Skip to content

AegisFlow v0.9.0: tool boundary hardening

v0.9.0 focuses on tool-call correctness, evidence integrity, scoped credentials, and release verification.

What changed

  • Tool definitions and tool calls survive translation across supported OpenAI-compatible, Anthropic, Gemini, and Ollama adapters.
  • Input, output, streaming, cache, budget, and kill-switch checks now share one request lifecycle across both gateway protocols.
  • MCP tools/list, tool arguments, and streamed output pass through policy checks before reaching clients.
  • Human approval is bound to one exact action and consumed once.
  • Evidence records use HMAC signatures and independent session chains.
  • GitHub App tokens are restricted to requested repositories and permissions.
  • AWS STS credentials include session policies derived from requested scope.
  • ** policy globs now match nested paths.
  • Federation config responses no longer expose literal credentials or signing material to data planes.
  • Published governance load tests use uncached requests when provider latency is included.

Full details live in CHANGELOG.md.

Upgrade notes

  1. Replace v0.8.0 binaries and containers with v0.9.0.
  2. Set AEGISFLOW_EVIDENCE_KEY to a stable secret before collecting signed evidence. Export session evidence before gateway shutdown because session registry is memory-only. Stable key does not restore prior sessions.
  3. Review target globs containing **. They now cross directory separators and may match more paths than before.
  4. Leave messages_api.tool_passthrough disabled unless the selected provider tool loop has been tested end to end.
  5. Re-run policy efficacy tests after upgrade:
bash starter-kit/tests/run-efficacy-tests.sh
  1. Source builds require Go 1.26.6 or later.

Install

curl -fsSL https://raw.githubusercontent.com/saivedant169/AegisFlow/v0.9.0/scripts/install.sh | sh

Homebrew formulas install gateway and admin CLI separately:

brew install saivedant169/tap/aegisflow
brew install saivedant169/tap/aegisctl

Container images publish to both registries:

docker pull saivedant169/aegisflow:0.9.0
docker pull ghcr.io/saivedant169/aegisflow:0.9.0

Verify downloads

Every release includes SHA256SUMS, a Sigstore bundle, a source SBOM, and GitHub build provenance.

asset=aegisflow-linux-amd64
grep "  ${asset}$" SHA256SUMS | sha256sum --check -
cosign verify-blob \
  --bundle SHA256SUMS.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/saivedant169/AegisFlow/\.github/workflows/release\.yaml@refs/tags/v0\.9\.0$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  SHA256SUMS
gh attestation verify aegisflow-linux-amd64 \
  --repo saivedant169/AegisFlow

On macOS:

asset=aegisflow-darwin-arm64
grep "  ${asset}$" SHA256SUMS | shasum -a 256 --check

Known limits

  • Built-in editor tools that bypass the configured MCP gateway remain outside its policy boundary.
  • Messages API tool passthrough is opt-in.
  • Shell, SQL, GitHub, and HTTP execution gates marked experimental are libraries, not active runtime interceptors.
  • Project remains pre-1.0. Test policy behavior against your own actions before production use.

Contributors

Thanks to Godstime Aburu for the docs-writer policy pack and to everyone who tested earlier releases or reported policy gaps.