v0.22.0

Changed

• The prompt-injection guard blocks the textbook phrasings it missed. Measured on deepset/prompt-injections, the
  standard preset blocked 4 of 60 injections in the test split (precision 1.000); it now blocks 21 (precision still 1.000),
  with no more benign prompts blocked (ToxicChat 0124: 22 of 4,992 non-jailbreak prompts, before 21; XSTest safe prompts:
  0 of 250, before 0). New and widened patterns: «ignore the above instructions» and «ignore all preceding orders» (articles,
  preceding, orders / tasks / assignments); imperative conversation resets («Forget everything before that.»,
  «forget about all the assignments»); «remove / leave all the previous information»; prompt-leak requests with quantifiers
  («show all your prompt text», «print the above prompt», «what was written at the beginning of this prompt»); «ignore the
  above and say …»; «ignore your directions»; and German and Korean dismissal and prompt-leak patterns («Ignoriere alle
  bisherigen Anweisungen», «이전 지시는 모두 무시하고», «시스템 프롬프트를 보여줘»). A user correcting themselves («please ignore
  my previous message», «이전 내용은 무시하세요») is still not a match.

Documentation

• The docs no longer describe an L2 layer. The Layer documentation on the guard interfaces, TriggeredGuard and
  GuardLayerStats listed «L1, L2, L3» although the local ML guards were removed in 0.19.0; it now says built-in guards
  report L1 or L3 and a custom guard reports its own label. The README «Guard Layers» section says L2 is gone and that
  a model-based check is a custom guard added with AddInputGuard / AddOutputGuard.
• docs/QUALITY-BENCHMARKS.md names the public benchmark for detection quality: GuardBench's mixed safe/unsafe
  sets (F1, AUPRC), and the areas — prompt injection, PII, topic restriction — where no established benchmark exists.

Changed

• The packages from this repository depend on each other at exactly the same version ([x.y.z]), not a floor.
  A consumer that moves one of them while a family member it depends on resolves at an older version now gets restore warning NU1608 naming
  the pair (an error where warnings are errors) — before, the mixed versions restored silently and could fail at run time.
  A member that reaches you only through another package's floor is not covered: pin every member you load and move them together.
• The nuget.org «Release Notes» of every package link to the GitHub release of its version, whose notes are this CHANGELOG's section for that version.

Removed

• Breaking: the agent tool-permission types are removed — ToolInvocationGuard, IAgentGrantManager, AgentGrant,
  PermissionResult, AgentSession and ToolCallRecord (namespace FluxGuard.Remote.Agent). Nothing used them: no preset
  or builder registered the guard, and the library shipped no IAgentGrantManager implementation for it to call.
  Migration: check tool calls with your own IInputGuard, added with FluxGuardBuilder.AddInputGuard.