v3.7.0

Breaking Changes / Upgrade Notes

• A valid receipt prefix no longer counts as a completed chain. Chain verification reports VALID PREFIX, END UNPROVEN and exits 3 without a proven end. Use --allow-prefix only when deliberately checking an open prefix; the label stays. Clean reports use schema version 2 and expose end-proof status. Update automation that previously treated an open chain's exit 0 as completeness. A cleanly stopped recorder run that recorded EvidenceReceipt v2 receipts also exits 3 in receipt-chain mode, because that chain has no end marker; verify recorder directories with --whole-recorder. Upgrade guide. (#1892)
• Receipt content scanning has an explicit bounded search. Complete secrets in scanned fields remain checked before signing. Reassembly has limits for combinations involving Pipelock's fixed labels and formatted decision text; splits requiring multiple fixed values, dropped enum text, or nonadjacent decision-text fragments fall outside the documented search. Review the receipt content boundary before adopting the throughput improvements. The search also excludes splits into five or more pieces, four pieces outside forward/reverse order, and three pieces on receipts too wide for that search. Caller-supplied IDs stay scanned; process-proven generated IDs are excluded, including when their text could complete a secret. (#1872, #1886, #1897)
• Reinstall containment and restart running agents to adopt socket isolation. Managed launches hide host runtime socket directories and verify their live mount evidence. Existing managed units and wrappers need contain install with the new binary, followed by restarting agent services and sessions. Filesystem enforcement stays off when an existing config omits containment.filesystem.mode; new installs set enforce. Enforce-mode posture fields require compatible verifiers. Linux sandbox fallback below Landlock ABI 9 has documented IPC limits, and strict ARM64 launches below ABI 9 refuse. (#1813, #1890)
• Explicit child environment overrides that select loaded code now refuse. MCP and sandbox launch options share the code-loading subset of the verified-service deny list, covering runtime and loader controls such as PYTHONHOME, NODE_PATH and CLASSPATH. The sandbox guide distinguishes explicit refusal from filtering inherited variables. (#1870, #1873)
• Schema-bound JSON requires canonical keys. Typed MCP, A2A, GraphQL, contract and receipt inputs reject noncanonical aliases and case-variant duplicates. Legacy signed receipts with noncanonical-case keys now reject even when their signatures verify; free-form argument, environment and label map keys remain unchanged. On MCP, malformed JSON, invalid UTF-8 and duplicate keys also refuse despite mcp_input_scanning.on_parse_error: forward, and rejected responses don't update tracking state. Replay profiles v4 and v5 pin byte decoding across verifiers; historical profiles retain their contracts. (#1888, #1889, #1892)
• Core credential protection blocks in audit mode. Ordinary policy still warns. On HTTP request bodies, a fully redacted core credential forwards only to a configured request-body trusted host, in audit and enforcement modes. MCP input has its separate configured action. Strip actions block when their rewritten result doesn't pass the deciding checks again. (#1798, #1817)
• Parallel receipt groups require group-capable verifiers. flight_recorder.receipt_chains accepts 1 to 32 and defaults to 1. Preserve the complete directory and use group verification; a valid shard isn't proof of a complete group. Changing receipt_chains requires restart; reload retains the old count with a warning. Multi-chain automatic anchoring is unsupported, and changing its signing key closes the group and requires supervised restart. The published @pipelock/verifier-ts and pipelock-verifier-rs 0.6.5 verify whole groups (chain --dir --group ID and group --group-id ID); the PyPI package pipelock-verify 0.4.1 verifies each shard and chain but not the group, so use one of the others for group evidence. (#1828, #1838, #1863)
• Each native evidence run has a 256 MiB verifier ceiling that Pipelock 3.7.0 doesn't stop before. The Go, TypeScript, Rust and Python verifiers refuse a native AEL stream over 256 MiB and the writer has no cap, so a run that reaches the ceiling can't publish a close that verifies. With flight_recorder.receipt_chains above 1, a restart over that run is refused; a single-chain restart starts a new run and leaves the old one unverifiable. In one 200,000-request run across eight chains the largest stream was about 28 MB, which puts the ceiling near 1.9 million requests for that workload; shard count and event mix change the figure. If you run flight_recorder.receipt_chains above 1 under sustained load, restart on a schedule that keeps each run well inside the figure you measure for your own traffic. Details.
• Recording proxies get a 10-minute stop budget. Closing the receipt group at shutdown rehashes the run's evidence, so it takes longer with more recorded history and less CPU: in one development measurement, 300,000 requests across eight chains closed in about 15 s on 8 CPUs and 109 s on 2. The contain install unit, the Helm chart (terminationGracePeriodSeconds), init sidecar and generate docker-compose output and the Compose examples now set 10 minutes instead of their managers' 90 s, 30 s or 10 s defaults. contain upgrade from 3.7.0 adds it to an existing unit unless one is set; after upgrading from an earlier release, run pipelock contain install with the new binary. Hand-written deployments need their own setting. A run killed before its close finishes keeps its durable receipts but verifies as GROUP_INCOMPLETE. Stop budget. (#1909)
• Issuer-cookie evidence needs a writable state home in read-only containers. Pipelock saves issuer-bound session cookie evidence under $XDG_STATE_HOME (default ~/.local/state). The pipelock contain unit sets it, but the Helm chart and pipelock init sidecar output run with a read-only root filesystem, so the write fails, the proxy logs issuer cookie state write failed and the evidence resets on restart; those cookies are then scanned again. Set XDG_STATE_HOME to a writable directory that only Pipelock mounts; with the chart, use extraEnv, extraVolumes and extraVolumeMounts. Browser session cookies
• Partial and cache-validating HTTP responses must remain inspectable. Forward, intercepted and reverse proxies strip Range and cache-validator request headers and refuse origin 206 or 304 replies as response_incomplete. Browser Shield exemptions do not bypass that refusal. (#1809)
• JWT cookies follow header DLP policy. A JWT in a Cookie header now follows the configured action and core floor instead of always warning; an issuer-bound cookie observed through TLS interception keeps its scoped allowance. (#1837)
• Generated request IDs use UUIDv7 instead of a counter. Consumers of logs, events and receipts must accept req-<UUIDv7>; the receipt scanner verifies a process-held origin proof before treating an ID as generated. (#1897)
• Built-in credential-audience changes move the canonical policy hash. Update conductor and followers together before republishing fleet policy, and refresh consumers that pin the prior default hash. (#1783)

