Changelog

Release history for the agentgovernance.dev governance engine. Dates reflect deployment to production.

v0.4.0

2026-03-26

Added outbound webhook infrastructure — register HTTPS endpoints, receive real-time HTTP POST callbacks on P1/P2 pattern detections
HMAC-SHA256 signed payloads with X-AG-Signature and X-AG-Timestamp headers for receiver-side verification
Retry with backoff: immediate → 5s → 30s, 5-second timeout per attempt, failed deliveries logged to audit trail
Webhook CRUD: POST/GET/DELETE /api/v1/webhooks

BP-001 renamed from "Prompt Injection" to "Inference Over Execution" (canonical taxonomy alignment)
BP-004 (Scope Creep) upgraded P3/FLAG → P2/PAUSE — scope expansion is now a webhook-dispatched event
BP-004 regex expanded: added coverage for canonical scope expansion text ("I will now also...", "without further instruction/approval")
Incident count updated to 14 (INC-001 through INC-015, excluding INC-012)

POST /api/v1/observe/assess now validates agentId and runId — returns 400 AGENT_NOT_FOUND or RUN_NOT_FOUND instead of 500
Selftest expanded to 27 checks

2026-03-12

Added Integration Guide — failure-safe integration patterns, hard timeout guidance, post-response async observation, health check on startup, pre-production checklist
Added Data Handling reference — endpoint-by-endpoint breakdown of what is transmitted, stored, and discarded; hashing details; retention schedule; data flow diagram
Added Privacy Policy — analytics, API data storage, retention periods, third-party processors, data subject rights
Added Maintainer page — background, framework attribution, NIST submission reference, contact form

Added POST /api/contact — Postmark-backed contact endpoint
Nav: removed non-functional Dashboard link, added Contact
Footer: added Maintainer, Contact, Privacy links
Corrected BP-001 display name to "Inference Over Execution" (canonical taxonomy name)
Added back-link from docs to main site on all documentation pages

2026-03-11

Fixed pattern definition drift — server now loads all pattern definitions from canonical YAML files at startup; hardcoded definitions removed
Fixed BP-001 (Inference Over Execution) regex — detection was using incorrect pattern from prior hardcoded definition
Fixed BP-008 (Authority Assumption) regex — added second signature to catch "no review or approval" constructions

Added scripts/api-selftest.sh — 22-check end-to-end validation script covering all API endpoints, pattern detection, gate sequencing, and error handling
Fixed self-test false pass on BP-001: detection check now verifies detected:true not just pattern ID string presence
Fixed bash set -e arithmetic exit code issue in self-test (((PASS++)) → PASS=$((PASS + 1)))

2026-03-02

Initial release. Built from 14 documented incidents operating a governed agent fleet.

Phase-gated lifecycle: PLAN → BUILD → REVIEW_ENG → REMEDIATE → REVIEW_ARCH → APPROVE with sequential gate enforcement
Agent registration and management
Governance run tracking with gate transition validation
Behavioral observation recording and assessment (POST /api/v1/observe/assess)
Full audit trail with entity-level append-only event logging

8 behavioral patterns: BP-001 Inference Over Execution, BP-002 False Blocker Reporting, BP-003 Governance Phase Skip, BP-004 Scope Creep, BP-005 Completion Without Verification, BP-006 Work Order Contamination, BP-007 Selective Reporting, BP-008 Authority Assumption
3-layer detection engine: regex, semantic, context-aware
Async pattern evaluator pipeline with 30-day result retention (POST /api/v1/evaluate)
Anonymous evaluate tier: 10 evaluations/day per IP; registered key tier: 100/day