luckyPipewrench/pipelock v3.7.0

on GitHub

Breaking Changes / Upgrade Notes

• A valid receipt prefix no longer counts as a completed chain. Chain verification reports VALID PREFIX, END UNPROVEN and exits 3 without a proven end. Use --allow-prefix only when deliberately checking an open prefix; the label stays. Clean reports use schema version 2 and expose end-proof status. Update automation that previously treated an open chain's exit 0 as completeness. A cleanly stopped recorder run that recorded EvidenceReceipt v2 receipts also exits 3 in receipt-chain mode, because that chain has no end marker; verify recorder directories with --whole-recorder. Upgrade guide. (#1892)
• Receipt content scanning has an explicit bounded search. Complete secrets in scanned fields remain checked before signing. Reassembly has limits for combinations involving Pipelock's fixed labels and formatted decision text; splits requiring multiple fixed values, dropped enum text, or nonadjacent decision-text fragments fall outside the documented search. Review the receipt content boundary before adopting the throughput improvements. The search also excludes splits into five or more pieces, four pieces outside forward/reverse order, and three pieces on receipts too wide for that search. Caller-supplied IDs stay scanned; process-proven generated IDs are excluded, including when their text could complete a secret. (#1872, #1886, #1897)
• Reinstall containment and restart running agents to adopt socket isolation. Managed launches hide host runtime socket directories and verify their live mount evidence. Existing managed units and wrappers need contain install with the new binary, followed by restarting agent services and sessions. Filesystem enforcement stays off when an existing config omits containment.filesystem.mode; new installs set enforce. Enforce-mode posture fields require compatible verifiers. Linux sandbox fallback below Landlock ABI 9 has documented IPC limits, and strict ARM64 launches below ABI 9 refuse. (#1813, #1890)
• Explicit child environment overrides that select loaded code now refuse. MCP and sandbox launch options share the code-loading subset of the verified-service deny list, covering runtime and loader controls such as PYTHONHOME, NODE_PATH and CLASSPATH. The sandbox guide distinguishes explicit refusal from filtering inherited variables. (#1870, #1873)
• Schema-bound JSON requires canonical keys. Typed MCP, A2A, GraphQL, contract and receipt inputs reject noncanonical aliases and case-variant duplicates. Legacy signed receipts with noncanonical-case keys now reject even when their signatures verify; free-form argument, environment and label map keys remain unchanged. On MCP, malformed JSON, invalid UTF-8 and duplicate keys also refuse despite mcp_input_scanning.on_parse_error: forward, and rejected responses don't update tracking state. Replay profiles v4 and v5 pin byte decoding across verifiers; historical profiles retain their contracts. (#1888, #1889, #1892)
• Core credential protection blocks in audit mode. Ordinary policy still warns. On HTTP request bodies, a fully redacted core credential forwards only to a configured request-body trusted host, in audit and enforcement modes. MCP input has its separate configured action. Strip actions block when their rewritten result doesn't pass the deciding checks again. (#1798, #1817)
• Parallel receipt groups require group-capable verifiers. flight_recorder.receipt_chains accepts 1 to 32 and defaults to 1. Preserve the complete directory and use group verification; a valid shard isn't proof of a complete group. Changing receipt_chains requires restart; reload retains the old count with a warning. Multi-chain automatic anchoring is unsupported, and changing its signing key closes the group and requires supervised restart. The published @pipelock/verifier-ts and pipelock-verifier-rs 0.6.5 verify whole groups (chain --dir --group ID and group --group-id ID); the PyPI package pipelock-verify 0.4.1 verifies each shard and chain but not the group, so use one of the others for group evidence. (#1828, #1838, #1863)
• Each native evidence run has a 256 MiB verifier ceiling that Pipelock 3.7.0 doesn't stop before. The Go, TypeScript, Rust and Python verifiers refuse a native AEL stream over 256 MiB and the writer has no cap, so a run that reaches the ceiling can't publish a close that verifies. With flight_recorder.receipt_chains above 1, a restart over that run is refused; a single-chain restart starts a new run and leaves the old one unverifiable. In one 200,000-request run across eight chains the largest stream was about 28 MB, which puts the ceiling near 1.9 million requests for that workload; shard count and event mix change the figure. If you run flight_recorder.receipt_chains above 1 under sustained load, restart on a schedule that keeps each run well inside the figure you measure for your own traffic. Details.
• Partial and cache-validating HTTP responses must remain inspectable. Forward, intercepted and reverse proxies strip Range and cache-validator request headers and refuse origin 206 or 304 replies as response_incomplete. Browser Shield exemptions do not bypass that refusal. (#1809)
• JWT cookies follow header DLP policy. A JWT in a Cookie header now follows the configured action and core floor instead of always warning; an issuer-bound cookie observed through TLS interception keeps its scoped allowance. (#1837)
• Generated request IDs use UUIDv7 instead of a counter. Consumers of logs, events and receipts must accept req-<UUIDv7>; the receipt scanner verifies a process-held origin proof before treating an ID as generated. (#1897)
• Built-in credential-audience changes move the canonical policy hash. Update conductor and followers together before republishing fleet policy, and refresh consumers that pin the prior default hash. (#1783)

