Skip to content

v0.10.5

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 May 04:20
v0.10.5
This tag was signed with the committer’s verified signature.
allenfbyrd Allen Byrd
SSH Key Fingerprint: a15X9s2rka0EQTAA01VrXaWYlxwaiB47co2D9bLNO9o
Verified
Learn about vigilant mode.
a688b20
This commit was signed with the committer’s verified signature.
allenfbyrd Allen Byrd
SSH Key Fingerprint: a15X9s2rka0EQTAA01VrXaWYlxwaiB47co2D9bLNO9o
Verified
Learn about vigilant mode.

Highlights

Theme: v0.10.5 — output-format expansion (OCSF Detection
Finding + CycloneDX VEX emit) + workspace refactor (evidentia-eval
package extraction) + collector idempotency hardening for the v1.0
API freeze + positioning rewrite (no metaphors; EU AI Act delay) +
commercial-validation foundation (design-partner program draft).
Patch bump (v0.10.4 → v0.10.5).

Release summary: Six cycle commits authored 2026-05-25 between
v0.10.4 (tagged 2026-05-24) and this 2026-05-26 tag, all on the
same main branch. 3,443 tests pass / 14 skipped / 3,457
collected across 278 source files (was 268 v0.10.4); mypy strict
0/0; ruff clean. Workspace now ships 8 PyPI packages (was 7;
evidentia-eval added in Phase 9). The 2026-05-24 v0.10.5 plan
targeted Phases 1-5 (OSPS Baseline catalog + OSCAL conversion +
OSPS-CONFORMANCE.md + SECURITY.md refresh + EOL.md +
verification-recipe) as the "OSS first-mover artifacts" theme; a
2026-05-25 full-sweep research pass redirected scope to Phases 7-12
(output-format expansion + workspace refactor + idempotency + EU AI
Act delay + design-partner program). Phases 1-5 deferred to v0.10.6
without scope loss — see docs/v0.10.5-plan.md
§0/§0.A for the full plan-vs-actual reconciliation.

Cross-links: docs/positioning-and-value.md
§10 (no-metaphor rewrite) + §8.1 (EU AI Act Annex III deferred to
2027-12-02 per Digital Omnibus political agreement of 2026-05-07);
docs/v1.0-transition.md §"Acceptance
gates for v1.0" (Gold honest-gap now tied to SOC 2 Type I
segregation-of-duties); docs/design-partner-program.md
v0 draft; docs/ocsf-mapping.md §7.B
(Detection Finding emit); docs/collector-idempotency-audit.md
NORMATIVE per-collector audit.

