v0.13.0

[0.13.0] - 2026-09-01

Added

• Fail-closed named agent authority manifests (TR-AGT-012) — a named endpoint must declare
  a non-empty tool allowlist; an omitted or empty list cannot inherit the complete registry.
  Unnamed legacy mode is selected only by omitting the complete named-agent manifest. Includes a
  standard-library reference implementation that rejects malformed manifests and unknown tool
  names before endpoint construction, with tests proving a named registry exposes only declared
  tools. This governs standing tool authority, not owner approval for individual data egress.

Fixed

• Release publisher — resolves the public repository's canonical name before creating the
  GitHub release, preventing the rename redirect that previously let sync/tag succeed while the
  release-object request failed.
• .ruff_cache/ is ignored in the staged public tree.
• The dual-LLM roadmap progress note no longer cites public TR-AGT-010 for a private-only
  model-diversity guard; public TR-AGT-010 remains frozen generated tool contracts.

Full changelog: https://github.com/onesimplecode/agent-engineering-standards/blob/main/CHANGELOG.md

v0.12.0

[0.12.0] - 2026-08-28

Added

• Frozen, generated tool contracts (TR-AGT-010) — additive-forever field semantics,
  protocol_version on every response and error, and a spec generated from live operation
  definitions rather than hand-maintained, checked two ways: the generated doc against what's
  committed, and the declared contract against what the registration code actually sets. Promoted
  from a running private-monorepo MCP tool surface with a passing drift-guard test covering both
  checks.
• AGENTS.md — "Disposition Field (TR-AGT-003, field 6)" — an optional sixth loop-contract field
  for a triage/gate node whose output routes to more than one next step, derived from the node's
  own verdict rather than set independently, plus a named caution about a fail-closed default
  landing on the wrong side of a gate that itself fails open on ambiguous evidence.
• Hybrid deterministic-then-agentic classification (TR-AGT-011) — a multi-stage classification
  pipeline (deterministic → optional trained-model → LLM) tags each result with which stage
  produced it, from one closed vocabulary; a deterministic stage may short-circuit a later, more
  expensive stage entirely, and an unbuilt stage is declared, not fabricated. Confidence-gated
  override of an earlier stage by a later one is a natural extension, not itself covered by this
  ID — it stays a backlog item until a real override path exists to evidence it. Reinforces
  TR-AGT-002 and TR-SEC-012 at the level of pipeline architecture. Promoted from a running
  private-monorepo classification pipeline.
• Graded outlet confidence (TR-SEC-015) — an optional, more finely graded confidence about a
  specific untrusted outlet, alongside TR-SEC-011's fail-closed trust tier — never upgrading trust,
  graded from a small curated allowlist with fail-closed absence. Includes a named caution about
  parsing untrusted host/URL data on a hot path without assuming the failure mode is "returns
  nothing" rather than raises. Promoted from a running private-monorepo retrieval pipeline with a
  passing drift-guard test.
• AGENTS.md — "Public Claims Require a Pinned Benchmark" section, generalizing
  tests/test_readme_claims.py's drift-guard pattern (previously scoped to this
  repo's own asset/test counts) and TR-TEST-004/TR-TEST-005 into a named
  convention: quantitative or comparative claims about an AI tool's behavior
  must cite a versioned benchmark, not assert a number. Cites
  alibaba/open-code-review's AACR-Bench as external corroboration.

Changed

• AGENTS.md — "Deterministic Checks Before Agent Judgment" (TR-AGT-002,
  TR-AGT-006) now cites alibaba/open-code-review as independent, at-scale
  validation of the same deterministic-scoping-before-agent-judgment split.
• registry/tr-registry.yaml — TR-AGT-003's text extended with the disposition-field
  description (field 6); no ID renumbering, three new IDs added (TR-AGT-010, TR-AGT-011,
  TR-SEC-015). Registry now 41 requirement IDs (was 38).

