# Changelog

> Release notes for Thoth SDKs, the Thoth binary line (proxy + thothctl), and IaC providers.

Source: https://docs.atensecurity.com/docs/changelog

**Historical release notes:**
  Entries describe behavior at the time of each release. Use [Install an
  SDK](https://docs.atensecurity.com/docs/getting-started) and [Your first governed
  agent](https://docs.atensecurity.com/docs/getting-started/quickstart) for current package names, runtime
  requirements, connection details, and failure behavior.

Release notes for every published Thoth package, newest first. Latest
releases come straight from each package's changelog, so they match what
is published; pre-releases are not listed. See the
[release-channel guide](https://docs.atensecurity.com/docs/deployments/release-channels) when selecting
an upgrade. Releases follow [Semantic Versioning](https://semver.org).

## Subscribe

- Direct feed URL: `https://docs.atensecurity.com/docs/changelog/rss.xml`
- One-click Feedly subscribe: [Feedly](https://feedly.com/i/subscription/feed/https%3A%2F%2Fdocs.atensecurity.com%2Fdocs%2Fchangelog%2Frss.xml)
- One-click Inoreader subscribe: [Inoreader](https://www.inoreader.com/?add_feed=https%3A%2F%2Fdocs.atensecurity.com%2Fdocs%2Fchangelog%2Frss.xml)

## Latest releases

Generated from each package's `CHANGELOG.md`, newest first.

- [Pulumi provider 0.1.16 (September 18, 2026)](#release-pulumi-provider-0-1-16-2026-09-18)
- [Python SDK 0.5.23 (September 18, 2026)](#release-python-sdk-0-5-23-2026-09-18)
- [Terraform provider 0.1.16 (September 18, 2026)](#release-terraform-provider-0-1-16-2026-09-18)
- [Thoth CLI and MCP proxy 0.3.7 (September 12, 2026)](#release-thoth-cli-and-mcp-proxy-0-3-7-2026-09-12)
- [Go SDK 0.1.19 (September 11, 2026)](#release-go-sdk-0-1-19-2026-09-11)
- [Python SDK 0.5.22 (September 11, 2026)](#release-python-sdk-0-5-22-2026-09-11)
- [TypeScript SDK 0.1.21 (September 11, 2026)](#release-typescript-sdk-0-1-21-2026-09-11)
- [TypeScript SDK 0.1.20 (September 11, 2026)](#release-typescript-sdk-0-1-20-2026-09-11)
- [Pulumi provider 0.1.15 (July 23, 2026)](#release-pulumi-provider-0-1-15-2026-07-23)
- [Terraform provider 0.1.15 (July 23, 2026)](#release-terraform-provider-0-1-15-2026-07-23)
- [Pulumi provider 0.1.14 (July 10, 2026)](#release-pulumi-provider-0-1-14-2026-07-10)
- [Terraform provider 0.1.14 (July 10, 2026)](#release-terraform-provider-0-1-14-2026-07-10)
- [Pulumi provider 0.1.13 (July 9, 2026)](#release-pulumi-provider-0-1-13-2026-07-09)
- [Terraform provider 0.1.13 (July 9, 2026)](#release-terraform-provider-0-1-13-2026-07-09)
- [Thoth CLI and MCP proxy 0.3.6 (July 9, 2026)](#release-thoth-cli-and-mcp-proxy-0-3-6-2026-07-09)
- [Go SDK 0.1.18 (June 20, 2026)](#release-go-sdk-0-1-18-2026-06-20)
- [Python SDK 0.5.21 (June 20, 2026)](#release-python-sdk-0-5-21-2026-06-20)
- [TypeScript SDK 0.1.19 (June 20, 2026)](#release-typescript-sdk-0-1-19-2026-06-20)
- [Python SDK 0.5.20 (June 15, 2026)](#release-python-sdk-0-5-20-2026-06-15)
- [Pulumi provider 0.1.12 (June 10, 2026)](#release-pulumi-provider-0-1-12-2026-06-10)
- [Thoth CLI and MCP proxy 0.3.5 (June 10, 2026)](#release-thoth-cli-and-mcp-proxy-0-3-5-2026-06-10)
- [Terraform provider 0.1.12 (June 9, 2026)](#release-terraform-provider-0-1-12-2026-06-09)

  Pulumi provider 0.1.16
  September 18, 2026
  Added, Changed, Upgrade note

**Added**

- Bridged the Terraform provider's 0.1.16 surface. `GovernanceSettings` gains the
  executable compliance declaration (`declaredRegulatoryRegimes`,
  `complianceEnforcementMode`) with computed canonical regimes, coverage,
  revision and propagation bound, and `McpVendor` gains manifest signature,
  capability, runtime identity and egress attributes. See the
  `terraform-provider-thoth` 0.1.16 changelog for the full surface and its
  upgrade note.

**Changed**

- Updated Terraform provider bridge dependency pin to
  `github.com/atensecurity/terraform-provider-thoth v0.1.16`.
- Bumped Pulumi release defaults/docs to `0.1.16`:
  - `Makefile` default `VERSION`
  - plugin install command in `docs/installation-configuration.md`

**Upgrade note**

Applying a compliance declaration requires a running enforcer that reports the
same catalogue and evaluator identity the bridged provider pins and reports
transactional declaration support. Otherwise the update fails with
`Compliance capability mismatch` and changes nothing. A service with tenant
declarations disabled refuses these fields by design; every other resource is
unaffected.

  Python SDK 0.5.23
  September 18, 2026
  Fixed, Security, Added, Unchanged

**Fixed**

- The tracer discarded the final enforcement decision after computing effective
  tool arguments, so POST telemetry hardcoded `ALLOW` and omitted server-issued
  reason codes and structured decision evidence. The real outcome is now
  retained and reported.
- A resolved `STEP_UP` no longer loses the initial policy evidence or the
  canonical terminal receipt. Final authorization semantics are merged with the
  initial reason, policy and receipt evidence, and the terminal receipt is
  preserved separately.
- A sparse server response no longer erases locally established correlation.
  Sparse decisions bind to the local trace and action IDs.

**Security**

- A server response whose action or trace ID contradicts the locally established
  one now **fails closed before the tool executes**, rather than proceeding with
  ambiguous correlation.

**Added**

- `EnforcementDecision` and the policy exceptions gain an optional
  `terminal_receipt` field. Existing callers are unaffected.
- Claude Agent SDK post-success and post-failure hooks now carry decision
  context, correlated through a bounded single-use map keyed on the provider
  tool-use ID. The map holds at most 1024 pending entries; a reused, missing,
  unseen or evicted ID yields empty context rather than another action's, so
  evidence correlation fails closed without changing the authorization result.

