v0.10.0: Tessera v1.0 compat (RustProvenanceLabelAdapter)

Requires tessera-mesh>=1.0.0 (Tessera GA), specifically v1.0.2 or later, which ships the missing tessera_rs.label submodule shim.

Added

• RustProvenanceLabelAdapter in agentmesh.adapters.tessera_rs that wraps the v1.0 tessera_rs.label.ProvenanceLabel PyO3 binding (Wave 4B in the Tessera v0.12-to-v1.0 plan). Ships four surfaces: trusted_user, untrusted_tool_output, join, and to_canonical_json plus three numeric accessors (integrity_numeric, secrecy_numeric, capacity_numeric).
• _TesseraRsBundle.label and _TesseraRsBundle.label_available flag for AgentMesh callers that want to gate the fast path on the v1.0 wheel being installed.
• Five parity tests in tests/test_tessera_rs_adapter.py covering trusted-user / untrusted-tool-output construction, the max-integrity join law, canonical-JSON source preservation, the Python-fallback path for non-default secrecy, and the mixed-backend join rejection.

Changed

• tessera-mesh dependency pin raised to >=1.0.0 so users get the v1.0 GA library by default. Older tessera-mesh>=0.7.1 installs still work; RustProvenanceLabelAdapter falls back to Python when the tessera_rs.label submodule is absent.
• agentmesh-proxy /healthz version field now reports 0.10.0 (was stuck at 0.7.1 since v0.7.1).
• FastAPI app version raised from 0.3.0 to 0.10.0.

Verified

• pytest tests/test_tessera_rs_adapter.py -v passes 5 new label tests + the existing parity matrix when tessera-rs>=1.0.0 is installed; the label tests skip cleanly on older wheels.
• Full AgentMesh suite: 267 passed, 10 skipped.

v0.9.0: deeper auto-swap + rate limiter adapter + PyScanner registry

v0.9.0: deeper auto-swap + rate limiter adapter + PyScanner registry

v0.8.0: tessera_rs adapter

v0.8.0: tessera_rs adapter + use_rust_primitives flag

v0.7.1: Multi-tenant Context isolation (security fix)

Requires `tessera-mesh>=0.7.1`.

Fixed

• Multi-tenant Context isolation. v0.7.0 and earlier shared one `Context` across all sessions. Combined with the taint-tracking invariant (`min_trust` over every segment drives the verdict), this meant a web-tainted segment from session A would deny tool calls from session B running on the same proxy. v0.7.1 keeps each session's Context, `DependencyAccumulator`, risk forecaster, and canary tracker isolated. Cross-session interference cannot happen.

Added

• `MeshProxy.session_context_ttl_seconds` (default 3600s) and `MeshProxy.session_context_max` (default 10000) config fields.
• `GET /v1/sessions` returns active session ids, eviction count, and the configured limits.
• `MeshProxy.reset_all_sessions()` for operator-driven full reset.

Changed

• `MeshProxy.add_user_prompt`, `build_provenance_manifest`, `split_context`, `check_output_provenance`, and `check_canary_leakage` now take `session_id: str = "default"`.
• The endpoints `/v1/context`, `/v1/context/split`, `/v1/provenance`, `/v1/check-output`, and `/v1/reset` accept `session_id` as a query parameter; `/v1/evaluate` and `/v1/label` accept it in the request body. Omitting `session_id` defaults to the literal session named `default` for backward compat.
• `MeshClient` propagates its `session_id` field through every endpoint call.
• `MeshProxy` no longer holds standalone `_accumulator`, `_risk_forecaster`, or `_canary_tracker` attributes. Tests that checked these need to read `proxy._get_session_state(session_id)` instead.

Verified

• 240 passing tests; same 2 pre-existing async-fixture failures as v0.7.0.
• 16 new tests in `test_session_isolation.py` pin the headline property (alice's taint does not deny bob), per-session accumulator / forecaster / canary isolation, eviction callback cleanup, every endpoint that accepts `session_id`, and backward compatibility for callers that omit `session_id`.

