Every sprint, what shipped, and when
SignalEvaluator — endpoint match, service account origin, call cadence, non-interactive timing, session continuity, chained consumption, tool schema present, structured handoffActivityWindowAggregator — async, queries audit_events, detects chaining/p50/session_continuityPassiveFinding model + passive_findings table (TimescaleDB)PASSIVE_FINDING_CREATED, PASSIVE_FINDING_UPGRADED, STRONGLY_INDICATIVE_DETECTED, OPERATOR_REVIEW_REQUESTEDclassification_policy.rego — alert_severity, review_overdue, proxy_enrollment_recommendedexposure_policy.rego — alert on ungoverned high-risk platforms, recommend enrollmentX-Next-Cursor / X-Total-Events headers, no 10k capPolicyGenerator singleton — subscribes to 6 event types (injection detected/blocked, conditioning suspected, drift detected, session cycling, behavior reversal)auto_activate_threshold)TrustResetDetector — 3 detection conditions: opposite disposition in new session ≤2h, ≥3 prior blocks for requester+action now allowed, ≥3 sessions in 30min with varying dispositionsBEHAVIOR_REVERSAL; 60s DB flush loop for disposition recordsWorkflowBaselineMonitor — EWMA baselines (α=0.2), Bray-Curtis divergence for tool distributionBEHAVIOR_REVERSAL, REQUESTER_SESSION_CYCLING, WORKFLOW_PARTICIPANT_UNEXPECTED, WORKFLOW_DEPTH_SPIKE, WORKFLOW_TOOL_DISTRIBUTION_ANOMALY, WORKFLOW_DURATION_ANOMALYaction_disposition_records TimescaleDB hypertable + workflow_baselines tableblast_radius.rego — 5 rules: shallow delete deny, recipient limit escalate, bulk threshold escalate, config path escalate, protected file pattern escalateGET/PATCH /api/v1/admin/blast-radius — per-tenant threshold config, syncs to OPAPOST /api/v1/exceptions now requires justification (≥10 chars) + expires_in_hoursBASELINE_POISONING_SUSPECTED at >3 approvals/24h per agentPolicyChangeRequest model — proposed Rego content, author, reviewer, notes, statuspolicy_change_approved / policy_change_rejectedSubmitChangeRequestForm + ChangeRequestsPanel in PoliciesPageBEHAVRY_DEPLOYMENT_MODE: standalone | control-plane | data-plane — route gating in api/router.pyGET /.well-known/jwks.json (RSA→JWK Set)GET /api/v1/opa/bundle/{tenant_id} (dp_token auth, .tar.gz)docker-compose.control-plane.yml + docker-compose.data-plane.yml + OPA bundle-polling configGET /api/v1/sessions — session list with tool_call_count, dlp_hit_count, risk_score_at_closeGET /api/v1/sessions/{id}/events — chronological event timeline per sessionSessionsPage.tsx — table + event slide-over, Sessions nav itemPOST /api/v1/gemini/{path} — X-Gemini-Key → upstream, model from URL path, usageMetadata token countsPOST /api/v1/ollama/{path} — native + OpenAI-compatible endpoints, 300s streaming timeoutAiApiCoverageSection — 4 providers with endpoint + key header + env var infoPOST /api/v1/delegations — issue scoped d_token JWT; scope intersection + ceiling guard + depth guardenforce_delegation_token() in proxy — verify DB row, confirm delegatee + session matchrequester_verified=TrueDELEGATION_SCOPE_PROBE alert at threshold of 3delegation_policy.rego — deny unverified; escalate tool not in effective_permissionsGET /api/v1/workflows/{id}/sessions/{sid}/delegations endpointbehavry_superadmin BYPASSRLS roleset_tenant_context() injected into every admin request via PasswordAuthProviderTenantConfig model: plan_tier, max_agents, max_rpm_per_agent, audit_retention_days, deployment_modePOST /api/v1/signup — atomic tenant + admin + enrollment_token + config; 5-req/IP/hr rate limit, 409 on duplicateOnboardingPage.tsx — 3-step flow: org setup → enroll agent → SSE verifyWorkflowContext dataclass + validate_workflow_context() — validates X-Workflow-Session JWT in proxy step 2dworkflow_session_id, causal_depth, parent_event_id, delegation_chain on every audit eventworkflow_policy.rego — deny depth > max_depth; escalate tool not in ceilingGET /api/v1/workflows/{id}/sessions/{sid}/trace — causal tree + per-agent policy summariesPATCH /api/v1/exceptions/{id}/extend — extend expiry up to 4× (configurable max_extensions)409 when max extensions reached; extension_count + max_extensions in responsetrusted (skip scanner), block (immediate substitution), untrusted (scan with severity promotion)domain_trust.rego — OPA policy for trust-level routing decisionsDriftDetector — linear slope analysis over rolling windows; fires INJECTION_CONDITIONING_SUSPECTED + BEHAVIORAL_DRIFT_DETECTEDDELETE /api/v1/agents/{id}/baselines — admin reset of behavioral baselineX-Requester-Id header propagated to every audit eventinstruction_hash SHA-256 per tool callREQUESTER_IDENTITY_MISMATCH alert — 15-min sliding window detectorawait db.commit() before HTTP responsemake setup + make tokens — zero-friction one-command onboardingproxy_http_version 1.1 (HTTP/1.0 was closing SSE after each event)SELECT FOR UPDATE on last-event lookupChainBreakEntry + acknowledge workflowGET /api/v1/audit/chain/breaks + acknowledgetest_policy_enforcement.py — 74 tests: OPA client, DLP validators, all 26 patternstest_mcp_proxy.py — 28 tests: rate limiter, tool call extraction, enforce() pipelinetest_behavioral_monitor.py — 55 tests: anomaly scoring, baselines, alert evaluationunittest.mock — no DB or OPA requiredimperative_command, authority_claim, permission_expansion, role_reassignment, encoded_payload, structured_escalation, urgency_framingchrome.storage.localGET /api/v1/audit/verify — cryptographic chain verification, cached + on-demandwf_token JWT (RS256) with permission ceiling + delegation depthX-Extension-Token header requiredDLP_FRAGMENT_REASSEMBLY critical alert with matched patterns + window sizemaxlen=200) with 5-minute alert cooldownSENTRY_DSN env var/metrics Prometheus endpoint with optional bearer token authBUILD_SHA baked into Docker image at build timePOST /api/v1/admin/killswitchasyncio.Future to DB-polled queuemake migrate / make migrate-stamp / make migrate-new