**Unchanged**

- Tool execution, blocking, deferral, step-up and argument-modification
  semantics, final `MODIFY` outcomes, and current `OBSERVE` behaviour. The
  enforcement return shape remains private to the SDK implementation.

  Terraform provider 0.1.16
  September 18, 2026
  Added, Changed, Security, Upgrade note

**Added**

- `thoth_governance_settings` gains an executable compliance declaration:
  `declared_regulatory_regimes` and `compliance_enforcement_mode`, with computed
  `canonical_regimes`, `compliance_coverage`, `compliance_revision` and
  `propagation_max_ms`. A declaration governs all current and future tenant
  agents, including agents with no policy record. `observe` records advisory
  findings and preserves independent authorization; `enforce` adds
  non-grantable restrictions for DENY, STEP_UP and evidence-based UNRESOLVED.
  Removing a managed declaration or setting `[]` clears it, and legacy profile
  defaults never activate the binding.
- Per-regime coverage counts are known at plan time from a catalogue pinned into
  the provider, so `terraform plan` previews which controls a declared regime
  would evaluate before any apply. These are Aten's own author classifications
  and are not a regulatory conformance assessment.
- `thoth_mcp_vendor` gains manifest signature attributes
  (`manifest_signature_status`, `_signer`, `_bundle_ref`, `_verified_at`),
  plus `capabilities`, `runtime_identity`, `egress_policy_mode` and
  `egress_allowed_host_patterns`.
- `thoth_governance_settings` gains `regulatory_regimes` for onboarding baseline
  auto-pack loading. This selects legacy packs only and does not activate
  executable compliance; the declaration fields above are separate.

**Changed**

- The governance executive summary and reports overview data sources return
  additional fields.

**Security**

- Updated indirect dependencies, including `golang.org/x/text` 0.37.0 to 0.41.0,
  `golang.org/x/net` 0.55.0 to 0.58.0 and `golang.org/x/crypto` 0.52.0 to 0.55.0.

**Upgrade note**

Applying a compliance declaration requires a running enforcer that reports the
same catalogue and evaluator identity this provider pins **and** reports
`transactional_declarations_supported`. If it does not, the apply fails with
`Compliance capability mismatch` and changes nothing rather than writing a
declaration the service cannot honour.

A service with tenant declarations disabled will therefore refuse these fields
by design. Every other resource and data source in this release is unaffected.
Verify the three-way agreement before rollout with:

```
python3 scripts/reliability/compliance_release_preflight.py \
  --base-url https://grid.<tenant>.<apex> --tenant-id <tenant>
```

  Thoth CLI and MCP proxy 0.3.7
  September 12, 2026
  Security, Added, Fixed, Known limitations, Changed

Stable release of the macOS runtime (`thoth` and `thothctl`) for Apple Silicon
and Intel. This is the global latest release; Linux and Windows artifacts are
not included and remain at v0.3.6. This client release does not change the
platform readiness status.

**Security**

- Updated the HTTP/2 stack from `h2` 0.4.13 in v0.3.6 to 0.4.19, fixing
  RUSTSEC-2026-0258 (unbounded queuing of empty DATA frames through `hyper`).
  The advisory is patched in h2 0.4.16 and later.

**Added**

- Carried an action attestation ID through every governed tool call. The proxy
  reuses `action_attestation_id` from the request when supplied and otherwise
  generates one, sends it to the enforcer, and reports it on decision responses
  and on both the request and terminal telemetry events, so an attempt can be
  correlated end to end.
- Reported decision evidence on `ALLOW` and `BLOCK` responses, which previously
  carried none. `BLOCK`, `DEFER` and `STEP_UP` responses now include the
  enforcement trace ID, action attestation ID, authorization decision, reason,
  reason code, action classification and risk score when the enforcer supplies
  them.

**Fixed**

- Stopped writing enforcer error response bodies and selected response headers
  into proxy logs when a call fails. A failure is now recorded as a reason code
  (`enforcer_transport_error`, `enforcer_http_error`, `enforcer_invalid_response`)
  with the HTTP status only, so response content cannot reach logs.
- Distinguished an enforcer response with no recognized decision from a genuine
  `BLOCK`. Both still fail closed, but the former is now recorded as
  `enforcer_invalid_response` rather than being indistinguishable from a policy
  denial in evidence.
- Preserved request-side correlation IDs on the terminal event when the enforcer
  is unreachable, returns an error status, or returns an undecodable body, so a
  failed call is still traceable to the attempt that caused it.
- Kept a locally escalated `STEP_UP` from exporting a receipt that the
  underlying `ALLOW` never carried.
- Distinguished an absent model risk score from one the enforcer explicitly
  reported as null, and stopped copying non-numeric risk payloads into decision
  evidence.
- Cleared stale request-side reason fields from terminal telemetry so a decision
  reason always describes that decision.

**Known limitations**

- On Windows the proxy API key file (`~/.thoth/proxy_api_key.json`) is written
  with inherited ACLs. The owner-only permission handling that `thothctl`
  applies on macOS and Linux has no Windows equivalent yet, so treat that file
  as readable by any account with access to the user profile until it does.

**Changed**

- Serialized the decision-evidence integration fixtures. Each spawns a proxy
  subprocess and a mock enforcer, and running them concurrently exhausted the
  proxy's bounded 5s HTTP timeout, so the proxy failed closed and the suite
  reported six failures unrelated to proxy behavior.

  Go SDK 0.1.19
  September 11, 2026
  Added, Changed

**Added**

- Added a per-action attestation ID, generated for each tool call unless the
  caller supplies one, and propagated it through enforcement decisions,
  behavioral events, logs, and policy errors for deterministic correlation.
- Added model name/provider/artifact context, authentication and delegation
  context, MCP runtime identity, and caller metadata to authorization requests.
- Added public process-local delivery status and bounded shutdown APIs.

**Changed**

- Minimized retained HTTP and SQS telemetry with an explicit allowlist. Tool
  arguments, free-text context, results, errors, explanations, full receipts,
  and unknown metadata remain available to authorization but are not retained
  by default.
- Added bounded HTTP and SQS delivery retries with stable event and FIFO
  deduplication identifiers. Retrying telemetry never re-executes a governed
  tool or repeats its authorization decision.
- Added SQS partial-batch failure handling, process-local delivery counters,
  bounded shutdown through `CloseWithTimeout`, and a five-second overall HTTP
  request timeout.
- Expanded the public decision-envelope compatibility contract and standalone
  module tests for the new authorization and evidence fields.
- Documented the telemetry privacy boundary and the limits of process-local
  delivery status.

