AgentProvenance

 verifiable agent observabilityDemos Documentation
Demos/Documentation

Changelog

English | 中文

v0.10.0 - 2026-10-19

Added

  • A signed investigation-and-repair demo follows one real DeepSeek session and its subagents across two runs, with tests, AppArmor/seccomp decisions, file changes, search, comparison and selected offline sharing. Named demos load companion captures together. The Linux capture runner verifies independent import.

  • Dashboard access-control entries separate saved audits, task state, configuration and collection observations. Audit detail keeps attempts, mechanism decisions and actual outcomes side by side; comparison gains an access-control view. Online and offline readers use the same evidence APIs.

  • Session-scoped search, event lists and graph focus include uniquely matched audit decisions through existing tool/runtime evidence. Derived membership is labeled separately; conflicting or unmatched decisions remain at run scope. Selected replays freeze that membership and withhold excluded supporting references, without changing original audit identities.

  • The comparison API projects access-control declarations, state snapshots, audit decisions, collection observations and runtime outcomes as distinct observed sets with original reader references. PID and timestamp changes do not create value differences; sources retain their original reader links.

  • Follow existing audit text or journal JSON files with telemetry follow-audit. Bounded batches commit evidence and source checkpoints together, resume after interruption, preserve partial lines, and report source replacement or truncation. Collection observations use the existing telemetry and signed Bundle paths; machine output stays English and raw-record retention stays fixed.

  • Observe AppArmor labels and seccomp mode/filter counts with independent, default-on native sensor state readers. Timestamped procfs snapshots retain their own thread identity; bounded sampling reports queue loss. K8s informer observations append structured and legacy configuration declarations without rewriting historical Pod metadata. These records remain separate from audit decisions and syscall outcomes and survive signed Bundle roundtrips.

  • Query audit associations through the daemon and Dashboard read APIs, remote CLI, Python SDK and AI/MCP tools, with strict pagination and explicit errors. Fresh offline replays preserve frozen candidates; partial exports withhold inferences whose evidence was excluded. API fields, statuses and generated errors stay English across locales. The Python HTTP client supports the existing daemon token and rejects redirects.

  • Inspect audit-to-runtime candidates with telemetry audit-associations. The read-only projection separates process and operation associations, keeps ambiguous candidates, and cites attempts, actual returns and process exits. Native events now retain source machine identity and coarse-clock resolution; association uses these with boot and task lifetimes, including audit timestamp precision. Late evidence is re-evaluated without rewriting original records.

  • Read existing AppArmor and seccomp audit text or journal JSON with telemetry ingest-audit. Keep ABI-specific decisions and original references, bound transactional batches, deduplicate by source host/boot and record identity, and honor run-fixed raw-record retention. Signed bundles preserve the records; importing them does not change host policy or guess Agent-session ownership.

  • Native open/connect return observations retain actual results and a shared operation ID with the entry record. Bounded per-thread state guards against reuse; asynchronous connect and restart results keep their distinct meanings. Outcome observations do not repeat attempt-level risk decisions.

  • Launch records its kernel sensor, workspace snapshot, full TLS body and agent context options before capture starts. The Dashboard shows these independently from context retention, and signed bundles and selected replay copies preserve the recorded values. Older runs show unrecorded settings explicitly.

  • Dashboard session, search, comparison and replay views now explain recorded context-retention settings. Configured omissions are separate from unavailable content, and frozen export inventories retain the source run's preset.

  • Choose additional-context retention with launch --capture basic|detailed and context import --capture basic|detailed. Detailed remains the default; --capture-tool-results provides a focused override. Run settings are fixed before launch, and Claude hook logs apply retention and redaction before bounded, serialized writes. Kernel/TLS and workspace capture remain independent.

  • Export a complete local run with dashboard export --run RUN --output replay.zip. The unsigned, single-run archive opens directly offline, with the existing graph, session and saved-content readers, a frozen file inventory and no original database or Bundle. By default, the command includes all saved run content. A separate record manifest lists included source IDs, categories and revisions from the same frozen snapshot as the replay.

  • Limit CLI, Dashboard or local API replay exports to a native session, or exclude records and categories. The frozen selection applies to graph, search, raw and body readers, including historical revisions. Cross-boundary references and omitted analyses remain visible; partial copies carry a selected-evidence label.

  • Prepare and inspect a frozen replay from the Dashboard before downloading its ZIP. Explicit scope confirmation, saved-source counts, exact file inventory and archive size accompany the existing reader. Local previews are bounded, expire automatically and are cleaned up on normal server shutdown.

  • Choose the whole run or current session, include categories and review individual records with the existing body reader before exporting. The frozen preview reports actual included/excluded counts, linked exclusions and repeated-content warnings; changing the selection retires the previous preview.

  • Compare two runs in a temporary Dashboard window, with configuration fields, file evidence, network destinations and outbound data types. Keep recorded task and capture context visible, preserve typed missing values, and link each side to saved content and graph evidence. Fresh public-demo exports use the same paged comparison records and reader.

  • Search saved messages, tool inputs/results, configuration, file bodies and runtime records in a temporary Dashboard window. Search stays within the current run or selected native session, with highlighted excerpts, paged reading, source references, cancellation and graph navigation with return. Public-demo exports include the same saved-content search catalog and reader.

Changed

  • Keep a visible Related sessions button in the run overview and beside every native session. Open the selected session's relationships directly, load evidence on demand, and retain the graph and keyboard focus on return.
  • Clarify the separate audit-reader workflow and seccomp logged action data. Controlled Linux checks now cover mixed AppArmor/seccomp decisions, logged ERRNO, ordinary permission failures, and signed/offline replay under both retention presets.
  • Local database schema 20 adds audit reader checkpoints. Back up the data directory before upgrading; reader checkpoints are local operational state and are not imported from evidence Bundles.
  • Context evidence can record a versioned, run-fixed retention policy and distinguish configured omissions from capture failures. The storage layer retains a compact, source-linked Claude intent projection when original records are omitted; signed bundles and selected replay exports preserve its retention and sharing boundaries.
  • Session directories show cross-run occurrences, recorded parent relationships, and typed Codex delegation, fork and message requests with source references. Related-session navigation restores the prior graph and reader on return; static exports confine relationship discovery to their selected run catalog.
  • Keep the graph and risk list in place while combining node summaries, related events and saved content in one below-graph reader. Auxiliary sections start collapsed with counts; existing content paging and enlarged reading remain.
  • Add a session/source directory based on recorded harness and native session identities, with parent references, conflict labels and exact-source context navigation. Processing diagnostics remain separate from native sessions.
  • Include the reader and session directory in public-demo static exports.
  • Filter graphs, linked events and conversation by recorded native session. Calculate summaries within that scope, preserve inferred-edge confidence, and restore the previous view when returning to the whole run. Risk and auxiliary sections state their whole-run scope. Static replay uses the same projections; context queries support namespaced harness/session filters.