Fixed

• Credential-isolated broker example (examples/credential-isolated-broker/broker.py) —
  consume_mutation popped the lease before validating the request, so a failed validation (e.g.
  a stale current_revision) permanently destroyed an otherwise-valid lease — a validation
  failure could deny the legitimate caller's own retry. Now validates first and only consumes the
  lease on a successful match. Found by code review, fixed with a regression test
  (test_failed_validation_does_not_burn_the_lease).

Full changelog: https://github.com/onesimplecode/agent-engineering-standards/blob/main/CHANGELOG.md

v0.11.0

[0.11.0] - 2026-08-21

Added

• Credential-isolated broker pattern (TR-SEC-014) — host-side named operations keep external
  credentials out of air-gapped agents; immutable event binding, immediate pre-mutation
  revalidation, single-use leases, and restart-safe read-only socket transport are required.
  Promoted from the verified Hermes PR reviewer integration.
• AGENTS.md — "Credential-Isolated Broker Operations" section documenting the pattern's four
  enforced invariants (exact resource scope, immutable event identity, single-use mutation
  leases, immediate pre-mutation revalidation) and the restart-safe socket-directory-mount
  requirement. Every prior TR-SEC-* export shipped a matching AGENTS.md section; this closes
  that gap for TR-SEC-014, flagged during release-readiness review.

Fixed

• docs/requirements-implementation-map.md — the TR-SEC-014 row's Evidence column was missing
  AGENTS.md, inconsistent with every other TR-SEC row's citation of both the pattern doc and
  its registry/example backing.

v0.10.0

[0.10.0] - 2026-08-13

Added

• AGENTS.starter.md — seven-rule, one-page starter with no requirement-ID
  vocabulary; now the primary adoption CTA, with the full AGENTS.md as the
  graduation path (the full file is ~460 lines and consumed on every agent turn,
  which made it a heavy first commitment)
• docs/assets/traceability.svg — diagram tracing TR-GOV-001 from its registry
  entry through the AGENTS.md convention, a maturity-checklist row, the
  deterministic script, and the CI gate that fails the build. Rendered in
  README.md; every stage names the same requirement ID and is pinned by
  tests/test_traceability_diagram.py
• tests/test_debt_report.py — first coverage for scripts/debt-report.py:
  canonical tag collection, legacy-alias normalization, exclusion of
  convention-defining files, and the always-exit-0 reporting contract
• tests/test_readme_claims.py — gates the README's factual claims: asset
  counts, the test count in both the badge and the asset line, and 1:1
  correspondence between gallery rows and examples/ directories. The counts
  were hand-written in two places with nothing stopping them drifting
• llms.txt — "Start Here" section naming AGENTS.starter.md and AGENTS.md,
  so the discovery manifest includes the primary adoption path
  (scripts/llms-txt-generator.py, pinned by a generator test)