  Python SDK 0.5.22
  September 11, 2026
  Added, Fixed, Changed

**Added**

- Added first-class LangGraph support through `instrument_langgraph()`,
  `instrument_tool_node()`, and `@thoth_graph`, including synchronous and
  asynchronous tool execution, concurrent call history, mock mode, and explicit
  `ThothDeferredError` handling.
- Added per-action attestation IDs across authorization, Claude Agent SDK hooks,
  lifecycle events, policy errors, and decision evidence. Provider tool-use IDs
  are used for correlation only and are never represented as authenticated
  workload identity.
- Added model name/provider/artifact context, authentication and delegation
  context, MCP runtime identity, and caller metadata to authorization requests.
- Added human-explanation retrieval for blocked and step-up decisions with
  optional bounded webhook delivery.
- Added wheel-content validation and clean installed-package tests for the base
  package and the Anthropic, AutoGen, Claude, LangChain, LangGraph, and OpenAI
  extras.

**Fixed**

- Return a fresh approval-timeout decision for every sync and async call, so
  blocked-event evidence cannot inherit an earlier action's attestation ID.
- Reject unresolved or malformed step-up results without executing the tool,
  and keep synchronous and asynchronous fallback enforcement to one decision
  per action.
- Reject Claude callback results that identify a different action, and avoid
  correlating concurrent callbacks by tool name when no trusted action ID is
  available.
- Govern callable-only tool collections and LangChain-style duck-typed
  `_run`/`run` tools even when their framework classes are unavailable.
- Correct optional dependency declarations and restore SDK type-check coverage.

**Changed**

- Minimized retained HTTP and SQS telemetry with an explicit allowlist. Tool
  arguments, free-text context, results, errors, explanations, full receipts,
  and unknown metadata remain available to authorization but are not retained
  by default.
- Added bounded HTTP and SQS delivery retries with stable event and FIFO
  deduplication identifiers. Retrying telemetry never re-executes a governed
  tool or repeats its authorization decision.
- Added SQS partial-batch failure handling, process-local delivery counters,
  and bounded shutdown through `close(timeout=...)`.
- Documented the telemetry privacy boundary and the limits of process-local
  delivery status.

  TypeScript SDK 0.1.21
  September 11, 2026
  Fixed

**Fixed**

- Continue polling canonical unresolved STEP_UP hold responses until resolution
  or the configured deadline instead of treating a missing decision field as a
  terminal fallback block. Timeout and malformed-response handling remain
  fail-closed.

  TypeScript SDK 0.1.20
  September 11, 2026
  Added, Changed

**Added**

- Added a per-action attestation ID, generated for each tool call unless the
  caller supplies one, and propagated it through authorization, lifecycle
  telemetry, decisions, and policy errors.
- Added bounded human-explanation requests for blocked and step-up decisions and
  exposed the explanation on decisions and `ThothPolicyViolation`.
- Exported behavioral-event emission and per-event delivery status types for
  applications that need process-local telemetry health signals.

**Changed**

- Minimize default telemetry with an explicit field allowlist; omit tool arguments and free-text context, reasons, explanations and full receipts. Authorization inputs and enforcement behavior are unchanged. See PRIVACY.md for wire data and migration limits.
- Remove payload-bearing diagnostic logs and verify the installed npm artifact against a local HTTP collector.
- Make telemetry delivery resilient: bounded retries with stable event IDs, so a
  retried delivery is de-duplicable server-side and never replays a governed tool
  call or re-requests authorization.
- Use native Node ESM imports throughout the published package.
- Restrict the published package to built output, source and user-facing docs via
  an explicit `files` allowlist. Development-only files (tests, CI workflows,
  `tsconfig.json`, fixtures and internal notes) are no longer published, and a
  packing artifact can no longer be swept into the tarball.

  Pulumi provider 0.1.15
  July 23, 2026
  Changed, Fixed

**Changed**

- Updated Terraform provider bridge dependency pin to
  `github.com/atensecurity/terraform-provider-thoth v0.1.15`.
- Bumped Pulumi release defaults/docs to `0.1.15`:
  - `Makefile` default `VERSION`
  - plugin install command in `docs/installation-configuration.md`

**Fixed**

- Updated docs for Pulumi Registry lint compatibility:
  - extensionless internal cross-link in `docs/_index.md`
  - markdown SDK links (no bare URLs) in
    `docs/installation-configuration.md`

  Terraform provider 0.1.15
  July 23, 2026
  Fixed

**Fixed**

- Updated provider docs for Pulumi Registry compatibility by converting
  markdown cross-links to extensionless paths and replacing bare SDK URLs with
  explicit markdown links.

  Pulumi provider 0.1.14
  July 10, 2026
  Fixed

**Fixed**

- Added required YAML front-matter blocks to:
  - `docs/_index.md`
  - `docs/installation-configuration.md`
- This unblocks Pulumi registry metadata generation (`resourcedocsgen metadata from-github`)
  and future nightly community-package refreshes.

  Terraform provider 0.1.14
  July 10, 2026
  Changed

**Changed**

- Release alignment patch to unblock downstream Pulumi provider `v0.1.14`
  publishing and registry metadata refresh.

  Pulumi provider 0.1.13
  July 9, 2026
  Changed, Added

**Changed**

- Updated Terraform provider bridge dependency pin to
  `github.com/atensecurity/terraform-provider-thoth v0.1.13`.
- Bumped Pulumi release defaults/examples to `0.1.13`:
  - `Makefile` default `VERSION`
  - README release line and manual plugin-install command docs
  - Node.js and .NET example package references
- Updated Pulumi bridge language metadata so Node.js SDK publishing is declared
  as `@atensec/pulumi-thoth` (matching npm publication and registry install
  instructions).
- Corrected .NET namespace configuration to avoid doubled NuGet identity
  rendering in generated metadata/docs.
- Added explicit plugin download URL + bridge metadata wiring in provider
  metadata for release consistency.

**Added**

- Added complete cross-language examples under `examples/` for Node.js, Python,
  and .NET with matching stack config templates.
- Added code examples to `docs/_index.md` for Node.js, Python, and .NET quick
  starts.

  Terraform provider 0.1.13
  July 9, 2026
  Added, Changed

**Added**

- Added policy-exception workflow resources:
  - `thoth_policy_exception`
  - `thoth_policy_exception_review`
  - `thoth_policy_change_artifact_apply`
- Added policy-exception workflow data sources:
  - `thoth_policy_exception`
  - `thoth_policy_exceptions`
  - `thoth_policy_change_artifact`
  - `thoth_policy_change_artifacts`
- Added governance + MCP summary data sources:
  - `thoth_governance_executive_summary`
  - `thoth_governance_board_incident_summary`
  - `thoth_mcp_inventory_digest`
- Added policy-exception workflow example under
  `examples/policy-exception-workflow`.