Added

• Parallel signed receipt chains. Requests stay on one chain across their decisions, outcomes and evidence records. Signed group openings, closes and successor transitions bind the chains together. The in-repository Go, TypeScript, Rust, Python and browser verifier sources distinguish GROUP_VALID, GROUP_INCOMPLETE and GROUP_INVALID. The published TypeScript and Rust verifiers (0.6.5) check whole groups, while the PyPI package pipelock-verify (0.4.1) accepts the signed group binding on each shard without verifying the group. Browser verification retains its 8 MiB compressed and 32 MiB uncompressed bundle limits. (#1828, #1838)
• Filesystem grants for host containment. containment.filesystem.mode: enforce hides other home directories and signing material, mounts unexpired workspace grants with their declared access, and refuses launch unless a canary proves the profile took effect. User-namespace remounts, same-user /proc, socket access and operator-written units retain the documented limits. (#1813)
• pipelock exec -- COMMAND. Check a running proxy's health, forwarding and kill switch, then launch cooperative clients with shared proxy and CA environment settings. Commands can ignore those settings; operating-system enforcement still needs containment or network policy. (#1810)
• Kernel-observed identities for local MCP services. Register and inspect local services through mcp_identities and pipelock mcp identity. Each new connection checks the service owner and pinned program inputs before sending data. Linux visibility, a unique socket holder and a direct connection are required. Reviewed credential acknowledgments can bind to verified local sessions without pinning their changing port and bearer value. (#1859)
• Expiring per-tool credential-request acknowledgments. mcp_tool_scanning.acknowledged_findings binds an operator-reviewed finding to the configured server, complete tool definition, detector revision and matches with a deployment-held HMAC key. It lifts only that finding; stale or mismatched entries refuse under every action. (#1844)
• Exact destination grants. destination_grants authorizes an exact TCP host and port through the existing destination checks without disabling content scanning or protected-address checks. Grants remain local fleet policy, and unsafe reload trust expansion refuses. (#1896)
• Signed recovery seals. A fresh run can attest the exact torn predecessor bytes and the new opening. Verifiers report an attested discontinuity while preserving the damaged history's failure; the seal doesn't turn damage into a clean chain. (#1752, #1795)
• Request correlation for emitted events. emit.correlation_header copies a bounded, DLP-clean request header into webhook, syslog, CEF, OCSF and OTLP events on HTTP-capable transports. It doesn't enter receipts or local audit logs. (#1807)
• Per-request TLS-interception timing. intercept_http records status, response size, total duration, upstream-header wait when reached, and client cancellation, honoring logging.include_allowed. (#1824)

Changed

• Receipt scanning caches exact clean text. The bounded, recorder-local cache belongs to its scanner and uses a random key per cache instance. Findings are never cached. Known labels no longer multiply the fragment search, and content is scanned before the v2 chain lock with final-byte binding checked before signing. A development build completed 1,000,000 requests at 414 requests/s with eight receipt chains and zero missing of 5,808,850 expected receipt records; the signed group verified across all eight shards. Measurement conditions and limits. (#1796, #1804, #1886, #1897)

• Required receipts confirm every configured family before the covered effect. Requests, MCP redirects and legacy HTTP methods, durable deferred resolutions, and covered response rewrites or warned events wait for their durable records. Durable append tickets release the chain lock while syncing, preserve append order, and fail the stream after a sync failure. With required receipts and multiple chains, one sync failure stops the whole group and process; failure metrics distinguish durability from durability_inherited. Denials retain best-effort receipt emission. (#1858, #1883)

• Whole-recorder verification streams complete history. Verification, group close, successor creation and automatic single-chain anchoring read beyond the display reader's 256-shard and 8 MiB limits. Changed files report unavailable or incomplete evidence with a nonzero exit, never a valid verdict. Display readers and compaction keep their separate limits. (#1805, #1863, #1869)

