v0.17.0

Added

• Bounded, cross-language control expressions with guarded regex and strict complexity limits.
• Enforcing steer outcomes that block before execution and return typed MODIFY guidance.
• Explicit signed deployment-proof clients with bounded, redirect-refusing transports.

Upgrade note

• Exhaustive switches must handle control, steer, and STEER_REQUIRED.

v0.16.0

Source lineage and retrospective blast-radius reconstruction across the TypeScript and Python SDKs.

• Explicit exact-source scopes for documents, retrievals, tool results, memory, and user input
• Parent lineage and bounded detector taints across governed async execution and explicit handoffs
• Chain format 5 binds the canonical source lineage hash into signed decision records
• Installed-artifact coverage for both npm and Python packages

See CHANGELOG.md for the complete release notes.

v0.15.0

Added

• Durable disk-backed audit delivery with restart replay and retained dead letters.
• Runtime coverage assertions and caller-owned deny smoke tests.
• LlamaIndex model startup governance for supported TypeScript Settings.llm assignments.

Changed

• Chain format 4 signs operation, source, and event type while preserving verification support for formats 1–3.
• Durable replay reservations and outbox filesystem boundaries are hardened against duplicate enqueue and symlinked paths.

v0.14.0

Added

• Signed deployment coverage attestations and generic function governance
• Layered action context with deterministic remediation and linked retries
• Separation-of-duties checks for strict approvals
• Policy lifecycle, signed workload registry, and signed policy templates
• Deterministic control analytics and bounded OTEL, OPA, and Cedar signal projections

Both Python and TypeScript packages share the same policy and evidence contracts.

v0.13.0

Automatic governance v1

Obsvr can now initialize before application imports and attach governance automatically wherever a supported integration exposes a real pre-call construction or process-global hook.

Automatic startup surfaces

• TypeScript: documented OpenAI, Anthropic, and Gemini construction; MCP clients; OpenAI Agents concrete models, local tools, handoffs, and supported later mutations
• Python: documented OpenAI and Anthropic construction; MCP sessions; OpenAI Agents concrete models, local tools, handoffs, and supported later mutations; CrewAI tools; AutoGen tools; LlamaIndex model calls
• Exact required-binding manifests can fail startup when an expected surface does not bind
• Status reports each automatic surface as armed, bound, or not-applicable

Explicit by design

LangChain in both SDKs, TypeScript LlamaIndex, Python LlamaIndex agent tools, Python Gemini, hosted/provider-side tools, pre-startup objects, saved raw aliases, custom transports, and unlisted import paths remain explicit boundaries. Tracing-only callbacks are not presented as enforcement.

Additional release work

• Opt-in sealRaw / seal_raw revokes documented methods on the exact raw client after wrapping
• Strict profile 2.1 adds signed terminal outcomes, durable execution journals, explicit uncertain recovery, provider-neutral action boundaries, evidence bundles, and content-free OpenTelemetry correlation
• npm and PyPI descriptions explicitly scope governance to supported model, agent, and tool boundaries

See the README, SECURITY.md, and COMPATIBILITY.md for the exact per-route guarantees and limitations.

v0.12.0

Highlights

• Adds the obsvr-authored AARM compatibility profile 1.0 across Python and TypeScript, with shared action-context, intent-alignment, identity, evaluation-evidence, and strict-receipt fixtures.
• Adds strict receipt profile 2.1 for opt-in unary direct-provider execution, binding cleaned arguments and provider targets before admission and durable local commit.
• Adds recovery and reconciliation for strict receipt state, hardened admission and provider endpoints, and explicit invocation-uncertain handling that prevents automatic replay.

Packages

• @obsvr/sdk 0.12.0 on npm
• obsvr-sdk 0.12.0 on PyPI

Full changelog

v0.11.2

Fixed

• Stored evidence is scrubbed independently of outbound enforcement. Both
  SDKs scan the final prompt and response before signing and emission, preserving
  not_evaluated verdicts on observe-only callbacks while keeping PII whose
  configured action resolves to block or redact out of the stored copy.
  (1c7bc68, 31efaa2)

• Provider-bound PII enforcement covers every text role on direct wrapper
  paths. System, user, assistant, and tool-result text now share the pre-call
  block/redaction pass. (52d80c6)

• The vendored integration gate cannot pass zero suites. Import failures and
  a suite-count mismatch are terminal, and the offline gate requires all 23
  declared suites. (aac7744)

• Sender-visible terminal delivery loss starts a signed fresh chain. Ingest
  rejection, permanent failure, and retry exhaustion arm reasoned gap markers;
  failed markers are counted without recursive replacement.
  (7b041e1)

• Both external policy connectors pin their approved DNS snapshot. Mixed
  public/private answers are refused, sockets use approved numeric addresses
  while retaining Host/SNI, redirects are not followed, and injected transport
  seams are explicitly trusted. (bcd7ce5, 5c8de50, 7dcb9a1)

• Current Gemini clients are governed in both SDKs. TypeScript supports
  @google/genai unary/streaming methods with explicit wrapping and module
  interception; Python supports the corresponding sync/async google-genai
  resource methods through explicit wrapping. (b3695e8, 461d73d)

• Applied NLP-only redaction fails closed in TypeScript. A Presidio analyzer
  or anonymizer failure can no longer fall back to a regex redactor that cannot
  locate the detected type; the provider call is refused even under fail-open
  detector posture. (1712bd5)

