Skip to navigation
Releases

Release Notes

View as Markdown

APF has not published a tagged release. Every workspace crate is at version 0.1.0, and this documentation describes the repository’s main branch. When releases are tagged, their notes will appear on this page.

Policy Supply

  • Signed policy bundles in the yaml-sigil format, with Ed25519 signing in apf-compile genfixture and Ed25519 or ECDSA P-256 trust roots.
  • Verification of the signature, every member digest, the validity window, and an anti-rollback revision counter. A restart can reload the bundle that is already active.
  • Local file and HTTP bundle sources, with polling and hot swap for the HTTP source and POST /v1/refresh for the local source.
  • JSON Schemas and protobuf contracts for every authored document kind in contracts/.

Decision and Enforcement

  • Cedar evaluation with the annotator, Cedar, and effect pipeline, capability grants and control rules, body rewriting, header mutations, verdicts, and findings.
  • Policy set hot swap in the gateway without a restart.
  • OpenShell gateway interceptor: signed sandbox policy injection and validation, refresh of running sandboxes, and governance of policy edits, proposals, approvals, providers, and provider profiles.
  • OpenShell supervisor middleware: per-request evaluation of HTTP requests and MCP tool calls at PRE_CREDENTIALS.
  • Caller authentication with OpenShell extension tokens and TLS on both listeners.
  • OpenShell bindings pinned to v0.1.3, with extension protocol 1.0 negotiation.

Evidence

  • The apf.audit.event.v1 schema, with one JSON Lines file per component.
  • Records for the policy lifecycle, document distribution, admissions, governance decisions, per-request decisions, the MCP tool on each request, and refused callers.
  • Provenance tokens on every document served over gRPC.

Deployment

  • Hardened systemd units with a polkit rule, under deploy/systemd/.
  • Dockerfiles and a Docker Compose development stack (compose.yaml), under deploy/docker/.
  • A Helm chart for Kubernetes, under deploy/helm/apf/. You build and load the images yourself. Refer to Kubernetes.
  • A verification harness under e2e/ that runs the Compose stack and the Helm chart against a real OpenShell gateway.
  • CI that builds release binaries of both services with SHA-256 checksums and third-party license notices.

Not Yet Available

The capabilities marked In Development in this documentation, a metrics endpoint and a delegation model, are not on main. Published container images and a published Helm chart, a shared policy service, and a verified user identity on the OpenShell request path are not in the repository either. Refer to Support and Compatibility.

Next Steps