release: v0.11.0

Author: onesimplecode

AGENTS.md

@@ -359,6 +359,50 @@ for a new agent split, re-verify its *reasoning* still holds before carrying
 its conclusions forward — a control copied without re-checking why it existed
 can turn into process weight that closes no actual gap.
 
+### Credential-Isolated Broker Operations (TR-SEC-014)
+
+An untrusted or air-gapped agent must never hold credentials for an external
+system. Give it a host-side broker instead: the broker holds the credential,
+the agent only requests named operations over a private transport, and no
+response path hands the credential itself back to the agent.
+
+The broker enforces, in order:
+
+1. **Exact resource scope.** Every request names the resource it targets; the
+   broker rejects anything outside the one resource (or resource set) it was
+   configured to serve. There is no wildcard scope.
+2. **Immutable event identity.** Each request carries the identity of the
+   event that triggered it (a PR number, a commit SHA) and the revision it
+   was computed against. A request with no event identity, or one that
+   doesn't match what the broker already bound to a lease, is rejected —
+   this is what stops a stale or replayed trigger from re-authorizing a
+   mutation.
+3. **Single-use mutation leases.** A lease is issued for one resource/event/
+   revision triple and consumed exactly once; a second consume attempt with
+   the same lease token fails closed, even if every other field still
+   matches.
+4. **Immediate pre-mutation revalidation.** The lease is checked against the
+   *current* revision at consume time, not only at issue time — an event
+   that was valid when the lease was issued but has since gone stale (the PR
+   moved, the branch force-pushed) must fail at the point of mutation, not
+   silently proceed on outdated authority.
+
+Transport matters as much as the validation logic: if the broker is reached
+over a Unix socket, mount the socket's *containing directory* read-only into
+the agent's sandbox, not just the socket file. Mounting only the file can
+leave a long-lived sandbox holding a handle to a deleted inode after the
+broker restarts, which either breaks silently or — worse — reconnects to
+whatever now occupies that path. A restart-safe transport re-creates the
+socket in the same mounted directory rather than assuming the mount survives
+a process restart.
+
+This pattern is the credential-isolation half of TR-SEC-010's least-agency
+principle taken to its limit: the agent isn't granted a narrowed credential,
+it is granted no credential at all, and every operation it can trigger is
+named, scoped, and lease-gated by something it does not control. See
+`examples/credential-isolated-broker/` for a reference implementation and its
+scope/lease/staleness tests.
+
 ### Ground-Truth Verification for Agent Security Claims (TR-TEST-007)
 
 An agent's own self-report is not verification evidence for a

CHANGELOG.md

@@ -5,12 +5,25 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-08-21
+
 ### Added
 
 - **Credential-isolated broker pattern (TR-SEC-014)** — host-side named operations keep external
   credentials out of air-gapped agents; immutable event binding, immediate pre-mutation
   revalidation, single-use leases, and restart-safe read-only socket transport are required.
   Promoted from the verified Hermes PR reviewer integration.
+- `AGENTS.md` — "Credential-Isolated Broker Operations" section documenting the pattern's four
+  enforced invariants (exact resource scope, immutable event identity, single-use mutation
+  leases, immediate pre-mutation revalidation) and the restart-safe socket-directory-mount
+  requirement. Every prior `TR-SEC-*` export shipped a matching `AGENTS.md` section; this closes
+  that gap for TR-SEC-014, flagged during release-readiness review.
+
+### Fixed
+
+- `docs/requirements-implementation-map.md` — the TR-SEC-014 row's Evidence column was missing
+  `AGENTS.md`, inconsistent with every other TR-SEC row's citation of both the pattern doc and
+  its registry/example backing.
 