Install

```
pip install agentmesh-mesh==0.7.1
```

v0.7.0

Requires tessera-mesh>=0.7.0.

Added

• LLMGuardrail circuit breaker exposed on /healthz and a new GET /v1/metrics/guardrail endpoint. Operators can now alert on breaker.state != "closed" or rising breaker.total_opens.
• Persistent hash-chained audit log via audit_log_path (and optional audit_log_seal_key for truncation detection). Backed by tessera.audit_log.JSONLHashchainSink. New GET /v1/audit/verify walks the chain and returns valid / first_bad_seq / seal_valid.
• Replay system over the audit log:
  • GET /v1/audit/cases filtered case listing with current label per case
  • POST /v1/audit/label set ground-truth label, persists to disk
  • GET /v1/audit/labels dump label map
  • GET /v1/replay/candidates list built-in candidates
  • POST /v1/replay/run replay against a candidate, return stats and per-case results
  • Built-in current_policy candidate rebuilds a Context from the recorded segments and runs Policy.evaluate.
• SSRF guard wired into the evaluator after destructive_guard / supply_chain and before YARA. New endpoint POST /v1/ssrf/check. Three new config flags: enable_ssrf_guard, ssrf_blocked_hostnames, ssrf_allowlist_hostnames.
• guardrail_redact_before_judge: bool = True toggle. Default preserves the invariant that no live secret reaches the judge endpoint; opt-out only when the operator trusts the judge at the same level as the application LLM. The choice is recorded in each guardrail event detail under redacted_input.
• Policy builder workflow:
  • POST /v1/policy/builder/run returns scored proposals from the deterministic analyzer ranked by net_fixes (fixed - regressed)
  • POST /v1/policy/builder/llm returns LLM-generated proposals (constrained template set), optionally scored. Reuses the same Anthropic / OpenAI client and model that backs the LLMGuardrail.
• Static URL pattern rules gate. Fast deterministic allow / deny that runs before SSRF and scanners. New endpoint POST /v1/url-rules/check. Two new config flags: enable_url_rules, url_rules (list of dicts with rule_id, pattern, kind, action, optional methods, optional description).

Changed

• LLMGuardrail parse failures now raise so the circuit breaker counts them.
• scan_and_label snapshots output_text before any redaction phase so the raw form survives subsequent mutation.

Verified

• 224 passing tests; 2 pre-existing async-fixture failures unrelated to this release.

Install

pip install agentmesh-mesh==0.7.0

v0.6.0

v0.6.0 - Scanner protocol + coding-agent hook SDK redesign

Requires `tessera-mesh>=0.6.0`.

Supply chain scanner (Scanner protocol)

• `_supply_chain_scanner` is now a `SupplyChainScanner` instance implementing the shared Scanner protocol
• evaluate_tool_call reports structured findings with `rule_id` like `sc.typosquat`, `sc.curl_pipe_sh`, `sc.separator_shadow`
• `/v1/supply-chain/check` response shape: `{allowed, primary_reason, max_severity, findings: [{rule_id, severity, message, arg_path, evidence, metadata}]}`
• `supply_chain_block_severity` config removed (now a SupplyChainScanner constructor arg)

YARA scanner (new)

• `_yara_scanner` is always instantiated with lazy import; `available=False` and no-op scan when yara-x is missing
• Integrated in evaluate_tool_call after supply-chain check
• Users can supply rules via direct instantiation; future config hook will expose `rules_dir`

Coding-agent hook SDK (full redesign)

Four adapters, one base class:

• `agentmesh.sdk.claude_code.ClaudeCodeAdapter` - Claude Code hook format precisely implemented (session_id, hook_event_name, tool_name, tool_input; emits `{"decision":"block","reason":...}` AND exit 2)
• `agentmesh.sdk.cursor.CursorAdapter`
• `agentmesh.sdk.copilot.CopilotAdapter`
• `agentmesh.sdk.gemini.GeminiAdapter`

