Guardana Control 0.13.0

A coding runtime's tool hooks can now reach a plane's experimental
enforcement API through guardana-control hook. The hook only takes calls
away: it lets a call run only when the plane answers EXECUTE of exactly the
input the runtime proposed, and reports its completion with the input that ran
(ADR-0056).
The first built-in profile, for one coding runtime,
is experimental, qualified on one release of that runtime and labelled
"decided, with failure gaps": the runtime, not the plane, runs the call, so a
hook is not an enforcement point. Outside OBSERVE, a call is now handed out
only while the policy it was decided under is still installed and fresh
(ADR-0055),
and the enforcement receiver holds a lock beside its socket, so a second plane
on the same socket is refused
(ADR-0054).
Every pull request now runs the guide for connecting an existing MCP setup
with the MCP project's Python SDK
(ADR-0057).
Among the pre-release audit's fixes: the receiver serves only the listener it
locked, and OBSERVE counts a stale hand-out only for a call its policy let
run. The project is still alpha, and the 0.x series makes no compatibility
promise between minor versions.

Added

• guardana-control hook takes a coding runtime's tool events to a plane's
  enforcement API: a call runs only when the plane answers EXECUTE of
  exactly the input the runtime proposed, and its completion is reported with
  the input that ran, compared by value
  (ADR-0056).
  The hook only restricts: it never replies allow, ask or defer. The first
  built-in profile, for one coding runtime,
  is decided with failure gaps and qualified on one release of that runtime:
  20 cases run headless against a plane, with the results beside the profile.
• A CI job runs the guide for connecting an existing MCP setup end to end with
  an MCP client outside the Go SDK, the MCP project's Python SDK, against the
  reference filesystem server, on every pull request
  (ADR-0057).
  The example now pins the server and its packages in a lockfile, and the
  guide installs it with npm ci --ignore-scripts.

Fixed

• An enforcement receiver's Serve refuses any listener but the one its own
  Listen bound with the socket's lock held, and that one a second time, so
  the plane never serves a socket whose lock it does not hold.
• In OBSERVE, pipeline_stale_handed_out_total no longer counts a call the
  kernel blocked or held: only one whose decision let it run, a read the
  fail-closed table opened included
  (ADR-0055).
• guardana-control react reads the clock for a stop once it holds the lock
  on the stop list. A stop no longer loses the time spent waiting for the lock,
  and a finding is no longer refused as "not written" because another react
  wrote a line with a later clock while this one waited.
• The gateway configuration refuses a double quote inside a plain value, with
  its line, instead of reading a # after it as part of the value. A
  configuration that holds one, such as an upstream argument --name="x", no
  longer loads: quote the whole value and write the quote as \".
• The evidence-report example reads a state of any earlier minor version and
  requires only the members that version had, comparing versions as numbers.
• The enforcement receiver holds a lock on <socket>.lock beside its socket
  for as long as it listens, and a second plane on the same socket is refused
  while the lock is held. On macOS a live receiver with a full backlog refuses
  connections, so a second plane could remove its socket and take its clients
  (ADR-0054).
  Built for Solaris, illumos or AIX, which have no flock, the receiver now
  refuses to listen, and doctor checks the lock file as run would.

Changed

• A call is handed out only while the policy bundle it was decided under is
  still installed and fresh. A bundle replaced, or past its staleness budget,
  between the decision and the hand-out now blocks the call with
  POLICY_STALE outside OBSERVE, which counts it as stale_handed_out; a
  read policy.fail_open_read opened still runs while its bundle is the same.
  A resume judges this before it consumes its approval, and a change found
  then spends nothing; one found after the consume still blocks the call, with
  the approval spent
  (ADR-0055).

Image: ghcr.io/guardana/control-gateway@sha256:85aecea0158a341b3c60e064f65f731505d5035dcb5218400ca9d1301703bfe3