 ## [0.10.0] - 2026-08-13
 
@@ -493,7 +506,8 @@ cases) — both fixed prior to this release.
 - `CONTRIBUTING.md`, `SECURITY.md`, issue/PR templates, `release-check` CI workflow
 - Roadmap and changelog for intentional release cadence
 
-[Unreleased]: https://github.com/onesimplecode/agent-engineering-standards/compare/v0.10.0...HEAD
+[Unreleased]: https://github.com/onesimplecode/agent-engineering-standards/compare/v0.11.0...HEAD
+[0.11.0]: https://github.com/onesimplecode/agent-engineering-standards/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/onesimplecode/agent-engineering-standards/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/onesimplecode/agent-engineering-standards/compare/v0.8.1...v0.9.0
 [0.8.1]: https://github.com/onesimplecode/agent-engineering-standards/compare/v0.8.0...v0.8.1

ROADMAP.md

@@ -17,9 +17,6 @@ unscheduled by default; a concrete use case is a legitimate reason to reprioriti
 
 ## Next up
 
-The v0.11.0 release includes the credential-isolated broker pattern, promoted from a running
-Hermes reviewer integration with real CI, lease, and restart-failure evidence.
-
 Candidates for the next release, in priority order. Each names the evidence gate
 it is still waiting on.
 
@@ -33,6 +30,7 @@ it is still waiting on.
 
 | Version | Date | Theme |
 |---|---|---|
+| [v0.11.0](CHANGELOG.md#0110---2026-08-21) | 2026-08-21 | Credential-isolated broker pattern (TR-SEC-014), promoted from a running Hermes reviewer integration with real CI, lease, and restart-failure evidence |
 | [v0.10.0](CHANGELOG.md#0100---2026-08-13) | 2026-08-13 | Announcement-ready README and roadmap, `AGENTS.starter.md`, rename to Agent Engineering Standards, `TECH-DEBT` tag, drift-guard tests for the README's own factual claims |
 | [v0.9.0](CHANGELOG.md#090---2026-08-13) | 2026-08-13 | Multi-runtime instruction source-of-truth, plugin-skill trust, honest CI limits, SSRF allowlist |
 | [v0.8.1](CHANGELOG.md#081---2026-08-03) | 2026-08-03 | Reviewer spot-checks completion-checklist citations against the diff |

docs/requirements-implementation-map.md

@@ -21,7 +21,7 @@ concrete artifacts. It is intentionally limited to public, reusable evidence.
 | Memory/provenance hygiene | Source-tag at ingest, fail-closed trust derivation at read time, validated at retrieval, unverified/external content quarantined | Documented + registry + example | `AGENTS.md`, `registry/tr-registry.yaml` (TR-SEC-011), `examples/provenance-trust-tags/` |
 | Strict LLM output-schema validation | Type and range checks on every model-returned field; reject, never coerce | Documented + registry + example | `AGENTS.md`, `registry/tr-registry.yaml` (TR-SEC-012), `examples/strict-output-schema/` |
 | Compartmentalized multi-agent isolation | Two independent layers (tool-registry scope + data-layer scope) for agents sharing one backing service; a test proves layer 2 blocks a simulated layer-1 misconfiguration | Documented + registry + example | `AGENTS.md`, `registry/tr-registry.yaml` (TR-SEC-013), `examples/compartmentalized-agents/` |
-| Credential-isolated broker operations | Scope- and revision-bound broker operations with single-use mutation leases and restart-safe read-only transport | Documented + registry + example | `registry/tr-registry.yaml` (TR-SEC-014), `examples/credential-isolated-broker/` |
+| Credential-isolated broker operations | Scope- and revision-bound broker operations with single-use mutation leases and restart-safe read-only transport | Documented + registry + example | `AGENTS.md`, `registry/tr-registry.yaml` (TR-SEC-014), `examples/credential-isolated-broker/` |
 | Ground-truth verification for agent security claims | An agent's self-report is not verification evidence for an isolation/permission/memory-scoping claim; verify against the enforcement point's own state | Documented + registry + template + example | `AGENTS.md`, `registry/tr-registry.yaml` (TR-TEST-007), `templates/completion-checklist.md`, `examples/compartmentalized-agents/` |
 | Rollout sequencing (layering rule) | Foundational/shared infrastructure ships first; every later phase immediately usable on arrival, no phase idling behind an unmet dependency | Documented | `docs/ai-engineering-operating-model.md` |
 | Design-time threat modeling | Trust boundaries, data classification, and ATT&CK/ATLAS technique mapping required for new listeners/credentials/tool grants/content sources | Template + example | `templates/threat-model.md`, `examples/worked-example/docs/decisions/ADR-004-example.md` |