Fixed

  • Audit association rule v2 excludes seccomp-blocked calls from executed syscall candidates and keeps mediated calls unknown without mediation evidence. LOG and AppArmor retain time-window candidates with explicit provenance; historical offline replays preserve their recorded rule version.

  • Basic Codex capture preserves typed fork-session metadata without retaining configuration bodies, including signed export/import and selective replay.

  • Run comparison treats unscanned ranges as unknown instead of reporting false one-sided differences, with scanned counts and distinct truncation reasons.

  • Offline export enumerates all retained sessions independently of the overview's 256-source display limit and reconciles graph, event and search indexes before delivery. Cancellation and resource limits return explicit errors.

  • Static session replay handles sessions without attributed runtime nodes. Demo Run and comparison selectors display readable, localized names while preserving original evidence IDs.

  • Run comparison shows readable task text from the current main session. A missing body now affects its own source records, while known values from unrelated sources remain comparable. Saved file changes and audit decisions appear before lower-level observations.

  • Portable exports include required provenance objects up to 16 MiB, separately from the 4 MiB snapshot-file cap. Larger required objects fail export explicitly instead of producing a replay with missing graph objects.

  • Record-manifest verification applies the same redaction as materialization, avoiding false mismatches for credential-variable expressions while still detecting command changes.

  • Audit CLI failures and AI tool diagnostics keep English machine-facing errors without appending localized usage text. JSON audit readers also keep daemon warnings in English; explicit help and ordinary terminal output remain localized. End-to-end checks cover real CLI, HTTP, Python SDK and MCP processes with both retention presets, pagination and original-language evidence.

  • Keep recorded host identity alongside boot/PID/start across native lifecycle bindings, Hook attribution, TLS exchanges, model-command links and process graphs. Missing execs, reused parent PIDs and unrelated exits no longer reuse a prior process owner. Numeric-only exits leave native lifetime anchors intact. New graph and derivation versions preserve historical signed graph semantics; process-focused queries and replay retain the same evidence references.

  • Verify unassociated telemetry without requiring a fabricated execution binding; positive-confidence associations still require binding evidence.

  • Separate native thread identity from the process TGID, retain exit signals, and keep a process association open when its leader exits before its workers. Close the process lifetime when no live thread remains. Preserve these fields through ingestion and signed bundles; add controlled Linux outcome tests.

  • Capture OpenSSL exports from a bounded dynamic symbol table when a large unused ordinary string table prevents full symbol inspection, including current Node.js binaries. Attach with validated executable-file offsets and retain the existing metadata limits.

  • Reserve the SQLite writer before reading context-retention settings, so live telemetry cannot invalidate a context import's read snapshot. Context records and diagnostics remain atomic, including when a commit fails.

  • Ignore obsolete focused-event and timeline responses after selection changes. New evidence selections clear previous rows while loading; failed requests show an unavailable result and an unknown count.

  • Replace endpoint capture projections atomically, including payload objects, events, policy decisions and signals. Missing bodies, malformed metadata and failed writes retain the previous graph; retries replace owned policy counters.

  • Commit intent diffs, their graph edges, signals and any new tool attribution together. Unreadable model evidence aborts reanalysis; repeated analysis keeps peer-message contract identities stable.

  • Replace policy replay results in one transaction, preserving the previous decisions and session state on failure and removing stale counter projections.

  • Discard database connections after failed reanalysis commits so an unfinished SQLite transaction cannot leak into subsequent requests. Reuse unchanged content-addressed objects and stage replacements before renaming them.

  • Avoid schema writes when opening an up-to-date store. Process native spool files in short transactions, retry transient SQLite contention, and preserve committed row receipts across interruptions so capture and investigation can share the store. Seal batches independently of replay and refresh queue priorities after each batch to avoid delaying new evidence behind retries.

  • Reject malformed transcript rows before replacing derived evidence, retaining the previous graph and reporting the source line.

  • Recheck current evidence in Dashboard overviews, including imported runs, instead of reusing results based on event/object counts or bundle metadata.

  • Keep unknown substrate confidence absent and preserve historical process-view projections in the six pinned v0.8.2 demo bundles.

  • Match live OpenSSL test fixtures by their captured kernel PID so lifecycle checks also work across WSL PID namespaces.

  • Preserve explicit zero confidence in scope bindings, process-lifetime inheritance and unified signals. Omitted inputs retain source defaults; invalid numeric values are rejected. Graph views distinguish unknown confidence from zero, including read-only replay and signed bundle roundtrips.

  • Propagate verification database failures instead of reporting missing evidence. CLI JSON and the daemon API expose status: unavailable with the failure reason; the API returns HTTP 503. Dashboard verification errors are shown separately. Overview checks use the current database and object contents.

  • Separate cgroup/container scope attribution from tool-call and application- process attribution. Process matches use captured time and compatible scope keys; parent PIDs no longer borrow a child binding's tool identity.

  • Preserve common context and bounded candidate diagnostics for overlapping bindings instead of choosing the most recently started call. Correlation reports retain the recorded ambiguity after subsequent binding changes.

  • Prevent ambiguous scope matches from seeding native process-lifetime anchors. Historical events and signed bundles retain their recorded metadata.

  • Match model decisions to subsequent exec records using complete argument boundaries, a two-minute window and compatible capture scope. Conflicting decisions or executions stay unlinked; truncated commands and process samples no longer supply command-execution anchors.

  • Link transcript decisions through recorded tool-use IDs and current direct tool-to-exec associations. Preserve source timestamps and identities, and expose new model-execution links as versioned inferences with evidence refs.

  • Replace TLS/transcript analysis atomically so read or write failures preserve the last stored graph. Endpoint imports retain upload and policy evidence without attributing uploads to the nearest chat call.