Added

• Parallel signed receipt chains. Requests stay on one chain across their decisions, outcomes and evidence records. Signed group openings, closes and successor transitions bind the chains together. The in-repository Go, TypeScript, Rust, Python and browser verifier sources distinguish GROUP_VALID, GROUP_INCOMPLETE and GROUP_INVALID. The published TypeScript and Rust verifiers (0.6.5) check whole groups, while the PyPI package pipelock-verify (0.4.1) accepts the signed group binding on each shard without verifying the group. Browser verification retains its 8 MiB compressed and 32 MiB uncompressed bundle limits. (#1828, #1838)
• Filesystem grants for host containment. containment.filesystem.mode: enforce hides other home directories and signing material, mounts unexpired workspace grants with their declared access, and refuses launch unless a canary proves the profile took effect. User-namespace remounts, same-user /proc, socket access and operator-written units retain the documented limits. (#1813)
• pipelock exec -- COMMAND. Check a running proxy's health, forwarding and kill switch, then launch cooperative clients with shared proxy and CA environment settings. Commands can ignore those settings; operating-system enforcement still needs containment or network policy. (#1810)
• Kernel-observed identities for local MCP services. Register and inspect local services through mcp_identities and pipelock mcp identity. Each new connection checks the service owner and pinned program inputs before sending data. Linux visibility, a unique socket holder and a direct connection are required. Reviewed credential acknowledgments can bind to verified local sessions without pinning their changing port and bearer value. (#1859)
• Expiring per-tool credential-request acknowledgments. mcp_tool_scanning.acknowledged_findings binds an operator-reviewed finding to the configured server, complete tool definition, detector revision and matches with a deployment-held HMAC key. It lifts only that finding; stale or mismatched entries refuse under every action. (#1844)
• Exact destination grants. destination_grants authorizes an exact TCP host and port through the existing destination...

