[jaschadub]

Status: blocked on AgentPin 0.3.1 publication

Do not merge yet. The compatible AgentPin backport is merged in ThirdKeyAI/AgentPin#11, and main is fixed in ThirdKeyAI/AgentPin#10. A restricted manual publisher was reviewed, tested, and merged in ThirdKeyAI/AgentPin#12. Its validation job passed tests, package verification, and cargo audit. The isolated publication job passed all source/lockfile/artifact checks, but crates.io rejected the existing CARGO_REGISTRY_TOKEN secret with 403 Forbidden: authentication failed: https://github.com/ThirdKeyAI/AgentPin/actions/runs/40824532605.

No 0.3.1 crate was published. An AgentPin owner must replace that repository Actions secret with a valid, appropriately scoped crates.io publishing token, then rerun the manual workflow. AgentSniff currently requires 0.3.1; its candidate lockfile was resolved using a command-line local override for tests, not a committed Cargo patch. After publication, regenerate the registry-only lockfile, rerun checks without overrides, and mark ready.

Fixes

• DNS-rebinding/Host/Origin protections, remote auth validation, and dashboard anti-framing headers.
• Notification timeouts, prompt cancellation, passive capture and aggregate detector/evidence limits.
• Bounded API/history/storage/backups; transactional quota failures preserve history; private SQLite files.
• Safe release tag validation, locked builds, pinned images, dependency updates, and Rust/audit CI.
• Configuration precedence and credential clearing across changed destinations.
• Safe-Rust YAML parsing with preserved scalar types, port keys, aliases/defaults, duplicate-key rejection, and redacted diagnostics.
• P-256 upgrade and compatible AgentPin 0.3.1 dependency; signed datasets and wire formats unchanged.

GitHub release environment now requires jaschadub approval, disallows admin bypass, and accepts only v* tags. An active no-bypass ruleset prevents version-tag updates/deletion. Self-review is allowed because jaschadub is the only human admin; this is an explicit approval gate, not two-person review.

Verification

• 263 AgentSniff tests passed, including live disposable PostgreSQL/Redis backends, with the local AgentPin candidate override.
• Formatting, Clippy with warnings denied, and cargo audit --deny warnings pass for that candidate graph.
• Independent investigator/reviewer completed; confirmed compatibility/minimum-version issues corrected and retested.
• Isolated live scanner: all 8 signed datasets verify; scan completes; hostile Host returns403; state modes700/600. No external scan traffic.
• AgentPin main:261 tests; backport:180 tests; each has one pre-existing ignored doc example. Both have clean audits, Rust1.89 checks, and green PR CI.

Unverified: registry-only AgentSniff build/package until publication; Windows/macOS binaries, actual eBPF attachment, full enrichment image rebuild, and privileged release signing run.