  • Preserve native process lifetimes in new runtime graph nodes, parent/thread references, labels and inferred data flows. Reused PIDs and different kernel boots remain separate; records without a usable lifetime use event-local process observations. Existing signed graphs keep their original identifiers.

  • Keep process-focused event queries, pagination and static replay tied to graph identities. Verification checks new process edges against their source events; signed export/import preserves the same identities and relationships.

  • Preserve parsed HTTP/1.x and HTTP/2 metadata from TLS capture through ingestion and signed export/import, including HTTP/2 stream IDs. Reassembled bodies are no longer reinterpreted as HTTP headers. Endpoint metadata omits URL credentials, query strings and fragments; arbitrary headers remain outside the allow-list.

  • Pair OpenSSL read entry/return probes by thread and task lifetime instead of process ID. Bounded per-thread stacks preserve nested calls, validate returned lengths and clear abandoned contexts on thread exit or successful exec. Stack overflow and invalid output pointers contribute to capture-loss diagnostics. Regenerate both sensor architectures and add live nesting, cleanup and 32-thread byte-for-byte tests.

  • Isolate OpenSSL HTTP/HPACK state by process lifetime and kernel-stamped capture generation. Object reuse, clear/rebind and delayed reads cannot inherit a prior generation's buffers or dynamic header table. Retain optional connection IDs through ingestion and signed bundles, and report discarded partial state. Remove implicit response completion on the next request; preserve same- generation HTTP/2 multiplexing and keepalive. Add real OpenSSL lifecycle tests.

  • Replace nearest-request TLS associations with versioned connection/stream pairing. HTTP/1 serial inference rejects overlapping, truncated or ambiguous sequences and recorded capture gaps; HTTP/2 multiplexing uses stream identity. Preserve unknown/ambiguous assessments alongside optional message bodies.

  • Stop generating temporal response-to-syscall causal edges during ingestion. TLS reanalysis withdraws invalidated pairs atomically, preserves transcript and endpoint objects, and carries pairing diagnostics through signed replay.

v0.9.0 - 2026-10-09

Recorded agent sessions, configuration history, and portable full-text evidence. Release notes: v0.9.0.

Added

  • A complete read-only online demo, bilingual user guides and demo export. Static replay uses the existing Dashboard and preserves graph, session, file-content and evidence navigation. Releases validate and deploy the same website artifact alongside the portable CLI archives.

  • Common context capture for Claude Code and Codex, with messages, tool inputs and outcomes, source-provided task, approval and configuration records. Native DeepSeek Harness 0.1.7-rc.2 v4 Zstandard transcripts use the same path; explicitly supported v3 transcripts and existing Kimi/Grok formats remain readable.

  • Session discovery, explicit source selection, verified resume boundaries, recorded child identities, revisions, and source-scoped coverage reports. Ambiguous selection does not attach a guessed conversation to a run.

  • context CLI commands and versioned HTTP queries for entries, saved content, configuration comparison, coverage, and recorded graph links.

  • A collapsible bilingual Agent session section, graph/session navigation, configuration history, and an independent paged saved-content viewer.

  • A signed real DeepSeek development-task replay, available through agentprov demo deepseek-context without a provider account or network access.

  • Opt-in final changed-file text with launch --file-diff, and per-run context, native-capture, artifact and correlation diagnostics.

Changed

  • Large context, file and peer-message bodies use bounded content chunks that survive offline export/import without increasing the existing per-object bundle limit. Original source records remain separately inspectable.
  • Launch reports configured capture at startup and observed coverage at exit. Hook and transcript parsing share input/record budgets across selected sources.
  • Runtime presentation separates probe/TLS coverage from capture-integrity diagnostics; node-level drops and pending batches retain their own scope.
  • Schema 19 preserves within-line source order. Historical context is retained separately from current execution and cannot authorize or seed new activity.

Fixed

  • Regenerate the committed amd64 probe after the child birth-cgroup fix; require real clone3/cgroup migration and durable attribution in amd64 CI.

  • Keep review branches in validation/build mode, and check release notes before building. Historical compatibility CI uses pinned v0.8.2 native binaries.

  • Consume complete readiness logs so a successful match cannot fail deployment through SIGPIPE on a busy KVM/K3s node.

  • Recognize native Codex provider and permission-profile fields in configuration coverage without inferring missing restrictions or rewriting historical reports.

  • Return 404 for unknown Dashboard paths instead of silently displaying a run; demo guides remain served by agentprov demo.

  • Compare TLS overlay backing files by device/inode identity in Linux tests, accepting /proc/1/root aliases while rejecting unrelated and shadowed files.

  • Retain newer Claude native attachments/session state and Codex completed messages, command/file-change reports and resumed thread settings, preserving source identity without treating execution reports as model proposals.

  • Prevent configuration changes, source-message variants, typed tool failures, completion-only dispatches and late results from losing their source semantics.

  • Preserve native argument boundaries and process-lifetime attribution limits; ambiguous runtime associations remain unresolved.

  • Anchor native process lifetimes with boot ID, PID and kernel birth time; preserve kernel capture timestamps and process-scoped attribution across cgroup migration. Fork events report the child's actual birth cgroup, including clone3(CLONE_INTO_CGROUP).

  • Reduce short-lived child sampling gaps by starting record process sampling before post-launch store writes.

  • Bound native shutdown draining and retain unresolved spool rows for their original TTL; shutdown does not discard pending evidence to report a clean queue.

  • Export telemetry batch membership with its stored hashes so offline replay can retain the batch verification available in the source store.

Compatibility

  • The six historical signed demo bundles, attestations and public keys are unchanged. Missing historical context remains legacy_not_recorded.
  • Signature validity, graph integrity and capture completeness remain separate results. Transcript capture is not a guarantee of TLS or kernel coverage.
  • External LLM/Jev evaluators remain optional and outside the capture path.

v0.8.2 - 2026-09-26

Portable replay and Chinese documentation and web interfaces. Release notes: v0.8.2.

Added

  • Linux/macOS amd64/arm64 archives with checksums, build metadata, all demo sources and bilingual getting-started guides. No Go installation is needed for replay.
  • One-command gallery and guide reader for six signed captures and two optional evaluator examples, using the dashboard theme.
  • Chinese dashboard, demo pages, evaluator workbench, documentation, API and SDK guides, diagrams and recorded replay clips.
  • CI checks for Chinese document coverage, links, UI resources and OpenAPI contract parity; four-platform archive acceptance covers bilingual guides.