v3.6.0

[3.6.0] - 2026-10-01

Breaking Changes / Upgrade Notes

• Building from source requires Go 1.26 or newer. Go 1.25 no longer receives upstream security fixes and current golang.org/x modules require 1.26. Release binaries are built with Go 1.26.8, the same toolchain the vulnerability scan checks, and CI tests Go 1.26 and 1.27. (#1670, #1673)
• A config file that omits fetch_proxy.monitoring.blocklist now gets the shipped blocklist. Before this only the no-config path carried it, so a config file without the key (including the Helm chart's default values) ran with an empty blocklist. Destinations on the shipped list that were reachable under 3.5.0 will now block. Set blocklist: [] to keep it off. (#1655)
• Request-body trust has its own list. On a destination in request_body_scanning.trusted_hosts, request-body injection and a fully redacted critical credential follow the configured action instead of the hard block. The request side no longer reads response_scanning.exempt_domains, so an operator who relied on a response exemption to relax outbound bodies must add the host to trusted_hosts. (#1454, #1637)
• Host patterns are validated against how they're matched. Allow, deny, trust and bypass lists refuse a pattern that isn't an ASCII hostname before case folding, that carries a URL, host:port, fragment, interior wildcard or malformed label, or whose validated form differs from what the matcher compares. A destination with an empty DNS label (an extra trailing dot) is refused as invalid on every transport. (#1524, #1541, #1548, #1569)
• tls_interception.passthrough_domains refuses a wildcard over a public suffix, including private-section suffixes shared by many tenants, because passthrough turns off body and response scanning for everything under it. List exact hosts or intercept with a trusted local CA. (#1595)
• Temporary exceptions have a maximum expiry. Seven controls have horizons enforced at load and reload: request_body_scanning.sigv4_credential_routes[].expires and response_scanning.core_observe_exceptions[].expires (30 days), sandbox.best_effort_expiry (30 days), request_body_scanning.content_entropy_warn_routes[].expires and response_scanning.unscannable_passthrough[].expires (90 days), and fetch_proxy.monitoring.path_entropy_exclusions[].expires and fetch_proxy.monitoring.query_entropy_param_exclusions[].expires (180 days). The refusal names the field, date and maximum. A config-sourced sandbox expiry must be an absolute RFC3339 time; best-effort reason and expiry must come from one source, and per-agent sandbox overrides need their own reason and expiry within the same 30-day limit. (#1447, #1520, #1600)
• session_profiling.volume_spike_ratio is removed. Nothing ever read it. A config that still sets it, top-level or per agent, is refused at load with a message naming the key. The canonical policy hash changes because the config shape changed; enforcement doesn't. (#1527)
• A custom DLP pattern that reuses a core pattern name can't carry exempt_domains. Config validation refuses it at startup and reload instead of accepting an exemption the core floor never honored. (#1451)
• pipelock run refuses file_sentry.action: block on the server listener. That listener has no child process to stop, so block could only log. A reload asking for it is rejected atomically. Subprocess MCP mode and action: warn are unchanged. (#1452)
• Named agent policy follows bound identity only (Enterprise). A per-agent listener or source_cidrs match selects the named profile. A self-declared X-Pipelock-Agent name is still recorded for attribution but gets the fallback policy, and its session state folds to the client IP so rotating names can't reset adaptive scoring. (#1461, #1530, #1578)
• contain install refuses to swap in a core build that can't enforce a named-agent config. Its pre-install check of the candidate binary requires the build to enforce every configured capability, so a working enterprise binary isn't replaced by one that can't enforce its listeners. A plain pipelock check on a core build still validates a named-agent config and exits 0. (#1629)
• Each Pipelock process writes its own receipt chain. Processes sharing one flight-recorder directory no longer fork a chain; a restart is recorded as a signed link naming the tail it continues. verify-receipt --chain and evidence doctor follow the links. Tools that read a single session file must read the run chains instead. (#1654)
• Activating the kill switch blocks held MCP approvals that haven't started sending. A held call that previously forwarded after activation now resolves as blocked. (#1699)
• The default canonical policy hash changes because a signed GitHub release-download JWT may now reach release-assets.githubusercontent.com in an https URL query, and nowhere else. Receipt consumers that pin the default hash will see a new value. (#1730)
• An approved MCP call that hasn't been sent yet is cancelled if the kill switch activates first. The client gets the same -32004 error as any other killed call, and the journal records a block with source kill_switch while the signed receipt records layer kill_switch. A config reload that turns the switch on applies it before the new proxy policy takes effect, including when the configured sentinel file already exists. Tools that group receipts by layer will see the new kill_switch value. (#1728)
• A held HTTP call that the upstream gate refuses at release records resolution source upstream_contract. Readers of deferred-resolution records will see this new source. (#1728)
• GitLab Private-Token and Job-Token headers are scanned for credentials by default. GitLab personal access tokens and CI job tokens sent to their issuer are still allowed; for a self-managed GitLab, list the host in dlp.gitlab_hosts so those tokens count as going to their issuer. Other GitLab token types stay blocked. (#1728)
• Reading an SSH public key (id_*.pub under .ssh) no longer trips the built-in Credential File Access rule when the path is the call's only string value, on the MCP proxy, pipelock explain, the Scan API and hook events, including ~/.ssh spellings and keys that exist on the host. Shell commands, calls with another string value, any JSON key that names a protected path, and arguments nested too deep to inspect stay blocked. A custom rule that reuses the built-in name keeps the ordinary matcher. (#1726, #1734)
• When MCP receipts are required, a request forwards only after its receipt is durably written. A failed or unsupported receipt write now blocks the request. (#1696)
• audit-packet --offline no longer reports a packet as trusted. The Go, Rust and TypeScript verifiers return verdict: schema_checked_trust_unverified with trusted and valid false and exit non-zero. Separately, pipelock verify-receipt --clean-report output carries a required verification_mode (pinned_provenance or unpinned_structural). CI jobs that accepted the old offline success must require chain verification with an explicit trust anchor. (#1700)
• The Scan API can return decision: "warn" for a tool_call that matches a warn-configured tool-policy rule, matching what the live MCP proxy does. Consumers that expected only allow or deny must handle warn. (#1572)
• Shipped presets now set arg_source: patch_targets on tool-policy rules, and a binary older than 3.6.0 refuses to load them. The field is unknown to earlier releases, so copying a 3.6.0 preset onto an older binary, or sending a conductor bundle that uses it to an older follower, fails at config load instead of running without the rule. Upgrade the binary first, or keep older followers on bundles without the field. (#1557)
• Contained hosts need pipelock contain install with the new binary to adopt the private network namespace, private temporary directories, the 0600 config mode and the refreshed CA export. (#1558, #1624, #1640, #1677)
• The absolute-URI forward proxy hands an allowed redirect back to the client instead of following it. A client that follows redirects, such as a browser using HTTP_PROXY, now sends each hop as its own request through Pipelock, and each hop gets full admission, a new receipt and its own mediation envelope, with cookies staying at the issuing origin. A redirect that targets something Pipelock would refuse is still refused before the response is released, and the redirect check no longer spends rate-limit capacity for a request nobody sent. A 301, 302, 303, 307 or 308 whose Location is duplicated or carries a backslash, whitespace or a control character is blocked with a 403 and the reason ambiguous redirect location. /fetch still follows and rescans redirects itself. (#1749)
• The redirect audit event now says redirect observed, not redirect followed. It fires when Pipelock sees a redirect, before it admits the target, and it isn't proof the target was contacted. Anything matching on the old message text needs the new one. (#1749)
• With flight_recorder.require_receipts, a credential-audience, issuer-cookie or issuer-query allow forwards only after its receipt is durably written. A failed write blocks the request with reason receipt_emission_failed and layer credential_audience_receipt or issuer_allow_receipt. With require_receipts off these receipts stay best-effort. The receipt takes its policy hash from the config the request started under, not one a reload installed mid-request. (#1741, #1744, #1745)

