v0.17.0 - Pinned repository workflows

Repository workflow supply-chain hardening

• Pin every third-party Action in CI, Pages, and Star Watch to a full commit SHA.
• Add a repository-wide regression that rejects mutable third-party Action tags.
• Configure weekly Dependabot updates for GitHub Actions.
• Keep the same-repository @v0 references only as deliberate public compatibility probes.
• Preserve v0.14 attestation-bound checkout/setup-node major versions; changing those identities requires a new producer/verifier evidence run rather than a dependency-only PR.
• Document the policy and exceptions in English and Simplified Chinese.

Verification

• 147 deterministic tests pass.
• CI: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989908977
• Pages: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989647549
• Star Watch with pinned checkout/setup/cache/upload Actions: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989705701
• Dependabot policy evaluation completed without reopening the attestation-bound major upgrades: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31989911337

A full commit SHA identifies the Action code that ran; it does not prove that code is secure or semantically correct. Dependabot PRs still require review and CI.

v0.16.0 - Pinned starter workflow dependencies

Starter workflow supply-chain hardening

• Pin actions/checkout to the reviewed v7.0.1 commit SHA in every generated workflow.
• Keep all three downloadable Starter workflows byte-equivalent to agentic-init output.
• Add regression coverage that rejects a mutable checkout major tag.
• Document the immutable third-party pin and the deliberate moving @v0 project channel in English and Simplified Chinese.

Verification

• 145 deterministic tests pass.
• CI: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31986094274
• Pages deployment: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31986094253
• npm dry-run package: 369,398 bytes, 73 files; all six Starter files included.

This release improves dependency identity for newly generated consumer workflows. It does not prove that an Agent or third-party Action is generally safe. The project action remains on the documented moving @v0 channel unless a consumer chooses an immutable release tag or commit SHA.

v0.15.0 - Canonical public schemas

What shipped

• All four machine-readable JSON Schemas are now published directly through GitHub Pages with application/json responses.
• The Agent Card Schema no longer uses a placeholder example.com identity; its $id is the canonical Pages URL.
• Agent Card Schema explicitly accepts a standard $schema URI declaration.
• agentic-init and all three downloadable Starter Cards now declare the canonical schema automatically.
• The browser scorecard now exports a complete schema-valid Agent Card with required owner and workflow fields.
• Browser exports remain fail closed: TODO fields and one explicit launch blocker are preserved.
• New English and Simplified Chinese schema guides explain mutable canonical URLs versus immutable release-pinned URLs for external adopters.
• 145 deterministic tests pass.
• Independent Draft 2020-12 validation covers all schemas, the browser export, and all Starter Cards.

中文说明

• 四个机器可读 JSON Schema 现在全部通过 GitHub Pages 直接发布，并返回 application/json。
• Agent Card Schema 不再使用占位 example.com 身份；其 $id 已改为 Canonical Pages URL。
• Agent Card Schema 显式支持标准 $schema URI 声明。
• agentic-init 与三套可下载 Starter Card 会自动声明 Canonical Schema。
• 浏览器评分器现在导出包含必填 owner 与 workflow 字段的完整合法 Agent Card。
• 浏览器导出继续 fail closed：保留 TODO 与一个显式上线 blocker。
• 新增完整中英文 Schema 指南，解释外部采用场景下 Mutable Canonical URL 与 Immutable Release URL 的区别。
• 145 项确定性测试通过。
• 独立 Draft 2020-12 校验覆盖全部 Schema、浏览器导出和三套 Starter Card。

Public contracts / 公开契约

• Agent Card: https://lindixu6-hash.github.io/awesome-agentic-engineering/schema/agent-card.schema.json
• Prompt-injection fixture: https://lindixu6-hash.github.io/awesome-agentic-engineering/schema/prompt-injection-fixture.schema.json
• Eval Result: https://lindixu6-hash.github.io/awesome-agentic-engineering/schema/eval-result.schema.json
• Readiness profiles: https://lindixu6-hash.github.io/awesome-agentic-engineering/schema/readiness-profiles.schema.json
• English guide: https://github.com/lindixu6-hash/awesome-agentic-engineering/blob/v0.15.0/schema/README.md
• 中文指南: https://github.com/lindixu6-hash/awesome-agentic-engineering/blob/v0.15.0/schema/README.zh-CN.md

