Agentic Security Harness v1.2.0

Agentic Security Harness v1.2.0

Agentic Security Harness v1.2.0 adds the first packaged local Runtime Gateway synthetic
contour while preserving the stable trace schema 1.0, corpus 1.0.0, and Agent Host V1
contracts.

Highlights

• A loopback-first HTTP gateway that evaluates a closed policy before dispatching two
  deterministic synthetic tools.
• Bounded OpenAI-compatible and stateless MCP 2026-07-28 development endpoints with
  strict request, header, origin, and protocol validation.
• Credential-free retained-envelope normalization for OpenAI Responses, Anthropic
  Messages, Google Interactions, and MCP tool calls through the same policy.
• Privacy-minimized, single-writer hash-chain audit records and a local aggregate
  dashboard that do not retain raw prompts, tool arguments, tool results, or credentials.
• Structured approval requests that are digest-bound and deliberately non-executable;
  no approval-grant endpoint is shipped.
• A hardened source-build Docker Compose contour with loopback-only publication,
  read-only root filesystem, dropped capabilities, and no-new-privileges.
• Installed-package, container, provider-fixture, MCP, packaging, and documentation
  coverage in the Linux-first CI matrix, with Windows compatibility retained.

Start here

Install from PyPI:

python -m pip install agentic-security-harness==1.2.0
ash gateway-init --out gateway.toml
ash gateway-check --config gateway.toml
ash gateway-serve --config gateway.toml

Open http://127.0.0.1:8787/dashboard after startup. For the hardened local container
path, use:

docker compose -f compose.gateway.yml up --build

The Docker definition is shipped as source. This release does not publish or attest a
public container image.

Evidence and limitations

The gateway is a defensive, credential-free synthetic integration contour. It has no live
provider transport, native provider SDK dependency, arbitrary tool executor, credential
broker, authenticated approval service, production IAM integration, deployment authority,
or enforcement claim. Offline provider adapters normalize retained fixture envelopes; they
do not call OpenAI, Anthropic, Google, or MCP servers.

The release workflow reproducibly builds and smoke-installs the wheel and sdist, produces
SHA-256 checksums and an exact-subject CycloneDX 1.6 SBOM, and creates independently
verified GitHub/Sigstore attestations before separately authorized package-index promotion.
A clean result is not a production safety certification. Independent standards validation
and independent maintainer review remain unclaimed.

Full changes: CHANGELOG.md. Release procedure:
release-checklist.md and
release-to-pypi.md.