release: v0.5.0 — SSL/TLS content capture (#7), KVM-validated

Opt-in OpenSSL uprobe content capture validated in a non-prod KVM VM: a marker sent inside a
local TLS session surfaced as SslContent plaintext (the GET / HTTP/1.1 request line + marker
header captured pre-encryption). README + CHANGELOG reflect the now-real content extension.
0.4.0 -> 0.5.0.

Author: RoyLin

CHANGELOG.md

@@ -2,17 +2,19 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
-## [Unreleased]
+## [0.5.0] — SSL/TLS content capture (opt-in)
 
 ### Added
 
 - **SSL/TLS content capture (#7)** — the long-deferred opt-in OpenSSL uprobe extension.
   `A3S_OBSERVER_SSL=1` attaches uprobes to `SSL_write` / `SSL_read` and emits `SslContent`
-  events with the request (prompt) / response (completion) **plaintext**. This is deliberately
-  outside the universal core (Rule 2): a uprobe binds to a library symbol, so it is **not**
+  events with the request (prompt) / response (completion) **plaintext**. Deliberately outside
+  the universal core (Rule 2): a uprobe binds to a library symbol, so it is **not**
   language-agnostic (OpenSSL only — Python `requests`/`httpx`, Node, curl …, not Go
-  `crypto/tls`), and it captures real content, so it is **off by default**. Build-validated;
-  runtime validation pending a non-prod VM (content capture is gated off the shared prod node).
+  `crypto/tls`), and it captures real content, so it is **off by default**.
+- **Validated end-to-end in a throwaway KVM VM**: a marker sent *inside* a local TLS session
+  surfaced as `SslContent` plaintext (the `GET / HTTP/1.1` request line and the marker header
+  were captured pre-encryption), confirming the uprobe reads cleartext the wire never sees.
 
 ## [0.4.0] — file-access intervention
 

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -54,6 +54,7 @@ provider + bytes/latency/TTFT), where (peer IP / hostname).
 | `dns` | `sendto` / `sendmsg` / `sendmmsg` to :53 | resolved hostnames |
 | LLM metrics | per-socket `read` / `recv` + `close` | req/resp wire bytes, latency, TTFT |
 | `file` | `sys_enter_openat` (write opens) | files written — **opt-in** (`A3S_OBSERVER_FILES=1`; high-volume) |
+| `ssl` content | uprobes on OpenSSL `SSL_write` / `SSL_read` | request/response **plaintext** (prompt/completion) — **opt-in** (`A3S_OBSERVER_SSL=1`; OpenSSL-only, not language-agnostic) |
 
 Userspace enriches each event with **identity** (k8s cgroup→pod, `/proc` comm+ppid, or an
 in-kernel `comm` fallback for short-lived processes) and a `(pid,fd)→peer` **correlation**,
@@ -79,9 +80,11 @@ turns observed events into a deny-list. See [`docs/enforcement.md`](docs/enforce
 - **Zero-instrumentation, language-agnostic** — observe or guard any agent
   (Python/Node/Go/Rust) without touching its code, including its tool subprocesses.
 - **Sees what the app won't report** — real execs, file I/O, network egress.
-- **Kernel hooks only, no uprobes.** The deliberate trade-off: **no LLM prompt / model name /
-  token / completion content** — that needs an opt-in per-TLS-library uprobe extension, kept
-  out of the universal core. (ECH will eventually hide SNI → fall back to IP/DNS.)
+- **Kernel hooks only in the always-on core, no uprobes.** The deliberate trade-off: the core
+  gives **no LLM prompt / completion content**. That content *is* available via an **opt-in**
+  OpenSSL uprobe extension (`A3S_OBSERVER_SSL=1`) that captures `SSL_write`/`SSL_read`
+  plaintext — kept out of the core because a uprobe binds to a library symbol, so it's OpenSSL
+  only, not language-agnostic. (ECH will eventually hide SNI → fall back to IP/DNS.)
 - **a3s-box:** a box is a separate guest kernel, so host-side eBPF sees box **egress** (it
   flows through the host net path) but not in-guest exec/file — those need an in-guest
   collector (phase 2).

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 license = "MIT"
 publish = false