Skip to content

runward v0.9.0 — audit-ready alignment

Choose a tag to compare

View all tags
@stranxik stranxik released this 09 Jul 12:08
v0.9.0
30900b2

Ecosystem and doctrine alignment from the 2026 veille — each decision locked as an ADR first, then implemented (doctrine before code, per the method). Together they make the conformance manifest read as an audit artifact and wire the deterministic gate into every harness, without adding any runtime surface. The gate stays zero-LLM and zero-run.

What's new

  • OWASP ASI risk grammar (ADR-0009). 20 security/governance craft rules gain an asi: mapping (OWASP Top 10 for Agentic Applications, verified against the official taxonomy) so the conformance manifest reads as ISO 42001 / EU AI Act evidence. 3 new CVE-derived deterministic rules (security-mcp-server-pinning, security-tool-change-reapproval, data-memory-provenance) — 51 → 54 rules; floors updated (architect 6, govern 10).
  • AGENTS.md as a first-class handover deliverable (ADR-0010). The handover workflow finalizes AGENTS.md as the receiving team's charter, in the harness-neutral format every agent reads.
  • Neutral standards as versioned ports (ADR-0011). MCP (pinned by spec version + server hash), OTel GenAI, agent identity (OAuth 2.1/PKCE, SPIFFE, Entra Agent ID) and A2A (deferred) named as pinned port contracts in the reference stack — never implemented in the core.
  • The gate as a port, with harness adapters (ADR-0012). The gate's exit code is the contract. init now emits 4 inert sample adapters under runward/adapters/ — a git pre-commit hook, a github-actions.yml CI job, a Claude Code Stop-hook, and a README.md pinning the exit-code contract — so the gate runs at each harness's lifecycle seam (commit, CI, agent turn-end). Opt-in and inert until the operator wires them: runward writes nothing into .git/, never a runtime.

Install

npx runward init

Full changelog: https://github.com/stranxik/runward/blob/main/CHANGELOG.md

Assets 2
Loading