- v0.1.0 ships a policy-first control plane for autonomous AI agents.
- Every risky job can be gated with REQUIRE_APPROVAL and constraints before dispatch.
- The release includes reproducible startup, workflow orchestration, and decision evidence you can audit.
Problem: Release Notes Usually Stop Before Runtime
Most release posts tell you what shipped. They do not tell you whether the system is safe to run in production. For autonomous AI agents, that missing layer is the difference between a demo and an operational service.
We reviewed top release-note research before refreshing this page. The findings are strong on writing patterns and stakeholder communication. The missing piece is consistent: no concrete runtime evidence contract for policy, approvals, and dispatch outcomes.
What Top Sources Cover and What They Miss
| Source | Strong coverage | Gap |
|---|---|---|
| Microsoft Research (ICSE 2022) | Large-scale release-note behavior data (32,425 release notes across 1,000 GitHub projects) plus practitioner interviews and survey evidence. | No runtime contract for policy decisions or approval integrity once autonomous agents execute. |
| Empirical Software Engineering (2022) | Pattern-level release-note findings across 69,851 releases, including evidence that low-information notes are common and often reused. | No release-note schema that binds changes to enforceable runtime controls and operational evidence. |
| Traceability Study (arXiv 2511.18187, 2025) | Release-note linkage quality in practice, including missing and broken traceability links across real repositories. | No control-plane model tying a release claim to policy snapshot, approval event, and dispatch outcome. |
What Shipped in v0.1.0
Safety Kernel
Policy-before-dispatch evaluation with four decision types: ALLOW, DENY, REQUIRE_APPROVAL, ALLOW_WITH_CONSTRAINTS
Workflow Engine
DAG-based execution with step types for workers, approvals, delays, notifications, and conditions
Pack System
Installable overlays that extend the platform without touching core code
MCP Native
Model Context Protocol support for Claude, GPT, and any compatible AI agent
Governance Evidence Contract (Concrete Example)
This is the shape we care about in release evidence: policy decision, snapshot, constraints, and approval reference. It is compact enough for operations and specific enough for audit trails.
{
"job_id": "job_7f84d",
"decision": "REQUIRE_APPROVAL",
"policy_snapshot": "cfg:system:policy:2026-04-01#3f9c1b2a",
"policy_reason": "prod-write requires approval",
"constraints": {
"max_runtime_sec": 900,
"max_retries": 1,
"max_artifact_bytes": 10485760
},
"approval_required": true,
"approval_ref": "job_7f84d"
}Try It in 3 Commands
Start the platform locally, then call policy evaluation before dispatch. This endpoint is available at /api/v1/policy/evaluate in the current gateway docs.
git clone https://github.com/cordum-io/cordum.git
cd cordum
docker compose up -d
curl -sS -X POST http://localhost:8081/api/v1/policy/evaluate \
-H 'X-API-Key: YOUR_API_KEY' \
-H 'X-Tenant-ID: default' \
-H 'Content-Type: application/json' \
-d '{"topic":"job.default","tenant":"default"}'The dashboard comes up at localhost:8082. The API gateway listens on localhost:8081. Use the quickstart guide if you want the full walkthrough.
Known v0.1.0 Tradeoffs
This release is intentionally focused. Here are the limits you should plan around:
- Workers are external by design. You deploy and operate worker runtimes outside the core control-plane repo.
- Constraints are strongest when both the control plane and worker runtime enforce them. Some guardrails depend on worker implementation choices.
- The release is source-available under BUSL-1.1, with Apache 2.0 conversion after four years.
Source-Available Licensing
Cordum is released under the Business Source License 1.1 (BUSL-1.1), which converts to Apache 2.0 after 4 years. You can use it freely for development, testing, and internal production use. Review terms in /legal/license.
Next Step
Run the quickstart, execute one policy evaluation call, and verify you can trace a decision from snapshot to approval before letting an autonomous job touch production systems.