PRAXO-CORE 2.5.0: Encoding Agent Governance Boundaries as Verifiable Contracts

Many agent frameworks expand feature lists — more models, more tools, more orchestration — but teams embedding agents into Go products first hit unclear boundaries: where policies execute, who mutates tool parameters, what the sandbox actually isolates, and who verifies signatures and SBOMs before plugin startup.

PRAXO-CORE addresses this by making those boundaries explicit contracts. It is an MIT-licensed Go framework that keeps its core small: agent loop, model/tool/memory/event/policy/sandbox/checkpoint seams, HITL, typed streams, and a process/WASM plugin plane. Graph execution is delegated to RHEOVELA; model hosting, memory storage, and enterprise HA/identity enforcement stay outside the core.

Version 2.5.0 Focus: Verifiability

1. Conformance Test Suite (pkg/conformance)

A new pkg/conformance package lets external implementations verify VFS, memory, sandbox, event, policy, gateway, model, streaming model, tool, and retriever contracts against the same check suite. conformance.Run executes named checks and reports all failures in a single pass.

2. Hardened Local Filesystem VFS (pkg/vfs/localfs)

The local filesystem adapter now rejects NUL bytes, Windows drive-relative paths, reserved device names, alternate data streams, and trailing dots or spaces — closing common path-traversal and canonicalization gaps.

3. Explicit Boundaries: Event Schema & Plugin Trust/SBOM Handoff

Event/OpenTelemetry schema: The event contract is now formally defined, enabling consistent observability integration.

Plugin trust/SBOM handoff: ValidateTrust only checks for the presence of a signature and an SBOM. Signature verification, trust roots, SBOM policy, content-addressed materialization, and persistent evidence remain the product's responsibility.

Evaluation Adapters & Examples

The release includes workspace/session evaluation harnesses and offline consistency adapters for E2B, Daytona, OpenSandbox, and CubeSandbox, plus a RHEOVELA durable worker example. These are local verification tools, not live production benchmarks.

Compatibility & Quickstart

2.5.0 does not change existing exported pkg/... declarations; the only API addition is pkg/conformance. Quickstart still targets Ollama or any OpenAI-compatible endpoint:

export PRAXO_BASE_URL=http://localhost:11434/v1
export PRAXO_MODEL=llama3.2
GOWORK=off go run ./examples/quickstart

Resources

Repository: https://github.com/axisvela/praxo-core Documentation: https://axisvela.github.io/praxo-core Release: https://github.com/axisvela/praxo-core/releases/tag/v2.5.0 Feedback on policy/tool boundaries, adapter interfaces, and conformance suite implementations is welcomed.