What shipped, and what we refused to ship.
Both are worth recording. A capability we decided not to build is more useful to you than a capability we described but did not finish.
Release consistency — 0.1.5 ships what 0.1.3 proved
Domain-signal prompt for egress-class denials (once per process, names the rule and destination, points to share.html); package scope restored to @cirvix_ai/agent-control; version surfaces aligned to 0.1.5; verify:package fixed for npm10. Tests: 812 (810 pass / 2 skip), adversarial 417/417, 11,629 corpus — audit and detection unchanged since 0.1.3.
Release pipeline — scope and lockfile on the release line
Fix for the platform-transformation commit that reintroduced the pre-fix @cirvix scope (registry 404) and a stale lockfile that broke npm ci. No engine behavior change; ships the full adapter + command platform from 0.1.3 intact.
Audit-chain signing — the repudiation gap, closed
Every decision record can now be Ed25519-signed. A forged chain with every hash recomputed used to verify clean; now it fails on the signature. cirvix audit verify --keygen writes a publishable public key; the hosted control plane signs its own chain. Honest limit stated in the source: this proves attribution to the key, not to a third party.
The gateway is the authoritative boundary
Unmodeled MCP methods default-deny as mcp.<method>; prompts and completions are evaluated before forwarding; stray notifications are dropped with an audit record. Previously all three forwarded unevaluated.
Hostile-review hardening
No privilege widening on any probed path (200k-pair delegation fuzz clean); escape benchmark 44/44 contained; README repositioned to runtime tool-call authorization with a five-minute quickstart.
ReleaseHardening44/44Control plane, feature-complete and self-hosted
Five-decision execution pipeline, JSON policy rules, hash-linked audit chain, and envelope encryption with a customer-managed master key.
ReleasePolicy engineAudit chaindocs/ became canonical
The published documentation had drifted into describing a product that did not exist — a policy language that was never Cedar, plus init, run, and approve commands that were never implemented. The reference was rebuilt against the actual software, and two real bugs surfaced in the process, including a Python guard that denied every filesystem call by default.
Replay and cirvix why
Decision records became answerable. Replay re-evaluates a past request against the current rule set and is structurally incapable of re-executing the original action.
Audit chainOperabilityOIDC for Google, Entra, and Okta
Identity resolves to (issuer, subject) rather than email, so a reassigned address cannot inherit an existing identity. SAML was deliberately refused rather than partially implemented.
IdentityRefused: SAMLSCIM 2.0
Provisioning and deprovisioning, with the SCIM token kept as a separate credential surface from console keys — enforced by test. Deprovisioning revokes live sessions rather than only removing membership.
SCIMIdentityAdversarial review
An adversarial pass against the control plane found and fixed eight real vulnerabilities, including an admin-to-owner privilege escalation and an unauthenticated denial-of-service path. The findings and the threat model are documented rather than summarized away.
Security8 fixesShared decision core
The gateway was refactored so the SDK and the gateway evaluate through one core and cannot disagree. A shared conformance fixture now holds the Node and Python engines in lockstep — and immediately caught a real path-canonicalization bug on Windows.
NodePythonBug fixGitHub Action and SARIF output
Policy scanning in CI with stable SARIF fingerprints, so a dismissed finding stays dismissed across runs. A packaging bug that omitted src from the published action was fixed.
Evidence reports
SOC 2 and ISO 27001 evidence generation. No report can claim compliance — the coverage vocabulary has no word for “pass”, and a test enforces that. Out-of-scope controls are listed on purpose rather than omitted.
EvidenceNever claims complianceBring every agent
under control.
Set durable policy, preserve a verifiable record, and give teams a safer way to put intelligent systems to work.