Skip to content

v2.7.0 - the engine runs what the dashboard sells

Choose a tag to compare

View all tags
@DNYoussef DNYoussef released this 29 Jul 00:47
· 7 commits to main since this release
v2.7.0
500128a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Nine more packs runnable (13 → 22). None removed.

Six packs the dashboard already sold but the engine could not load

sox-itgc, eu-ai-act, cfr-part-11, gdpr-privacy-by-design, and cmmc-level1 / cpcsc-level1 (enterprise tier).

Selecting one of these produced a warning in the CI log and then a scan governed by default — five generic rules instead of the regime the customer paid for. All six now load. If you selected one of these packs before, your scans were not enforcing it; after upgrading they will, so expect new findings.

Three new regulated-finance packs

dora-ict-requirements (DORA ICT), nacha-us-payments-requirements (US ACH), psd2-sca-requirements (PSD2 SCA) — each rule cites the instrument it comes from, so a finding names the control an examiner asks about. Short aliases dora, nacha, psd2 work.

These map changes to control themes. They do not certify compliance.

Reviewer models now see the policy in every round

Previously only round 1 was shown the rubric, while the last round produced the verdict — so a finding had to survive deliberation without the rule that justified it, against peers who could not see it either. Deliberation only runs when round 1 disagrees, so the policy was missing in exactly the contested cases.

One rule contract

  • enabled: false is now honoured (it was previously ignored, and such rules were still enforced)
  • semantic, pattern-less rules now reach the models instead of being dropped — a control regex cannot express is exactly what a reviewer model is for
  • an invalid pattern now fails loudly instead of being quietly laundered into "the model will handle it"

Supply chain

The prompt renderer and the rubric catalogue are now one published artifact — guardspine-prompts 0.2.0 — exact-pinned and hashed, shared with the dashboard. No vendored copies remain. Shipped packs live in an installed distribution, so a pull request cannot plant a file that passes as a shipped pack.

Upgrading

- uses: DNYoussef/guardspine-code-action@v2.7.0

Image: ghcr.io/dnyoussef/guardspine-code-action:2.7.0

Assets 2
Loading