release: v0.4.0 (agentic_posture verify) (spec 210)

[bartekus]

First release since v0.3.0, bundling PRs #12 and #13 (OAP spec 210 verify half).
Additive feature, so this is a minor bump under 0.x.

• Added (feat: carry + adjudicate agentic_posture binding (OAP spec 210 verify half) #12, spec 001): verify-certificate carries and adjudicates the
  certificate's agenticPostureBinding (round-tripped through the typed cert
  struct so the self-hash and Ed25519 signature hold), then adjudicates internal
  consistency, an SBOM cross-check of a declared none under --sbom-dir, and the
  spec 210 FR-004 governance-envelope shape check.
• Added (fix(001): ecosystem-scope SDK watchlist + drop contradictory unknown-posture notice (spec 210 verify) #13, spec 001): ecosystem-scoped the agentic-SDK watchlist (npm openai
  no longer matches pkg:pypi/openai; the purl match anchors on the name segment)
  and skipped the cross-check when internal consistency already failed, dropping
  the contradictory unknown-posture notice.
• Version bumped in lockstep across Cargo.toml (workspace + internal dep pins),
  npm/package.json (main + five platform optionalDependencies), and
  py/pyproject.toml; Cargo.lock and the by-package/tenant-tail.json
  codebase-index shard regenerated.

Local gates green: cargo fmt --all --check, clippy -D warnings --locked,
build --workspace --locked, spec-spine index check.

Spec-Drift-Waiver: Cargo.toml, npm/package.json, py/pyproject.toml release version bump to 0.4.0; a version-number change with no behavioral or spec-content change (the shipped behaviors were authored and spec-coupled in #12 and #13). Mirrors the accepted v0.3.0 release waiver in #8.

[github-actions]

AI Code Review

Now I have enough context to write the review.

---

Code Review: tenant-tail v0.4.0

Summary

This is a version-bump + CHANGELOG PR for the agenticPostureBinding work already merged in PRs #12 and #13. Spec-spine coupling discipline checks out: spec 001 was updated in the feature PRs and the .derived/ shard hash is correctly updated here. The Rust crate by-package index files don't carry semantic versions, so their absence from the diff is correct.

---

Bugs / Logic

purl_matches — partial percent-decoding (certificate.rs:1337–1355)

The function decodes %40 → @ but not %2F → /. CycloneDX tooling that emits fully percent-encoded scoped npm purls — pkg:npm/%40langchain%2Fcore@0.1.0 — leaves %2F in the name segment. After the rsplit_once('@') the pkg_name becomes @langchain%2Fcore, which will never equal the watchlist entry @langchain/core. This is a false negative in the SBOM cross-check: a none-posture app that depends on @langchain/core via a fully-encoded purl passes undetected.

Severity is low because (a) the SBOM check is supplemental to the certificate signature, (b) this is the safer failure mode, and (c) many real-world CycloneDX generators emit literal slashes, not %2F. But the fix is a one-liner alongside the %40 decode:

let decoded = purl.replace("%40", "@").replace("%2F", "/");

---

Security

Nothing notable. The untrusted --sbom-dir input is handled with a depth-bounded walk (MAX_BOM_DEPTH = 64, line 1370), the BOM is never written back, and the SBOM parse failure falls to None (treated as unverified, not as a pass). No injection surface.

---

Spec-spine Compliance

No issues. All evidence checked:

• specs/001-certificate-verify-core/spec.md explicitly covers spec 210 FR-002/FR-003/FR-004 adjudication and was updated in the feature PRs (not this release PR — correct per coupling discipline).
• crates/tenant-tail-{cli,core,types}/Cargo.toml spec annotations (000-tenant-tail-bootstrap) are unchanged and valid.
• .derived/codebase-index/by-package/tenant-tail.json shard hash update is the expected consequence of the version change in npm/package.json; Rust crate index files don't carry a version field and are correctly untouched.

---

Performance

No concerns. serde_json::from_slice over an SBOM is a one-shot verification call. The load_agentic_sdk_watchlist() call inside first_watchlist_match_in_bom (line 1364) deserializes embedded JSON on every invocation; this is inconsequential for CLI use, but if the function is called in a tight loop in future test harnesses, caching the watchlist lazily (e.g., OnceLock) would be cleaner.

---

Minor

• CHANGELOG date: ## [0.4.0] - 2026-07-08 is one day before today (2026-07-09). Cosmetic; update before merge if accuracy matters.
• Watchlist is npm-only: All 26 watchlist entries carry "ecosystem": "npm". A Python or Rust app declaring none posture while shipping PyPI/Cargo agentic-SDK packages will pass the SBOM cross-check silently. The matching logic is correctly ecosystem-scoped, but the absence of PyPI entries is an implicit coverage gap worth a comment or a tracking issue.

---

Automated review by Claude. Diff size: 34 lines.