Added

• Contained agents run in their own network namespace. The agent reaches Pipelock and declared host services only through doorway sockets Pipelock forwards. The namespace is verified at launch, survives a binary swap and is restored on rollback. containment.published_services publishes agent services to the o...

v3.5.0

[3.5.0] - 2026-08-31

Breaking Changes / Upgrade Notes

• npm lifecycle scripts are disabled by default in contained environments. Commands that require dependency install scripts must use the documented explicit override.
• Emit configuration changes now require a restart. Reloads leave the active emitter unchanged and report the ignored change.
• Provider-key detection now requires a valid leading boundary. This removes false positives and accidental redaction of ordinary prose; keys glued directly to a preceding key-alphabet character are no longer matched.
• Immutable core DLP and response floors can no longer be suppressed. Existing suppressions naming those protected patterns must be removed or replaced with the documented scoped alternatives.
• Invalid duration values that overflow internal conversion are rejected during configuration validation.
• Unsafe request trailers and opaque MCP arguments are now rejected. Populated HTTP trailers that cannot be scanned and MCP tool arguments that redaction cannot safely inspect fail closed.

Added

• External authority propagation at forwarding gates, including audit, emission, WebSocket, and MCP paths.
• Offline recorder compaction and legacy recorder-epoch inventory with bounded reads and integrity-preserving publication.
• Native AEL evidence emission for session lifecycle and activity records.
• License-expiry warnings and rules-bundle compatibility warnings in operator status surfaces.
• A code-checked capability manifest that reports the supported capabilities from attached implementation.
• Route-scoped entropy warnings for selected request paths.
• Detection and redaction for current GitHub installation-token and Azure SAS token formats.
• An exported rules reader-schema contract with atomic bundle loading and status publication.

Changed

• Canary matching now uses bounded recursive decoding across whole-text and segmented views.
• Shielded large-response handling is consistent across forward and reverse proxy paths and records the configured cap and remedy.
• Audit, evidence, and dashboard surfaces distinguish recorded agent labels from identities established by trusted provenance.
• AEL liveness evidence begins with an immediate heartbeat so short sessions can satisfy the declared cadence.
• Conductor follower state uses signed applied-state heartbeats with bounded negotiation retry.
• Verified PNG and JPEG bodies bypass text prompt scanning while readable metadata and malformed or non-image bodies remain scanned.
• DLP prefiltering uses proven required literals to reduce unnecessary pattern work while retaining an always-run path for patterns whose anchors cannot be proven.
• MCP tool-definition scanning avoids reprocessing duplicate input-schema text while retaining one scan of every agent-visible field.

