Summary

v0.8.0 is the governance release: 133 commits since v0.7.0, and the largest one is a permission control plane for agents rather than another provider hookup.

The design bet stays the same, and it is the reason this release is verifiable before it is configurable: the default provider is a deterministic local fake provider. You can exercise tool discovery, every tool call, streaming, budget enforcement and the audit chain without supplying a key and without anything leaving your machine.

docker run --rm ghcr.io/happy520ai/unified-ai-system/ai-gateway-service:0.8.0 \
  pnpm gateway demo "Build a small API for my team" --enhance --profile coding

What's new

Agent Governance control plane. A dependency-free packages/policy-engine plus a gateway service giving each governed agent a deterministic permission lifecycle: classification, policy compilation, per-call Tool Proxy enforcement, approvals, expiry and cascade revocation. SQLite and PostgreSQL registries with an authority switch and a JSON→SQLite migration tool. Off until AI_GATEWAY_AGENT_GOVERNANCE_ENABLED=true. The source MCP tool surface grew from twelve to fifteen with three read-only governance inspection tools.

Governed code delivery. Up to sixteen server-side profiles bind exact read/write paths, immutable test hashes, a baseline revision, one fixed command and a digest-pinned image. Execution happens in an owned worktree; verification runs in a read-only, network-disabled container. A successful task returns one complete patch plus durable evidence. It never commits, merges, deploys or publishes. An opt-in native Codex backend drives a hash-pinned Codex CLI 0.153.4 (Windows x64 only; other platforms are refused before startup).

Resident and long-running governed work. One task UUID now spans prepare, plan, approve, bounded run fragments, status, pause, cancel, session recovery and an explicit reconcile that settles an unknown pending operation to terminal failure without replaying any effect. A shared AgentPool advances up to 16 projects / 64 admitted goals / 8 concurrent fragments and re-verifies identity, approval, workspace and full checkpoint after a restart inside the original grant.

Forge gains approved media and browser tasks. Text-to-speech through the gateway's own provider channel with server-side PCM WAV validation (RIFF length, chunk bounds, fmt/data uniqueness, frames, duration, SHA-256) and a single operator-named .wav output; the local-fake-provider profile uses a built-in synthetic tone and makes no real provider call. Finite governed web tasks only report success after re-reading the real DOM, are bound to a literal http://127.0.0.1 origin with four administrator-registered element IDs, never attach to your browser, and carry no cookies, logins, uploads, messaging or payment.

Also in this release. The taiji governed capability surface; Feishu enterprise-application API delivery alongside webhook mode; the read-only local AI control center (pnpm gateway control-center) with lossless JSONC/TOML/YAML client onboarding and per-client governed rollback; verified context re-encoding with model comparison; durable owner-scoped workflow run history with fenced recovery; unified provider usage accounting across every execution entry (an explicitly reported zero is now distinguished from a synthesized one); a Windows-native proof-of-possession replay profile; Compose/Kubernetes/native deployment profiles and artifact-bound build identity; and a bai provider. Fixes cover guardrail coverage, cross-session response isolation, provider accounting regressions, OpenAPI input-binding fidelity in the reverse-MCP REST bridge, and container source readability.

Full detail: CHANGELOG

Boundaries, stated plainly

• Public preview, single maintainer, single host. Multi-instance and PostgreSQL governance profiles are refused outright rather than partially supported. No claim of production readiness or autonomous operation is made or implied here.
• Native Codex role execution is Windows x64 only.
• Tool count: the published v0.8.0 image and the current source both expose fifteen bounded MCP tools. Older material may still say twelve or nine - that describes the v0.7.0 and v0.4.x images respectively, not this release.
• Real provider calls are opt-in and require explicit configuration; nothing in this release reaches a provider by default.
• Adoption evidence is deliberately not quantified here. There is no production deployment, no independent audit, and no adoption metric that a release note can state without going stale within a week of writing it; the repository page shows whatever the current figure is. Reproducible gates: CI, security scan, anonymous container verification, and public-clone verification that runs without credentials and leaves no service process behind.

Verify it yourself