Release v0.5.0 · praxis-proxy/policy

Added the opt-in delegator/vault builtin to read downstream credentials from Vault KV v2 for a user, client, or workload. Routes using it must authorize before delegation. (#168)
Request header assertions can use a declared secret.<name> value for static upstream credentials. Values are resolved at startup and read from the secret store at the point of use, so rotation takes effect on the next request after refresh without fetching on the request path. Unknown names and response assertions using secrets are rejected. (#174)
Added an OCSF audit sink as an unpublished reference plugin. It emits decision records with optional chained attestations and DSSE signatures for offline verification. (#171)
Exposed MCP tool, resource, and prompt annotations to policy, including readOnlyHint and destructiveHint. Workload attestation timestamps are available as RFC3339 strings and Unix seconds; APL can compare attested_at_epoch against a fixed threshold. (#175)
Added secret-provider health details through secrets_health and atomic value/generation reads through SecretRef::snapshot. (#191)

Breaking: Secret configuration reloads that change secrets: now fail; restart to apply those changes. The env provider rejects unused settings. secrets_last_success retains its last successful timestamp after a failure, so use secrets_health to detect outages. (#191)
Breaking for Rust callers: Secret assertions add HttpExtension::secret_headers; exhaustive struct literals must initialize it, and hosts must preserve it between hooks. SourcePath::resolve and assertions::render now take a secret store, AssertionsConfig::validate takes secret configuration, SourcePath::capability returns Option<Capability>, and SourcePath gains a Secret(String) variant and is non-exhaustive. (#174)
Breaking for custom CEL functions: CelResolver::with_functions and its registration callback now return Result. Conflicts with standard-library overloads fail construction; later registration failures deny even with on_error: allow. Hosts that need such overloads must use a CEL Env overload. (#185)
CEL 0.15 counts Unicode code points instead of UTF-8 bytes in string size(). exists() returns true if an element matches even when another element errors. Review policies that depend on byte limits or list-predicate errors, since previously denied requests may now allow. (#185)
JSON floats now parse with serde_json's float_roundtrip feature. Exact numeric boundaries and re-serialized audit records can change. (#171)

Breaking for Rust callers: Removed eight CAP_READ_* names for unrestricted CMF slots and seven BAG_*_PREFIX constants. The policy attributes remain available. (#175)

Rejected JWTs with unsupported critical headers. OAuth token exchange now validates issued token type, granted scopes, and JWT audience and subject by default. Empty scope requests accept IdP defaults; allowed_extra_scopes permits named defaults alongside requested scopes. (#188)
Bound CIBA approvals to the selected route, tool, and authenticated requester, with atomic single-use redemption within a plugin instance. Backchannel and poll failures no longer expose OP response bodies that may contain credentials. (#188)
Made non-scalar numeric policy comparisons fail closed. Structured JSON redaction now matches keys without case sensitivity, supports recursive paths, preserves keys containing dots, and bounds recursive traversal. (#188)
Kept secret assertion headers redacted in plugin and audit views across subsequent hooks, config reloads, and header case normalization. Plugin header writes preserve the original credential while allowing unrelated changes. (#174)
Confined file-provider reads to base_dir, rejecting symlinks that escape it while supporting links within it, including Kubernetes projected secrets. (#191)
Corrected CMF capability namespace descriptions, including the read_teams mapping, and added checks against the keys the bridge actually emits. (#175)

Added integration, resilience, and security suites through the reference host, covering Cedar, CEL, OPA, dependency failures, concurrency, and credential leaks, with optional live Keycloak, Valkey, and Vault scenarios. (#180)
Expanded authorization coverage for glob and wildcard entity routes, including route specificity. (#122)
Defined requirements for audit serialization, delivery, and offline verification. (#173)
Updated project governance, contribution, security, maintainer, and code ownership guidance. (d2bf93c, 940c5c5, 93580f2)

New Contributors

Full Changelog: v0.4.1...v0.5.0