Skip to content

v1.5.4 — Downstream Adaptability & Credential Hardening

Choose a tag to compare

View all tags
@KbWen KbWen released this 14 Jun 09:12
v1.5.4
23f2037
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release: downstream adaptability for heterogeneous flows/architectures (many custom skills, harness/subagent fan-out, other work-management flows), plus cross-contributor credential CI hardening and a security-policy refresh. Covers everything merged since v1.5.3.

Downstream adaptability (PR #238 — ADR-007 + ADR-008)

  • Downstream Capability Declaration Seam (ADR-007) — a present-only, opt-in, gate-capped downstream-capabilities.yaml (loaded at bootstrap §1b) lets a downstream register custom-* skills into auto-activation, declare a subagent_policy, and declare advisory trackers. Gate-relaxation is structurally unrepresentable — a denylist + allowlist schema validator rejects, never clamps. Absent file = zero behavior change.
  • Portable Safety Floor (ADR-008) — the three always-loaded AGENTS.md safety invariants are fenced into a committed .agentcortex/AGENTS.safety.md nucleus (+ a validator freshness check) that any non-shim harness (Codex/Gemini/custom) can inject into every dispatched subagent. A no-Python credential floor (credential_floor.sh / .ps1 — narrow FP-free AKIA/PEM/ghp_ subset, redacted) is wired into the pre-commit hook so the "block secrets before object history" control works without Python; scan_credentials.py — previously absent from the deploy whitelist, a dead control downstream — is added as the richer Python path.
  • Reviewed by 4 independent fresh-context agents (NOT READY → 4 fixes); 30 new tests, full fast suite 307 passed; validate.sh↔.ps1 parity; native-baseline ratchet 194/195. All additive + present-only.

Security / CI (PR #236 — #73/#74/#75; PR #237)

  • CI PR-diff credential scan (#73) — scan_credentials.py --range base...head in a pull_request job so contributors who never install the opt-in hook still get pre-merge secret protection (complements TruffleHog --only-verified), with a # pragma: allowlist secret escape + zero-sha/exit-3 fail-safe.
  • ShellCheck now lints .githooks/*.sample (#74); the opt-in hook's gitignored worklog-count check is WARN, not a hard FAIL that blocked every commit (#75).
  • SECURITY.md supported-versions refreshed to 1.5.x (#237); TruffleHog action bumped 3.95.3 → 3.95.5 (#174).

Zero always-loaded prompt cost; all additive + present-only. Full notes: CHANGELOG.md [1.5.4].

Assets 2
Loading