Shared base `AgentHookAdapter` in `agentmesh.sdk.init` handles the stdin-JSON / stdout-JSON + exit-code pipeline. Two evaluator transports:

• `HTTPEvaluator` (stdlib urllib, dependency-free) with `TESSERA_FAIL_OPEN` env var for explicit fail-closed (default) or fail-open
• `InProcessEvaluator` wraps a callable for tests and all-in-one deployments

Install in Claude Code:

```json
// ~/.claude/settings.json
{
"hooks": {
"PreToolUse": [{
"matcher": "*",
"hooks": [{"type":"command","command":"python -m agentmesh.sdk.claude_code"}]
}]
}
}
```

Environment: `AGENTMESH_ENDPOINT=http://localhost:9090\` (required), `AGENTMESH_API_KEY=...` (optional), `TESSERA_FAIL_OPEN=0|1` (default 0).

Removed

• `agentmesh.sdk.coding_agent` (replaced by per-agent modules)
• Old module-level handlers in `claude_code` (replaced by ClaudeCodeAdapter)

Tests

179 passing (was 177). Full HTTP transport smoke tests for the evaluator (fail-open and fail-closed on unreachable endpoint).

Install

```bash
pip install -U agentmesh-mesh tessera-mesh
```

v0.5.0

v0.5.0 - Sensitivity + destructive_guard redesign (breaking)

This release reworks the two Sondera-inspired primitives based on design feedback. The old stub APIs are gone; both primitives now match how a production proxy actually needs them to behave.

Sensitivity (breaking)

Trajectory-keyed high-water-mark. Multiple concurrent sessions each get their own watermark; the old single-context model could not support shared proxy deployments.

• `HWMStore` protocol with `InMemoryHWMStore` default. Swap for Redis without touching the policy code.
• `SensitivityClassifier` with pluggable rules. Defaults cover AWS/GCP/JWT/PEM/GitHub/Slack tokens, bearer headers, SSN, Aadhaar, credit cards, and explicit CONFIDENTIAL/INTERNAL markers.
• `OutboundPolicy.check(tool_name, hwm)` is a pure function. The HWM is mutated only by `/v1/sensitivity/classify`, so evaluator reads are reproducible from audit data.
• Per-tool `ToolClassification(outbound, max_sensitivity)` registry replaces the hardcoded glob list.
• Four labels: PUBLIC, INTERNAL, CONFIDENTIAL, RESTRICTED.

Destructive guard (breaking)

Every pattern is a named hard deny. No severity axis, no score.

• `DestructiveGuard.check(tool_name, args)` returns `GuardResult` with `allowed` and `matches[i]` carrying `pattern_id`, `category`, `description`, `arg_path`, `matched_text`.
• Args flattener handles nested dicts/lists so audit logs report `headers.x-run` instead of a concatenated blob.
• Expanded patterns: fork bomb, shutdown/halt/poweroff, find -delete at root, chmod -R 777 at root, git clean -fdx, kubectl delete --all --force, aws s3 rb --force, --force-with-lease explicitly allowed.
• `fs.rm_rf_root` only blocks terminally-root targets. `rm -rf node_modules` stays legitimate.

Reference evaluator

New `agentmesh.evaluate.ToolCallEvaluator` shows the correct layer ordering:

1. destructive_guard (explicit deny, highest audit signal)
2. sensitivity / outbound (pure HWM read)
3. your existing scanners (directive, intent, heuristic)
4. irreversibility scorer (threshold-based, runs last)

Test `test_destructive_wins_over_sensitivity` verifies that when a call is both destructive AND a leak, the audit attributes it to the destructive pattern.