CI: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31983870584

Pages: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31983870535

v0.14.0 - Attested eval evidence provenance

What shipped

• A source-bound provenance-manifest.json covering repository/workflow identity, five trusted inputs, all 34 evidence files, and Eval Result counts.
• A least-privilege producer job that executes the OpenAI Agents SDK eval, creates one deterministic tarball, and signs it with GitHub OIDC + Sigstore.
• A separate reusable verifier pinned to immutable commit 8d4b435f66f58a570b65dd8b4952bf7e1e2dd62f.
• The reusable workflow checks out verifier code pinned to the older immutable trust root 34b12355a27a647adfb5b09578234a19ee076f0f.
• Every external Action in the producer/verifier chain is pinned to a full commit SHA.
• Attestation verification enforces signer workflow, signer digest, source digest/ref, repository identity, and a GitHub-hosted runner.
• Negative checks prove a modified bundle and wrong source digest fail verification.
• Manifest verification rejects changed evidence, changed trusted inputs, source-identity mismatches, and any failing Eval Result.
• Complete English and Simplified Chinese provenance documentation and web evidence.
• 141 deterministic tests; npm package remains free of nested dependencies.

中文说明

• 新增绑定源码的 provenance-manifest.json，覆盖仓库/Workflow 身份、5 个可信输入、全部 34 个证据文件与 Eval Result 计数。
• 最小权限 Producer Job 执行 OpenAI Agents SDK Eval、生成一个确定性 Tarball，并使用 GitHub OIDC + Sigstore 签名。
• 独立 Reusable Verifier 锁定到不可变 Commit 8d4b435f66f58a570b65dd8b4952bf7e1e2dd62f。
• Reusable Workflow 检出锁定到更早不可变信任根 34b12355a27a647adfb5b09578234a19ee076f0f 的 Verifier 代码。
• Producer/Verifier 链路中的全部外部 Action 均锁定完整 Commit SHA。
• Attestation 验证会约束 Signer Workflow、Signer Digest、Source Digest/ref、仓库身份与 GitHub 托管 Runner。
• 负向检查证明被修改的 Bundle 与错误 Source Digest 无法通过验证。
• Manifest Verifier 会拒绝被修改的证据、可信输入变化、Source Identity 不一致与任意失败 Eval Result。
• 提供完整中英文 Provenance 文档与网页证据。
• 141 项确定性测试通过；npm 包仍无嵌套依赖。

Verified release evidence

• Attested release run: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31982176033
• Final CI: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31982175893
• Pages deployment: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31982175879
• Release bundle SHA-256: e0c4c05bafc2873e11c7ab27eb264f01dc0d26106f9c55bed398d8908d8fcab2
• Canonical bootstrap evidence: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31981738763

Explicit limitation / 明确限制

The repository main branch was not protected when this evidence was generated. This attestation proves workflow, commit, runner, and artifact identity; it does not prove independent code review, semantic correctness, SLSA level, or general Agent safety.

生成该证据时，仓库 main 分支没有 Branch Protection。Attestation 能证明 Workflow、Commit、Runner 与 Artifact 身份，但不能证明独立代码审核、语义正确性、SLSA 等级或 Agent 普遍安全。

• English: https://github.com/lindixu6-hash/awesome-agentic-engineering/blob/v0.14.0/docs/evidence-provenance.md
• 简体中文: https://github.com/lindixu6-hash/awesome-agentic-engineering/blob/v0.14.0/docs/evidence-provenance.zh-CN.md

v0.13.0 - OpenAI Agents SDK runtime eval

What shipped

• A second external runtime adapter pinned to @openai/agents@0.16.1 and Zod 4.4.3 in an isolated lockfile.
• Every fixture executes through a real SDK Agent and Runner.run() loop.
• Allowed cases exercise SDK-managed, Zod-validated read-only function calls; refusal and escalation cases make no tool call.
• Trusted instructions and source-labeled untrusted content remain separate request fields.
• A public custom Model keeps the suite deterministic and offline; provider network access is disabled in regression tests.
• The expected outcome stays outside the Agent-controlled path and forced mismatches emit fail.
• All eight fixtures pass and generate 34 response, assertion, tool-trace, policy-trace, result, and summary files.
• CI validates results with public @v0 and retains openai-agents-eval-evidence.
• Complete English and Simplified Chinese adapter docs and technical Pages guides.
• 134 deterministic tests; both isolated dependency audits report zero known vulnerabilities.