**Changed**

- Expanded governance cost report coverage to include pricing-catalog metadata,
  fallback counters, and unresolved-model visibility fields.
- Refreshed provider docs/README for the new policy exception and governance
  summary surfaces.

  Thoth CLI and MCP proxy 0.3.6
  July 9, 2026
  Fixed

**Fixed**

- Emitted behavioral telemetry events from the Rust `thoth` proxy for local
  preflight outcomes (`BLOCK`, `DEFER`, `STEP_UP`) and forwarded execution
  outcomes so Claude Desktop/runtime decisions are ingested through
  `/v1/events/batch` and appear in governance feeds.

  Go SDK 0.1.18
  June 20, 2026
  Changed

**Changed**

- Added configurable resilience mode via `Config.FailOpen` / `THOTH_FAIL_OPEN`.
  When enabled, enforcer transport failures and retryable statuses (`429`, `5xx`)
  return `ALLOW` so tool execution can continue.
- Auth failures (`401`/`403`) remain fail-closed and continue returning `BLOCK`.
- Added regression coverage in internal and public SDK tests for fail-open/fail-closed behavior.
- Added vendor-runtime observability coexistence tests for Datadog, LangSmith, OpenTelemetry,
  and Sentry in an isolated compat test module (`sdk/thoth/compat`).
- Added compatibility matrix CI coverage for Go runtime-stack coexistence verification.

  Python SDK 0.5.21
  June 20, 2026
  Changed

**Changed**

- Added configurable resilience mode via `ThothConfig.fail_open` / `THOTH_FAIL_OPEN`.
  When enabled, enforcer transport failures and retryable statuses (`429`, `5xx`)
  return `ALLOW` so agent execution can continue.
- Auth failures (`401`/`403`) remain fail-closed and continue returning `BLOCK`.
- Added regression tests for fail-open timeout, retryable status, and auth-failure handling.
- Added LangSmith coexistence integration coverage
  (`tests/integrations/test_langsmith_compat.py`) to ensure `traceable` tools
  continue to execute under Thoth governance wrappers.
- Added observability-wrapper coexistence integration coverage for Datadog-like,
  OpenTelemetry-like, and Sentry-like instrumentation patterns
  (`tests/integrations/test_observability_compat.py`).
- Hardened `instrument()` wrapping for LangChain-style duck-typed tools so
  `_run` and `run` are both governed even when LangChain classes are not
  importable at runtime.
- Fixed generic `.tools` wrapping for callable-only tool entries (plain
  functions/callables), which are now replaced with governed callables instead
  of bypassing enforcement.
- Added regression tests for callable-only tool entries and LangChain
  duck-typed `_run`/`run` wrapping in `tests/test_instrumentor.py`.
- Added first-class LangGraph instrumentation APIs:
  `instrument_langgraph()`, `instrument_tool_node()`, and `@thoth_graph`.
- Added mock-mode LangGraph decision simulation (`THOTH_MOCK_MODE=true`) for
  local end-to-end development without a live enforcer.
- Added `ThothDeferredError` and LangGraph DEFER handling that raises without
  executing the tool and emits defer metadata in tool telemetry.
- Added a thread-safe session call-history path for concurrent LangGraph
  branches via `SessionContext.pending_tool_calls(...)`.

  TypeScript SDK 0.1.19
  June 20, 2026
  Changed

**Changed**

- Added configurable resilience mode via `failOpen` / `THOTH_FAIL_OPEN`.
  When enabled, enforcer transport failures and retryable statuses (`429`, `5xx`)
  return `ALLOW` so tool execution can continue.
- Auth failures (`401`/`403`) remain fail-closed and continue returning `BLOCK`.
- Added regression tests for fail-open timeout/status behavior and auth-failure handling.
- Added vendor-runtime compatibility regression tests for Datadog, LangSmith,
  OpenTelemetry, and Sentry coexistence with Thoth tool interception.
- Added compatibility matrix CI coverage with per-stack TypeScript runtime test runs.

  Python SDK 0.5.20
  June 15, 2026
  Added

**Added**

- Added a LangGraph runtime enforcement example at
  `examples/langchain/langgraph_runtime_enforcement.py` that demonstrates
  observe and progressive enforcement flows using `instrument_toolchain()`.
- Added a companion policy example at
  `examples/langchain/policies/research_agent.rego` covering allow, step-up,
  block, and flag outcomes for a research-agent toolchain.
- Added a cookbook notebook at
  `examples/langchain/cookbook_agent_governance.ipynb` with end-to-end shadow
  and enforce walkthroughs.
- Added a reusable composite GitHub Action at
  `.github/actions/thoth-policy-check/` for static policy checks against
  Python agent tool-call patterns.
- Added a static analysis helper script at
  `scripts/langchain/thoth_policy_check.py` used by the action.
- Added a vendor-neutral RFC issue draft for LangGraph tool interception hooks
  at `docs/contributions/langchain_rfc_tool_hooks.md`.
- Added an engineering blog draft at
  `docs/blog/langchain-runtime-enforcement.md`.

  Pulumi provider 0.1.12
  June 10, 2026
  Changed, Added, Fixed

**Changed**

- Updated Terraform provider bridge dependency pin to
  `github.com/atensecurity/terraform-provider-thoth v0.1.12`.
- Bumped Pulumi release defaults/examples to `0.1.12`:
  - `Makefile` default `VERSION`
  - Node.js example package dependency (`@atensec/pulumi-thoth`)

**Added**

- Pulumi bridge now exposes Terraform `0.1.12` MCP vendor registry and catalog
  verification surfaces:
  - `McpVendor` resource
  - `getMcpVendors` data source
  - `McpCatalogVerify` resource
  - `getMcpInventoryReport` data source

**Fixed**

- Inherited Terraform `0.1.12` stabilization for MCP vendor `hostPatterns`
  ordering so Pulumi up/refresh operations converge deterministically when API
  response ordering differs.

  Thoth CLI and MCP proxy 0.3.5
  June 10, 2026
  Added, Changed

**Added**

- Added MCP vendor registry and catalog verification command surfaces in `thothctl`
  to align CLI capability with current control-plane governance APIs.

**Changed**

- Updated release automation and public distribution flow for `thoth` and `thothctl`
  so production release tags drive Homebrew package publication from signed assets.

  Terraform provider 0.1.12
  June 9, 2026
  Added, Fixed

**Added**

- Added MCP vendor registry support:
  - `thoth_mcp_vendor` resource
  - `thoth_mcp_vendors` data source
- Added MCP inventory and verification surfaces:
  - `thoth_mcp_inventory_report` data source
  - `thoth_mcp_catalog_verify` resource

**Fixed**

- Stabilized `thoth_mcp_vendor.host_patterns` state behavior to avoid apply/read
  inconsistencies caused by server-side ordering differences.