Fixed

• URL paths now participate in cross-request exfiltration detection.
• Skill and file scanning discovers extensionless references, scans text before classifying binary content, and prevents symlink or path-replacement escapes from presenting as clean.
• MCP setup and generated wrappers verify executable identity and proxy invocation rather than trusting self-written markers.
• MCP tool arguments that redaction cannot safely inspect now fail closed.
• Generic non-media responses and WebSocket control payloads are scanned, with taint attribution preserved across frames.
• A2A Agent Card controls run on forwarded MCP responses.
• Redirect policy and official rules-registry origin checks remain enforced across repeated fetch, update, and sink paths.
• Conductor audit/admin operations are organization-scoped, including removed-follower handling.
• Unreadable posture evidence warns without taking down receipt-enabled startup.
• Files already present in newly created file-sentry directories are scanned without blocking event processing.
• Response prefiltering preserves required literals across regex alternation branches, keeping candidate selection deterministic and never skipping patterns without a proven anchor.
• HTTP request trailers fail closed when they cannot be scanned; forwarded hosts follow the admitted URL, and scanned bodies are not replayed across authority-changing redirects.
• MCP media policy scans and safely rewrites nested resource.blob payloads.
• Strict reloads cannot remove an active MCP listener state-token requirement.
• Pinned EvidenceReceipt verification requires signer_key_id to match the pinned public key across the bundled verifiers.
• Description-scoped bundle rules match only tool and input-schema descriptions, including Hyper-Schema link descriptions, while built-in scanning retains broader field coverage.

---

📚 Docs: https://pipelab.org • 💬 Community: https://discord.gg/badNfhGKTc

Pipelock is an open-source agent firewall. Come poke holes in it.

v3.4.0

Changelog

🐛 Bug Fixes

• 092a149 fix(killswitch): scope endpoint exemptions to pipelock's own requests (#1295)
• 888e669 fix(scanner): scan the path and query together for split credentials (#1296)

Other Changes

• 4c748ab Give the release preflight gate the keyring secret it checks (#1300)
• 2f1ec20 chore(release): correct the 3.4.0 date and the Python verifier availability (#1298)
• d66603a test(mcp): stop the subreaper-direction deadline deciding the result (#1293)

---

📚 Docs: https://pipelab.org • 💬 Community: https://discord.gg/badNfhGKTc

Pipelock is an open-source agent firewall. Come poke holes in it.

v3.3.0

Changelog

🐛 Bug Fixes

• c31656d fix(ci): align release test shards (#1139)
• de451af fix(release): restore compatible cosign signing (#1140)

Other Changes

• e98de12 docs(receipts): clarify post-activation recovery (#1138)

---

📚 Docs: https://pipelab.org • 💬 Community: https://discord.gg/badNfhGKTc

Pipelock is an open-source agent firewall. Come poke holes in it.

v3.2.0

Changelog

🐛 Bug Fixes

• 4500249 fix(contain): narrow credential guard watches (#1008)
• a48d545 fix(coveragecert): fail closed when no trusted signer is supplied (#1014)

📦 Dependencies

• 3747656 chore(deps): update dependency setuptools to v83 [security] (#1007)

Other Changes

• 7a6f866 Add MCP tool-policy example with verify script (#1006)
• e0536c4 Add fetch proxy SSRF example with verify script (#1005)
• 913a051 Add kill switch example with verify script (#1004)
• c0715e6 Fail closed when replay verification is unpinned (#1016)
• 8c5ab23 Fix A2A forward request-body scanning (#1013)
• 990725b Harden security trust boundaries and parser semantics (#1010)
• 371893f Make executable config examples fail closed in CI (#1011)
• 51b21d4 Make startup validation honest and accelerate releases (#1012)
• 39e93b4 chore(ci): fail CI when a shipped config example cannot start (#1009)
• ecbe637 chore(release): reconcile v3.2.0 changelog, chart version, and broken instructions (#1017)
• 3850edb chore(release): set v3.2.0 changelog date to the tag date (2026-07-17) (#1019)
• ca1eb9a chore(release): stamp v3.2.0 date and add release-readiness gate (#1018)

---

📚 Docs: https://pipelab.org • 💬 Community: https://discord.gg/badNfhGKTc

Pipelock is an open-source agent firewall. Come poke holes in it.