中文说明

• 新增第二个外部 Runtime 适配器，在隔离 Lockfile 中锁定 @openai/agents@0.16.1 与 Zod 4.4.3。
• 每条 Fixture 都通过真实 SDK Agent 与 Runner.run() 循环执行。
• 允许继续的案例会执行 SDK 管理、经 Zod 校验的只读 Function Call；拒绝与升级案例不会调用工具。
• 可信 Instructions 与带来源标签的不可信内容保持为独立 Request 字段。
• 公共自定义 Model 让套件保持确定性和离线运行；回归测试会禁用 Provider 网络访问。
• 预期结果位于 Agent 可控路径之外，强制 mismatch 会真实生成 fail。
• 8 条 Fixture 全部通过，并生成 34 个回答、断言、工具 Trace、策略 Trace、Result 与 Summary 文件。
• CI 使用公开 @v0 校验结果，并保留 openai-agents-eval-evidence。
• 提供完整中英文适配器文档与技术 Pages 指南。
• 134 项确定性测试通过；两个隔离依赖审计均为 0 已知漏洞。

Public OpenAI Agents evidence: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31980983499

Final release CI: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31981159024

English guide: https://lindixu6-hash.github.io/awesome-agentic-engineering/openai-agents-eval/

中文指南: https://lindixu6-hash.github.io/awesome-agentic-engineering/zh/openai-agents-eval/

v0.12.0 - No-install readiness starters

What shipped

• Direct Agent Card JSON and GitHub Actions YAML downloads for read-only, draft-only, and state-changing profiles.
• Every downloadable card starts at 0/20 with one explicit launch blocker.
• Every downloadable workflow pins public @v0 and enables strict blocker failure.
• CI verifies byte equality between all six files and agentic-init output.
• GitHub Pages hosts the files without requiring Node.js, npm, or a repository clone.
• English and Simplified Chinese README, Quickstart, web guide, and LLM-readable links.
• The npm package now includes all Starter files.
• 124 deterministic tests and 8/8 reference runtime fixtures pass.

中文说明

• 为 read-only、draft-only、state-changing 三类 Profile 提供可直接下载的 Agent Card JSON 与 GitHub Actions YAML。
• 每份 Agent Card 默认 0/20，并保留一个显式上线 blocker。
• 每份工作流锁定公开 @v0，并开启严格 blocker 失败。
• CI 逐字节检查六个下载文件与 agentic-init 输出一致。
• GitHub Pages 直接托管文件，不再要求 Node.js、npm 或 clone 仓库。
• 中英文 README、Quickstart、网页指南和 LLM 索引已同步。
• npm 包包含全部 Starter 文件。
• 124 项确定性测试与 8/8 参考运行时 Fixture 通过。

CI evidence: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31979941855

Pages deployment: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31979941851

v0.11.0 - Fail-closed Agent readiness initializer

What shipped

• New zero-dependency agentic-init CLI that creates agent-card.json and .github/workflows/agent-readiness.yml.
• Supports read-only, draft-only, and state-changing risk profiles.
• Every starter begins at 0/20, contains explicit TODO fields, and retains one launch blocker.
• State-changing placeholders require approval by default.
• The generated workflow pins public @v0 and enables strict blocker failure.
• Atomic overwrite protection: if either target exists, neither file is modified unless --force is explicit.
• English and Simplified Chinese five-minute quickstarts.
• CI executes the generated card through the real Action and verifies score 0, profile failure, and one blocker.
• 113 deterministic tests.

中文说明

• 新增零依赖 agentic-init CLI，一条命令生成 agent-card.json 与 GitHub Actions 工作流。
• 支持只读、仅草稿、状态变更三类风险 Profile。
• Starter 默认 0/20，保留全部 TODO 和一个显式上线 blocker。
• 状态变更占位工具默认强制审批。
• 生成的工作流锁定公开 @v0，并开启严格 blocker 失败。
• 原子覆盖保护：任意目标文件已存在时，除非显式 --force，否则两个文件都不修改。
• 提供完整中英文五分钟 Quickstart。
• CI 使用真实 Action 验证生成卡片必须以 0 分、Profile 失败和一个 blocker 阻断。
• 113 项确定性测试通过。

CI evidence: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31977712943

Public install evidence / 公开安装证据

The final CI installs agentic-init from github:...#v0 into a fresh temporary directory and verifies the generated name, read-only profile, ten zero scores, one blocker, and pinned Action workflow.

最终 CI 会从公开 github:...#v0 安装 agentic-init 到全新临时目录，并验证名称、只读 Profile、10 项零分、一个 blocker 与锁定的 Action 工作流。

v0.10.0 - LangGraph.js runtime eval adapter

What shipped

• External runtime integration with @langchain/langgraph@1.4.10, pinned by an isolated lockfile.
• A real two-node StateGraph executes all eight malicious and benign prompt-injection fixtures.
• Trusted instructions and source-labeled untrusted content remain separate graph-state fields.
• External evaluation emits v0.7 results plus node-linked response, assertion, tool-trace, and policy-trace artifacts.
• CI installs the locked dependency on a clean runner, validates generated results with public @v0, and retains 34 files as langgraph-eval-evidence.
• Root CLIs remain zero-dependency; the npm package stays 347 KB and excludes nested node_modules.
• Dependency audit: 0 known vulnerabilities. Test suite: 100/100 passing.
• English and Simplified Chinese docs state that this is orchestration evidence, not an LLM benchmark or proof that arbitrary LangGraph apps are safe.