## Earlier releases

Combined release-line notes up to June 8, 2026.

- [v0.1.18 / v0.3.4 (June 8, 2026)](#release-v0-1-18-v0-3-4-2026-06-08)
- [v0.1.18 / v0.3.3 (May 14, 2026)](#release-v0-1-18-v0-3-3-2026-05-14)
- [v0.1.17 / v0.3.3 (May 10, 2026)](#release-v0-1-17-v0-3-3-2026-05-10)
- [v0.1.16 / v0.3.0 (May 5, 2026)](#release-v0-1-16-v0-3-0-2026-05-05)
- [v0.1.15 / v0.2.23 (April 30, 2026)](#release-v0-1-15-v0-2-23-2026-04-30)
- [v0.1.14 / v0.2.22 (April 28, 2026)](#release-v0-1-14-v0-2-22-2026-04-28)
- [v0.5.5 / v0.2.20 (April 27, 2026)](#release-v0-5-5-v0-2-20-2026-04-27)
- [v0.5.4 / v0.2.19 (April 26, 2026)](#release-v0-5-4-v0-2-19-2026-04-26)
- [v0.5.4 / v0.2.18 (April 26, 2026)](#release-v0-5-4-v0-2-18-2026-04-26)
- [v0.1.6 / v0.2.8 (April 24, 2026)](#release-v0-1-6-v0-2-8-2026-04-24)
- [v0.1.6 / v0.2.8 (April 22, 2026)](#release-v0-1-6-v0-2-8-2026-04-22)
- [v0.1.6 / v0.2.7 (April 21, 2026)](#release-v0-1-6-v0-2-7-2026-04-21)
- [v0.1.6 / v0.2.3 (April 20, 2026)](#release-v0-1-6-v0-2-3-2026-04-20)
- [v0.1.6 / v0.2.2 (April 19, 2026)](#release-v0-1-6-v0-2-2-2026-04-19)
- [v0.1.3 / v0.2.0 (April 15, 2026)](#release-v0-1-3-v0-2-0-2026-04-15)
- [v0.1.2 (April 10, 2026)](#release-v0-1-2-2026-04-10)
- [v0.1.1 (March 31, 2026)](#release-v0-1-1-2026-03-31)
- [v0.1.0 (March 30, 2026)](#release-v0-1-0-2026-03-30)

  v0.1.18 / v0.3.4
  June 8, 2026

    Enterprise release pathway: Homebrew tap + notarized PKG + supply-chain trust metadata

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.17`
- Python SDK: unchanged at `sdk/python/v0.1.16`
- TypeScript SDK: unchanged at `sdk/npm/v0.1.18`
- Thoth proxy + `thothctl` binary line: `thoth/v0.3.4`
- Terraform provider: unchanged at `v0.1.11`
- Pulumi provider: unchanged at `v0.1.11`

  ⚡
  Improvements

**Enterprise distribution and verification**

- Added Homebrew tap publication flow for `atensecurity/homebrew-tap`.
- Added notarized macOS PKG release pathway for MDM deployments (Jamf/Intune/Kandji).
- Published Santa trust metadata (`santa-metadata.json`) and signing metadata for endpoint allowlisting.
- Expanded release metadata set: SBOMs (CycloneDX + SPDX), provenance, immutable manifest, checksums, and Sigstore keyless signatures.
- Added documentation runbooks for release channels, Santa trust policy, Kandji deployment, and deployment validation matrix.

  v0.1.18 / v0.3.3
  May 14, 2026

    MODIFY, DEFER, and complete MOSES decision envelope across Python, Go, and TypeScript

This release line publishes:

- Go SDK: `sdk/go/v0.1.17`
- Python SDK: unchanged at `sdk/python/v0.1.16`
- TypeScript SDK: `sdk/npm/v0.1.18`
- Thoth proxy + `thothctl` binary line: unchanged at `thoth/v0.3.3`
- Terraform provider: unchanged at `v0.1.11`
- Pulumi provider: unchanged at `v0.1.11`

  ✦
  New Features

**Two new decision outcomes**

- **`MODIFY`** — the enforcer rewrites tool arguments before execution. The governed wrapper calls the tool with the modified args. `PolicyViolationError` / `ThothPolicyViolation` is not raised — execution proceeds with policy-applied arguments. The audit trail carries both the original request and the modification reason.
- **`DEFER`** — the enforcer signals the caller to retry after a specified timeout. Different from `STEP_UP`: no human approval required, time-bounded, and recoverable by design. The error surfaces `deferTimeoutSeconds` / `DeferTimeoutSeconds` for caller-side retry logic.

Legacy enforcer aliases normalize automatically: `TRANSFORM→MODIFY`, `HOLD/DEFERRED→DEFER`, `DENY→BLOCK`, `CHALLENGE/ESCALATE→STEP_UP`.

**Full MOSES ML decision envelope in SDK error types**

`PolicyViolationError` (Go) and `ThothPolicyViolation` (Python and TypeScript) now carry six new fields from the MOSES two-tier enforcement path:

| Field | Description |
|---|---|
| `decision_envelope_version` / `DecisionEnvelopeVersion` | Schema version of the enforcer response — for forward-compatibility checks |
| `enforcement_trace_id` / `EnforcementTraceID` | Correlation ID following the request through enforcer → fast-ML → deep-LLM |
| `fastml_features` / `FastMLFeatures` | ONNX fast-ML feature vector used to score the request |
| `score_components` / `ScoreComponents` | Composite risk score breakdown by component (scope, velocity, identity binding, etc.) |
| `top_contributors` / `TopContributors` | Ranked list of highest-weight features that drove the decision |
| `decision_evidence` / `DecisionEvidence` | Raw evidence fields from the enforcer response envelope |

These fields are available directly on the caught exception — no additional API calls needed for incident reporting or audit trail reconstruction.

  ⚡
  Improvements

**Canonical observe mode**

`shadow` is no longer part of the public SDK surface. The canonical enforcement mode is `observe`. The enforcer and all three SDKs continue to accept `shadow` as an alias — no config changes required in running deployments.

**Expanded policy context propagation**

`ThothConfig` / `Config` now accepts `environment`, `enforcement_trace_id`, `session_intent`, `purpose`, `data_classification`, and `task_context`. All fields are forwarded on every enforcement call.

