[v3.1.0] Release showcase — what's new and what's next

[imran-siddique]

v3.1.0 is live! 🎉

Release notes | CHANGELOG

This is our biggest feature release since the v3.0.0 Microsoft-signed public preview. Here's a visual tour of what shipped.

---

💻 Unified agt CLI (#924)

Single command-line entry point replacing 12+ separate tools. Plugin discovery, doctor diagnostics, global --json flag for CI/CD.

📊 Governance Dashboard (#925)

Real-time Streamlit-based dashboard showing:

• Agent fleet health (active/degraded/offline)
• Trust score distribution across your agent fleet
• Policy compliance rates with SLO tracking
• Recent audit events timeline

🔄 Agent Lifecycle Management (#923)

8-state lifecycle model:
Provisioning → Active → Suspended → Rotating → Degraded → Quarantined → Decommissioning → Decommissioned

Includes automatic credential rotation, orphan detection, and full audit trail at every transition.

🔍 Shadow AI Discovery (#921)

Finds unregistered agents hiding in your infrastructure:

• GitHub scanner — repos with agent-related topics/keywords
• Process scanner — running agent processes on hosts
• Config scanner — agent config files on disk
• Risk scoring: each discovered agent gets a risk assessment

🔒 Quantum-Safe ML-DSA-65 (#927)

Post-quantum cryptography ready today:

• ML-DSA-65 (FIPS 204) for signatures
• Runs alongside existing Ed25519
• Seamless — agents automatically use the strongest available algorithm
• Because Q-day preparation starts now, not in 2030

🛡️ OWASP ASI 2026 Taxonomy

Migrated from the draft OWASP Agentic Top 10 to the finalized ASI 2026 taxonomy with a complete reference architecture mapping. Still 10/10 coverage.

🧪 PromptDefenseEvaluator (#854)

12-vector prompt injection audit covering:
Direct injection, indirect injection, jailbreaks, role manipulation, encoding attacks, multilingual attacks, and more.

---

By the numbers

Metric	Value
Tests	9,500+
OWASP coverage	10/10
Policy eval latency	< 0.1ms
Policy violation rate	0.00%
Framework integrations	20+
SDK languages	5 (Python, TS, .NET, Rust, Go)
Prompt-based safety violation rate	26.67% (AGT: 0%)

What's next

We're already working on the next wave:

• Plugin ecosystem — mesh, sre, runtime packages registering with agt CLI
• agt dashboard — terminal-native TUI (no browser needed)
• Agent-to-agent delegation chains — governed delegation with trust decay
• GA readiness — moving from Public Preview toward General Availability

---

⭐ If AGT is useful to your team, consider giving us a star! It helps others discover the project.

Feedback, feature requests, and contributions welcome. 👇

[imran-siddique]

Post-launch update — what shipped in the last 48 hours

Since the v3.1.0 showcase, we've merged 14 additional PRs addressing market gaps, public criticism, and community contributions:

New Capabilities

PR	Feature	Tests
#937	Data-Layer ABAC — classification-aware policies (PII/PHI/PCI detection, geography restrictions)	28
#933	Developer Experience — 60-sec quickstart, AWS/GCP deployment guides, progressive complexity tutorial, YAML policy generator	21
#956	AGT Lite — zero-config governance in 3 lines (from agent_os.lite import govern) + fixed broken quickstart	16
#955	Reversibility Checker — pre-execution reversibility assessment with compensation plans	19
#955	Trust Score Calibration Guide — weights, decay functions, threshold recommendations

Security Hardening

PR	Fixes
#944	9 CWE fixes in new packages (symlink escape, path traversal, race conditions, auth bypass)
#945	7 fixes in existing code (XSS, curl|bash, CORS wildcard, PII in exceptions, policy fallback warning)

Documentation & Quality

PR	What
#941	Normalized all 20 tutorials to consistent format (metadata, What You'll Learn, Next Steps)
#929	README cleanup — all 13 packages now documented

Community PRs Merged

PR	Contributor	What
#908	@eeee2345 (Cisco ATR)	15 ATR detection rules + sync script for 108 rules (closes #901)
#948	@kevinkaylie	ADR 0005 — Liveness attestation for TrustHandshake
#949	@harshnair75567-cloud	LotL prevention policy
#899	@aymenhmaidiwastaken	MCP Security blog post (closes #848)

Production Policy Library

Shipped 5 battle-ready policy sets in examples/policies/production/:

• minimal.yaml (startups) → enterprise.yaml → healthcare.yaml (HIPAA) → financial.yaml (SOX/PCI) → strict.yaml (defense/ITAR)

By the numbers (updated)

Metric	At launch	Now
Tests	9,500+	9,700+
PRs merged (total)	343	357+
Production policy sets	0	5
ATR detection patterns	38	86+ (community) + 15 (PolicyEvaluator)
Tutorials normalized	~10 consistent	All 30 consistent
Security findings fixed	—	27 of 31