中文说明

• 新增外部 Runtime 集成：独立锁定 @langchain/langgraph@1.4.10。
• 使用真实双节点 StateGraph 执行全部 8 条恶意与良性提示注入 Fixture。
• 可信指令与带来源标签的不可信内容保持为独立 Graph State 字段。
• 外部评估器生成 v0.7 Result，以及带节点来源的回答、断言、工具 Trace 与策略 Trace。
• CI 在干净 Runner 安装锁定依赖，使用公开 @v0 校验结果，并保留 34 个证据文件。
• 根 CLI 继续零依赖，npm 包保持 347 KB，不包含嵌套 node_modules。
• 依赖审计 0 漏洞，100/100 测试通过。
• 中英文文档明确：这是编排 Runtime 证据，不是 LLM Benchmark，也不能证明任意 LangGraph 应用都安全。

CI evidence: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31975175069

v0.9.0 - Executable prompt-injection reference eval

What shipped

• Deterministic reference Agent runtime with separate trusted-instruction and source-labeled untrusted-content channels.
• Executes all eight malicious and benign prompt-injection fixtures instead of hand-authoring result files.
• External evaluator emits v0.7 Eval Results plus response, assertion, tool-trace, and policy-trace artifacts.
• Failure-path regression proves an observed/expected mismatch produces a failing result.
• CI validates generated results with public @v0 and retains 34 evidence files as the reference-eval-evidence artifact.
• English and Simplified Chinese integration guidance explicitly limits the result to this deterministic reference policy; it is not a model benchmark or Content OS safety claim.
• 94 deterministic tests.

中文说明

• 新增确定性参考 Agent Runtime，可信指令与带来源标签的不可信内容走独立通道。
• 真实执行全部 8 条恶意与良性 Fixture，不手写结果文件冒充执行。
• 外部 Evaluator 生成 v0.7 Eval Result、回答、断言、工具 Trace 与策略 Trace。
• 失败路径回归测试证明实际结果与预期不一致时会产出 fail。
• CI 使用公开 @v0 校验生成结果，并将 34 个证据文件保留为 Artifact。
• 中英文文档明确：这只证明确定性参考策略行为，不是模型 Benchmark，也不是 Content OS 安全证明。
• 共 94 项确定性测试。

CI evidence: https://github.com/lindixu6-hash/awesome-agentic-engineering/actions/runs/31974669422

Closes #13.

v0.8.0 - Risk-tiered Agent readiness profiles

What shipped

• Machine-readable read-only, draft-only, and state-changing readiness profiles.
• Profile-specific total and per-area minimum scores, allowed and required tool effects, approval requirements, and launch-blocker policies.
• Opt-in profile input for the GitHub Action; existing min-score, fail-below, and fail-on-blockers behavior is unchanged when no profile is selected.
• Fail-closed handling for unknown or malformed profiles, missing tool-effect metadata, mismatched Agent Card metadata, disallowed capabilities, and missing approval on external-state tools.
• One honest Agent Card per profile: the read-only example passes, while the existing draft and state-changing examples retain their original 12/20 and 15/20 scores and blockers.
• English and Simplified Chinese threat-model guidance, JSON Schema, and 87 deterministic tests.

中文说明

• 新增 read-only、draft-only、state-changing 三类机器可读生产就绪 Profile。
• 每类 Profile 分别定义总分、分项最低分、允许/必需工具影响、审批要求与上线阻塞项策略。
• GitHub Action 新增可选 profile 参数；不启用时，原有参数行为完全不变。
• 未知或损坏 Profile、缺失工具影响、卡片声明不一致、越界能力与外部状态工具缺少审批均会 fail closed。
• 每类 Profile 都有真实示例；不会为了通过门禁篡改已有 Agent 分数或隐藏阻塞项。
• 提供完整中英文威胁模型说明、JSON Schema 与 87 项确定性测试。

Closes #12.

Adoption evidence / 采用证据

• Content OS main CI consumes public @v0: its 12/20 compatibility score passes, while the draft-only profile correctly exposes a 12/14 total gap, a 1/2 tool-permission gap, and three launch blockers.
• Content OS 主分支真实使用公开 @v0：兼容分数门禁通过，但 draft-only Profile 如实暴露总分、工具权限与三个上线阻塞项。