API changes

• `POST /v1/sensitivity/classify` now takes `{content, trajectory_id?}`. Only mutates HWM when trajectory_id is present.
• `GET /v1/sensitivity/status?trajectory_id=...` reports HWM for that trajectory.
• `DELETE /v1/sensitivity/status?trajectory_id=...` resets a trajectory HWM.
• `POST /v1/destructive/check` response shape: `{allowed, primary_reason, matches:[{pattern_id, category, description, arg_path, matched_text}]}`.
• `destructive_guard_block_severity` config removed.
• `outbound_tool_registry` config replaces `outbound_tool_patterns`.
• `scan_and_label` and `reset_context` now take `session_id`.

Tests

• AgentMesh: 177 passing (was 167)
• Tessera: 83 passing for the two rewritten modules

Install

```bash
pip install -U agentmesh-mesh tessera-mesh
```

v0.4.0

v0.4.0 - Sondera-inspired primitives + coding-agent hooks

Three new defense primitives wired into the proxy, plus SDK adapters for coding agents (Claude Code, Cursor, Copilot, Gemini CLI).

New primitives (require tessera-mesh>=0.4.0)

Information Flow Control (sensitivity labels) - Bell-LaPadula lattice on an axis orthogonal to trust. `HighlyConfidential` content (SSN, AWS keys, private keys) blocks all outbound tools. `Confidential` + injection signal blocks outbound. Two new endpoints, fully orthogonal to taint tracking. Default off.

Destructive operation guard - Explicit pattern deny-list for irreversible ops: `rm -rf /`, `DROP DATABASE`, `terraform destroy`, `git push --force main`, `kubectl delete --all`, lock-file deletion. Configurable BLOCK / WARN severity. Default ON.

Supply chain scanner - Detects pip / npm / cargo / yarn / gem install patterns indicating attacks: command injection in flags, `curl ... | bash`, dependency confusion, typosquatting, credentials in manifests, lock-file regen. MITRE ATT&CK mapped (T1195.x, T1552.001). Default ON.

Coding-agent SDK (NEW market)

`agentmesh.sdk.claude_code` - Claude Code stdin/stdout JSON hooks (PreToolUse, PostToolUse, UserPromptSubmit, SessionStart). Drop into `~/.claude/settings.json`.

`agentmesh.sdk.coding_agent` - Generic adapter for Cursor, Copilot, Gemini CLI with per-agent field-name aliasing. CLI: `python -m agentmesh.sdk.coding_agent --agent cursor --hook pre-tool`.

Tests

• AgentMesh: 167 passing (was 109), +58 across the new features
• Tessera: 96 new tests for sensitivity (31), destructive_guard (39), supply_chain (26)

Install

```bash
pip install agentmesh-mesh tessera-mesh
```

Reference

Sondera coding-agent-hooks: github.com/sondera-ai/sondera-coding-agent-hooks

v0.3.0

AgentMesh v0.3.0

Security mesh for AI agent systems, composing 51 Tessera modules into a proxy service with 23 HTTP endpoints.

Highlights

• 23 HTTP endpoints covering taint-tracking policy evaluation, content scanning, RAG retrieval guard, tool baseline drift detection, provenance manifests, SARIF compliance export, signed evidence bundles, and agent liveness
• Framework SDK with proxy-backed adapters for LangChain, OpenAI Agents, CrewAI, and Google ADK
• 22 defense layers from prompt screening to SARIF compliance export
• 106 tests passing in 5.5 seconds
• OpenAPI docs auto-generated at /docs (all request bodies are typed Pydantic models)

Modules

• agentmesh.proxy (1,172 lines): 23-endpoint proxy orchestrating 51 Tessera modules
• agentmesh.identity: Signing, SPIRE, mTLS, liveness, delegation intent
• agentmesh.transport: MCP interceptor, baseline drift, RAG guard
• agentmesh.exports: SARIF, telemetry, evidence, control plane
• agentmesh.client: HTTP client for the proxy API
• agentmesh.sdk: Framework adapters (LangChain, OpenAI Agents, CrewAI, Google ADK, generic)

Install

pip install agentmesh tessera-mesh

Quick test

pip install -e '.[dev]' tessera-mesh[agentmesh,cel,sessions]
pytest tests/ -v  # 106 passed in 5.5s