v0.3.0
Security and reliability hardening plus three roadmap features. 163 tests, ruff + mypy --strict clean.
Fixes
- Per-agent tool allowlist enforced at dispatch (undeclared tools can no longer execute)
- One bridge adapter / httpx client per provider per app (was: new unclosed client per model call)
- Malformed provider responses degrade to human handover instead of crashing (
BridgeErrorwrapping) - Eval reruns no longer inherit prior session history (unique session ids)
- Audit/session sqlite appends safe under multi-worker deployments (immediate transactions + busy timeout)
- Sync tools run on worker threads; a slow bank API no longer stalls concurrent sessions (make tools thread-safe, or declare them
async def) - Clean CLI errors for bridge failures; cohort files validated before feedback promotion; ci.yml actions SHA-pinned
Features
evals:auto-wired from agent YAML;zolva eval --agents <config_dir> --gate(fails loudly on zero or missing cohorts)zolva syntheticssubcommand with--gatefor cron/CI patrolzolva.signingwith receiver-sideverify_zolva_signature(wire format unchanged)