Doberman-Core Files

Adds the runtime egress broker (RB.1–RB.7) and ships three security fixes.

Install / upgrade:

pip install --upgrade doberman-core

Runtime egress broker (RB.1–RB.7)

A new public package, doberman.egress, plus a new plugin entry-point group doberman.egress_brokers. Third-party brokers register the same way as every other Doberman seam.

• RB.1 — the EgressBroker interface, registry, and fail-closed default (wired but dormant)
• RB.2a — default-deny host allowlist + a two-sided enforcement probe (a failed direct connection alone is never accepted as proof of enforcement)
• RB.2b — a stdlib-only forcing forward proxy that enforces the allowlist at the socket; a denied destination's upstream connection is never opened
• RB.3 — retrospective ground-truth reconciliation; an observed route diverging from static host trust raises the verdict
• RB.4 — broker-backed egress PASS, but only behind enforcement genuinely proven at the socket
• RB.5 — mode-gated egress posture; Paranoid hard-blocks non-allowlisted egress, and only when a broker attests it will actually drop it
• RB.6 — per-entity egress velocity signals (burst / volume / fan-out), bounded and memory-safe
• RB.7 — post-fetch artifact digest verification against operator-pinned digests

Every one of these is raise-only and dormant with no broker registered — behavior is byte-for-byte unchanged unless you register one.

Security fixes

• Bounded AUTH challenges (AN-4). An unanswered challenge now denies on a wall-clock deadline instead of hanging forever. An indefinite block is not a denial — and it failed worst exactly where agents run: headless and unattended.
• Raw socket/shell egress classification (CRIT-1). Network reach hidden inside shell_exec / package_install / git_op is now visible to the guardrails instead of passing as an opaque command.
• Path canonicalization padding. Trailing dots and spaces are stripped per path component before glob matching, on every platform — a padded spelling and its unpadded counterpart are the same file on Windows and must match the same rule.

Also in this release

• CI/CD-config protection extended beyond GitHub Actions to GitLab CI, Jenkins, CircleCI, and Azure Pipelines
• devops role no longer allow-lists .github/workflows/** — CI config now escalates consistently for every role
• doberman 2fa remove to unenroll TOTP
• Color-coded verdicts and width-aware explanation wrapping in CLI output
• Dashboard fixes: authentication survives a reload; the 2s poll no longer wipes the TOTP field

Full detail: CHANGELOG.md (github.com)