PALO v3.1.0 - Governance Control Plane

PALO v3.1.0 releases the governance control plane across fairness and subgroup testing, system cards and explanation assurance, affected-person notice and remedy, Article 50 transparency, data lifecycle, GPAI and systemic-risk workflows, serious incidents and decommissioning, accessibility, environment, AI literacy, ISO/IEC 42001 alignment, and PALO-AI production admission.

The release distinguishes governance-complete, operationally complete, production-complete, and certification-complete status. PALO-AI v2.6 remains a non-production developer preview; the bundled reference runtime is denied by its own production profile.

Validation completed through the full P0 gate: schema and semantic validation, OPA policy tests, 52 Node tests, 3 Python tests, deterministic build checks, and browser smoke coverage across 92 public pages.

Assets include the root-correct Hostinger deployment bundle and its SHA-256 checksum.

PALO v3.0.1 - Evidence Pack Activation

PALO v3.0.1 - Evidence Pack Activation

Allowed is not verified. This patch turns PALO's broad governance surface into one focused activation route: give PALO one AI use case and leave with a traceable, reviewable evidence dossier in less than ten minutes.

Start here

Open the preloaded Evidence Pack case. It runs locally, requires no account and sends no mandatory telemetry. Export is voluntary.

The validation receipt records schema checks and a SHA-256 digest. It is not certification, legal advice, production approval or independent assurance.

Included

• one primary website and README activation route
• preloaded synthetic agentic invoice case
• three schema-valid gold cases across agentic workflows, HR and procurement
• voluntary browser-local and CLI validation receipts
• npm run case:contribute for Community Casebook preparation
• 30-day new-module freeze and a five-day activation runbook
• one canonical GitHub Discussions feedback channel
• 12 atomic activation issues across cases, adapters, threat tests, mappings and accessibility

Verification

• complete npm run p0 gate
• Linux and Windows GitHub Actions builds
• 29 agentic/runtime Node tests and 3 Python connector tests
• Evidence Pack tests 4/4
• deterministic source and distribution build validation
• browser smoke across 85 public HTML pages
• generated dossier and receipt verified at 375px and 390px without horizontal overflow

Starter assets

The attached archive contains the three gold cases, Case File and validation-receipt schemas, CLI validation and contribution tooling, locked package metadata and contribution guidance. SHA256SUMS.txt covers the archive and the three individually attached cases.

PALO v2.5.0 — Full-Cycle Agentic Assurance Developer Preview

PALO v2.5.0 — Full-Cycle Agentic Assurance Developer Preview

PALO-AI v2.5.0 extends governance from pre-execution authorization to a full assurance cycle: explicit authority, policy evaluation, digest-bound approval, one-time execution capability, trusted receipt, authoritative outcome verification, and held incident response when an authorized action produces the wrong effect.

Public experience

• Why PALO-AI: before/after comparison plus an interactive, browser-local demonstration of direct execution, governed execution, and the “authorized but wrong” case.
• Three quickstarts: Code-first, n8n/no-code, and Copilot Studio/MCP.
• Always-visible truth surfaces: Capability Matrix, Production Readiness, and Security boundary across the public agentic journey.
• Governance Hub: an eight-step guided prototype for executive and technical evaluation.

Developer-preview artifacts

• Official-SDK MCP reference server with stdio and authenticated Streamable HTTP preview transports.
• Versioned governance contracts, Rego v1 reference policy, replay controls, exact-claim approval, one-time execution capability, trusted receipts, and outcome attestation.
• Unpublished n8n-nodes-palo-ai 0.2.0 installable preview package and safe synthetic workflow.
• Hostinger-ready static site bundle.
• Capability matrix, release manifest, changelog, threat boundary, SHA-256 checksums, and detached Ed25519 SSH signature.

Threat boundary

This is a Developer Preview, not a production authorization service, certified security boundary, compliance certification, or substitute for organization-owned identity, access control, key management, monitoring, backup, retention, legal review, and independent security assurance.

Use only isolated data and reversible, non-consequential tools. A visual decision gate is advisory whenever an alternate path retains an equivalent credential or can reach the protected tool directly. Production deployment still requires workload identity and scoped tenant RBAC, KMS/HSM-backed key custody, durable distributed storage and coordination, authenticated policy distribution, connector isolation and attestation, abuse and disaster-recovery testing, real reversible connector validation, and independent threat modelling, penetration testing, cryptographic review, and supply-chain assessment.

Verification

The Git tag and commit are SSH-signed. Release files are listed in SHA256SUMS.txt, which is signed with the release Ed25519 key in SHA256SUMS.txt.sig. See VERIFY_SIGNATURES.md and palo-release-signing-key.pub.

Validation completed

• PALO P0 suite: agentic contracts, 23 MCP/gateway tests, Rego compile and policy tests, Dify adapter tests, source/dist validation, deterministic build check, and browser smoke across 77 public pages.
• n8n package 0.2.0: lint, TypeScript build, utility tests, package metadata, and installability checks.
• Independent frontend evaluation: PASS at desktop, 390 px, and 360 px.

The n8n package remains unpublished and is not n8n-verified. This release invites architectural feedback and disposable local evaluation; it does not request connector approval.