Skip to content

v1.8.1 — Hardening: PSS, SBOM, ThreadPool, input quality, dashboards, intersectional fairness

Choose a tag to compare

View all tags
@DuqueOM DuqueOM released this 08 Aug 15:13
· 266 commits to main since this release
archive/v1.8.1
a2ac4a1

Note

Historical audit snapshot. This release belongs to the v1.0–v1.12 line that
shipped during the post-audit remediation sprint (2026-04-15 → 2026-04-29).
Per docs/RELEASING.md
these tags are immutable historical snapshots; the active public release line
is now v0.x
hardening, with v1.0.0 reserved for the first verified GKE+EKS cloud E2E rollout.
See CHANGELOG.md for the reclassification rationale.

Release date: 2026-04-24

Patch release hardening the security, observability, and operational
layers of v1.8.0. Six focused commits, no breaking changes.

Highlights

C1 — Pod Security Standards (D-29)

  • templates/k8s/policies/pod-security-standards.yaml — canonical
    Namespace definitions: prod enforce=restricted, dev/staging
    enforce=baseline + warn/audit=restricted (shift-left)
  • deployment.yaml: pod-level and container-level securityContext
    compatible with PSS restricted (runAsNonRoot: true,
    capabilities.drop: [ALL], seccompProfile: RuntimeDefault)
  • Rule 02 §Pod Security Standards section with namespace + container
    snippets

C2 — SBOM attestation (D-30)

  • deploy-gcp.yml + deploy-aws.yml now generate a CycloneDX SBOM
    (Anchore sbom-action@v0) and attach it as a Cosign attestation
    (cosign attest --type cyclonedx)
  • Full SLSA L3 provenance via slsa-github-generator documented as
    ROADMAP with the exact block operators can uncomment once the
    Dockerfile is hermetic

C3 — ThreadPoolExecutor sizing

  • docs/threadpool-sizing.md — operator guide: decision rule,
    BLAS/OMP interaction, anti-patterns, sample benchmark table
  • templates/service/scripts/benchmark_executor.py — executable
    sweep script that writes ops/benchmarks/{ts}-executor.json

C4 — Edge-level input quality

  • common_utils/input_quality.py — opt-in checker against training-time
    [p01, p99] quantiles. Emits {service}_input_out_of_range_total
    labels (feature, direction) without blocking requests
  • build_from_env() honors INPUT_QUALITY_ENABLED + INPUT_QUALITY_PATH
  • 14 unit tests covering load/check/disabled paths

C5 — Closed-loop Grafana dashboard

  • templates/monitoring/grafana/dashboard-closed-loop.json — 10 panels:
    SLO availability + burn, per-version AUC, sliced-AUC heatmap,
    Champion/Challenger error rate, score-distribution p50, logger error
    rate (D-22), input-quality flags (C4), monitor heartbeat, PSI top 10

C6 — Intersectional fairness

  • fairness.py::compute_intersectional_fairness() — evaluates every
    2-way combination of protected attributes so subgroup-only bias
    (e.g. race=Black + gender=Female) is no longer masked by per-
    attribute DIR
  • run_fairness_audit(intersectional=False, min_intersectional_samples=30)
    — opt-in + min-cell-size guard (avoids noisy DIRs from tiny groups)
  • 4 new tests (1 synthetic biased dataset, 1 single-attr skip, 1
    small-cell insufficient, 1 flag-off default)

New anti-patterns

  • D-29 — Namespace without Pod Security Standards labels
  • D-30 — Production image without SBOM attestation

Files

New: 8 (policies YAML, benchmark script, docs, dashboard, input_quality
module + tests, intersectional tests, release notes).

Changed: deployment.yaml securityContext, deploy-{gcp,aws}.yml
SBOM steps, fairness.py intersectional, 02-kubernetes.md, AGENTS.md.

Tests

118 passing (was 100 in v1.8.0) — +18:

  • test_input_quality.py: 14
  • test_fairness_intersectional.py: 4

Migration from v1.8.0

All changes backward compatible. To adopt:

  1. PSS labels — apply templates/k8s/policies/pod-security-standards.yaml
    (per env). Services with privileged pods will see warnings in audit
    logs immediately; fix by tightening securityContext.
  2. SBOM attestation — no action; the new steps run automatically on
    the next deploy. Verify via cosign verify-attestation post-deploy.
  3. Input quality — set INPUT_QUALITY_ENABLED=true +
    INPUT_QUALITY_PATH=artifacts/baseline_quantiles.json. Requires
    emitting quantiles at training time (small patch to train.py).
  4. Dashboard — import dashboard-closed-loop.json alongside the
    existing dashboard-template.json.
  5. Intersectional fairness — pass intersectional=True to
    run_fairness_audit() in your training pipeline quality gate.

Related

  • AGENTS.md — D-29, D-30 rows added
  • Rule 02 §Pod Security Standards
  • Rule 04a — already referenced ThreadPool sizing (docs now flesh it out)
  • CHANGELOG entry under [1.8.1]
Assets 2
Loading