v3.1.0

Changelog

🚀 Features

• 5564402 feat(cli): explain hook blocks via explain --command/--tool/--file (#877)
• 5a04b7c feat(conductor): add --dry-run to publish/kill/rollback and a replay CLI (#989)
• 6440a45 feat(conductor): dry-run and decision-replay for signed policy, kill, and rollback actions (#950)
• ad6cb93 feat(conductor): fleet runtime/apply-state drift guardrail with fail-closed publish preflight (#910)
• 693b51d feat(conductor): sign follower applied-state into audit batches for verifiable fleet overview (#948)
• 4803713 feat(contain): add verified run launcher (#846)
• a59d78c feat(dashboard): add RBAC permission seam (#967)
• 3add482 feat(dashboard): add durable state operability (#971)
• fa96926 feat(dashboard): add trust and keys audit view (#970)
• 757263d feat(dashboard): cross-agent evidence explorer, decision investigator, and free viewer (#946)
• 61d18c4 feat(dashboard): exemption lifecycle store and coverage certificates (#947)
• a42d3f3 feat(dashboard): land on Overview at root; restyle the free evidence console (#995)
• 86c43a6 feat(dashboard): live per-agent forward-budget data via runtime snapshot (#968)
• 68eb7c9 feat(dashboard): mTLS client-certificate authentication (#973)
• 20bc056 feat(dashboard): operator console revamp with a free evidence view, tier gating, and honest states (#991)
• af2ba15 feat(dashboard): pipelock dashboard serve command for the Evidence view (#888)
• f2de27c feat(dashboard): read-only Evidence view for Pro/Enterprise (#885)
• ad7d544 feat(dashboard): read-only Signed Action Workbench and Incident Cockpit (#960)
• 0d4f6d1 feat(dashboard): read-only exemptions inventory with inert-exemption detection (#923)
• e07c26a feat(dashboard): read-only fleet overview of signed follower state (#951)
• 3f06e6d feat(dashboard): read-only per-agent budget panel (#966)
• 5d76d52 feat(deferred): cascade-depth limit + pending-ancestor linkage for held MCP actions (#887)
• 8474b31 feat(enterprise): add compliance console (#969)
• 212c417 feat(examples): add tool-poisoning-honeypot MCP manifest-poisoning demo (#997)
• 426069f feat(mcp): record durable receipts before egress for all forwardable verdicts (#937)
• 596b9b5 feat(mcp): tool-policy type/range/length/value arg validators (#881)
• c11639c feat(playground): WASM browser verifier + load-test harness (#837)
• b01a2ce feat(playground): broker hardening for public exposure (#838)
• 5531946 feat(playground): harden broker for public internet exposure (#831)
• df95834 feat(playground): require real live model, add per-session verify kits, fix model 400 (#834)
• 2b402fe feat(proxy): surface the exempt_domains full-trust blind spot (#936)
• 2a284eb feat(receipt): additive exact-bytes receipt verification foundation (#915)
• d85d4e2 feat(receipt): cross-language verifier parity for rotated chains (#935)
• 23bce3f feat(receipt): strict unknown-field rejection and two-mode chain contract (#963)
• c012f89 feat(replaycapture): add three Make It Leak episode scenarios (#896)
• 870e5a0 feat(rules): verify official bundles on source builds (#955)
• 2134bf7 feat(scanner): central block-remediation table, wired into explain and audit (#875)
• 42e1d2b feat(scanner): operator-configurable endpoint/parameter query-entropy exemption (#916)
• 5737958 feat(verifier): wasm raw receipt-chain verification with parity harness (#952)
• f243013 feat: add CEF SIEM export format and action-aware export filtering (#920)
• 745459f feat: add MCP taint trust by server name (#865)
• 1954ff6 feat: add Rekor anchor submission backend (#861)
• 446ed52 feat: add durable SIEM event forwarding (#972)
• d11094b feat: add explain-event, quickstart, and status operator commands (#921)
• a6a806f feat: add local receipt anchor bundles (#858)
• 730d356 feat: add preset listing, richer startup summary, and unset-knob surfacing (#922)
• 016bce1 feat: durable intent before egress on CONNECT-intercept inner requests (#925)
• 72834c0 feat: durable receipt-evidence lifecycle and honest completeness verifier (#924)
• 7dfbcf2 feat: make all seven config presets selectable via --preset (#874)
• e030fe5 feat: operator surface to list, approve, and deny held (deferred) MCP actions (#905)
• a794ae8 feat: verify Rekor anchor inclusion proofs (#866)
• ace3374 feat: verify the bound-genesis session-control wire format in every language (#926)

