## 0.15.3

- Added a read-side CFO cost dashboard (`aggregateLedger`, `classifyOrigin`, `decisionCents`, `centsToUsd`) that rolls the signed decision log into spend by hour/model/provider, frontier-vs-"dark" (self-hosted / open-weight) token attribution, reserved-vs-settled true-up, a saved-by-policy figure, and a chain-integrity verdict. Runnable demo: `npm run demo:dashboard`.
- Added model-agnostic provenance that survives model hot-swap (`workloadProvenance`, `formatLineage`): a portable per-workload manifest with the model lineage, swap events, frontier/dark origin mix, and a single tamper-evidence verdict spanning the whole swap sequence. Runnable demo: `npm run demo:hotswap`.
- Added a runnable DAG trust-attestation demo (`npm run demo:attestation`).
- Purely additive; no existing API changed.

## 0.15.2

- Enhanced the Hermes Kanban adapter with Tony-style state vocabulary, signed workspace provenance, hashed board scope metadata, and signed revoke receipts that assert zero spend after reclaim.
- Added a lightweight task path for low-cost read-only work so trivial tasks get caps and receipts without Reviewer Cascade overhead.
- Added TypeScript and Python parity tests for revoke receipts, workspace provenance tamper detection, and the lightweight path.

## 0.15.1

- Removed import-time `sdk_init` telemetry from package entry points. Telemetry remains opt-in and now fires lazily when `SpendGuard` is constructed.
- Added lazy-import regression tests so root SDK and Operating Pack imports make zero HTTP calls and open zero network sockets even when telemetry is enabled.

## 0.15.0

- Added the Agent Operating Pack for law: bundled AGENTS.md guardrails, five local skills, source-of-truth layout, DIY checklist, and counsel-review-pending marker.
- Added TypeScript and Python Operating Pack envelopes with capability gates, per-workflow spend caps, Reviewer Cascade on the high-risk subset, and Ed25519 signed metadata-only DAG receipts.
- Added tests for static pack guardrails, dispatch and trust-account gating, Reviewer Cascade receipts, tamper detection, and zero-data-plane behavior.

## 0.14.0

- Added Hermes Kanban adapters for TypeScript and Python with governed task envelopes, per-task spend caps, profile capability ceilings, reclaim receipts, and signed DAG receipt trees.
- Added Reviewer Cascade auto-wiring for reviewer-profile and high-risk Kanban tasks while keeping task titles, prompts, summaries, outputs, and free-text metadata out of receipts.
- Added `agentguard hermes-kanban demo` plus tests for cap blocking, capability denial, revocation, diamond DAG verification, tamper detection, builderCode separation, and zero-data-plane behavior.

## 0.13.3

- Hardened DAG receipt verification compatibility by preserving legacy builder attribution fields during normalization.

## 0.13.2

- Added thin framework adapters for Vercel AI SDK middleware, Claude Code hooks, Hermes hooks, and OpenRouter OpenAI-compatible clients.
- Kept all adapter receipts metadata-only: prompts, completions, provider keys, signing keys, and policy details stay in the customer runtime.
- Added TS and Python parity tests for pre-dispatch enforcement, post-dispatch signed receipts, and data-plane redaction.

## 0.13.1

- Hardened `builderCode` receipt verification so legacy-hash fallback is unavailable when attribution metadata is present.
- Kept `builderCode` as partner attribution metadata only.

## 0.13.0

- Added optional `builderCode` partner attribution metadata to SpendGuard config, call contexts, signed decisions, and DAG-normalized receipt nodes.
- Covered `builderCode` in the signed entry hash when present while preserving legacy verification for receipts without partner attribution.

## 0.12.0

- Added DAG receipt trees with Ed25519-signed nodes, parent hashes, topology labels, deterministic trust scores, and legacy linear-chain compatibility.
- Added DAG verification with Kahn cycle detection, diamond common-ancestor checks, minimum-of-chain trust scoring, capability gates, and Merkle inclusion proofs.
- Attached signed DAG envelopes to outcome runtime receipts when signed decision entries are available.

## 0.11.1

- Fixed metadata learning timestamp defaults so rows without an explicit timestamp normalize safely.

## 0.11.0

- Added metadata-only learning helpers for feedback rows, k-anonymous aggregates, shadow proposals, and reason-chip revision suggestions.
- Added export/no-lock-in helper surface for AI team configuration portability.

# Changelog

## 0.14.1

- Security: workflow receipts now fail closed without an Ed25519 signing key and use real Ed25519 signatures over canonical JSON instead of hash-only signatures.
- Security: local dashboard decision-log rendering now escapes attacker-controlled fields before inserting HTML.

## 0.10.0

- Added Solo Builder Core governance: metadata-only loop detection, workflow budget envelopes, and signed pre-dispatch tool gate receipts.
- Added BYO outcome YAML starters plus `agentguard init <template>`, `agentguard run <slug>`, and `agentguard deploy` local CLI surfaces.
- Exported governance and BYO helpers for app integrations.