Added

  • evidentia gap analyze --format ocsf-detection (Phase 7): gap
    analysis output emits as an OCSF Detection Finding (class_uid 2004)
    JSON array. The OCSF ecosystem's actual production traffic is on
    Detection Finding 2004 — Prowler and AWS Security Hub emit 2004
    natively, and major SIEMs (Splunk / Elastic / Microsoft Sentinel /
    Datadog) wired their ingest pipelines to it. Compliance Finding 2003
    (the v0.10.4 default --format ocsf emit) is the semantically
    correct class for control pass/fail evidence and remains the default
    for OCSF-aware GRC tooling; --format ocsf-detection is the
    SIEM-target alternative. Detection Finding has no native compliance
    object, so framework + control_id rides in finding_info.types[] as
    a stable <framework>/<control_id> identifier (mirroring the SARIF
    rule_id shape); full gap JSON preserved under
    unmapped["evidentia"]["gap"] for round-trip fidelity. New
    evidentia_core.gap_analyzer.ocsf_detection.gap_report_to_ocsf_detection_array
    library helper.
  • evidentia gap analyze --format cyclonedx-vex (Phase 8): gap
    analysis output emits as a CycloneDX 1.6 VEX document. Federal
    supply-chain mandates (EO 14028, SEC 2026 supply-chain enforcement)
    are driving CycloneDX VEX adoption; CycloneDX is already used in
    Evidentia's release-time SBOM emit, so VEX is an additive surface
    over the existing supply-chain artifact stack. Each ControlGap
    becomes one CycloneDX vulnerability entry; analysis.state is
    derived from the gap's implementation_status + GapStatus
    (implemented → resolved; missing + OPEN → exploitable;
    missing + IN_PROGRESS → in_triage; missing + REMEDIATED →
    resolved; missing + ACCEPTED → not_affected with
    code_not_reachable justification; partial / planned →
    in_triage; not_applicable → not_affected with code_not_present
    justification). Composable with the release-time SBOM via standard
    CycloneDX merge tooling. New
    evidentia_core.gap_analyzer.vex.gap_report_to_cyclonedx_vex library
    helper.
  • OutputFormat Literal extension: extended additively per
    docs/api-stability.md §3 to include "ocsf-detection" +
    "cyclonedx-vex". Existing emits (json / csv / markdown /
    oscal-ar / sarif / ocsf) unchanged. No breaking changes.
  • New workspace package evidentia-eval (8th package): the DFAH
    determinism + faithfulness harness moves out of evidentia-ai/eval/
    to its own pip-installable package with its own optional extra
    (evidentia-eval[faithfulness-semantic] for the sentence-
    transformers + numpy path). Public API: DFAHarness, EvalResult,
    EvalSample, DeterminismResult, ReplayResult,
    FaithfulnessResult, PromptFaithfulnessResult,
    faithfulness_score, faithfulness_score_semantic,
    extract_claims, determinism_score, replay_equivalent,
    normalize_for_determinism, hash_output, sign_eval_result,
    verify_eval_result. Same symbols, same signatures as the prior
    evidentia_ai.eval location — only the import path changes.
  • tests/unit/test_ai/test_lazy_imports.py: pins the lazy-import
    posture of evidentia_ai. Asserts via subprocess that
    import evidentia_ai, import evidentia_ai.risk_statements, and
    related production-runtime entry-points do NOT pull torch /
    transformers / sentence-transformers / evidentia-eval into
    sys.modules. Closes the Kimi engineering audit concern about
    air-gap installs transitively loading ML deps.
  • Deterministic SecurityFinding.id derivation (v0.10.5 Phase 10 —
    collector idempotency hardening for the v1.0 API freeze)    . New
    evidentia_core.models.common.deterministic_finding_id(source_system, source_finding_id) helper computes a UUID v5 from natural keys
    under the pinned NAMESPACE_EVIDENTIA_FINDING namespace. A new
    @model_validator(mode="before") on SecurityFinding runs the
    derivation when no explicit id= is supplied AND both
    source_system + source_finding_id are present at construction.
    Effect: two collect() calls against an unchanged source produce
    findings with byte-identical id values across runs — closes the
    audit-flagged idempotency gap before v1.0. Additive-only;
    docs/api-stability.md frozen-surface contract preserved (explicit
    id= always wins, OCSF round-trip via unmapped["evidentia"]
    unchanged, pre-v0.10.5 OSCAL AR documents continue to load).
  • docs/collector-idempotency-audit.md — NORMATIVE per-collector
    audit covering the 13-collector + 1-ingest-module surface as of
    v0.10.5. Per-collector PASS/GAP verdicts on cursor model, natural
    key shape, and finding-identity contract. Refutes the principal-
    engineer architecture audit's "second-granularity cursor" diagnosis
    (no collector uses timestamp cursors) and "INSERT ... ON CONFLICT
    store" diagnosis (no DB-backed findings store exists; OSCAL AR is
    the canonical sink). Documents the actual gap: random uuid4() on
    SecurityFinding.id despite stable source_finding_id natural
    keys. Cross-referenced from docs/api-stability.md §"Frozen
    surfaces" + docs/threat-model.md §"Stuck-cursor guards" +
    docs/v0.10.5-plan.md Phase 10.
  • tests/unit/test_collectors/test_idempotency.py — CI regression
    test: runs each mockable collector (AWS Config, AWS Security Hub,
    GitHub repo settings, GitHub Dependabot alerts, Okta, Vanta, Drata,
    OCSF file ingest) twice against deterministic fixtures and asserts
    zero net new SecurityFinding.id values on the second run. Plus an
    OSCAL JSON round-trip sanity assertion that the validator's
    "explicit id wins" branch survives serialize → deserialize.
  • tests/unit/test_models/test_finding_idempotency.py — model-
    layer unit tests covering the deterministic_finding_id helper
    (UUID v5 verification, NAMESPACE pinning, NUL-separator collision
    resistance, empty-input rejection) and the SecurityFinding
    validator (explicit-id wins, falls back to random when natural
    keys missing, OCSF round-trip preservation).

Changed

  • evidentia-ai extra eval-faithfulness now proxies to
    evidentia-eval[faithfulness-semantic]. Existing
    pip install evidentia-ai[eval-faithfulness] invocations continue
    to pull the same sentence-transformers >= 3.0 + numpy >= 1.26
    stack — the heavy deps just live on the eval package now. Tracking
    removal in v0.12.0 when the wider deprecation shim is dropped.
  • Architecture doc + api-stability doc: workspace package count
    updated from 7 to 8; evidentia-eval added to the §5 public
    library entry-points and the §Revision history.