Changed

• README.md — announcement-oriented first screen: one-line positioning, CI /
  test / dependency badges, an asset count line, runnable proof (real guard
  output, verbatim) above the fold, then the starter CTA. Example gallery
  reordered failure-first and extended to cover all shipped examples. Negative
  positioning now confined to the "Who this is for" and "What you get" tables;
  dropped from the subtitle.
• ROADMAP.md — inverted for readers: "Next up" candidates with their evidence
  gates first, shipped releases compressed to a table pointing at CHANGELOG.md,
  backlog condensed into collapsed sections. Private decision-record references
  replaced by a single statement of the promotion bar.
• De-branded public prose: the private monorepo name no longer appears anywhere
  outside historical changelog entries and the deliberate LUMIA-DEBT legacy
  alias — LICENSE, AGENTS.md, ATTRIBUTIONS.md, CONTRIBUTING.md,
  SECURITY.md, docs/, templates/, registry/, generated llms.txt, and
  generated Cursor rules. Attribution now names David Lin directly.
• Deferred-work tag renamed LUMIA-DEBT: → TECH-DEBT: (TR-GOV-002),
  pairing with the already-generic POC-EXCEPTION:. scripts/debt-report.py
  still scans LUMIA-DEBT: as a legacy alias and reports it under the canonical
  name, so a tree tagged before the rename produces a complete report with no
  migration step.
• Renamed to "Agent Engineering Standards" / agent-engineering-standards
  (from "AI Engineering Standards" / ai-engineering-standards) — "agent" names
  the audience where "AI" named nothing. Applied to the README title and badge,
  clone and comparison URLs, docs/releasing.md,
  docs/agent-skills-integration.md, CONTRIBUTING.md, ATTRIBUTIONS.md,
  generated llms.txt, and generated Cursor rule descriptions. GitHub issues a
  permanent redirect for the old path, so existing clones, stars, forks, issues,
  and the v0.1.0–v0.9.0 releases and tags all follow the rename; no CI change was
  needed, since no workflow references the repository name.
• docs/releasing.md — new "Announcement prep" section absorbing the
  issue-seeding step formerly parked at the end of ROADMAP.md, plus badge-URL
  verification, the repository About description, and a verified topic list.
  Also corrects the ROADMAP.md release step, which still said to tick [x]
  checkboxes the restructured roadmap no longer has.
• .github/labels.md — seeded-issue list replaced by a pointer to ROADMAP.md
  "Next up"; the hardcoded list still named v0.2–v0.4 items shipped in July
• CONTRIBUTING.md — domain-specific agent modes named as out of scope, so
  ROADMAP.md's cross-reference to that boundary is now true
• scripts/debt-report.py — tests/test_debt_report.py added to
  EXCLUDE_FILES; its fixtures were surfacing as false findings in this repo's
  own deferred-work report

Fixed

• scripts/check-config-consistency.py pointed readers at docs/tr-registry.yaml
  on failure — a path that does not exist in this repo (it is
  registry/tr-registry.yaml). examples/worked-example/README.md reproduced
  the wrong path as "real output".
• examples/worked-example/README.md showed a duplicated scan location the
  script no longer emits, with a paragraph explaining a glob-dedup quirk that no
  longer occurs. Both "real output" blocks in the repo are now pinned by
  tests/test_readme_claims.py, which runs each command and requires a fenced
  block to match byte for byte.