• Session taint detects injection without a separate PII rule. Enabling the
  latch now runs its built-in injection scan directly in both SDKs, without
  fabricating PII telemetry when no PII policy exists, and escalates later
  session egress as configured. (6c315e5)

• Python preserves explicit blank principal precedence. An ambient subject
  no longer replaces an explicitly empty or whitespace user_id; required
  principal enforcement refuses it consistently with TypeScript, and the
  signed record keeps the same explicit value. (4b6f272)

• The evaluation conformance contract matches the hardened engines. Spec
  version 1.2 and cross-SDK fixtures now pin deny-wins resolution, local versus
  remote malformed-rule handling, action-bound approvals, current rule hashing,
  and detection-versus-application failure posture. KD-11 is closed.
  (062bfc8)

• Monitor mode retains clean governed events at any sample rate. The shared
  emission gates cover wrapper, integration, and standalone execution-span
  paths while enforce mode keeps ordinary allowed-call sampling.
  (3d3e2f1, 7fd5495, 3e11332)

• Stream evidence opt-out no longer bypasses enforcement. TypeScript
  streamingMode: "skip" still avoids wrapping an allowed stream in enforce
  mode, but only after pre-call block/redaction has run; monitor mode records
  the stream despite the opt-out. (8e1bbb1)

• Haystack prompt blocks no longer create raw-input exception snapshots. A
  terminal conditional output prevents the downstream generator from becoming
  runnable and returns only a safe block branch. (027663d)

• A retained MCP task facade cannot keep a raw client binding. TypeScript
  repairs an already-issued experimental facade onto the governed Proxy and
  fails loudly for an opaque shape it cannot repair. (8ad7d65)

• Optional integration ranges stop before untested future majors. Resolver
  metadata now matches the reviewed major lines instead of making open-ended
  compatibility promises. (0484553)

• Python package metadata uses the current SPDX license form. Builds retain
  LICENSE and NOTICE without deprecated classifier or manifest warnings.
  (dc372d5)

• Release benchmark evidence is reproducible and retained. Two complete
  TypeScript/Python passes publish raw overhead, stress, chain, loss, and memory
  results for the measured revision; fake ingest transports acknowledge the
  exact accepted count used by current sender reconciliation.
  (a6fe59c, a8c8185, c970505)

• Observe-only PII storage no longer claims outbound redaction. Framework
  callbacks now report action_taken: "not_evaluated" when they redact only
  the stored event copy, and preserve the requested action, detected types, and
  unchanged outbound status under metadata.obsvr_telemetry.
  (b015b58, 0d8b9f2)

• Detector failures and tool observations retain their correct reporting
  boundary. Hostile metadata access resolves through fail mode, response-only
  canary findings become policy flags, and OpenAI Agents tool spans no longer
  duplicate model-observer compliance. (7b091cc)

• Python now governs Anthropic provider tool runners. Messages runner
  construction sends the initial prompt through the normal pre-call policy and
  installs governed copies of local runnable tools before dispatch is
  registered, while preserving hosted tool definitions. Sync and async
  Messages runners are covered from Anthropic 0.68.0, and async managed-session
  local tools are covered from 0.103.0 without claiming governance over remote
  session model traffic.

• Python now keeps legacy Gemini chat sessions inside governance.
  start_chat() returned the provider's raw ChatSession, so both sync and
  async messages bypassed pre-call policy and audit. The factory now returns a
  transparent governed session whose send_message and send_message_async
  calls enforce the same block, redaction, stream, and response rules as direct
  generation.

• Python now governs OpenAI and Anthropic with_streaming_response calls.
  Policy runs before a response context manager is created, preserving the
  providers' deferred sync and async request lifecycle while preventing blocked
  prompts from reaching context entry. Parsed or read response content is
  captured once when the context exits, with the raw status, headers, and body
  accessors still available to callers.

• Python now governs OpenAI and Anthropic with_raw_response calls. The
  accessor objects were outside proxy traversal, so their text-generation
  methods bypassed every pre-call block and redaction. The explicit raw-response
  paths now run through the same sync/async pipeline, preserve the raw response
  object returned to the caller, and use its cached typed view for response
  policy and audit extraction. The deferred with_streaming_response context
  managers remain a separate boundary.

• Python now governs legacy Gemini's async generation method. The declared
  google-generativeai integration intercepted generate_content but handed
  generate_content_async straight to the provider with no policy or audit
  event. The real 0.8.6 package exposes it as a coroutine with the same request
  shape; it now runs through the async governance pipeline, including outbound
  redaction and pre-provider blocking.

• Python retry and byte-split items cannot fall out of the signed chain when
  producers refill the public queue. The worker put an already-signed item
  back into that bounded queue; a concurrent producer could fill the slot first,
  making put_nowait drop the signed item while later events still chained to
  it. Worker-owned pending lanes now retain those items in order until terminal
  delivery, and queue-drain accounting follows the original submission.

• Security correction: a customer hook can no longer erase an existing block. The
  published advanced-options example combined an SSN block with an
  on_pre_call / onPreCall hook whose ordinary path returned allow; that
  explicit allow replaced the PII verdict and sent the SSN to the provider.
  Pre-call enforcement is now monotonic in both SDKs and on both TypeScript
  pipelines: hooks may add a block or redaction, while allow only preserves
  a call that no earlier layer blocked. External-oracle regressions assert the
  provider receives zero calls for the published composition.

• Policy-change events use the signed delivery queue. set_tenant_policy
  / `setT...