Skip to content

v0.3.0

Choose a tag to compare

View all tags
@OpenComplaiCTO OpenComplaiCTO released this 13 Aug 10:10
· 46 commits to main since this release
v0.3.0
eb8c442

Opencomplai v0.3.0

⚠️ Breaking changes

  • Inspect-AI eval bridge hard-cut rename — --suite inspect-ai, pip extra
    inspect-bridge, module opencomplai_core.bridges.inspect_eval, evaluator
    IDs EVAL_INSPECT_* (evidence hashes change). Previous suite/extra
    identifiers are removed with no aliases.
  • Ed25519 signatures are now domain-separated. Signed bytes are now
    opencomplai.sig.v1\0<purpose>\0<payload> instead of the raw payload.
    Previously one keypair signed scan-status artifacts, Annex IV dossier
    bundles, and compliance badges with nothing in the signed bytes
    distinguishing which was which — a opencomplai check --sign signature
    verified unmodified as a compliance-badge signature for the same object.
    sign_bundle_bytes/verify_bundle_bytes now require a domain argument.
    Signatures produced before this release do not verify — there is no
    compatibility flag.     Re-sign anything you need to verify again.
  • Badge issuance now requires a signature whenever
    OSS_BADGE_PUBLIC_KEY_PATH is set (previously an unsigned request skipped
    verification even with the key configured). Unsigned issuance with no key
    configured is unchanged — that remains OSS unsigned mode.

Added

  • Fail-closed scanner defaults: refuse symlinks, numeric file/byte caps,
    report text sanitize helpers, and scan_errors gating when --fail-on is
    set.
  • Versioned CLI JSON ScanOutputEnvelope for scan/gaps/report (distinct
    from the signed ScanStatusArtifact).
  • Artifact probes for Arts. 9, 13, 14, 16, 24, 43, plus honesty/confidence
    labels on gap rows; a new MCP/agent detector (DET_AGENTS_MCP_V1).
  • Four compile-checked Python remediation templates (transparency, logging,
    oversight, disclosure helpers) via opencomplai recommend.
  • Working Inspect-AI eval bridge MVP: curated strong_reject / bbq /
    bigbench_calibration pin, --log-dir, never gates check.
  • Local opencomplai serve (optional [serve] extra) — loopback dashboard.
  • Meta-package extras re-export: reports, inspect-bridge, serve.
  • Docs: serve, Inspect-AI eval bridge, hostile-scan defaults, SOC2/ISO
    control mapping, ADR local-serve-vs-saas.

Changed

  • Interactive HTML reports embed the JSON envelope and support status/text
    filters.

Removed

  • EvidenceObject.encryption_profile and the evidence_objects
    encryption_profile column (evidence-vault migration 0006). It
    advertised "AES-256-GCM", including in the generated OpenAPI, while no
    CAS backend has ever encrypted anything — nothing wrote it and nothing
    read it. Evidence objects are stored as plaintext; integrity comes from
    content-hash re-verification on read, confidentiality from volume- or
    bucket-level encryption at the deployment layer.

Upgrade notes

  • If you pin --suite inspect-ai / the inspect-bridge extra under the old
    identifiers, update to the new module path — there is no aliasing period.
  • If you rely on Ed25519 signature verification (scan-status artifacts,
    dossier bundles, or badges), re-sign after upgrading; pre-0.3.0 signatures
    will not verify.

Full diff: v0.2.0...v0.3.0

Assets 2
Loading