v0.9.0

[0.9.0] - 2026-08-13

Added

• TR-AGT-006 — Deterministic post-processing over agentic bookkeeping
• TR-AGT-007 — Self-healing metadata with enrichment marker
• TR-AGT-008 — Split agent capabilities by determinism (four-tier + deciding test)
• TR-AGT-009 — Event hooks carry cheap work; schedules carry expensive LLM work
• templates/knowledge-confidence.md — five-label claim vocabulary; contested
  claims never resolved by recency alone
• AGENTS.md — capability-split, hooks-vs-schedules, earned MCP annotations,
  self-healing metadata sections; also "Honest CI Limits", "Outbound Fetch
  Hygiene"; plugin-skill and thin-pointer sections cite worked examples
• agents/reviewer.md — "Map independently before reading the artifact"
  (anti-anchoring)
• docs/ai-engineering-operating-model.md — OKF cite; permission boundaries
  do not fix data quality
• templates/threat-model.md — read-boundary vs topic-avoidance distinction
• templates/adr.md — deferred decisions must name meantime degradation
• ATTRIBUTIONS.md — langchain-ai/openwiki (MIT), garrytan/gbrain,
  plus v0.9 comparative cites for santifer/career-ops,
  MadsLorentzen/ai-job-search (thin-pointer / honest CI), and
  koala73/worldmonitor (SSRF allowlist pattern)
• examples/plugin-skill-trust/ — planted overriding community skill +
  skill_boundary.py (quarantine helpers, fail-closed merge). Completes
  the TR-SEC-005 plugin-skill trust ROADMAP v0.9 item (AGENTS.md prose
  already existed).
• examples/thin-pointer/ — minimal multi-runtime SoT: canonical
  review checklist + short AGENTS and Cursor-rule wrappers. Completes
  the thin-pointer ROADMAP v0.9 item (docs-first; dual-runtime dogfood
  not required for this minimal export).
• tests/test_plugin_skill_trust_example.py,
  tests/test_thin_pointer_example.py
• examples/honest-ci-limits/ — docs-first fixtures for stating CI
  security/permission/gitignore guards as friction, not barriers
  (ci-header.example.yml, gitignore.example, README). Comparative
  only vs community CI-honesty patterns (MadsLorentzen/ai-job-search);
  pairs with existing TR-SEC-009/010 prose. ROADMAP v0.9 item.
• examples/ssrf-allowlist/ — MIT stdlib worked example
  (safe_fetch.py): host allowlist, fail-closed address checks, DNS
  pin, redirect-hop re-validation; true IP/socket pinning omitted and
  named as residual. No new TR-ID (TR-SEC-005 open-world fetch hygiene).
  ROADMAP v0.9 item (private ADR-017).
• tests/test_honest_ci_limits_example.py,
  tests/test_ssrf_allowlist_example.py — structural + mocked-network
  unit coverage for the two examples
• docs/requirements-implementation-map.md — rows for honest CI, SSRF
  fetch hygiene, thin-pointer, and plugin-skill trust; rows for
  TR-AGT-006..009 and knowledge-confidence
• docs/agent-skills-integration.md — thin-pointer example path; notes
  path-contract moved to ROADMAP Backlog (unscheduled)
• examples/local-only-model-registry/ — reference implementation
  (registry.py) and worked-example writeup concretizing TR-SEC-003 ("PII
  routed to local LLM only"): a config-driven MODEL_REGISTRY declaring
  provider family per model, and validate_local_only(), which fails loud
  on a model absent from the registry rather than assuming it's safe.
  Extracted from a private-repo fix (private ADR-036) that closed a real
  gap of the same shape TR-SEC-003 already covers: a prior local-only
  enforcement control (private ADR-013 point 7) existed as tested code that
  was never actually wired into either of its two call sites, so the
  requirement had policy language but no verification behind it — this is
  the second independent instance of that exact gap, which is what
  triggered generalizing it into a portable pattern rather than leaving it
  local to one project
• tests/test_local_only_model_registry_example.py — 7-test suite: the
  drift guard (every shipped default model is registered), the
  disabled-by-default no-op, the registered-cloud-model-raises case, the
  unregistered-model-raises case (the pattern's central claim — an
  unverifiable model must fail loud, not pass by omission), and that every
  candidate field is checked, not just the first
• README.md — worked-traces list and Enforced workflow sections for the
  five v0.9 examples above

Changed

• TR-AGT-003 — MCP annotations must be earned (demonstrated in tests), not
  merely asserted
• ROADMAP.md — system vs user path data contract moved from v0.9 to
  Backlog (unscheduled); not a release gate

Fixed

• Generalized three private app-name citations in ROADMAP.md,
  docs/ai-engineering-operating-model.md, and
  templates/knowledge-confidence.md to private-repo / private app
  wording so the mandatory private leak scan passes before publish

Full changelog: https://github.com/onesimplecode/ai-engineering-standards/blob/main/CHANGELOG.md

v0.8.1

[0.8.1] - 2026-08-03

Changed

• agents/reviewer.md — require the reviewer to spot-check completion-
  checklist evidence: when a templates/completion-checklist.md is attached
  to the handoff, verify at least one cited file:line per item against the
  actual diff; a citation that does not support its claim is a blocking
  issue, not advisory. Closes a rubber-stamp gap where the developer
  self-certified evidence the reviewer never re-checked
• docs/requirements-implementation-map.md — completion self-critique row
  upgraded to "Template + role contract" and cites agents/reviewer.md
• .gitignore — ignore in-tree .venv/ so a local release-check virtualenv
  cannot trip public-export-check.py