• Receipt health is checked per chain. /stats exposes chain state, newest receipt and anchor coverage; an observation that can't be compared is pending instead of healthy. The latest-receipt self-audit complements whole-history verification. (#1883)

• Browser Shield and media policy honor browser-visible content types. Repeated Content-Type values follow the browser's last-valid-value rule; relaxation requires agreement. Media policy continues to enforce the effective type established from leading body bytes. Fixed exposure labels bound media diagnostics. (#1837, #1853, #1854)

• Origin-issued URLs and object IDs receive scoped entropy relief. TLS-intercepted links, query values and new object IDs can return to their issuing origin and session without entropy false blocks. Other checks still run; reflection, incomplete sent history, session eviction and restart limit eligibility. XHTML issues no HTML-link evidence, and stripped hop-by-hop origin headers don't support an exemption. (#1866, #1868, #1871)

• Temporary entropy routes can name a path prefix and content types. content_entropy_warn_routes supports expiring segment-boundary prefixes, while content_entropy_exclusions accepts owner/reason/expiry mappings as well as legacy host strings. (#1837, #1839)

• MCP preserves protocol negotiation and usable upstream refusals. Successful initialize negotiation supplies later HTTP protocol headers. Empty successful acknowledgments are accepted, and clean eligible 4xx replies retain their status and permitted headers; incomplete, unsafe or 5xx replies stay sanitized. (#1846, #1884)

• Generated tool schemas get the envelope's inspection depth. Schemas, annotations and extension fields share the derived bound; malformed or uninspectable tool lists refuse consistently in the CLI and proxy. (#1778, #1780, #1834)

• Release verification accepts the exact tag-bound workflow identity under either supported repository owner. Self-update and the action accept only the named release workflow under either supported owner, bound to the requested tag. (#1855)

• The release checks the verifier packages customers install. @pipelock/verifier-ts and pipelock-verifier-rs 0.6.5 (from verifier-v0.6.5) and pipelock-verify 0.4.1 are pinned by registry digest and source commit, and the install check requires each of the four verifiers to accept a candidate receipt and reject a tampered copy. pipelock-verify 0.4.1 accepts the signed group binding that 0.4.0 rejected on every shard of a parallel-chain run, and its README now states what a valid result does and doesn't prove.

• GitHub download grants and Azure SAS URLs get scoped scanner allowances. Grants remain bound to their intended hosts and validity windows; other credential and destination checks still run. (#1776, #1784, #1794, #1812, #1818)

• Scanner prefilters skip work proven unable to change the result. Shared normalized views, cached secret encodings, bounded suffix/anchor proofs and response-pass reuse reduce repeated scans. The historical scanner tables remain labeled by their measured release and hardware. (#1802, #1809, #1814, #1822, #1861)

• Pull requests run the fast test suite; main and release run the race suites. CI tests Go 1.26 and 1.27; release builds and vulnerability scans pin patched toolchains. Input-identical packages can reuse main's no-race results, and measured shard weights keep jobs within their deadlines. Review crashes publish an incomplete verdict rather than a false clean result. (#1803, #1836, #1845, #1850, #1851, #1852, #1867, #1878, #1879, #1882)

• Dashboard and audit metadata use shared declarations. Preparation, navigation, license-tier metadata and event metadata were refactored without changing their wire values. (#1767, #1768, #1769, #1831)

