v0.1.0 (pre-release)

First pre-release of allowops: an AI operations gateway where an AI agent can only call actions from a signed catalog, with typed parameters, ABAC policy, batch scheduling and a hash-chained audit log.

This is a pre-release for evaluation in test environments. See CHANGELOG.md for known limitations and docs/architecture-diagram.html for the architecture.

Assets

File	Content
allowops_0.1.0_linux_amd64.tar.gz	allowops CLI, allowops-gateway, allowops-agent, allowops-exec, LICENSE, third-party notices
allowops-agent_0.1.0_amd64.deb	Host agent and privileged helper (Ubuntu 20.04+, Debian 11+)
allowops-agent-0.1.0-1.x86_64.rpm	Host agent and privileged helper (CentOS/RHEL 7, Rocky/Alma/RHEL 8+)
allowops-gateway_0.1.0_linux_amd64.docker.tar.gz	Gateway container image allowops-gateway:0.1.0 (docker save archive)
*.sbom.json	SPDX SBOMs
checksums.txt, checksums.txt.sig	SHA-256 checksums and detached GPG signature
allowops-release-signing-key.asc	Release signing public key

All binaries are linux/amd64, built with Go 1.27.3 and CGO_ENABLED=0 from commit 33876181e5f3c1ad47d598199f53e1ad5517b6e5.

Verify

The release signing key fingerprint is:

341D 3146 85C8 C784 0D22  E43F A626 F4C9 BFFD E9E9

Confirm the fingerprint through a channel other than this page before trusting the key.

gpg --import allowops-release-signing-key.asc
gpg --verify checksums.txt.sig checksums.txt
sha256sum -c checksums.txt

The .deb and .rpm packages are also signed with this key. For rpm: rpm --import allowops-release-signing-key.asc && rpm -K allowops-agent-0.1.0-1.x86_64.rpm.

Gateway image

docker load -i allowops-gateway_0.1.0_linux_amd64.docker.tar.gz

The image is not published to a container registry for this pre-release.

Verification performed for this build

• CI on the tagged commit: lint, unit and integration tests with -race, govulncheck (source mode, 0 affected), OPA tests, fuzzing, generated-code drift.
• Package install tests on debian:12, ubuntu:20.04, centos:7 and rockylinux:9; rpm signature checks with rpm 4.11 (CentOS 7) and Rocky 9.
• govulncheck in binary mode reports GO-2026-5932 (golang.org/x/crypto/openpgp) for the stripped gateway binary because symbol information is removed; the gateway does not import that package, and the same source built without stripping reports 0 vulnerabilities.