Changed

  • Web pages follow the browser on first visit and remember a manual choice. English remains the fallback and the default for CLI and tool output; existing --lang zh-CN support is optional.
  • Language changes preserve navigation and workbench drafts. Original evidence and protocol values remain unchanged.

Fixed

  • Quoted the health response description so YAML parsers preserve its commas as text instead of treating them as extra response fields.

v0.8.2-rc.2 - 2026-09-26

Prerelease: dashboard-styled demo gallery and formatted local guides. Release notes: v0.8.2-rc.2.

Changed

  • Gallery and guide reader share the dashboard theme, with responsive layouts, section navigation, tables, embedded images and copyable code blocks.
  • English/Chinese introductions, all demo entry points, product/deployment guides, screenshots and packaged instructions describe the portable workflow.
  • Native archive acceptance checks all eight guide entries and reader assets.

v0.8.2-rc.1 - 2026-09-26

Prerelease: portable CLI and all-demo replay. Release notes: v0.8.2-rc.1.

Added

  • Precompiled Linux/macOS amd64/arm64 archives, individual and aggregate SHA-256 checksums, source/build metadata and agentprov --version.
  • agentprov demo embeds six signed captures and two optional evaluator guides, verifies evidence before replay and uses an isolated temporary store.
  • Four-platform native archive gates exercise the downloaded experience without Go on PATH. All original example sources accompany the CLI.

v0.8.1 - 2026-09-22

Optional external-evaluator reference integration in demo/jev-judge/. Release notes: v0.8.1. Existing evidence and signal interfaces are unchanged; no new core module or runtime dependency.

Added

  • Jev reference adapter. A bounded TypeSafe/Jev client evaluates selected declarations, runtime conformance and secret-transfer evidence, preserving raw request/response bodies, probabilities, model identity and hashes.
  • Standalone demo UI. A separately launched workbench compares manually authored v1/v2 rubrics, records separate reference labels and approval or rejection, and exports reviewed signals for explicit import through the existing contract. It is not embedded in the main evidence dashboard.
  • Demo review boundaries. A fixed missing-runtime coverage guard, per-question regression checks, append-only local review revisions and stale approval invalidation. No optimizer, automatic promotion or enforcement.
  • Keyless regression tests for the optional demo, plus dated live API and local browser validation documented separately from CI.

v0.8.0 - 2026-09-20

Portable, reliable native evidence capture across Linux, KVM guests and Kubernetes, with a replay-first introduction. Detailed validation and limits: v0.8.0 release notes.

Added

  • Native Linux amd64 sensor. Separate architecture-selected eBPF objects, amd64 C and Go ABI handling, legacy open/unlink probes, kernel capture time, and live syscall/OpenSSL/Go TLS acceptance. Existing ARM64 bindings are retained.
  • KVM guest and K3s deployment. In-guest systemd collection and node-local attribution, with recorded multi-workload, semantic parity, restart, normal reboot, export/import and schema-upgrade gates. KVM uses local-record.
  • Automatic container TLS discovery. Visible process/rootfs discovery, shared-library deduplication and target lifecycle reconciliation. Supported amd64 Go 1.23-1.26 binaries add response/read capture using decoded return sites and goroutine/frame pairing; stripped and unsupported targets report gaps.
  • Persistent native stream. Bounded durable batches, late-binding retries, interrupted-batch recovery, transactional deduplication and loss/backlog reporting for sensor stream.
  • Readiness contract. /v1/live is separate from database/schema readiness. Storage failures return 503 and unknown queue counts are null; historical capture loss is reported without falsely declaring a usable store unavailable.
  • Regression gates. Frozen-schema upgrade tests, real HTTP readiness faults, amd64 live Go 1.23-1.26 tests, and static Linux amd64/arm64 builds.

Fixed

  • Correlation compares actual instants across fractional precision and timezone offsets, sees binding changes inside the current transaction, and preserves capture time for queued events. Record publishes its binding before launch.
  • Shared ingest atomically writes events, edges, evidence and related state; errors propagate instead of leaving partial records. JSONL row savepoints isolate failed events while allowing valid rows in the batch to commit.
  • CPU sample retention compares parsed instants, orders sub-second samples correctly and rolls back the retention pass on invalid timestamps.
  • Health OpenAPI 3.1 definitions use explicit integer/null unions, checked against healthy and unavailable-store HTTP responses.
  • Native recovery retains missing-file diagnostics, rejects unreplayable oversized rows, and defers failed payload cleanup without blocking restart.

Changed

  • English and Chinese READMEs now start with a signed-bundle replay, followed by live capture. Docker is not a prerequisite for replay or local record, and launch signing is explicitly opt-in. Existing real demos and images remain.
  • Capability descriptions, architecture SVG, demo index, runbooks and closeout criteria reflect KVM and current TLS coverage. Older roadmap notes are marked historical rather than presented as the current implementation checklist.
  • Falco-specific spool restart recovery is unchanged. Shared ingestion fixes apply to it; native stream recovery guarantees must not be inferred for it.

v0.7.2 - 2026-08-05

Evidence collection and investigation hardening. This release turns the Kubernetes producer from a capture preview into a measured, lifecycle-aware node profile, adds bounded high-volume ingest, and makes outbound data movement queryable as evidence rather than a dashboard-specific special case.

Added

  • Lifecycle-aware Kubernetes attribution. A filtered client-go informer maps Pod/container lifecycle to kernel cgroup bindings, including container restart and Pod deletion. One privileged node sensor can observe multiple independent workloads without modifying workload Pods.
  • True local/Kubernetes semantic parity gate. The same id + ls / workload now runs through active local-record and passive k8s-daemonset capture. Both evidence graphs verify with zero errors/warnings and share the canonical execve -> runtime_process -> runtime_event semantics while preserving their different scope-confidence tiers.
  • Bounded telemetry ingest. The daemon spool enforces batch-count, total-byte, and per-batch limits with explicit reject/drop behavior and producer-health counters. A checked 100k-event report records throughput, query/health latency, memory, queue state, drops, and correlation coverage.
  • Outbound Data Surfaces. Endpoint capture, normalized egress evidence, intent divergence, risk/response links, and generic dashboard investigation cards cover sensitive context egress, source bundle upload attempts, and behavioral telemetry sent to third-party services.
  • Grok CLI evidence scenario. A replayable demo captures and distinguishes secret-to-model context flow, codebase upload behavior, and product telemetry as three separate outbound surfaces.