**HTTP diagnostics**

Improved error messages for `401`/`403` enforcer responses with actionable hints about API key scope and ingest token configuration.

  v0.1.17 / v0.3.3
  May 10, 2026

    Proxy 0.3.3 and provider 0.1.7 release alignment

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.15`
- Python SDK: `sdk/python/v0.1.16`
- TypeScript SDK: `sdk/npm/v0.1.17`
- Thoth proxy + `thothctl` binary line: `thoth/v0.3.3`
- Terraform provider: `v0.1.7`
- Pulumi provider: `v0.1.7`

  ⚡
  Improvements

**Docs and release consistency**

- Promoted Thoth CLI/proxy docs to the `thoth/v0.3.3` binary line.
- Standardized provider references on `v0.1.7` across Terraform and Pulumi docs.

  v0.1.16 / v0.3.0
  May 5, 2026

    Org API key auth for IaC + Thoth 0.3.0 release line

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.15`
- Python SDK: unchanged at `sdk/python/v0.1.15`
- TypeScript SDK: unchanged at `sdk/npm/v0.1.16`
- Thoth proxy + `thothctl` binary line: `thoth/v0.3.0`
- Terraform provider: `v0.1.3`
- Pulumi provider: `v0.1.2`

  ⚡
  Improvements

**Infrastructure-as-code provider releases**

- Added org-level API key auth for provider workflows and preserved bearer-token compatibility.
- Standardized CI/CD auth through `THOTH_API_KEY` for Terraform and Pulumi provider usage.
- Updated provider release notes and docs for dual-auth guidance.

**Thoth binary line release**

- Published `thoth/v0.3.0` and aligned customer-facing install/version references.
- Updated release docs to reflect the current stable binary line for `thoth` and `thothctl`.

  v0.1.15 / v0.2.23
  April 30, 2026

    Canonical release lines, Secrets Broker GA docs, and ingest resilience

This release line publishes:

- Go SDK: `sdk/go/v0.1.14`
- Python SDK: `sdk/python/v0.1.14`
- TypeScript SDK: `sdk/npm/v0.1.15`
- Thoth endpoint runtime: `thoth/v0.2.23`

  ⚡
  Improvements

**Release and upgrade clarity**

- Standardized customer docs on canonical release channels (`thoth/v*` for endpoint runtime, `sdk/*` for SDKs).
- Updated install and quick-reference pages to reflect current stable versions and package constraints.

**Operator workflows**

- Added customer-ready strict-mode Secrets Broker examples for MCP tools (for example Figma, Notion, and Stitch host bindings).
- Documented fail-closed token handling patterns for endpoint runtime use without storing long-lived tokens in local tool config.

**Runtime resilience**

- Hardened telemetry ingest behavior for intermittent `403`/edge enforcement failures to reduce dropped event noise and improve operator troubleshooting.

  v0.1.14 / v0.2.22
  April 28, 2026

    SDK log-level controls + governance envelope hardening

This release line publishes:

- Go SDK: `sdk/go/v0.1.13`
- Python SDK: `sdk/python/v0.1.13`
- TypeScript SDK: `sdk/npm/v0.1.14`
- Thoth endpoint runtime: `thoth/v0.2.22`

  ⚡
  Improvements

**SDK diagnostics and enforcement traceability**

- Added SDK log-level controls across Go, Python, and TypeScript for cleaner operator debugging.
- Improved STEP_UP token and enforcement trace diagnostics to make approval-path troubleshooting faster.

**Thoth control-plane hardening**

- Unified auth/delegation envelope fields across control-plane and runtime services.
- Added stricter default purpose-class enforcement and promotion lifecycle guardrails.
- Hardened model-router policy behavior and admin settings integration for safer runtime rollout control.
- Clarified API key redaction output and governance feed query UX.

  v0.5.5 / v0.2.20
  April 27, 2026

    Tenant-scoped telemetry and API-key hardening

This release line publishes:

- Go SDK: `sdk/go/v0.1.11`
- Python SDK: `sdk/python/v0.5.4`
- TypeScript SDK: `sdk/npm/v0.5.5`
- Thoth endpoint runtime: `thoth/v0.2.20`

  ⚡
  Improvements

**SDK telemetry isolation**

- Go, Python, and TypeScript SDK ingestion paths now align to tenant-scoped telemetry/event IDs to avoid cross-tenant event collisions.
- Instrumentation payload models were updated to preserve scoped event identity throughout ingest and normalization.

**Endpoint runtime management**

- Improved API key management UX and guidance for scope-aware authorization.
- Set a secure 90-day default API key expiry with proactive warnings for near-expiry keys.
- Fixed shadow mode STEP_UP visibility so review-to-agent-registry flows surface approval state consistently.

  v0.5.4 / v0.2.19
  April 26, 2026

    In-place runtime update experience

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.10`
- Python SDK: unchanged at `sdk/python/v0.5.3`
- TypeScript SDK: unchanged at `sdk/npm/v0.5.4`
- Thoth endpoint runtime: `thoth/v0.2.19`

  ⚡
  Improvements

**Lifecycle management**

- Added in-place update workflows for endpoint runtime and admin tooling.
- Each command checks GitHub Releases, verifies asset checksums (`checksums.sha256`), and installs only verified binaries.
- `--force` is supported for explicit reinstallation of the latest release.

**Customer docs**

- Updated external docs to reflect current Thoth binary line `v0.2.19`.
- Added update workflow guidance so operators can keep binaries current without reinstall scripts.

  v0.5.4 / v0.2.18
  April 26, 2026

    Scoped key reliability + SDK ingest auth parity

This release line publishes:

- Go SDK: `sdk/go/v0.1.10`
- Python SDK: unchanged at `sdk/python/v0.5.3`
- TypeScript SDK: `sdk/npm/v0.5.4`
- Thoth endpoint runtime: `thoth/v0.2.18`

  ⚡
  Improvements

**SDK ingest reliability**

- Go and TypeScript SDK emitters now send both `Authorization: Bearer ...` and `X-Api-Key` headers on ingest calls to match enforcer/runtime expectations.
- Non-2xx ingest failures now log the HTTP status, target URL, and a safe response-body snippet to speed up debugging.

**API key management**

- API key creation and authorization flows now support explicit scope selectors:
  - `--organization`
  - `--fleet-id`
  - `--endpoint-id`
  - `--agent-id`
- Command help now explains key scope vs runtime context matching in plain language.
- Authorization output now includes clear hints when validation fails due to expiry, permission mismatch, or scope mismatch.

**Operator docs**

- Public runbooks now use explicit scope flags in API key command examples so customer operators can copy/paste known-good commands.

  v0.1.6 / v0.2.8
  April 24, 2026

    Python SDK `ThothClient` Backward-Compatibility Export

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.5`
- Python SDK: unchanged at `sdk/python/v0.1.6`
- TypeScript SDK: unchanged at `sdk/npm/v0.1.6`
- Thoth binary line: unchanged at `thoth/v0.2.8`

  ⚡
  Improvements

**Python SDK (`atensec-thoth`)**

- Restored `from thoth import ThothClient` compatibility export.
- Added legacy method aliases (`wrap`, `wrap_openai_tools`, `wrap_anthropic_tools`) that delegate to current `instrument*` APIs.

