Skip to content

v1.32.0

Choose a tag to compare

View all tags
@abrichr abrichr released this 20 Aug 02:39
· 64 commits to main since this release
v1.32.0
d1b054c

v1.32.0 (2026-08-20)

This release is published under the MIT License.

Bug Fixes

  • Bind structured push to retained server version (#369, 663550f)

  • Close paused push schema state (#369, 663550f)

  • Forbid server bindings on unsuccessful push (#369, 663550f)

  • Keep admission identity independent (#376, c2c2993)

  • Preserve resized capture coordinate spaces (#366, 02e68bf)

  • Prove an exact accepted ingest before push reports success (#369, 663550f)

  • Reject contradictory push result states (#369, 663550f)

  • Require Flow production release evidence (#366, 02e68bf)

  • Require passing evidence for supported claims (e1a236c)

  • browser: Apply the same proof to a bare URL fragment (#364, a5a0bbb)

  • browser: Bind same-task secret mutations (#364, a5a0bbb)

  • browser: Bind secret redaction to the element, never to keystroke prefixes (#364, a5a0bbb)

  • browser: Close attach evidence gaps (#364, a5a0bbb)

  • browser: Close attached finalization gaps (#364, a5a0bbb)

  • browser: Close three round-4 blockers and redact URLs by structure (#364, a5a0bbb)

  • browser: Harden attached recording boundaries (#364, a5a0bbb)

  • browser: Harden attached recording finalization (#364, a5a0bbb)

  • browser: Latch attached recording races (#364, a5a0bbb)

  • browser: Make secret classification sticky across DOM replacement (#364, a5a0bbb)

  • browser: Never drop a value the field holds or a commit point recorded (#364, a5a0bbb)

  • browser: Prefer the definite withhold reason over the ambiguous one (#364, a5a0bbb)

  • browser: Recognise a keystroke prefix per declared field, not globally (#364, a5a0bbb)

  • browser: Replace secret value retention with capture-time withholding (#364, a5a0bbb)

  • browser: Retain masks through final capture (#364, a5a0bbb)

  • browser: Treat a page that consumes its own field as having held a value (#364, a5a0bbb)

  • browser: Withhold a later document's URL; the path is not structural (#364, a5a0bbb)

  • profiles: Require independent evidence for the Regulated profile (#355, 45c8d38)

  • sealing: Keep pre-field sealed v2 digests valid for the new effect fields (#362, d7f58d9)

Build System

  • Bump ruff from 0.15.22 to 0.16.3 in the python-minor group across 1 directory (#353, 833022b)

  • Bump ruff in the python-minor group across 1 directory (#353, 833022b)

  • Refresh the lock after the rebase (#366, 02e68bf)

Chores

  • Apply Ruff 0.16.3 formatting (#353, 833022b)

  • Regenerate the artifact inventory after the rebase (#366, 02e68bf)

  • browser: Re-pin the public artifact inventory after the claims update (#364, a5a0bbb)

  • claims: Regenerate verification report and artifact inventory after rebase (#364, a5a0bbb)

  • deps: Bump aiohttp to 3.14.3 and cryptography to 50.0.0 for security fixes (#361, 687090e)

Continuous Integration

  • Bound installer process cleanup (#370, 973e21c)

  • Bound qualification and browser setup (#370, 973e21c)

  • Bound the paper build and stop false private-source alarms (#373, 7860278)

  • Bump the actions group across 1 directory with 2 updates (#363, 16c9177)

  • Enforce immutable dependency lock (#353, 833022b)

  • Make installer cleanup fail closed (#370, 973e21c)

  • Prefer the canonical Ubuntu archive for the apt installs (#375, 7633d45)

  • Prefer the canonical Ubuntu archive for the paper TeX install (#374, 068b777)

  • Refresh public artifact inventory (#363, 16c9177)

  • Reserve RDP evidence cleanup budget (#370, 973e21c)

  • Retain installer trees until verified cleanup (#370, 973e21c)

  • Terminate privileged installer descendants (#370, 973e21c)

  • Terminate Windows installer process trees (#370, 973e21c)

Documentation

  • Align generated verification timestamp (#364, a5a0bbb)

  • Keep generated verification report in sync (#364, a5a0bbb)

  • browser: Correct comments that still described the removed scrubber (#364, a5a0bbb)

  • browser: Correct the commit-point comment (#364, a5a0bbb)

  • browser: State the retention rule and every withheld identity (#364, a5a0bbb)

  • browser: State the structured URL rule and what it still costs (#364, a5a0bbb)

  • paper: Record the four B1 decisions -- authorship+ORCID, CC BY 4.0, COI statement, workshop target (#358, 3e740f8)

Features

  • Add structured push result contract (#369, 663550f)

  • Add the v2 qualification authority contract (#376, c2c2993)

  • Enforce signed qualification admission before actuation (#376, c2c2993)

  • Enforce signed workflow qualification admission (#376, c2c2993)

  • Negotiate qualification authority v2 (#376, c2c2993)

  • attest: Opt-in post-run bridge to the openadapt-attest proof sidecar (#357, a2ceac3)

  • browser: Attach recorder to existing sessions (#364, a5a0bbb)

  • effects: Exact-new-set guard closes the over-write false-pass gap (#362, d7f58d9)

  • tutorial: Print next steps after a verified run (#354, f792da6)

Testing

  • browser: Assert the refused DOM identity states its reason (#364, a5a0bbb)

Detailed Changes: v1.31.0...v1.32.0

Assets 6
Loading