Changed

  • Producer capabilities are validation-gated. Profiles now report validated or planned. microvm-guest-init remains discoverable but reports no coverage and zero confidence until a guest runner and live KVM acceptance exist; local and Kubernetes profiles are validated. agentprov sandbox profiles --json exposes the machine-readable capability report.
  • Passive runtime causality is complete. PID-derived runtime process nodes now connect to their runtime events even when no application-level process ID exists, which is required for zero-SDK Kubernetes capture.
  • Central service remains design-only. This release proves a bounded single-node producer and documents the scale-out boundary; it does not claim a multi-tenant control plane.

v0.7.1 - 2026-07-09

Zero-touch k8s attribution and multi-harness app-context. Capturing a pod is now one command (or auto), egress resolves to domains, node-side response capture is reliable, and the app-context layer — previously Claude Code only — reads the session transcripts of Kimi Code and Codex too, all validated end-to-end.

Added

  • agentprov sandbox capture — one-shot k8s pod attribution. Collapses the manual node-side flow (resolve pid/cgroup, pull pod metadata, bind-cgroup, run the sensor, ingest) into a single command; --container pins to a named container in a multi-container pod. Points the sensor's libssl/libc uprobes at the pod's own /proc/<pid>/root, so model intent and DNS are captured node-side.
  • agentprov sandbox watch — auto-attribution (phase-2 preview). A node-side control loop that discovers pods and binds each to a run with no per-pod command (agentprov.io/run annotation opts into a named run, else an auto-run per UID). Honestly a kubectl poll, not yet a client-go informer; a single per-round sensor means model-intent coverage is weaker than capture (use capture for that).
  • Egress resolves to domains. Pointing the getaddrinfo uprobe at a pod's own libc captures its DNS lookups; the dashboard correlates each dns_query hostname to the connect that follows, so egress shows api.deepseek.com, not just the IP.
  • Multi-harness app-context (hooks bridge --harness kimi|codex|claude). The major coding CLIs aren't black boxes — they write rich session transcripts, and some reuse Claude Code's hook vocabulary. A thin per-harness adapter normalizes each transcript into the existing bridge: Kimi Code's wire.jsonl (single- and multi-agent delegation, merged into one wall-clock timeline) and Codex's rollout-*.jsonl (its exec_command shell tool normalized to Bash for command-match). All three harnesses validated end-to-end against a live run.

Fixed

  • Node-side tls_read reliability. Close-framed HTTP responses had no in-band terminator, so on a reused SSL* connection they stayed buffered and were lost on a long-lived workload; a new request now flushes the pending response. Node-side tls_read went 0 → 1:1 with tls_write. Partial TLS-uprobe attach is surfaced.

v0.7.0 - 2026-07-08

Portable Producer Profiles. Evidence collection extends from local/VM to Kubernetes pods with the same guarantees — without changing the core graph or the schema. The core stays substrate-agnostic: it reads the normalized telemetry schema out of SQLite, and substrate never reaches it. Producers differ only in where the sensor runs, how scope is attributed, how events ship, and which layers they can honestly collect. One node sensor can now observe multiple pod cgroups and pin each to its own signed run. The microVM guest profile is declared as capability data and marked in progress.

Added

  • Producer Profile abstraction (internal/producer/profile.go). A profile declares sensor placement, scope mode, and — as first-class capability data — the coverage of each of the three collection layers (system telemetry / model intent / app context), so a degraded layer is honest data, not a hidden gap. Ships local-record, k8s-daemonset, and microvm-guest-init (the last a capability declaration; runner/guest-image integration is in progress).
  • k8s-daemonset scope attribution. agentprov sandbox bind-cgroup binds a pod's node-observed cgroup to a run as a passive k8s_cgroup scope (confidence 0.8, vs record's kernel-verified 1.0), with optional pod-metadata enrichment (cluster / node / namespace / pod / container / image / service-account / pod-ip / labels) recorded as a context event — no schema change, no client-go informer required.
  • Substrate lens (dashboard + graph lens --lens substrate). Renders the producer topology: profile → node sensor → workload → per-pod cgroup → scope → run, plus a pod_influences_pod edge when one pod's egress targets another pod's IP (a real cross-pod A2A call as kernel ground truth). A run-overview producer-profile bar surfaces evidence source / scope source / confidence.
  • Node-side model intent for pods. The libssl uprobe attaches by inode, so pointing it at a pod's own /proc/<pid>/root/.../libssl.so.3 captures the pod's TLS request/response bodies from the node with no image change. Python's module-loaded OpenSSL (_ssl.so) is auto-detected.
  • Parity acceptance (scripts/accept_k8s_pod_parity.sh). Asserts a node-observed pod's telemetry attributes to a run and verifies clean (errors=0) — the same evidence guarantee as local-record, for an externally-scheduled pod never wrapped by record.

Changed

  • File nodes for passive (absolute-path) writes. Graph file nodes previously came only from record's workspace diff (workspace-relative paths). A passive, node-side capture has no workspace diff, so its file writes — all absolute — produced no file node. Ingest now links substantive absolute paths (filtering /dev/null, /proc, /sys, sockets, pipes) to workspace_file/<abspath> nodes, so passive file activity is first-class in the file, raw, and taint lenses, joined to the writing process.

Demo

  • demo/k8s-substrate/ — the k8s-daemonset profile end to end: a real LLM agent pod captured node-side (system telemetry + model intent), attributed by cgroup. Ships a signed, replayable bundle (run-claude-demo).
  • demo/k8s-cross-pod-a2a/ — the multi-agent attacker arc across a pod boundary: alice (pod A) influences bob (pod B) over a real A2A network call; one node sensor pins bob's secret-read → staged-file → metadata-IP exfil to his cgroup while alice stays provably clean; both cgroups bind to one signed run. Ships a signed, replayable bundle (run-a2a-demo).

v0.6.0 - 2026-07-06

One-command capture and an intent-conformance layer. agentprov launch -- <agent> wraps any agent in a full provenance run with a single command, and the model- intent layer moves from "which command did the model run" to contract-vs-effect: what each action DECLARED it would do versus what the runtime ACTUALLY did, with boundary violations, refusal bypasses, and honest coverage gaps as first-class verdicts. The agent's real prompt and reasoning are harvested from the session transcript with zero instrumentation.