**Documentation**

- Python SDK README now includes a legacy compatibility section for `ThothClient`.
- Docs-site Python SDK reference now calls out preferred module-level APIs and legacy `ThothClient` support.

  v0.1.6 / v0.2.8
  April 22, 2026

    Headless operations improvements

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.5`
- Python SDK: unchanged at `sdk/python/v0.1.6`
- TypeScript SDK: unchanged at `sdk/npm/v0.1.6`
- Thoth endpoint runtime: `thoth/v0.2.8`

  ⚡
  Improvements

**Fleet management + MDM providers**

- Added tenant-scoped MDM provider configuration and sync workflows for Jamf and Intune.
- Fleet management now supports on-demand provider inventory synchronization to upsert endpoint records.
- Provider sync now supports default fleet and environment mapping for imported endpoints.

**Headless control plane**

- Admin tooling is now documented as the default path for no-dashboard bootstrap and updates.
- New headless operations section covers API-driven and automation-driven orchestration patterns.
- Documentation now emphasizes customer-run automation workflows without dashboard dependency.
- SIEM/PAM integration guidance is now aligned to API-first and CI-driven operations.
- Added browser control-plane workflows for provider, policy, and enrollment management across supported browsers.
- Added browser sync workflows for endpoint-side policy resolution and managed artifact application (`applied`/`rendered`/`dry_run`) to support mixed browser fleets.

**Manual endpoint enrollment**

- Fleet management now provides generated re-enrollment scripts for endpoints not associated with a fleet.
- Direct endpoint enrollment supports optional fleet assignment through `THOTH_FLEET_ID`.
- Endpoint health state remains current through periodic proxy check-ins.

**Documentation**

- Added external-facing docs for MDM provider sync and manual endpoint enrollment flow.
- Proxy install docs now default to `thoth/v0.2.8`.
- Added public-platform delivery workflows: Terraform-based public repo bootstrap and CI mirroring for provider/runbook content.

  v0.1.6 / v0.2.7
  April 21, 2026

    Proxy Identity Defaults + Enforcer Context-Diff Warnings

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.5`
- Python SDK: unchanged at `sdk/python/v0.1.6`
- TypeScript SDK: unchanged at `sdk/npm/v0.1.6`
- MCP Proxy: `thoth/v0.2.7`

  ⚡
  Improvements

**MCP Proxy (`thoth` binary)**

- Endpoint identity resolution now defaults to immutable machine identity (Intune/Jamf managed ID override, then OS machine ID), with hostname only as last-resort fallback.
- `THOTH_USER_ID` remains required and must be a valid email address.
- `enforcer_url` and `govapi_url` are inferred from `tenant_id` + `apex_domain`.
- `--enforcer-url` / `THOTH_ENFORCER_URL` are now deprecated and ignored.

**Enforcer**

- Requests with valid keys now proceed even when endpoint/fleet scope context does not match exactly; enforcer emits warnings for follow-up.
- Tenant user-domain mismatches are now warn-only when key validation succeeds.

**Documentation**

- Customer docs now reflect `thoth/v0.2.7` defaults for identity, URL inference, and runtime env expectations.

  v0.1.6 / v0.2.3
  April 20, 2026

    Wrap-Config Env Injection + Simpler Endpoint Routing

This release line publishes:

- Go SDK: unchanged at `sdk/go/v0.1.5`
- Python SDK: unchanged at `sdk/python/v0.1.6`
- TypeScript SDK: unchanged at `sdk/npm/v0.1.6`
- MCP Proxy: `thoth/v0.2.3`

  ⚡
  Improvements

**MCP Proxy (`thoth` binary)**

- `thoth wrap-config` now supports repeatable `--env KEY=VALUE` to inject runtime environment values directly into selected MCP server entries.
- Wrap output remains idempotent and now reports environment changes when values are updated.
- Fleet registration URL handling is simplified:
  - `govapi_url` is derived automatically from `tenant_id` + `apex_domain` as `https://grid.<tenant>.<apex-domain>`.
  - `enforcer_url` is derived automatically as `https://enforce.<tenant>.<apex-domain>` when not explicitly set.
  - legacy `gov_api_url` compatibility paths are removed.
- Runtime identity hardening:
  - `THOTH_USER_ID` must be a valid email address.
  - customer domain policy is enforced centrally by enforcer tenant metadata (admin-managed), with automatic request blocking for non-matching user domains.

**Documentation**

- Customer-facing docs are updated for `v0.2.3`.
- Proxy setup examples now use supported `wrap-config` flags and document inline environment injection via `--env`.

  v0.1.6 / v0.2.2
  April 19, 2026

    Fail-Closed Enforcement + Canonical Contract Parity

This release line publishes:

- Go SDK: `sdk/go/v0.1.5`
- Python SDK: `sdk/python/v0.1.6`
- TypeScript SDK: `sdk/npm/v0.1.6`
- MCP Proxy: `thoth/v0.2.2`

  ⚡
  Improvements

**Proxy + SDK enforcement behavior**

- Go and proxy paths now enforce fail-closed posture on enforcer/runtime failures.
- Enforcement payload contract is normalized to canonical fields:
  - `tool_args`
  - `enforcement_trace_id`
  - `user_id`, `approved_scope`, `session_intent`, `session_tool_calls`
- Session tool-call history is bounded to the latest 128 calls for parity across Go and proxy paths.

**Documentation**

- Docs now reflect fail-closed behavior in SDK guidance and security posture sections.
- Version banners and docs-site changelog are updated for the latest SDK/proxy releases.

  v0.1.3 / v0.2.0
  April 15, 2026

    Telemetry Metadata + Policy Context Propagation

This release publishes:

- Go SDK: unchanged at `sdk/go/v0.1.2`
- Python SDK: `sdk/python/v0.1.3`
- TypeScript SDK: `sdk/npm/v0.1.3`
- MCP Proxy: `thoth/v0.2.0` (public release: `atensecurity/thoth` `v0.2.0`)

  ⚡
  Improvements

**Python SDK (`atensec-thoth`)**

- `BehavioralEvent` now includes endpoint context fields:
  - `endpoint_id`
  - `hostname`
- `BehavioralEvent` now includes WORM chain evidence fields:
  - `chain_index`
  - `hash`
  - `previous_hash`
  - `signature`
- Dependency lock/metadata refreshed as part of the SDK patch line.

**TypeScript SDK (`@atensec/thoth`)**

- Enforcer payload now propagates:
  - `tool_args`
  - `user_id`
  - `metadata.policy_context`
  - `enforcement_trace_id`
- `ThothConfig` adds:
  - `policyContext`
  - `enforcementTraceId`
- Instrumentation now serializes tool call arguments safely before enforcement checks.

