Skip to content

v3.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Nov 16:07
· 2 commits to main since this release
v3.0.0
8505248

Release notes: v3.0.0

Why this release

v3.0.0 is the focus release. Akmon now does one job: it seals an AI agent session into one signed, tamper-evident file that someone who doesn't trust you can verify offline, with the standalone agef-verify binary or with stock OpenSSL 3. Anything that didn't serve that job has been archived. Some commands, flags, config keys and JSON shapes changed, so this is a major version. The evidence format is unchanged (AGEF v0.1.3), and every bundle produced by 2.x still verifies.

Highlights

  • akmon seal: one command from trace to sealed evidence. Seal an OpenTelemetry GenAI trace from any agent, or an existing journal session. Akmon imports, bundles, checks integrity, signs, optionally adds an operator attestation, verifies its own output, and prints the exact commands to hand to the verifier.

    akmon bundle keygen --out signer.pk8 --public-out signer.pub
akmon seal trace.json --key signer.pk8 --output audit.akmon
# the auditor, on their own machine:
agef-verify audit.akmon --verify-key signer.pub --require-signature
agef-verify audit.akmon --verify-key signer.pub --require-signature --format markdown > report.md

  • An auditor report. --format markdown (on agef-verify and akmon bundle verify) prints a plain-language verdict, a checks table, the session window, unsigned metadata, and explicit "what this proves / what this does not prove" sections.

  • Verdicts that say what was established. The headline now distinguishes integrity OK; signature verified by key_id=… from signature present but NOT verified and UNSIGNED (integrity only). Without --require-signature, a pass means integrity only.

  • Hardened verification. Archive parsing is stricter (duplicate entries, non-hex object names, symlinks and other non-regular entries are refused). Every manifest-sourced string is sanitized before it reaches your terminal. bundle sign, bundle attest and bundle prove-openssl refuse bundles that don't verify, so you can no longer get an OpenSSL "Signature Verified Successfully" for a broken bundle.

  • Honest capture in three levels. OTEL imports are now full, partial or structural, computed from the content slots actually captured. The importer supports semconv v1.37–v1.42, including the inference-details event, and records failed calls.

Upgrade notes (read before upgrading scripts)

  1. agef-verify error JSON: tool_version is now akmon_version. All bundle and seal errors share one shape: {tool, akmon_version, passed:false, error, category}.
  2. Don't grep the human headline. Its wording changed. Use exit codes (0 pass, 1 verification failed, 2 usage, 3 I/O) or --format json (passed, integrity_ok, signature_verified).
  3. Corrupt or truncated archives now exit 1, not 3. Only I/O and environment problems exit 3.
  4. otel import refuses more input (exit 2): multi-trace files without --trace-id, traces with no GenAI provider or tool span, missing or invalid span timestamps, conflicting duplicate spans. In human mode the session id is now the only thing on stdout.
  5. capture_level can be partial. --require-capture full rejects it.
  6. akmon diff compares more (retry attempts, status, errors), so sessions that used to match may now diverge. Request-hash differences are listed as informational and don't change matches. JSON-mode failures print {akmon_version, category, error} on stdout.
  7. Agent policy: paths are normalized before matching (src/../.git/config now hits .git/** deny rules). Paths outside the project root need an explicit allow glob. File tools no longer write through symlinks. Permissions are also checked on the canonical (symlink-resolved) path, filesystem deny globs match case-insensitively, and apply_patch rejects a patch whose headers name a different file than file_path.
  8. akmon config key set <provider>: prefer piping the key on stdin or setting ANTHROPIC_API_KEY. A key passed on argv prints a warning. ~/.akmon/config.toml is now always mode 0600.
  9. --output text|json must come before the subcommand. Agent flags such as --audit-log, --shell-allow and --mcp-server now work after it too.
  10. Library users of akmon-bundle: EventsReader::new(reader, algorithm). object_path, read_object_file, write_object_file and the with_* builders were removed.

Removed and archived

These commands now fail with a usage error (exit 2). The code is under archive/ and the full tree is tagged archive/pre-focus-v2.2.1. Restore an item with git checkout archive/pre-focus-v2.2.1 -- <path> (equivalently git checkout v2.2.1 -- <path>: both tags point at the same commit).

Removed Use instead
akmon sign and the [signing] post-run hook akmon seal, or akmon bundle sign + --verify-key
akmon slo verify / slo trend, [slo] config Gate on agef-verify / akmon bundle verify exit codes
akmon import / akmon export (AKMON.md sync), TUI /import /export akmon init reads existing context files
akmon spec, akmon scout, --dossier, tools read_spec / write_spec None
Semantic index (semantic-index feature, akmon-index, --index, /index, semantic_search) The search tool
spawn_subagent, AKMON_EXPERIMENTAL_SUBAGENTS None

Legacy [slo] and [signing] sections in ~/.akmon/config.toml are ignored rather than rejected.

Deprecated, still working: akmon audit verify and akmon evidence verify are hidden and print a notice. Use akmon seal <session-id>, or akmon bundle export followed by akmon bundle verify.

Regulatory wording corrected

The EU AI Act timeline now follows Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force 27 July 2026). The high-risk duties, including Art. 12 logging and Art. 19/26(6) log retention, apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I): deferred, not cancelled. The 2.2.0 notes said operator attestation closes an "Art. 14 / Art. 12(3)" gap. That overstated it: Art. 12(3) covers only remote biometric identification, and an attestation helps evidence human oversight rather than satisfy Art. 14. Akmon helps you produce evidence. It does not certify compliance.

Known gaps

  • No signed time yet. AGEF signatures don't cover a timestamp. For now, use the RFC 3161 recipe in the README (openssl ts on proof/statement.bin, with a qualified TSA where legal weight matters). Native timestamps (manifest.timestamps[], AGEF v0.1.4) are planned.
  • Release binaries are covered by SHA256SUMS and an SBOM but are not yet signed.

Verify this release

base=https://github.com/radotsvetkov/akmon/releases/download/v3.0.0
curl -fL -O "$base/agef-verify-linux-x86_64" -O "$base/SHA256SUMS"
sha256sum --check --ignore-missing SHA256SUMS

Full details: CHANGELOG.md · Archive index: archive/README.md · Security policy: SECURITY.md

Full Changelog: v2.2.1...v3.0.0

Assets 10
Loading