Added

  • agentprov launch -- <agent> (internal/launch). One command does the whole run: create a run scope, serve the live dashboard, inject a per-run Claude Code hooks overlay via --settings (the user's ~/.claude is never modified), start the kernel sensor when the host can (else degrade honestly), exec the agent in a dedicated cgroup, then seal + sign the evidence graph and print a one-line verdict. Evidence level is printed up front on two honest axes — application side (hooks / transcript vs record-only) and system side (kernel telemetry vs none). A hidden internal command group begins the git-style porcelain/plumbing split.
  • agentprov doctor -- <agent> launch preflight. The same readiness checks launch prints can now run without starting the agent: agent binary, Claude hook-injection compatibility, dashboard port availability, cgroup v2 scope support, and kernel sensor capability. Warnings are explicit degradation reasons rather than hidden failures; --json gives install scripts a stable machine-readable report.
  • Intent-Runtime Diff conformance engine (internal/intent, agentprov intent diff). Reconciles each captured IntentContract (a tool call, peer message, or refusal, each declaring the effects it should and must not produce) against the RuntimeEffects attributed to its scope. Verdicts: declared_vs_effect_mismatch (a boundary violation, e.g. an install that read a foreign secret), refused_but_runtime_happened, decided_and_executed, and the honesty state intent_coverage_gap (an effect it could not tie to captured intent is a gap, never a fabricated finding). Effects are classified through the existing policy engine (a foreign-secret read vs the agent's own creds), and the finding is conditional on each action's declared contract — a network connect is drift for a read-only tool but permitted for bash. Results feed a new intent_conformance dimension in the unified signal model and flip the launch verdict; peer_message_intent_mismatch marks a violation whose intent came from another agent's message.
  • Transcript harvest. The Claude Code session transcript (the JSONL a hook's stdin points at) is ingested into the same llm_call graph model TLS capture feeds — the model's real prompt, reasoning, and tool decisions — with zero instrumentation and on any platform. Renders through the existing agent-intent flow with no lens change.
  • Conformance ("Intent · declared vs actual") graph lens. Renders each contract's scope → the diff verdict → the observed effects, colored by status, alongside the delegation (主从) and peer (对等) agent structure.

Changed

  • Agent-intent DAG collapses the caused fan-out. A model response that causes hundreds of syscalls now aggregates into a single "caused N syscalls" summary node above a threshold, so the prompt→decision→action spine stays legible (individual syscalls remain in the process / security lenses).
  • Demos re-captured with launch. The snake supply-chain and multi-agent team bundles are freshly captured through the one-command flow; both now carry the transcript (cognitive) axis and surface a real conformance mismatch — the poisoned install's secret-read + metadata-egress is flagged as an install operation exceeding its declared contract, attributed to the acting sub-agent.

LLM-intent provenance: the sensor now captures the agent's actual LLM traffic as full TLS plaintext, reassembles and parses it, and materializes it into the signed graph — so the DAG can answer "which model call caused this syscall, and did the command that ran match what the model decided?" The agent-intent lens is rebuilt as a causal DAG over real evidence nodes, and a new llm-judge demo has an external LLM render an audited verdict over the full trajectory.

Added

  • Full TLS body capture (internal/sensor). The SSL_write/SSL_read uprobes now emit the complete plaintext as ordered chunks keyed by TLS connection and direction (previously hash + bounded metadata only).
  • TLS reassembly + LLM semantics (internal/tlsintent). Userspace accumulates the sensor's chunks into COMPLETE HTTP/1.1 messages (Content-Length, chunked, and SSE streaming bodies; HTTP/2 is detected via the client preface and passed through raw, never mis-parsed) and parses minimal LLM semantics tolerant across Anthropic Messages / OpenAI Chat Completions shapes: model, message count, system-prompt presence, tools offered, tool calls + the shell commands the model decided to run, stop reason. Platform-neutral (no eBPF deps), unit-tested off-Linux.
  • LLM calls in the signed graph (graph materialize-llm, internal/provenance.MaterializeLLMCalls). Each captured body is objectified as a content-addressed llm_message; each request/response pair becomes a first-class llm_call node with llm_request / llm_response / llm_body edges. Idempotent; covered by graph verify and scripts/accept_llm_intent_causality.sh.
  • llm_caused scoped to the decided command. The causality edge from an llm_call to a syscall is drawn only when the executed command matches a tool_command from the model's response — not to everything that happened after the call — so "the model told it to" stays narrow and defensible. The legacy ingest-time llm_intent_caused edge is no longer rendered (superseded by the materialized llm_caused).
  • Agent-intent lens is now a causal DAG. The stage-card renderer is dropped; the view is a DAG over real evidence nodes — llm_call → decided command → process → runtime events → risk — with blocked/refused intents shown as first-class nodes, grouped by the agent that proposed them. Run Overview tool-call / LLM-intent entries drill down into it.
  • Dashboard: LLM lifecycle spine + readability. summary shows only the LLM lifecycle route when a captured model call exists (the send-msg step tracks orchestrator delegation); readable execve labels; content previews on tool_call/event nodes; sticky expand; node labels clipped inside their boxes.
  • llm-judge demo (demo/llm-judge/judge.py, Stage 3). A single-file, stdlib-only Python judge reads a captured run's FULL trajectory through the generic contract surfaces (EvalContext, ai tools, graph lenses — no event-type filter, chunked map-reduce past the context budget, coverage recorded), has any Anthropic/OpenAI-protocol LLM produce a structured verdict (agentprovenance.llm_judge/v1), and imports it back as graph-referenced signals. The judge itself runs under record and its own LLM requests/responses become llm_call nodes in the judge's provenance run — the judge is itself audited. Degrades to a keyless offline fixture.
  • Real LLM intent in the demo bundles (demo/shared/llm-intent-curl.sh). Both capture harnesses fire one real model/tool-intent request via curl/OpenSSL (secrets stay in headers, never in the script or body), so the recaptured, re-signed Stage 1/2 bundles now carry the model call that decided the poisoned install — llm_call → llm_caused → the exact syscall.