Full changelog: https://github.com/onesimplecode/ai-engineering-standards/blob/main/CHANGELOG.md

v0.8.0

[0.8.0] - 2026-07-31

Added

• registry/tr-registry.yaml — TR-SEC-013 (two-layer isolation for
  multi-agent tool and data access) and TR-TEST-007 (agent security-property
  claims verified against ground truth, not self-report), exported from the
  private-repo agent-platform deployment (private ADR-013, ADR-014).
  TR-SEC-013 graduates the "Compartmentalization worked example" item
  roadmapped since the 2026-07-13 Zero-Trust-for-AI-Agents review (private
  ADR-031), now backed by a running, hands-on-verified implementation rather
  than a design-only ADR; TR-TEST-007 is new content, motivated by two real
  false passes in the ADR-014 spike where an isolation/memory-scoping check
  "passed" only because the question was answered by the wrong backend, not
  the mechanism actually under test
• examples/compartmentalized-agents/ — reference implementation:
  ToolRegistry (tool-registry scope) + DataStore (data-layer scope),
  with a test that deliberately misconfigures the tool layer and proves the
  data layer alone still blocks the resulting call (the defense-in-depth
  evidence, not just that both layers exist); SelfReportingAgent, with a
  test showing its self-report gives a false pass on a real isolation leak
  that ToolRegistry.list_tools() (ground truth) catches
• docs/ai-engineering-operating-model.md — "Rollout Sequencing" section
  (the layering rule: foundational infrastructure ships first, every later
  phase immediately usable on arrival), also graduated from the 2026-07-13
  review, second exemplar from private ADR-013's phased rollout table
• templates/completion-checklist.md — "Ground-truth verification for agent
  security claims" checklist item
• AGENTS.md — "Compartmentalized Multi-Agent Isolation" and "Ground-Truth
  Verification for Agent Security Claims" sections
• docs/requirements-implementation-map.md — rows for all three exports above
• README.md — examples/compartmentalized-agents/ added to the worked-traces
  list and "Enforced workflow" section

Reviewed by a fresh-context reviewer agent before release: 0 blocking
findings, 2 advisory (the README.md gap above, and two added test cases
for previously-untested DataStore/ToolRegistry default-permission edge
cases) — both fixed prior to this release.

Full changelog: https://github.com/onesimplecode/ai-engineering-standards/blob/main/CHANGELOG.md

v0.7.0

[0.7.0] - 2026-07-26

Added

• registry/tr-registry.yaml — TR-SEC-011 (content provenance tracked and
  trust derived fail-closed at retrieval), TR-SEC-012 (strict LLM
  output-schema validation — reject, never coerce), exported from the
  2026-07-13 Zero-Trust-for-AI-Agents review (private monorepo)
• scripts/spotlighting-drift-guard.py — single-sourced spotlighting
  constants (security notice + untrusted-content delimiters) enforcement:
  fails CI if any LLM boundary re-inlines a copy instead of importing the
  designated constants module
• examples/spotlighting/ — worked example + planted re-inlined-copy
  fixture for the drift guard above (TR-SEC-005);
  .github/workflows/spotlighting-drift-guard-demo.yml proves the guard
  still catches it
• examples/provenance-trust-tags/ — reference implementation of a
  fail-closed source-type → trust-level mapping with its own drift guard
  (every content type must be explicitly classified), and a quarantine
  helper routing untrusted/unverified content into the spotlighting layer
  (TR-SEC-011)
• examples/strict-output-schema/ — before/after reference parser for LLM
  JSON output, with a live repro of the bool("false") is True fail-open
  coercion bug and the reject-never-coerce fix (TR-SEC-012)
• AGENTS.md — "Spotlighting at the Reasoning Boundary", "Memory /
  Provenance Hygiene", and "Strict LLM Output-Schema Validation" sections
• docs/requirements-implementation-map.md — rows for all three exports;
  the TR-SEC-005 row upgraded from "Documented" to "Documented + script +
  example"
• ATTRIBUTIONS.md — Microsoft public research on prompt-injection defenses
  (the "spotlighting" technique name and its measured effectiveness),
  cited via the same Anthropic eBook review