🐛 Bug Fixes

• 527f4b3 fix(anchor): make the Rekor hashedrekord hash algorithm configurable (#987)
• 771613d fix(anchor): versioned per-session state index and hostile-filesystem fail-closed loading (#979)
• 18ca6f8 fix(audit): emit operational visibility events (#843)
• cbda57f fix(baseline): cross-process integrity lock and fail-closed profile integrity (#914)
• a1dd7ad fix(baseline): enforce behavioral baseline on A2A methods (#894)
• 441f443 fix(baseline): fail closed on persisted profile tamper via signed integrity manifest (#897)
• bdd5b93 fix(baseline): fail closed on unreadable or corrupt persisted profile under enforcement (#892)
• b1e569c fix(baseline): fingerprint integrity diagnostics (#943)
• 41e5c57 fix(baseline): restore Windows regular-file reads without following symlinks (#980)
• 519f44c fix(baseline): sanitize control characters in agent-identifier log fields (#940)
• 312a995 fix(conductor): additively merge published detection content onto follower baseline (#999)
• c95791c fix(conductor): make bootstrapped policy bundles publishable with a loaded-config policy hash (#986)
• 1d88391 fix(conductor): reject empty-scope audit queries and enforce config-consumption gate (#904)
• 9f814f5 fix(conductor): survive upgrade with an existing bundle and add signed-decision replay modes (#993)
• 26cda65 fix(coverage-cert): re-validate certificate body on verify and bind signer key (#1000)
• dddf762 fix(coveragecert): reject over-claiming certificates by construction (#1001)
• d1e1a37 fix(dashboard): accept mutual TLS as a sole authenticator (#982)
• b87e659 fix(dashboard): harden auth boundary, store loading, and evidence read bounds (#978)
• 9484ba8 fix(dashboard,siemforward): default-proxy coverage certs, forwarder metadata floor, brand favicon (#1002)
• c331bf3 fix(deferred): never derive cascade linkage across session-less holds (#889)
• 58ab15b fix(deferred): record depth-limit denials in the audit journal (#913)
• b6a2985 fix(dlp): anchor dotted-token patterns case-sensitively to stop prose false positives (#836)
• 7a33227 fix(emit): queue syslog delivery asynchronously (#845)
• df4e973 fix(evidence): fail closed when a coverage certificate signer is not in the pinned trusted-signer set (#984)
• 38891a2 fix(evidence): re-tier point-in-time containment grade to kernel_observed (#938)
• 6d0b1be fix(mcp): audit completeness, full-object drift, fail-closed hardening (#895)
• 5cc240d fix(mcp): enforce denial-of-wallet and chain detection on A2A methods (#900)
• b060d9d fix(mcp): enforce session-binding, taint, and contract gates on A2A methods (#909)
• 0f82ed6 fix(mcp): fail closed without envelope leak on empty action id under require-receipts; harden A2A method match + drift doc (#903)
• 1ef37c2 fix(mcp): harden input envelope handling (#840)
• cee8b07 fix(mcp): namespace reserved-prefix tool names in enforcement identity (#934)
• 04438c3...

v3.0.0

Changelog

v3.0.0-rc.2

Changelog

• 6ea1823 Add per-server MCP response trust classes (#820)
• d3edac5 Add provider-key DLP coverage (#821)
• fbe631b Make contain install portable across Linux distros (#817)
• cd399d6 conductor: clearer follower operator UX (check advisories, error remediation, recovery docs) (#828)
• 091d66d feat(playground): add brokered Fly deployment (#826)
• b444ccd feat(playground): harden live playground core (#825)
• a0d859f fix(conductor): prevent follower restart-wedge and add replay-state recovery command (#823)
• 9f52193 fix(proxy): measure idle across both tunnel directions (CONNECT + WebSocket) (#816)
• 25283bd fix(security): receipt trust anchor, fail-closed reload/state, scan masking, sandbox TOCTOU (#819)
• c5668e1 fix(selfupdate): require signed release manifest, never exec the download (#818)
• 778f391 playground: pin Fly Dockerfile base images by digest (#829)
• cc0757e v3.0.0: conductor fleet day-2 ops (follower un-enroll, DR backup/restore) + fail-closed hardening defaults (breaking) (#827)

