release: v0.9.0 — telemetry + injection-path hardening

[requie]

The CHANGELOG header states the project adheres to Semantic Versioning and that pre-1.0 minor versions may contain breaking changes. Patch releases are for backwards-compatible fixes. Shipping a default-on phone-home under a patch number is also how telemetry backlashes happen, so the version signals it instead of burying it.

Roadmap consequence: Federation + fleet moves from v0.9.0 to v0.10.0.

Fixes a claim this release would have made false

The "What it does" paragraph still read:

It runs locally with zero required dependencies and never makes network calls to Cogensec or any other service.

The same README documents default-on telemetry posting to https://us.i.posthog.com. Tagging a release with both statements in one file would have been indefensible against Design Principle #6 ("every claim the library makes is defensible in writing").

Rewritten to state plainly that evaluation runs locally and no agent content, prompt, tool argument, or attestation leaves the process; that shape-only telemetry is the one outbound call; and to link the opt-out.

Version parity

Bumped every site the two parity checkers enforce, plus one they don't:

• pyproject.toml, src/agentegrity/__init__.py
• README shields badge and the present-tense prose claims (ships / (current) / As of)
• all 7 TypeScript package.json files
• the internal @agentegrity/client dependency pins — without these, we would have published 0.9.0 packages declaring a dependency on client@0.8.1

Release contents

Unchanged from what already landed on main; this PR only promotes and documents it.

• Added — anonymous, shape-only usage telemetry (enum values, counts, rounded scores, durations; never prompts, tool arguments, names, or agent content). Stdlib-only sender, no new dependencies, cannot break the host process. Opt out with DO_NOT_TRACK=1, AGENTEGRITY_TELEMETRY_DISABLED=1, or agentegrity.disable_telemetry().
• Security [Critical] — tool arguments could shadow the fields governance matches on. A prompt-injected agent calling payment_execute with {"tool": "noop"} skipped GOV-001's approval gate entirely; under enforce=True the dangerous tool ran, and in observe-only mode the signed attestation recorded governance: pass for a check that never happened.
• Security [High] — the LLM classifier skipped shared_memory and broadcast_messages, so a compromised peer's injection reached neither strong detector. That is the cross-agent cascade (T-CASCADE) those v0.8 channels exist to defend.
• Changed — LLM classification cost bounded (concurrency limit, per-evaluation target ceiling, verdict caching, truncation reported so a capped scan never reads as full coverage).

Migration from 0.8.1

Tool-call actions nest their arguments. context["action"] is now {"tool": …, "type": "tool_call", "arguments": {…}}. Custom PolicyRule conditions reading call-derived keys off the top level must read them from action["arguments"]. Rules matching only tool or type are unaffected.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.