**MCP Proxy (`thoth` binary)**

- Emitted events now include normalized top-level endpoint metadata:
  - `endpoint_id`
  - `hostname`
- Event metadata includes `hostname` consistently for downstream pipelines.
- MCP proxy distribution now uses the cross-platform `thoth` binary release line.
- Docs + install path standardized to:
  - `curl -fsSL https://install.atensecurity.com/thoth | sh`
  - GitHub release assets from `atensecurity/thoth`

  v0.1.2
  April 10, 2026

    Tenant API URL Contract + Session Intent Enforcement

This release publishes `v0.1.2` for all Thoth SDKs:

- Go: `sdk/go/v0.1.2`
- Python: `sdk/python/v0.1.2`
- TypeScript: `sdk/npm/v0.1.2`

  ⚡
  Improvements

**Unified SDK API URL contract**

- Go, Python, and TypeScript SDKs now use a single tenant API URL for both:
  - policy enforcement (`POST /v1/enforce`)
  - behavioral event ingestion (`POST /v1/events/batch`)
- SDK startup now requires tenant API URL configuration via:
  - explicit config (`APIURL` / `api_url` / `apiUrl`)
  - or `THOTH_API_URL`
- Removed SDK fallbacks to hosted global defaults and split endpoint semantics.

**Go SDK**

- `NewClient` now fails fast when `APIURL` is missing.
- Examples and tests updated to pass `THOTH_API_URL` explicitly.
- SDK docs now include required env setup and quickstart examples.

**Python SDK**

- `ThothConfig` now requires tenant API URL resolution (`api_url` or `THOTH_API_URL`) and enforces a single URL contract.
- `resolved_enforcer_url` now follows the single-URL contract and mirrors `resolved_api_url`.
- `session_intent` is now accepted in config and passed to enforcement payloads.
- Step-up polling now sends auth headers when `api_key` is present.

**TypeScript SDK**

- Removed `HOSTED_API_URL` fallback and split enforcer semantics.
- `instrument()` now throws at startup when `apiUrl`/`THOTH_API_URL` is missing.
- Enforcement and event emission now route through the same tenant API URL.
- `sessionIntent` is now supported in config and forwarded to enforcement payloads.
- Runtime/test baseline updated and validated for Node.js 18+ compatibility.

  v0.1.1
  March 31, 2026
  API Contract Fixes

This patch release fixes critical mismatches between the Go and TypeScript SDKs and the
enforcement API. All SDK consumers on v0.1.0 should upgrade.

  ⚠
  Bug Fixes

**Go SDK (`github.com/atensecurity/thoth-go`)**

- Critical enforcement compatibility and decision-handling fixes across request/response mapping.
- Endpoint and schema alignment updates for stable enforcement and step-up behavior.
- Improved client metadata propagation and response observability fields.

**TypeScript SDK (`@atensec/thoth`)**

- `emitBehavioralEvent` was not exported from the package root. It is now accessible via
  `import { emitBehavioralEvent } from "@atensec/thoth"`.

**REST API documentation**

- All endpoint paths, request field names (corrected to snake_case), response schemas, and
  HTTP status codes in the API reference now match the actual backend.

  v0.1.0
  March 30, 2026

    First General Availability Release

This is the first general-availability release of the Thoth SDK. All three language SDKs
(Python, Go, TypeScript) are stable and production-ready.

  ✦
  New Features

**Hosted API — single API key, zero infrastructure**

The Thoth enforcement and event ingestion API is now hosted at `https://api.atensecurity.com`.
Authentication requires a single `THOTH_API_KEY` — no AWS credentials, no infrastructure setup.
All three SDKs pick it up automatically from the environment.

```bash
export THOTH_API_KEY="thoth_live_your_key_here"
```

**Python SDK (`thoth-sdk`)**

- `instrument(agent, ...)` — Instrument any AI agent with a `.tools` attribute. Auto-detects
  LangChain `AgentExecutor` and CrewAI `Agent` via duck-typing.
- `instrument_anthropic(tool_fns, ...)` — Wrap tool execution functions for Anthropic Claude
  agentic loops. Returns a governed `dict[str, Callable]`.
- `instrument_openai(tool_fns, ...)` — Wrap tool execution functions for OpenAI tool-calling loops.
- `ThothPolicyViolation` exception — raised when the enforcer blocks a tool call. Fields:
  `tool_name`, `reason`, `violation_id`.
- `get_current_session()` — Access the active session context from within a governed tool call.
- `ThothConfig` — Pydantic model with full field validation.
- `EnforcementMode` enum — `observe` | `progressive` | `step_up` | `block`.
- LangGraph and CrewAI integrations — auto-detected via duck-typing.

**Go SDK (`github.com/atensecurity/thoth-go`)**

- `NewClient(Config)` — Initialize the Thoth client with env-var fallback.
- `Client.WrapTool` / `Client.WrapToolFunc` — wrap string and map tool functions.
- `Client.StartSession(ctx, agentID, sessionID)` — per-request session isolation.
- `PolicyViolationError`, `StepUpRequiredError` — typed error values.
- Fail-open guarantee — enforcer unreachable never blocks tool execution.

**TypeScript SDK (`@atensec/thoth`)**

- `instrument<T>(agent, config)` — generic agent instrumentation; preserves TypeScript types.
- `wrapAnthropicTools` / `wrapOpenAITools` — sub-path imports for framework-specific wrappers.
- `ThothPolicyViolation` — extends `Error`. Fields: `toolName`, `reason`, `violationId`.
- `EnforcementMode` enum, `ThothConfig` interface, `BehavioralEvent` interface.
- Async generator support and `strict: true` compilation.

**REST API (`https://api.atensecurity.com`)**

- `POST /v1/events/batch` — up to 100 events per batch; idempotent via `event_id`; 90-day retention.
- `POST /v1/enforce` — returns `ALLOW | BLOCK | STEP_UP` with progressive anomaly scoring.
- `GET /v1/enforce/hold/{hold_token}` — returns `pending | approved | denied | expired`.
- Rate limits: 1,000 req/min (events), 500 req/min (enforce), 200 req/min (hold) per tenant.

  ⚡
  Enforcement Modes

| Mode          | Behavior                                                              |
| ------------- | --------------------------------------------------------------------- |
| `observe`     | Log and emit events only. Never block.                                |
| `progressive` | Escalating enforcement based on session anomaly scoring. **Default.** |
| `step_up`     | Always require human approval for out-of-scope tools.                 |
| `block`       | Immediately reject with `ThothPolicyViolation`.                       |