Changed

  • README narrative: evidence layers, not integration modes. The "White-box mode / Zero-SDK mode" split is gone: one entry point (record -- <cmd>), kernel/runtime facts as the foundation, application context (hooks bridge / MCP context-write, ai_asserted ≤0.5) as an automatically stacking enrichment layer. "SDK/framework integration" phrasing removed throughout; docs/product.md aligned.
  • README slimmed into docs/ references. Full command references moved to docs/security-commands.md, docs/graph-commands.md, and docs/compliance.md; the Python custom-rules content merged into the External Evaluator Protocol section (one topic, told once).
  • Falco receiver demoted to a compatibility path. The README section moved to docs/falco-receiver.md; the native eBPF sensor is the featured kernel-evidence source, and third-party receivers (Falco/Tetragon) are maintained for compatibility, not extended.

Fixed

  • graph explain no longer crashes on large scopes. Telemetry batches are matched against event ids in Go instead of one SQL LIKE clause per event, which overflowed SQLite's expression-depth limit (~1000 events) and crashed --attempt/--tool-call/--process/--file.
  • Deterministic DAG rendering. Every created_at ordering feeding the causality DAG gained an id tiebreaker, lens summary builders iterate in (created_at, node id) order, and /api/graph node output is sorted — BFS order, page_hash, evidence_refs, and the 32-item lens truncations are now byte-stable across renders and survive re-materialize (verified 3× on both demo bundles).
  • Hooks bridge: sub-agent identity. Sub-agents spawned via the Agent tool now resolve their name from the tool's name field instead of falling back to a generic id.
  • perf: graph edges indexed by (run_id, created_at, id); lens metadata cached.

v0.5.0 - 2026-07-03

Multi-agent orchestration provenance: attribute an attack across a Claude Code agent team (delegation + peer edges) against real kernel syscalls in one signed graph — plus policy replay/config and the app-context hardening that gives record's own scopes a real kernel join key.

Added

  • Multi-agent orchestration provenance (agentprov hooks bridge, internal/hooksbridge). Translates a Claude Code (or compatible) agent team's harness hooks into the graph: an agents table (PRIMARY KEY (run_id, id), so each run's main orchestrator stays distinct) + a tool_calls.agent_id column, agent_spawn (delegation) and agent_message (peer — the SendMessage body objectified as content-addressed evidence) edges, and a policy-scored tool_call per action bound to the acting agent. In-process sub-agents share one cgroup, so the exfil syscall is joined to the right sub-agent by command-match (agent_syscall edge), not cgroup. A new orchestration graph lens draws the topology; the dashboard renders agent, A2A-message, and refused nodes and labels runtime events with their target (secret_path .aws/credentials, metadata_ip 169.254.169.254). Proven end-to-end on a signed VM capture (demo/multiagent-provenance).
  • agentprov security reevaluate --run [--rules]. Re-runs the policy engine over a captured run's already-stored events, regenerating the decision/risk/response/unified-signal layer (and its graph edges) from the current or a custom policy. Raw events are untouched, it is idempotent, and graph verify stays green — so an edited policy can be applied to already-captured runs without re-running the agent or the sensor.
  • agentprov policy rules [--out]. Dumps the built-in policy as an editable YAML rules file, to tune and load back via policy test --rules / security reevaluate --rules.
  • Default self_credential_access policy rule. An agent reading its OWN operational credentials (.claude/.credentials.json, its LLM API env) is still captured as an event (full observability) but no longer raises a high secret_path alert — ranked as an allow before the kill rule — so operational self-reads stop burying the real target-secret reads. Configurable via the dumped rules file.
  • SelfLaunched as a dimension orthogonal to CorrelationClass. An event can now be both kernel_correlated (independently witnessed) and self_launched (the process was started by us). It is derived from the event source and the matched binding's binding_source, propagated onto sensor events through a new events.binding_source column, and surfaced in the dashboard as a badge next to the correlation class. This preserves the "did we start it vs. did the kernel confirm it" distinction that the old string-hack classifier collapsed.
  • Real cgroup-per-scope for record (Linux). record now places the child (and its whole subtree, via SysProcAttr.UseCgroupFD) into a dedicated cgroup v2 leaf, so independent telemetry auto-joins the entire subtree by cgroup_id at 0.98 — no pid polling, no pid-reuse window. Non-Linux and any Linux failure (no cgroup v2 / not delegated) degrade to the previous synthetic logical id, so behavior is unchanged off-Linux. Validated end-to-end on the lab VM (Ubuntu 24.04, kernel 6.8, arm64): the child is placed in /agentprov/<attempt>, the stored cgroup_id equals the cgroup dir inode (== bpf_get_current_cgroup_id), and a zero-context sensor event carrying that id resolves to the scope via cgroup_time_window @0.98 as kernel_correlated + self_launched. The synthetic parent leaf is created lazily; per-scope leaves are removed on exit.
  • agentprov sensor stream — per-node supervised capture. One long-running command runs the eBPF sensor and streams its events straight into the store, correlating each by cgroup — replacing the manual agentprov-sensor | telemetry ingest-jsonl pipe. It excludes AgentProvenance's own I/O (data-dir snapshot + DB writes, which otherwise form a self-feedback storm) and drops uncorrelated host noise that belongs to no scope (which would fail per-run graph verify). Needs CAP_BPF+CAP_PERFMON (setcap or root).
  • Built-in artifact objectify in record. Each changed file's content is objectified as a workspace_file/<path> artifact object, so the dashboard Side Panel previews what the agent actually produced. Previously this was a manual post-capture script that was easy to forget.

Changed

  • CorrelationClass no longer keys self_observed off the synthetic agentprov-record- container-id string. It keys on the event source, so a real kernel event that merely matched a record-launched binding stays kernel_correlated (with the self_launched badge) instead of being mislabeled self-observed.
  • App-asserted joins read honestly lower. ai_asserted bindings (bind_scope) are capped at 0.5 confidence instead of defaulting to 1.0, so a scope the model merely claimed can never resolve as certain as a kernel-verified match. Method tiers (cgroup 0.98 / container 0.92 / pid 0.85 / process 1.0) are unchanged; the dashboard now colours the confidence number by band.

