v0.2.6

Multi-provider metering and richer pricing.

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.6

Before you upgrade: one behavior change

Under a cost budget, leash now fails closed on billed activity it cannot price, not just on a blind meter. A call that reports server-side tool requests (Anthropic server_tool_use web search / fetch) is a per-request charge with no entry in the price table, so with the default --on-blind=refuse it now stops the run (server_tool_unpriced). If your agents use provider-side tools under a budget, either price them (web_search_per_request / web_fetch_per_request) or set --on-blind=warn.

Added

• Native Gemini metering. leash reads Google's Gemini generateContent / streamGenerateContent (usageMetadata) as a third wire format. Because leash keys on the wire format, not the model name, "OpenAI-compatible" already covered Gemini and Ollama through their OpenAI-compatible endpoints; this adds the native API. A new model version never needs a code change.
• Anthropic thinking tokens (output_tokens_details.thinking_tokens) are metered at the reasoning rate, matching OpenAI reasoning and Gemini thoughts.
• Opt-in priced dimensions in the --prices table: per-request tool rates (web_search_per_request, web_fetch_per_request), audio (audio_input, audio_output), per-TTL cache-write (cache_write_5m, cache_write_1h), and per-service-tier overrides under tiers. Each is optional and falls back to a coarser rate, so existing tables are unchanged; each subset is priced exactly once.

Verify

Every artifact is cosign-signed with SBOM and SLSA provenance; see docs/security-model.md.

v0.2.5

Durable escalations. No breaking changes.

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.5

Added: durable governance reactions

--webhook alone is best-effort. Add --reactions-db PATH (a store separate from --db) to make reactions crash-surviving: a stop or budget warning runs as a retried rerun workflow off the enforcement path (notify-webhook then run-command-hook), delivered at-least-once and deduplicated per run, and resumed after a restart. --on-event-exec CMD adds a local command hook with event data in LEASH_* env vars.

• leash ships no connectors - the command hook reaches yours. The day leash carries a Jira/Slack connector is the day it stops being small enough to audit.
• This is leash's first use of rerun's execution layer (nine symbols, no new dependency). The reaction workflow, its two sinks, the crash-resume path, and the non-blocking enqueue are all tested.
• One bounded gap at the async enqueue seam is documented (the enforcement path never waits): see ADR-0009.

Runnable demo: examples/demos/09-durable-reactions.sh. Reference command hook: examples/hooks/on-event.sh.

Verify

Every artifact is cosign-signed with SBOM and SLSA provenance; see docs/security-model.md.

v0.2.4

Correctness and craft. No breaking changes.

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.4

Added

• Windows single-governor lock (#25). The SQLite flock guard that stops two serve processes from double-governing a ledger is now enforced on Windows via LockFileEx, exercised on real Windows in CI. Implemented through the standard-library syscall package: no new dependency.
• Contributor documentation: ARCHITECTURE.md (layering, request path, invariants), architecture decision records under docs/adr/, and COMPATIBILITY.md (the stability contract). Plus property-based tests and a ledger fault-injection harness guarding the core invariants.

Fixed

• Idempotent ledger appends (#26). A durable write that commits but returns an error to its caller is no longer re-recorded on retry, so a call cannot be counted twice.

Verify

Every artifact is cosign-signed with SBOM and SLSA provenance; see docs/security-model.md.

v0.2.3

leash v0.2.3 makes every release verifiable. No behavior or config changes.

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.3

Added: a signed release supply chain

All keyless (signer identity is the GitHub Actions workflow via OIDC, recorded in the Rekor transparency log; there is no private key):

• Binaries carry a cosign signature over checksums.txt (checksums.txt.sig + .pem), a CycloneDX SBOM per archive (*.sbom.json), and a SLSA build-provenance attestation.
• The container image is cosign-signed by manifest digest and carries its own build-provenance attestation in GHCR.

