing of the decision chain (now capturing live traffic) with read-only verification endpoints, a turnkey central-store / SIEM audit exporter, and automatic cross-border transfer-basis stamping on the canonical audit record. Two behavior changes to note (both in Fixed): the seeded RBI / SEBI / MAS-FEAT / EU-AI-Act compliance policies now actually fire on /decide and the gateway (they were silently excluded by a category-name mismatch), and a tool or connector response carrying an indirect prompt-injection pattern is now sanitized by default on the response plane. Everything else is additive and off by default.

Added

  • Read-only MCP posture, enforced at the database. (Community) A single configuration switch, MCP_READ_ONLY (default off), turns the entire MCP surface read-only: every write-path MCP call is blocked across all planes that consult the policy engine (policy-check and check-input, tools-execute and resources-query, and the gateway pre-check), classified by a verb tokenizer and a SQL statement classifier that masks string literals and comments and rejects stacked statements, SELECT ... INTO, and EXPLAIN ANALYZE. The classifier fails closed: anything it cannot prove read-only is treated as a write and blocked. A defense-in-depth backstop at the connector layer opens read-only queries in a database-enforced read-only transaction, so a write that slips past the verb gate is rejected by the database itself (PostgreSQL SQLSTATE 25006). Byte-for-byte unchanged when the switch is off.
  • Tamper-evident audit signing, now on the live decision path, with verify endpoints. (Community) Each decision record is signed with a per-record Ed25519 signature and linked into a hash chain, so removing, reordering, or editing any record breaks the chain and is detectable. Signing now runs on the live decision path (the platform writes a signed record as decisions are made), and two read-only verification endpoints let an auditor check integrity without database access: GET /api/v1/audit/chains/{chainID}/verify (an entire chain) and GET /api/v1/audit/records/{recordID}/verify (a single record). Configured via AXONFLOW_AUDIT_SIGNING_KEY and AXONFLOW_AUDIT_VERIFY_KEYS (which makes key rotation possible without invalidating older records). Opt-in; a no-op when no signing key is configured.
  • Turnkey SIEM / central-store audit exporter. (Community) A built-in exporter ships every decision record to an external sink off the request hot path. A non-blocking queue with a bounded timeout and a circuit breaker means it never adds latency to or blocks an enforcement decision; if the sink is unreachable, records are dropped with a counter rather than back-pressuring the platform. Configured with AXONFLOW_AUDIT_SINK plus the AXONFLOW_AUDIT_S3_* variables, and metered on axonflow_central_store_records_total. Disabled by default.
  • Automatic cross-border transfer-basis stamping. (Enterprise) At LLM-forward time the platform auto-stamps the Indonesia UU PDP Pasal 56 cross-border transfer basis (and derived destination data-residency) onto the canonical audit record, and the OJK cross-border export reads that same row. The basis is resolved per-request, then per-organization (AXONFLOW_ORG_TRANSFER_BASIS), then a global default (AXONFLOW_DEFAULT_TRANSFER_BASIS); an invalid configured value is rejected and the row is left unstamped rather than written with a fabricated basis. A no-op in community builds.

Fixed

  • Indirect prompt-injection is now governed on the response / tool-output plane. (Community, behavior change) AxonFlow already governed indirect prompt-injection patterns (instruction-override, role-reassignment, system-prompt exfiltration, and template/bracket markers) on the request plane, but a tool or connector response could return the same patterns in a free-text field and re-enter the model's context ungoverned. Those patterns are now evaluated on the response and tool-output plane as well. The default response-plane action is redact (sanitize): the sentence, line, or clause carrying the injection is removed (JSON-aware, preserving valid structure and sibling fields), overridable per organization to warn or block; the input plane still blocks. Behavior change: such a response now has the injection-bearing statement removed by default.
  • Seeded compliance policies now enforce on /decide and the gateway. (Community, behavior change) The seeded EU AI Act, RBI, SEBI, and MAS FEAT compliance policies carried category names that had drifted from the canonical compliance-* constants the decision API filters on, so they were present but never selected on those paths. The categories are canonicalized at source for fresh deployments, with a forward-fix migration for existing ones. No new policies were added. Behavior change: deployments running these seeded compliance packs will start enforcing them on the decision API and gateway after upgrading.
  • Matched policies surface the policy name, not an opaque identifier. (Community) The orchestrator's active-policy listing now reports the stored policy name in matched_policies instead of the internal cache key.
  • The OJK cross-border export reads the canonical audit record. (Enterprise) The Indonesian OJK cross-border export is repointed to the canonical audit record carrying the stamped transfer basis, consolidating cross-border evidence onto one source of truth.

Upgrading

v9.2.1 is a drop-in upgrade from v9.2.0 and from v9.1.x. Database migrations apply automatically on startup and add columns to the canonical audit record without changing existing behavior. Every new capability in this train is opt-in. Two things to check first (both introduced in v9.2.0): the seeded EU AI Act / RBI / SEBI / MAS FEAT compliance policies now match and enforce on the decision API and gateway after upgrading, and a tool or connector response carrying an indirect prompt-injection pattern is now sanitized by default on the response plane. Review those if either is a concern.

# Community
docker compose pull && docker compose up -d

# Enterprise
docker compose -f docker-compose.yml -f docker-compose.enterprise.yml pull
docker compose -f docker-compose.yml -f docker-compose.enterprise.yml up -d

Full release notes: https://docs.getaxonflow.com/docs/releases/v9-2-1
Migrations are additive and apply automatically on startup.

Assets 2
Loading