Full changelog: https://github.com/onesimplecode/ai-engineering-standards/blob/main/CHANGELOG.md

v0.6.0

Release 0.6.0

Full changelog: https://github.com/onesimplecode/ai-engineering-standards/blob/main/CHANGELOG.md

v0.5.0

[0.5.0] - 2026-07-16

Added

• registry/tr-registry.yaml — TR-SEC-008 (local credential files
  permission-restricted and secret-scanned), TR-SEC-009 (CI pipelines run
  least-privilege and fully pinned), TR-SEC-010 (agent tool permission grants
  are a security boundary — least agency), exported from the private
  ATT&CK/ATLAS-informed security baseline (ADR-009)
• templates/threat-model.md — design-stage threat model mapping trust
  boundaries and data classification to MITRE ATT&CK/ATLAS techniques,
  required for ADRs introducing a new listener, credential, agent tool grant,
  or external content source; includes the "Impossible vs. Tedious" section
  (barrier vs. friction classification, from Anthropic's Zero Trust for AI
  Agents, ADR-010)
• AGENTS.md — "Threat Modeling and Least Agency" section presenting the
  impossible-vs-tedious test and TR-SEC-010 under the industry "least agency"
  name (OWASP), with citations
• AGENTS.md — "Guard Pattern: Co-located Reviewed Baselines" section
  documenting the "make dangerous changes loud, not impossible" governance
  pattern, including its honest limit
• scripts/agent-permission-guard.py — reference implementation of the
  co-located-baseline guard pattern for TR-SEC-010: hard-codes a reviewed set
  of agent tool-permission grants, fails on any forbidden wildcard
  write/install/exec/network grant, and fails on any grant absent from the
  baseline until a human adds it in the same PR. Exit-0/1/2 CLI contract
  matching the existing scripts; 7 tests in tests/test_agent_permission_guard.py
• examples/agent-permission-guard/ — worked example: a settings file with a
  planted forbidden grant and a planted unreviewed grant, both caught by the
  guard; .github/workflows/agent-permission-guard-demo.yml gates this in CI
  the same way config-drift-demo.yml gates the config-drift worked example
• examples/worked-example/docs/decisions/ADR-004-example.md — synthetic ADR
  illustrating the security-baseline decision (public-safe rewrite of the
  private ADR-009 pattern)
• scripts/llms-txt-generator.py — generates llms.txt (v0.5 roadmap item) at repo
  root from the coding-relevant TR registry subset plus agents/, templates/, and
  scripts/, following the emerging llms.txt convention (https://llmstxt.org) so any
  agent framework that reads it — not only Cursor — can discover this repo's content.
  Generalizes scripts/cursor-rules-adapter.py's "generate editor/agent context from
  the registry" pattern (docs/agent-skills-integration.md integration pattern 2):
  dynamically loads and reuses the Cursor adapter's registry parser and subset
  selection (importlib, since the adapter's filename is hyphenated and not
  import-able as a normal module) rather than re-implementing YAML parsing.
  --check drift-gates the committed llms.txt in release-check.yml, alongside
  the existing Cursor rules drift gate. 15 new tests
  (tests/test_llms_txt_generator.py), following the same subprocess-CLI testing
  pattern as tests/test_cursor_rules_adapter.py.

Changed

• .github/workflows/release-check.yml and .github/workflows/config-drift-demo.yml —
  added an explicit least-privilege permissions: contents: read block and pinned
  actions/checkout and actions/setup-python to full commit SHAs (human-readable
  version in a trailing comment) to comply with the TR-SEC-009 this release exports;
  previously pinned to mutable version tags
• ATTRIBUTIONS.md — added rows for MITRE ATT&CK/ATLAS, Anthropic's Zero Trust for
  AI Agents, OWASP agentic security guidance, and MadsLorentzen/ai-job-search
  (comparative pattern reference for the guard script; no code copied)
• docs/requirements-implementation-map.md — rows for threat modeling, impossible-vs-tedious,
  least agency, the co-located guard pattern, and CI least-privilege/SHA pinning
• README.md — Quick start command for agent-permission-guard.py; Enforced workflow
  section links the new examples/agent-permission-guard/ trace

Full changelog: https://github.com/onesimplecode/ai-engineering-standards/blob/main/CHANGELOG.md