v0.8.2-rc.1 — portable CLI and all-demo replay

English | 中文

This prerelease makes the first experience possible without installing Go or checking out the repository.

• Precompiled CLI archives for Linux and macOS, each on amd64 and arm64. Linux archives also include agentprov-sensor from the committed bindings.
• SHA256SUMS, individual .sha256 files, and build metadata identify each archive and its source commit. Checksums provide download integrity, not publisher signatures. macOS binaries are not Developer ID signed/notarized.
• agentprov demo opens a local gallery of all existing examples. Six signed captures are embedded, verified before import, and checked for graph integrity. Named replays automatically select their Run and lens and start playback for timed lenses; placement lenses show their topology.
• LLM Judge and Jev appear as optional setup guides; their complete original sources, along with all other demo sources, ship under demo/ in the archive. Live evaluator calls remain explicit and require their own environment.
• agentprov --version reports the release, source commit, date and platform.

Try it

Download the archive and matching .sha256 file for your platform. For Linux x86-64, in the download directory:

sha256sum -c agentprov_v0.8.2-rc.1_linux_amd64.tar.gz.sha256
mkdir agentprov-demo
tar -xzf agentprov_v0.8.2-rc.1_linux_amd64.tar.gz -C agentprov-demo
cd agentprov-demo
./agentprov demo

For macOS, choose darwin_amd64 (Intel) or darwin_arm64 (Apple Silicon) and use shasum -a 256 -c. Windows users run the matching Linux package in WSL.

./agentprov demo --list
./agentprov demo multiagent-provenance
./agentprov demo k8s-cross-pod-a2a --no-browser

Replay is offline and read-only. It opens a loopback server with a temporary store and removes that store on normal exit. Ctrl-C stops it. A forced kill can leave an agentprov-demo-* directory in the system temporary directory. No captured commands or agents are executed. Signature verification uses the bundled demo public keys; it does not establish complete capture or prove every inferred relationship.

Validation and limits

The release workflow runs Go vet and race tests, including all six fixture imports and tamper rejection. Each of the four native runner platforms then builds, extracts and exercises its own archive with Go absent from PATH, checking the gallery, every signed run, graph APIs, guides and shutdown cleanup. All four packages must pass before publication. This validates portable replay, not additional live eBPF or long-running node acceptance.

Linux runtime capture keeps its kernel/cgroup/privilege requirements. macOS supports replay and application evidence; the Linux sensor is not available on macOS. No capture bindings or deferred correlation/retention logic changed.