Changelog

Shipped.

A living record of the NOCTRYS enforcement core and moat.

MCP session binding (MCP 2026-07-28 RC): opt-in policy checks that the release candidate’s auth hardening was honored on each MCP session: an authorization-server issuer is present (RFC 9207, the mix-up-attack defense), the token is bound to this specific server via a resource indicator (RFC 8707), token issuer and session issuer agree, and the issuer sits on the agent’s allowlist. NOCTRYS does not re-implement OAuth; it verifies the bindings a compliant client must already have validated, and it fails closed when a governed action carries no session metadata.
Persistent audit store: noctrys serve --store audit.jsonl appends every decision to a JSONL file before the HTTP response returns; on boot the chain is reloaded and verified end to end, an intact store is extended in place so the hash chain spans restarts, and a store that fails verification refuses to start (EU AI Act Art. 12 logging and Art. 26 retention).
Benchmark adapter surface + methodology: a defense-adapter module (a pure judge contract, an OASB SecurityProductAdapter-style adapter with P95 latency, an AgentDojo shim) so third-party harnesses can run the governor without our involvement, plus a public methodology draft stating the limits of our internal numbers. No public-benchmark numbers are claimed until pinned-version third-party runs exist.
Provable policy narrowing: a policy edit can carry a machine-checkable narrowing proof, one clause per policy dimension with the evidence inline; any third party re-checks it against the two manifests alone with the verify-narrowing CLI. Fail-closed outside the decidable fragment, and conservative: it can call a genuinely narrower edit widening, never the reverse.
Witness mesh: checkpoint cosigning upgraded from a single witness to a 2f+1 quorum of independent witnesses with diversity rules (different organizations and jurisdictions) over a hash-linked checkpoint chain; a witness that signs two conflicting histories yields a compact equivocation proof anyone can verify with its public key alone, and is excluded.
KEYTRANS: an RFC 6962-style key-transparency log for enforcer and witness keys, with inclusion and consistency proofs, terminal revocation, and its head checkpointed into the witness mesh, so key substitution or a rewritten key history is detectable by anyone.
Art. 50 disclosure-evidence records: signed, time-stamped, tamper-evident records that an agent disclosed its artificial nature and on whose behalf it acts, sealed into the audit chain, with an optional policy gate that blocks designated tools unless the action carries a resolvable disclosure reference, and a transparency-evidence section in the compliance report. Article 50 imposes no standalone record-keeping duty; these are the records you produce when asked to demonstrate disclosure.
noctrys serve: the governor boots as a self-hosted HTTP sidecar with one command from a policy file; Dockerfile and docker-compose included.
Decision-BOM: a deterministic bill of materials on every governed decision (policy hash, agent identity, tool fingerprint, verdict and reasons, mandate/provenance/delegation refs), hash-chained into the audit.
NIST SP 800-53 + CSA MAESTRO crosswalk: control-family mapping (AC, AU, CM, IA, IR, SI) and 7-layer alignment in the compliance report, alongside the EU AI Act mapping.
Content-usage (AIPREF): honor publisher AI opt-outs on agent fetches.
Web Bot Auth: signed, attributable agent egress (RFC 9421).
Tool-output schema: govern what a tool returns, not just its inputs.
Signed human approval: non-repudiable, action-bound sign-off.
Witness cosigning: non-equivocation for the audit trail.
Assurance levels L0 to L4: an objective governance grade per agent.
Execution receipts: prove what actually ran.
AP2 payment mandates: signed consent chains for money movement.
Collective defense: a cross-fleet threat network.
Public verifier + neutral notary: independently verifiable proof.