v0.4.0

What's Changed

• chore: release v0.3.0 by @yxshwanth in #29
• fix: CodeQL CI permissions + frame alloc overflow by @yxshwanth in #30
• chore(deps): Bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #31
• docs: tighten architecture Mermaid into a single-column layout by @yxshwanth in #32
• feat: LSM quarantine, fail-closed mode, evidence chain, and Variant B coverage by @yxshwanth in #41
• chore(deps): Bump actions/setup-go from 6 to 7 by @dependabot[bot] in #33
• chore(deps): Bump modernc.org/sqlite from 1.53.0 to 1.54.0 by @dependabot[bot] in #37
• release: v0.4.0 detection depth and INTERLOCK.md by @yxshwanth in #42

Full Changelog: v0.3.0...v0.4.0

v0.3.0

Full Changelog: v0.2.2...v0.3.0

v0.2.2 — Post-v0.2 detection and operability

Summary

Ships the post-v0.2 detection and operability backlog on the usable-tool line.

Highlights

• Async evidence emit (AsyncEvidenceSink, evidence backpressure)
• Variant B payload-backed EXFIL via eBPF write()/sendto() first-256 overlap
• openat + sensitive_paths and DNS (sendto:53) as SUSPICIOUS
• Bounded overlap expansion (depth-2 nests, gzip_base64, same-call JSON reassembly)
• Startup cross-server tool-shadowing detection
• Concurrent HTTP load p99 + eBPF ringbuf DropCount tests

Verify

git fetch --tags
git -c gpg.ssh.allowedSignersFile=allowed_signers tag -v v0.2.2

Full changelog: CHANGELOG.md

v0.2.1 — HTTP overhead benchmarks

Summary

Interlock now publishes deployer-facing HTTP overhead numbers — not just engine microbenchmarks.

Headline: sub-millisecond engine overhead — ~0.5 ms on sensitive reads (typical agent traffic) and ~0.1 ms on sink checks.

Added

• End-to-end HTTP overhead benchmarks (A + C): TestHTTP_OverheadReport_* (p50/p95/p99/p999 histogram), BenchmarkHTTP_EngineDelta_* (engine on vs passthrough)
• make bench-http and CI smoke (OVERHEAD_SAMPLES=100)
• mcphttp.Client.CallDuration for client-perceived latency
• TestHTTP_ConcurrentLoad_KnownGap — concurrent multi-session load deferred (single canonical HTTP load gap)

Changed

• docs/performance.md — leads with engine delta (C), not absolute latency (A); explains taint-ingestion vs overlap delta inversion; secret-count scaling caveat

Removed

• TestBenchmark_FullHTTPLoad_KnownGap — duplicate gap documentation (superseded by TestHTTP_ConcurrentLoad_KnownGap)

Verify

git fetch --tags
git -c gpg.ssh.allowedSignersFile=allowed_signers tag -v v0.2.1

Full changelog: CHANGELOG.md

v0.2.0 — HTTP transport, concurrency, encoded-exfil detection

Interlock v0.2 closes the gap between demo and deployable: real HTTP/SSE transport, multi-session concurrency, and encoding-aware dataflow detection on the proxy plane — with honest scoping on what is still partial.

Headline

• Streamable HTTP/SSE transport (MCP 2025-11-25): inspect-then-forward, session IDs, JSON + SSE responses
• Multi-session concurrency: per-session backend pools, SessionManager, PIDRegistry, eBPF dynamic PID watch/unwatch, race CI
• Encoded exfil detection (Variant A): canonical overlap for base64, hex, URL-encoding, and reversal at taint registration

Also in this release: engine microbenchmarks (make bench, docs/performance.md), opt-in SQLite evidence with max_records retention, event-log backpressure, eBPF ring-buffer drop counter, and docs/v0.2_summary.md.

Honest partials

These are real capabilities with real boundaries — called out in the changelog and README:

1. Performance numbers are engine-component benchmarks, not end-to-end per-request proxy latency. Do not quote ~0.56 ms EvaluateRequest as "Interlock's overhead" — see TestBenchmark_FullHTTPLoad_KnownGap.
2. Variant B is a connect() tripwire, not payload detection. Legs-only SUSPICIOUS at 0.60 until eBPF sendto/write capture lands post-v0.2.

Known limitations

• Value-overlap catches literal + canonical encodings only — not split/compressed/nested
• HTTP multi-session spawns a full backend pool per initialize — bounded by config, but session-flood can exhaust process slots
• Unattributed eBPF events during PID teardown are audit-logged, not tripped
• Default evidence remains append-only JSONL; SQLite retention is opt-in

Verify this release

This tag is signed (SSH). Verify locally:

git tag -v v0.2.0

Signing key fingerprint: SHA256:j0vZxZexFyPA8Hj8ys2NbdMEtyqmZ+kT60eWRdfjlq8 — see SECURITY.md.

Full changelog: CHANGELOG.md

v0.1.0 — Runtime trifecta detection (proof release)

First release — a working proof that runtime trifecta detection works across two observation planes.

Highlights

• Variant A — chained-tool exfil prevented at the MCP proxy (hold-before-forward)
• Variant B — server side-channel detected and contained via eBPF connect() tracing
• Fused evidence timeline with cross-plane timeline_seq ordering
• Self-contained HTML evidence viewer
• Three-pass demo with quiet mode for recordings (make demo-quiet-ebpf)
• 73 tests; CI on every push to main

Quickstart

git clone https://github.com/yxshwanth/Interlock.git
cd Interlock
sudo make demo-quiet-ebpf GO=$(which go)

Known limitations

• Value-overlap is raw-substring matching — misses encoded/obfuscated exfil
• Variant B is SUSPICIOUS at 0.60 confidence — unauthorized connection during a sensitive session, not proven exfiltration
• eBPF containment is kill-after-connect, not first-packet prevention
• STDIO transport only; single session; IPv4 connect() only
• eBPF tested locally (root + BTF), not in CI

Full changelog: CHANGELOG.md
Roadmap: docs/ROADMAP.md