This release adds 5 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
ReleasePort's take
Light signalBernstein v1.11.0 ships per-artifact lineage tracking with transparency logs and a new `lineage gate` CI check. One-command `compliance pack` produces signed audit bundles supporting EU AI Act requirements.
Why it matters: Lineage tracking enables per-artifact audit trails; `lineage gate` blocks merges with unresolved parallel edits. Compliance bundle supports EU AI Act audits. Test in dev before adopting.
Summary
AI summaryBernstein now produces per‑artifact transparency logs with lineage tracking, merge entries for concurrent edits, and a one‑command EU AI Act compliance bundle.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
`bernstein compliance pack --since … --until … --org "…" --output …` produces signed ZIP with PDF, CSV, raw log, Agent Cards, SLSA-style manifest. `bernstein compliance pack --since … --until … --org "…" --output …` produces signed ZIP with PDF, CSV, raw log, Agent Cards, SLSA-style manifest. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`bernstein lineage gate` new required CI check blocks merges with unresolved parallel-edit forks. `bernstein lineage gate` new required CI check blocks merges with unresolved parallel-edit forks. Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
`bernstein-verify pack <bundle.zip>` standalone auditor CLI shipped as its own wheel (`pip install bernstein-verify`). `bernstein-verify pack <bundle.zip>` standalone auditor CLI shipped as its own wheel (`pip install bernstein-verify`). Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
3 reference demos under `examples/lineage/` (fintech / healthcare / EU manufacturer) added. 3 reference demos under `examples/lineage/` (fintech / healthcare / EU manufacturer) added. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
`bernstein lineage {chain,forks,reindex,merge}` operator-side helpers added. `bernstein lineage {chain,forks,reindex,merge}` operator-side helpers added. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
New MCP resource `lineage://artefact/<path>` for in-run introspection introduced. New MCP resource `lineage://artefact/<path>` for in-run introspection introduced. Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Low |
'bernstein-verify' CLI tool is distributed as its own pip package (wheel) with minimal dependencies (cryptography, click). 'bernstein-verify' CLI tool is distributed as its own pip package (wheel) with minimal dependencies (cryptography, click). Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Feature | Low |
Three example demos illustrating lineage usage are added under `examples/lineage/` for fintech, healthcare, and EU manufacturing scenarios. Three example demos illustrating lineage usage are added under `examples/lineage/` for fintech, healthcare, and EU manufacturing scenarios. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
Full changelog
Lineage v1 — every agent edit, signed and auditable
Bernstein runs now produce a per-artefact transparency log. Two agents touching the same file no longer race silently — concurrent edits surface as siblings, and the Steward writes an explicit merge entry. Compliance officers run one command to get an EU AI Act Article 12 evidence bundle. Auditors verify the bundle on an air-gapped laptop without installing Bernstein.
What's new
bernstein compliance pack --since … --until … --org "…" --output …— produces a signed ZIP with PDF + CSV + raw log + Agent Cards + SLSA-style manifestbernstein-verify pack <bundle.zip>— standalone auditor CLI shipped as its own wheel (pip install bernstein-verify); cryptography + click are the only depsbernstein lineage gate— new required CI check; blocks merges with unresolved parallel-edit forksbernstein lineage {chain,forks,reindex,merge}— operator-side helpers- New MCP resource
lineage://artefact/<path>for in-run introspection - 3 reference demos under
examples/lineage/(fintech / healthcare / EU manufacturer)
Why we built this
Multi-agent orchestrators lose the audit trail the moment two workers touch the same file. ADR-009 (docs/decisions/009-lineage-v1.md) closes that gap end-to-end — every write Ed25519-signed by the agent's A2A Agent Card, every merge explicit, every chain reverifiable without operator secrets. Article 12 of the EU AI Act becomes a one-command export.
Install
pipx install --upgrade bernstein
pipx install bernstein-verify # auditor-side
Compare: https://github.com/sipyourdrink-ltd/bernstein/compare/v1.10.8...v1.11.0
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About chernistry/bernstein
Deterministic multi-agent orchestrator for 18 CLI coding agents (Claude Code, Codex, Cursor, Aider, Gemini CLI, OpenAI Agents SDK, and more). MCP server mode (stdio + HTTP/SSE) exposes the orchestrator to any MCP client. Git worktree isolation per agent, HMAC-chained audit trail, cost-aware model routing via contextual bandit. ~11K monthly PyPI downloads, Apache 2.0.
Related context
Related tools
Beta — feedback welcome: [email protected]