Fixed

• JSON fields stay separate during fragment scanning. Fragments of the same field still join, while neighboring fields sharing a retention bucket don't become one value. Field identity stays separate from the value retention budget. (#1779)
• Exemption-only edits retain built-in credential audiences. Adding exempt_domains alone no longer discards a built-in pattern's compiled audience. Configuration checks warn when an override changes a property that removes the audience or when an exemption is redundant. Core credential patterns still refuse exemptions. (#1825)
• Repeated release versions don't inflate filename entropy. Final filenames can be scored without one repeated version from the immediately preceding path segment. Outer and nested URLs share the rule, while credential and query checks remain active. (#1860)
• Runtime security state survives profile changes and unrelated reloads. Replay protection and license revocation remain enforced. Paid WebSocket, CONNECT and streaming HTTP connections end on expiry or proven entitlement loss. WebSocket relay panics close connections with explicit failure labels, and cancelled frames don't count as DLP blocks. (#1885, #1891)
• Broken upstream streams don't look complete. Forward, intercepted, reverse, SSE, WebSocket and MCP-listener paths abort after truncated delivery and record incomplete outcomes. Interrupted releases and refused MCP calls retain outcome evidence. (#1811, #1819)
• Receipt rotation waits before assigning the next chain position. Slow syncs no longer create sequence gaps during size rotation. Startup rejects retained unsafe receipt content, failure details stay value-free, and reserved mirror-field collisions refuse. (#1872, #1883, #1887)
• Parallel-chain shutdown closes the receipt group in seconds instead of minutes. Sealed segments are verified once as they rotate and the close re-checks their identity, size and SHA-256, so a segment that was replaced, changed, added or removed still refuses the close. A worker error triggers a fresh full verification of that shard instead of leaving the group incomplete. At 200,000 requests and eight chains, shutdown fell from about 139 s to about 6.6 s on one host. (#1903)
• Parallel-chain restarts verify each session once and keep systemd waiting while they do. A restart over a long receipt history no longer verifies the same evidence twice before the listener binds, and independent shards verify in parallel. While verification reads evidence, pipelock run reports progress to systemd so the 90-second start budget of the generated unit extends only while verification is making progress, and READY=1 follows verification and the listener bind. A closed predecessor whose content changes while startup is running is refused instead of linked. Restart time still grows with the amount of recorded history. (#1904)
• Decoded credentials and partial query content remain inspectable. Basic/base64 carriers and encoded hostname labels retain known-secret detection before DNS, malformed queries keep recoverable security views, and cross-request attribution preserves existing findings across rewrites and empty rescans. Quoted or bracketed seed phrases are recognized. (#1800, #1830, #1833, #1888)
• MCP and A2A scan the full accepted content. Media decoding, multipart text, tool credential directives and formatted or negated redirects remain inspected within the shared response budget. Oversize or incomplete inspection refuses where required. Verified Agent Card signatures aren't treated as credential text, while ordinary fields stay scanned. (#1790, #1797, #1817, #1835, #1842, #1849)
• Credential-file policy covers write destinations in all seven presets. Built-in block rules now cover supported writes, moves, copies and patch targets. (#1848)
• Taint classifications preserve read-object and publish boundaries. Supported read-only tool names retain their read classification, and pull_request_read with the published GitHub retrieval methods is a read after untrusted exposure. Mutations, malformed methods, namespace evidence and lookalike names stay conservative. (#1786, #1792, #1900)
• Binary response bodies are scanned as contiguous printable runs. Each unbroken printable run of at least 16 bytes is scanned on its own and may be joined with neighboring runs to catch an instruction split across them. Short runs of unprintable bytes are no longer turned into spaces, so compressed downloads such as release archives stop forming false Jailbreak Attempt matches. Rebuilt base64 and hex text is decoder input only: decoded content is still scanned, and the stitched letters aren't matched as prose. (#1901)
• pipelock mcp identity lists a held file once on btrfs. A service that holds a file both open and mapped reports different device numbers from stat and from /proc/<pid>/maps, so the file was listed twice and registration refused to pin it. Registration also refuses to pin a path while the service still holds a replaced copy of it and asks the operator to restart the service first; dial-time verification is unchanged. (#1902)
• MCP header validation omits submitted values from diagnostics. (#1881)
• Registry credential audiences expand by carrier. GitHub-token Basic login support has bounded usernames and exact HTTPS registry hosts; GHCR registry JWTs and RubyGems Bearer behavior have separate rules and limits. Windows path-like environment values aren't enrolled as secrets. (#1783, #1787, #1874, #1875)
• Containment rollback preserves revoked doorways. A failed reconcile restores only still-declared routes and stops revoked sockets and their host relay. Installation requires forwarding, and Linux sandbox syscall prerequisites bind to the installing thread. Sandbox legacy path syscalls support Python and Node file operations. (#1788, #1801, #1799, #1816)
• OIDC refreshes coalesce for late callers. Dashboard authentication avoids duplicate JWKS fetches. (#1843)
• Release artifact checks enforce attestation completion and verifier source identity. Build flags carry the release keyring, and producers and gates retain ordered subject contracts. Dependencies include patched golang.org/x/net and current locked verifier inputs. (#1714, #1781, #1815, #1832, #1847, #1893)
• Test fixtures require actual enforcement evidence. Runtime listener fixtures can't mistake the upstream for a ready proxy; replay tests require the real block close, and race-slow startup/license tests get time to reach the behavior they judge. Receipt-load diagnostics pin their inputs and separate integrity from performance. (#1791, #1821, #1827, #1829, #1840, #1856, #1857, #1862, #1864, #1876, #1894, #1895)