Skip to content

Seshat BI v2.0.0

Choose a tag to compare

View all tags
@Kemetra Kemetra released this 22 Aug 09:29
· 59 commits to main since this release
v2.0.0
f252c74
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

MAJOR release. Two existing CLI contracts changed. If you script against seshat, read this before upgrading.

Full detail: docs/releases/v2.0.md · per-entry citations in CHANGELOG.md.

Breaking

1. seshat doctor's default text output is reshaped (M8, #689)

# v1.1.0 — flat, one line per finding
  [error] A1 <message> (<locator>)

# v2.0.0 — grouped by rule id
A1: 2 finding(s)
  [error] <message> (<locator>)
  hint: <non-mutating repair guidance>

next allowed action: <action>

Any consumer scraping doctor stdout will break. Migration: seshat doctor --format json — new in this release, emitting {"findings": [...], "finding_count": N} with a repair_hint per finding. Parse that; the text digest is a human surface and may be reshaped again.

2. seshat pbi-mcp preflight can now exit 2 where it exited 0 (spec 149, #659)

Server identity is now derived from the argument vector, not just name/command/url, and --readwrite=true is recognised as write mode. A .mcp.json could previously alias the official Power BI MCP server under an unrelated name, invoke it via npx in args, and classify as absent — handing the bypass guard a clean verdict while --skipconfirmation sat in the same entry.

This is a security fix, not a regression. If preflight newly exits 2, it is reporting a real bypass-shaped config that was previously invisible. Fix the config; do not pin to 1.1.0 to restore the 0.

What did NOT change

No seshat check rule id was added, removed, or renamed, and no existing rule's predicate or severity changed. src/seshat/rules/ has zero changed files in this range, and the registered id set is identical at both refs. A consumer's seshat check verdict on an unchanged repo is unaffected by this release — the blast radius is the two CLI contracts above, not the governance rule set.

Also in this release

  • Studio governed analyst workbench (spec 140, #695) and Studio operations and client review (spec 141, #697). 141 guards a disclosure where 140 guarded a write: contracts/export-boundary.md separates softening, leaking and acting.
  • Approval-gated Power BI MCP writes (spec 149, #659 + #670/#672/#674/#679). plan-write and apply against Microsoft's official local server (external, unforked, never vendored, ADR 0018). Every precondition is derived, never accepted as a caller assertion; twelve typed gate blockers, fail-closed. A successful write advances no readiness stage and grants no approval, and --skipconfirmation is refused everywhere.
  • Guided setup execution (spec 155) and capability derivation from committed evidence (spec 153).
  • seshat doctor --format json, grouped findings, non-mutating repair hints, next-allowed-action (M8). Hints are text only — nothing is executed on your behalf, and doctor still never modifies a file. It remains advisory: seshat check's exit code is the only gate.
  • The unit suite now runs on Windows in CI (#698, #699). Previously Windows CI ran only the CLI first-success journey and never invoked pytest, so POSIX-locked fixtures were invisible by construction (#691). Non-blocking while a baseline accumulates.

Install

pip install seshat-bi==2.0.0

Also on npm as @kemetra/seshat-bi and the unscoped seshat-bi.

Assets 2
Loading