Verify a download

# binaries
cosign verify-blob --certificate checksums.txt.pem --signature checksums.txt.sig \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'https://github.com/sylvester-francis/leash/.github/workflows/release.yml@.*' \
  checksums.txt
gh attestation verify leash_0.2.3_linux_amd64.tar.gz --repo sylvester-francis/leash

# image
cosign verify ghcr.io/sylvester-francis/leash:0.2.3 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'https://github.com/sylvester-francis/leash/.github/workflows/docker-publish.yml@.*'
gh attestation verify oci://ghcr.io/sylvester-francis/leash:0.2.3 --repo sylvester-francis/leash

Full detail in docs/security-model.md.

v0.2.2

leash v0.2.2 updates the one dependency, rerun, to v0.2.0 ("correct under failure").

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.2

Changed

• Updated rerun to v0.2.0 and adopted its typed error sentinels: EnsureRun and the append retry now match rerun.ErrRunExists / rerun.ErrSeqConflict with errors.Is, replacing a fragile SQLite error-string heuristic (a resume no longer depends on the wording of a driver error). Existing ledger databases migrate in place via rerun's versioned schema migrations.

No config or behavior changes for users. See the CHANGELOG.

v0.2.1

leash v0.2.1 adds request-level observability on top of v0.2.0.

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.1

Added

• leash_request_duration_seconds histogram, leash_requests_in_flight gauge, and leash_responses_total{code} counters - so a 503 (capacity/draining) is distinguishable from a boundary 429.
• X-Request-Id on every response (a safe incoming id is propagated, otherwise a fresh one is minted), also emitted in a per-request debug log, for correlating a client call with the gateway's logs.

No behavior or config changes; SSE streaming is unaffected. See the CHANGELOG.

v0.2.0

leash v0.2.0 is a security- and integrity-focused release following an adversarial architecture review, now also including soft limits and backpressure. It is the first release to change default behavior - read the migration notes before upgrading.

Container image: docker pull ghcr.io/sylvester-francis/leash:0.2.0

Breaking changes (migration)

• Cost-budget runs fail closed on unmeterable calls. When leash can't price a call under a cost budget, it now refuses instead of forwarding at $0. Restore the old behavior with --on-blind=warn (or allow).
• serve requires a token. It won't start without --auth-token / LEASH_AUTH_TOKEN; pass --insecure for a trusted local socket.
• Runs are tenant-scoped when auth is on. The same X-Loop-Id under two tokens maps to two isolated budgets.
• The rate limit is now transient backpressure, not a terminal stop: a refused call returns Retry-After and the run resumes once its window decays.

Highlights

• Metering integrity - mis-tag and OpenAI Responses no longer metered at $0; client-disconnect can't skip metering.
• Ledger writes fail closed - a write outage refuses further calls; /readyz write-probes; leash_ledger_errors_total.
• --max-cost-per-call, single-governor enforcement (SQLite OS lock), reasoning + prompt-cache pricing fixes, bounded memory.
• Soft limits & alerting - --warn-at early warning, leash_budget_warnings_total, and serve --webhook URL for push alerts.
• Hardening - --max-conns, --auth-token-file, --shutdown-timeout (30s), readiness draining, leash healthcheck + Dockerfile HEALTHCHECK.

Full detail: CHANGELOG. Deferred work is tracked in known-issues and under the roadmap label. Runnable demos in examples/.

v0.1.1

Changelog

• 35cf9ad: Add landing page and GitHub Pages deploy; cut CHANGELOG 0.1.1 (@sylvester-francis)
• 64a92cb: Build leash: durable agent spend governor (@sylvester-francis)
• 402b9b6: Merge production hardening and release engineering (#2) (@sylvester-francis)
• 35891b4: Merge pull request #1 from sylvester-francis/build-leash-app (@sylvester-francis)
• 8e4fe30: Phase 1: harden the request path (@sylvester-francis)
• aba539a: Phase 2: operability (@sylvester-francis)
• 8b5b46b: Phase 3: postgres ledger and active/passive HA (@sylvester-francis)
• c6c5837: Phase 4: warm-path cache with before/after benchmarks (@sylvester-francis)
• 0e3ae77: Phase 5: release engineering (@sylvester-francis)
• 50d0fda: Phase 6: production documentation (@sylvester-francis)