v2.8.0

Changelog

• a728e24 Add Enterprise Fleet Receipt Report minting (#749)
• 0c023e7 Add Fleet Receipt Report verifier foundation (#748)
• 2f0f898 Receipt evidence: clean-A2A allow receipts + fleet-receipt conformance (#801)
• 0e5ebb2 ci: Update ci-actions to v7 (#798)
• 4d44bbf deps: Update docker-base-images (#734)
• 524e068 deps: Update docker-base-images (#764)
• 0a0c854 deps: Update docker-base-images (#777)
• fce5a64 deps: Update docker-base-images (#789)
• 03e6299 deps: Update docker-base-images (#800)
• 5ff537a deps: Update go-deps to v0.9.0 (#781)
• 9abd09a deps: Update go-deps to v1.52.0 (#793)
• 8b14341 deps: Update go-deps to v2.7.0 (#754)
• 6634a00 deps: Update k8s-images (#747)
• ca519a5 deps: Update ts-verifier to v24.13.0 (#765)
• c01c561 deps: Update ts-verifier to v24.13.1 (#787)
• 480d06e docs(metrics): complete Prometheus metric catalog (#756)
• 939f8d5 feat(cli): add 'explain' command for remediable block explanations (#750)
• c2ec807 feat(cli): add 'keys status' unified signing-key inventory (#752)
• d49fb60 feat(cli): add 'support bundle' diagnostics command (#753)
• 2c542a3 feat(cli): add 'update' self-update command (#757)
• c036238 feat(conductor): offline fleet-report export and verification (#791)
• 2e72b0f feat(conductor): operator credential and enrollment-token lifecycle (#792)
• a240b9e feat(conductor): operator recovery commands for the fleet control plane (#763)
• 1b54c20 feat(conductor): operator stream observability + publish-error clarity (#758)
• be8c25f feat(conductor): verify emergency-control signatures at all leader read paths (#776)
• 5a641c9 feat(conductor): wire follower audience labels into policy, rollback, and remote-kill apply paths (#772)
• 07621dc feat(contain): install/UX hardening for first-run and older hosts (#761)
• 2425c2e feat(contain): publishable offline containment conformance artifact with must-fail fixture (#773)
• a917feb feat(doctor): flag inert exemptions and semantic config mismatches (#751)
• 70faa8a feat(license): add 'license crl inspect' and 'license crl verify' (#762)
• 026b7f2 feat(license): gate CLI issuance on paid capability + signed service import table (#779)
• 7d2b4ba feat(license): monotonic CRL generation with consumer rollback rejection (#770)
• 19bd993 feat(license): require-intermediate enforcement, issuer-side intermediate revocation, CRL freshness (#775)
• 8f658d4 feat(mcp): defer authorization action with fail-closed resolution (#799)
• b9bdfdd feat(mcp): per-server response suppression + airlock reset for first-party tools (#774)
• 3482757 feat(playground): bundle generator + stable published orchestrator key (#795)
• 26ce17d feat(playground): gated live-chat backend (stream seam, gate, fail-closed limits, SSE server) (#802)
• 6ec8b4e feat(playground): honest live-chat demo backend (bundle, caps, trust-class) (#812)
• bbaaf4d feat(playground): honest live-chat demo for the agent firewall (#809)
• af5f0dd feat(playground): live demo engine with offline-verifiable evidence (#784)
• 9fdd1b1 feat(playground): live model-backed agent for the demo (#804)
• 1437a0f feat(playground): live-demo spend controls + polish (#807)
• 3a5423a feat(playground): split-proof contained mode with signed host-containment witness (#785)
• d7dfaab feat(receipts): freeze v1 fixtures and publish versioning policy (#755)
• 1de117a fix(chart): render valid Conductor image refs (digest vs tag) (#790)
• 3f5a7bb fix(conductor): tolerate abandoned fork siblings + offline recovery (#786)
• 49d660b fix(deps): bump Python verifier cryptography to 48.0.1 (GHSA-537c-gmf6-5ccf) (#788)
• 5236c74 fix(license): evaluate token expiry against the injected verification clock (#780)
• 4fa9952 fix(mcp): opt-in stdio response timeout + self-update downgrade warning (#810)
• 1a30205 fix(playground): harden live demo adversarial edges (#808)
• 90812be fix(proxy): make redaction config key invariant to per-agent config deep-copy (#783)
• 1413a09 fix(scanner): direction-anchor Credential Solicitation to stop documentation false positives (#760)
• b3807cd fix(scanner): fail closed on over-depth JSON and stacked URL DLP encodings (#803)
• bb33140 fix(wsutil): treat Windows Winsock close errnos as expected WS teardown (#769)
• 08538ae fix: close stacked-encoding DLP bypass, freeze receipt v1 canonical, correct dropped-action accounting (#814)
• d897e51 fix: operability, UX, and support-bundle secret-redaction fixes (#805)
• edad608 fix: verify raw action receipt chain jsonl (#771)
• f8bf755 refactor(license): extract splitToken helper and rename Decode to DecodeUnverified (#782)
• ac614ac test(certgen): make read-only-dir tests portable (#767)
• a73ce53 test(cli): make read-only-dir/config tests portable on Windows (#766)
• abce869 test(mcp): close recorder in receipt harness to fix Windows TempDir cleanup (#768)