## 0.9.0

- Replaced placeholder vertical outcome catalogs with the validated five-vertical library for law, accounting, insurance, real estate, and e-commerce.
- Added effort-aware routing so recommendations carry model effort plus separate drafter and reviewer effort for Reviewer Cascade.
- Exposed the full vertical outcome library from the SDK through `./verticals` and package-level exports for terminal and app usage.
- Added outcome guardrail tiers, blocked origin policy, and cite-or-refuse boundaries for regulated vertical workflows.
- Added tests for active outcome coverage, spec fixes, fair-housing flag-only behavior, COI source-policy refusal, no auto-refund behavior, and CN-origin blocking.

## 0.8.0

- Added the metadata-only outcome runtime: atomic holds, execute, quality gate, opt-in Reviewer Cascade, fallback on error, refund on failure, and signed outcome receipts.
- Added five vertical outcome catalog hooks and local learning proposals that use receipt metadata only and require manual promotion.
- Preserved BYO behavior. Reviewer Cascade remains opt-in.

## 0.7.0

- Added per-vertical cost-optimal router recommendations backed by OpenRouter catalog pricing.
- Added opt-in Reviewer Cascade auto-fire for OpenAI-compatible request paths. Non-opted-in BYO behavior is unchanged.

## 0.6.1

- Added Pro-tier managed OpenRouter key fetch for server runtimes. The SDK caches keys for 15 minutes and injects them only for the OpenRouter host. Customer runtime still calls OpenRouter directly.
- Added inference billing provenance fields so signed receipts can distinguish customer-managed and AgentGuard-managed inference relationships.

## 0.6.0

- Added receipt schema v3 provenance blocks for model identity, hosting route, jurisdiction, BAA status, retention, and foreign-origin model flagging.
- Added provider registry and local provenance enforcement: compliance posture blocks foreign-origin weights, standard posture requires a signed consent receipt.
- Added consent receipt validation hooks for `foreign_origin_consent_receipt_id`.
- Kept v1 and v2 receipt verification paths backward compatible.

## 0.5.0

- Added the workflow primitive: one budget envelope, one duration cap, resumable checkpoints, and signed receipt chains across multi-step agent runs.
- Added receipt schema v2 fields for workflow_id, parent_receipt_id, chain_validation_hash, checkpoints, and reviewer cascade evidence.
- Added SDK chain validation helpers and workflow-specific error types.

## 0.4.4

- Added the functional-use disclaimer to README, package metadata, LICENSE addendum, CLI first-run notice, and /llms.txt surfaces.
- Added license validation plumbing, seat registration, CLI license commands, and paid-feature gates for posture switching, custom watchlists, vertical SKILL pack imports, Outcome Builder, and audit retention.
- Replaced hard CLI license failures with soft-cap dialogs so free-tier users can continue with the allowed local behavior.
- Added the insurance active vertical and Chinese-origin model blocking for compliance posture recommendations.

## 0.4.3

- Updated Advisor vertical intelligence from `docs/research/per-vertical-intel-may28.md`. Advisor now cites vertical outcomes, per-outcome caps, recommended models, compliance citations, pricing anchors, and default Governance Posture for law, accounting, e-commerce, real estate, and insurance.

## 0.4.1

- **Renamed `agentguard coach` to `agentguard advisor`** to better match the business-buyer mental model. The command name now aligns with the outcomes-based positioning, AI policy advisor for your business. v0.4.0 had zero downloads at the time of this release. The rename is clean with no alias.
- Session logs now stored at `~/.agentguard/advisor-sessions/`.
- **Added Governance Posture**: Velocity, Standard, and Compliance policy generation modes that shape enforcement mode, capability tiers, downgrade behavior, approval gates, and audit retention. Inspired by @_catwu's Claude Code velocity playbook.

## 0.4.0

- Added `agentguard advisor` subcommand: local LLM-driven policy setup via your OpenRouter key.
- Added local Advisor session logs, policy and quickstart writers, projected savings output, and review and forecast skeletons.

## 0.3.0

- Added streaming true-up for OpenAI, Anthropic, and Bedrock, including signed settlement entries.
- Added native TypeScript Anthropic and Bedrock bindings.
- Added OpenRouter model aliases, catalog sync, local pricing overrides, and auth CLI.
- Added models picker, guided wizard, tips system, and five task templates.
- Added public verifier demo receipt export and README quickstarts for the wizard flow.

## 0.2.2

- Emit opt-in sdk_init beacon on package import so adoption metrics capture executed SDK loads before guard construction. Install IDs persist in ~/.agentguard/install.json and telemetry remains best effort.

## 0.2.1

- Beacon endpoint moved from merchantguard.ai to agentguard.run for clean positioning. No SDK behavior change.