v1.0.2

What's Changed

• fix: remediate fast-uri advisory for v1.0.2 by @tuzuminami in #44

Full Changelog: v1.0.1...v1.0.2

VEIL v1.0.1

VEIL v1.0.1

• Publishes the installable package as a verified GitHub Release artifact.
• Adds tag-to-artifact content verification and a pre-publication fixture gate.
• Enables immutable releases for future VEIL releases.

Install from the attached tuzuminami-veil-1.0.1.tgz; npm registry publishing is not enabled.

VEIL v1.0.0

VEIL v1.0.0 is the first product-level release of the fail-closed policy decision point for AI agent model calls and tool execution.

Highlights

• Typed model_call and tool_call decisions for agent, resource, classification, model, attributes, and cost.
• Tamper-evident decision receipts with deterministic verification.
• AuthZEN Authorization API 1.0-compatible single evaluation.
• OIDC/JWT authentication and trusted PEP assertion scopes.
• PostgreSQL persistence with tenant-scoped, atomic decision and evidence writes.
• Active policy binding and rollback that cannot be bypassed by caller-selected versions.
• Production fail-closed configuration, migrations, runbooks, package checks, dependency audit, and SBOM.

Verification

• Main CI passed on release commit 389068c.
• All 72 tests passed in CI, including PostgreSQL upgrade, rollback, and concurrency integration tests.
• Production dependency audit reported no known vulnerabilities.
• Independent Sol correctness and security reviews reported GO with no release blockers.
• Review issues #6-#12 and #14-#19 were closed through PR #13.

The attached veil-sbom.cdx.json is the CycloneDX SBOM generated by the release commit CI.

Licensed under Apache-2.0.

VEIL 0.1.0

VEIL 0.1.0

Initial public release of VEIL as a fail-closed conversational AI policy decision point.

Highlights

• Fail-closed policy bundle validation, publication, and decision flow.
• Tenant/scope checks, audit evidence, idempotency records, outbox events, and appeals.
• OpenAPI 3.1, JSON Schemas, JavaScript SDK, PostgreSQL migration, and public boundary guard.
• GitHub-standard LICENSE file for Apache-2.0 repository metadata.
• Stable validation error for malformed JSON request bodies.
• Package exports and repository metadata for JavaScript consumers.

Verification

• pnpm run verify
• pnpm pack --dry-run