Skip to content

UADS v0.10.3 - Bound host adapter ownership to a privacy-safe target-root digest so ...

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Sep 12:20
· 12 commits to main since this release
v0.10.3
f0ab15e

[0.10.3] - 2026-09-04

Highlights

  • Bound host adapter ownership to a privacy-safe target-root digest so identical bytes at different canonical roots cannot replay as trusted ownership.

Fixed

  • Added rootBinding to persisted adapter state and hostTargetRootDigest to Host Dispatch Bundles; cross-root replay, tampered binding, and stale bundles now fail closed.
  • Legacy v0.10.0–v0.10.2 unbound states remain readable but block destructive uninstall until an explicit install/update safely adopts binding without overwriting user bytes.

Verification

  • T49–T56, AD33–AD36, all existing tests/evals, and the complete validation matrix are required for the exact release SHA; v0.10.0–v0.10.2 remain immutable.

Review Evidence

  • Commit SHA: f0ab15e
  • CI run ID + conclusion: 33871531618 + success
  • Direct-review workflow run ID: 33871839963
  • Test summary: 45 test files; 314 passed; 0 failed
  • Eval summary: orchestrator: 9/9 passed; execution: 9/9 passed; context: 19/19 passed; fault: 18/18 passed; cost: 27/27 passed; modelRouting: 22/22 passed; specialistRouting: 26/26 passed; adapters: 36/36 passed
  • npm audit: clean (0 high-or-greater)
  • Release run ID: 33871954628
  • Direct-review artifact: uads-direct-review-f0ab15e0b00834f3ca2f0ed3d72f193d579741b0
  • Direct-review evidence SHA-256: 06cf27487bb3cc628e811bbd5a4092abedd9f4a95e4d0117daa7d191113adab7
  • GitHub review index: github-review-index.json
Assets 12
Loading