Release 1.6.0: FlareFlow capability-bounded agent declassification

[umudhasanli]

Summary

• add flare-redact/agent with runtime-owned source/detector/sink/JSON-Pointer capabilities
• enforce atomic whole-call authorization, per-capability limits, cumulative sink budgets, TTLs, bounded value-free audit, and non-reentrant transactional callbacks
• expose opt-in operator-policy-controlled /v1/flows gateway endpoints plus Python and Go remote clients
• add the FlareFlow 1 normative spec, runnable agent example, SEO guide, CLI help, public benchmark corpus, result snapshot, and technical preprint
• release every package/docs/example version reference as 1.6.0

Security properties

A token is restored only when a live same-flow record and the first matching capability agree on trusted source, detector, runtime-resolved sink, and destination path, with all projected budgets valid. One failure denies the complete graph without partial plaintext or budget consumption. Forged, expired, foreign-flow, wrong-path, cross-sink, and key-position tokens fail closed. Gateway clients cannot supply policy, and typoed flow routes cannot fall through to an upstream.

Evaluation

The checked-in deterministic corpus runs 700 exact-token attack trials and 300 utility trials. FlareFlow records 0 plaintext exposures, 680 explicit denials, 20 harmless percent-encoded opaque-token passes, and 300/300 utility passes. This is deliberately scoped evidence for exact protected-value restoration, not a general prompt-injection benchmark.

Local Node 22 / Apple A18 Pro microbenchmark, median of nine 100,000-iteration samples: 220,964 FlareFlow authorizations/s. The raw snapshot is checked in under paper/results/.

Verification

• Node: 374/374 tests
• Python: 88/88 tests
• Go: go vet ./... and go test ./...
• Rust: clippy with warnings denied, unit/integration/doc tests
• npm run spec:check
• all four runnable examples
• npm pack, clean tarball install/import/security smoke, and npm audit (0 vulnerabilities)
• 10-page preprint rendered and visually inspected

No existing API changes behavior. FlareFlow and its gateway endpoints are opt-in.