Fixed

  • Dashboard graph: annotation nodes no longer render disconnected. The visible node set was built from all filtered edges but only a capped subset was returned, so policy_decision / response_action / risk_signal / file / artifact nodes came back orphaned (their edges truncated by the runtime-event/process bulk). Edges are now prioritized so the rare semantic ones survive the cap, and the node set is built from the RETURNED edges only — 0 orphans across all nine lenses, annotation nodes stay wired to their lineage.
  • Dashboard graph: processes show names, not bare pids. comm/tgid fallback labels runtime_process and thread-group nodes; the process tree collapses repeated leaf commands (base64 -d ×72) so a real agent's fan-out stays readable.
  • Dashboard performance. graph verify is cached by a cheap fingerprint (Run Overview ~2s → instant after first load); the Sugiyama layout is cached by topology so select/hover/zoom no longer re-lay-out; the edge budget and live refresh interval are eased. Scrubber edgeVisible now respects the edge's own time instead of only its endpoints'.
  • Recaptured the snake / supply-chain demo bundle under the new supervised mode, signed (demo/snake-supply-chain/run-snake-supervised.forensics.json.gz), replacing the older pre-cgroup bundle: the agent's product (snake.py) is objectified and previewable, the supply-chain TTP correlates @0.98 + self_launched, and graph verify is clean.

v0.4.1 - 2026-07-01

A consolidation-and-fix release on top of v0.4.0. No new surfaces — it makes the compliance mapping defensible, unifies it across CLI and dashboard, and fixes two display bugs.

Changed

  • Compliance mapping is now rule-driven with four honest states instead of "any evidence of class X exists":
    • enforced (a mapped detection rule fired and blocked), detected (fired but detect-only), not_triggered (rule maps here, did not fire), no_rule (no detector maps to this control — an honest coverage gap, not a fake pass).
    • The dashboard compliance card and the compliance map / gaps / explain CLI now share one model (compliance.MapRunRules) so they never drift.
    • Expanding a control shows every individual rule hit (time, decision, reason), each clickable back to its graph node.
  • security.Rule gained mode (enforce | detect) and controls: so custom YAML detection rules map themselves onto framework controls; detect-mode rules are recorded but do not block. See examples/policies/agentic-security.yaml.

Fixed

  • Dashboard timeline "detail" and evidence "payload" cells no longer truncate at 160 chars — the full record is shown, clamped by default and expandable.
  • Graph lens no longer renders tool_call / session / attempt / rollout / process id endpoints as generic "unknown" nodes; they are typed by id prefix and counted correctly (e.g. the overview "Tool calls" count).

Removed

  • The legacy evidence-class compliance model (MapRun, ResolveEvidence, and the internal/compliance/evidence.go loaders) — superseded by the rule-based model.

v0.4.0 - 2026-06-30

This release turns AgentProvenance from a CLI-first evidence prototype into a local, replayable provenance dashboard for sandboxed agent execution.

Compared with v0.3.0, the main change is the new Graph Explorer and replayable agent-in-sandbox demo: a signed supply-chain exfiltration capture can now be imported directly and inspected offline without a Linux/eBPF VM.

Added

  • Added a portable signed demo bundle at demo/snake-supply-chain/.
    • Captured a real coding-agent run in a sandbox.
    • Shows a supply-chain install hook reading planted fake secrets and attempting metadata-IP egress.
    • Can be replayed with forensics import and inspected through the dashboard.
  • Added Graph Explorer lenses for query-oriented provenance inspection:
    • Run overview
    • Security
    • Process
    • File/artifact
    • Network egress
    • Data-flow/taint
    • Agent intent
    • Trust/origin
    • Sandbox boundary
  • Added bounded graph detail modes:
    • summary for grouped, high-signal views
    • expanded for selected high-value detail
    • raw for drilldown-oriented evidence, not default rendering
  • Added focused evidence drilldown from graph nodes and risk signals.
  • Added local graph expansion controls for upstream/downstream/children/raw evidence exploration.
  • Added dashboard artifact preview support for bounded, redacted content preview.
  • Added forensics import support for signed portable bundles.
  • Added forensics round-trip tests.
  • Added compliance rule mapping:
    • examples/policies/agentic-security.yaml
    • internal/compliance rule-to-control mapping
    • dashboard compliance API and panel
    • policy rule modes for enforcing vs detect-only mappings
  • Added dashboard preview tests and graph lens tests.

Changed

  • Reworked the dashboard from a large canonical graph dump into a query-oriented evidence surface.
  • Reworked README positioning around execution observability, Git-like provenance, dashboard replay, and signed evidence.
  • Clarified that raw telemetry remains queryable, but the dashboard should not render every syscall/event as a graph node by default.
  • Narrowed taint derivation so sensitive-data flow is gated by risky egress destinations instead of treating every network connection as exfiltration.
  • Improved process naming from sampled process data so graph nodes are easier to inspect.
  • Updated telemetry schema and eBPF sensor documentation to match the shipped native sensor surface.
  • Updated roadmap/status documentation to reflect the actual implemented dashboard, MCP, native sensor, replay, and compliance surfaces.

Fixed

  • Fixed graph summary aggregation counts in dashboard lenses.
  • Fixed risk signal clicks to focus the relevant graph path instead of only listing raw events.
  • Fixed process burst drilldowns so grouped process/event summaries expand to the intended evidence set.
  • Fixed dashboard labels that made Focused Evidence and Run Timeline look like the same surface.
  • Fixed clean replay verification and populated Signals panel for the captured demo run.

Demo

The release demo does not require re-running the agent or the eBPF sensor. Import the signed bundle:

go build -o /tmp/agentprov ./cmd/agentprov

/tmp/agentprov --data-dir /tmp/snake-replay forensics import \
  demo/snake-supply-chain/run-snake-supervised.forensics.json.gz \
  --pub-key demo/snake-supply-chain/attestation.pub

/tmp/agentprov --data-dir /tmp/snake-replay dashboard serve --addr 127.0.0.1:7396

Then open http://127.0.0.1:7396 and select run-snake-supervised.

The capture scripts under demo/snake-supply-chain/capture/ are only needed to reproduce the original Linux/eBPF capture on a compatible VM. They are not required for replaying the shipped demo.

Verification

  • go test ./...
  • Dashboard JavaScript syntax check
  • Signed forensics import/replay path
  • Graph lens and dashboard preview tests

Known Boundaries

  • This is a technical preview, not a production HIDS.
  • The project provides local integrity verification and signed evidence export. It does not yet provide off-host capture-time tamper-evidence against a malicious host root.
  • Central evidence service, notification hooks, long-running multi-tenant deployment, and hardened production eBPF packaging remain future work.