Deprecated

  • evidentia_ai.eval.* import paths are now deprecation shims
    that re-export from evidentia_eval.* and emit a
    DeprecationWarning at import time. Removal scheduled for
    v0.12.0     (2-minor-version migration window). Migration: replace
    from evidentia_ai.eval import X with from evidentia_eval import X
    (or for submodule imports, from evidentia_ai.eval.harness import Y
    with from evidentia_eval.harness import Y). Same symbols, same
    signatures — the rename is mechanical.

Internal

  • Lazy-import contract: production runtime entry-points
    (evidentia_ai, evidentia_ai.risk_statements,
    evidentia_ai.explain) verified not to pull the eval stack on
    bare import. Air-gap installs of evidentia-ai no longer
    transitively load sentence-transformers / numpy / instructor
    (instructor was already lazy; sentence-transformers + numpy
    remained gated behind a now-moved optional extra).
  • bump_version.py workspace allowlist: the F-V100-M1 close-out
    introduced in v0.10.1 reads [tool.uv.sources] dynamically;
    adding evidentia-eval = { workspace = true } to the workspace
    root pyproject.toml automatically includes it in the bump path
    (no script edit needed).

Test coverage

  • tests/unit/test_gap_analyzer/test_ocsf_detection_emit.py (NEW):
    10 tests covering the adversarial-probe taxonomy from the v0.10.4
    capability-matrix shape (Vectors 1 / 2 / 4 / 7) — minimal positive
    (each gap becomes one Detection Finding), severity mapping,
    GapStatus → OCSF StatusID mapping, empty inventory, unmapped block
    round-trip fidelity, end-to-end via export_report dispatch.
  • tests/unit/test_gap_analyzer/test_vex_emit.py (NEW): 21 tests
    covering the same adversarial-probe shape for CycloneDX VEX — VEX
    envelope, severity mapping, recommendation flow, every state-mapping
    rule in the Phase 8 state-derivation table, justification handling
    (only emitted on not_affected), empty inventory, end-to-end via
    export_report dispatch, deterministic serialNumber, schema
    sanity check.
  • tests/unit/test_gap_analyzer/test_end_to_end.py::test_export_all_formats
    extended    : parameterized end-to-end smoke test now covers the new
    ocsf-detection + cyclonedx-vex formats alongside the existing
    json / csv / markdown / oscal-ar / sarif coverage.

Documentation

  • docs/ocsf-mapping.md: new §7.B documents the v0.10.5 Detection
    Finding emit — ControlGap → Detection Finding field map, the
    types[] strategy for framework + control_id, rationale for the
    two-emit shape (GRC-target Compliance Finding 2003 vs SIEM-target
    Detection Finding 2004), API examples.
  • docs/api-stability.md: revision-history row added for v0.10.5
    Phases 7+8 (OutputFormat literal extension + two new library
    entry points, all additive-only). §5 library entry points section
    extended with the new gap_report_to_* helpers.
  • docs/integration-survey.md: row 15 (Splunk / Datadog) updated
    to reflect the v0.10.5 Detection Finding path (production-traffic-
    compatible with Splunk / Elastic / Sentinel / Datadog ingest); new
    row 16 added for CycloneDX VEX emit; "Beyond the original sequence"
    section gains two new SHIPPED entries.

Verify the wheels (PEP 740 publish attestations)

Every wheel uploaded to PyPI from this release carries a
Sigstore-signed PEP 740 publish attestation. Verify locally:

pip install pypi-attestations
pypi-attestations verify pypi \
  --repository https://github.com/polycentric-labs/evidentia \
  "pypi:evidentia==0.10.5"

Verification confirms the wheel was built + published from
polycentric-labs/evidentia/release.yml@refs/tags/v0.10.5
under GitHub Actions OIDC — i.e., a malicious mirror cannot
serve a tampered wheel without the verification failing.

See docs/sigstore-quickstart.md
for the full verification narrative + supply-chain framing.

CHANGELOG

Full changelog (every release): CHANGELOG.md

Container image

  • ghcr.io/polycentric-labs/evidentia:v0.10.5
  • ghcr.io/polycentric-labs/evidentia:latest
  • Digest: sha256:f315c1fc20ed93227d79b6576da9e3bb74e3901e76cab5f0af65cfd8b98bb1de

Verify (cosign keyless OIDC):

cosign verify ghcr.io/polycentric-labs/evidentia:v0.10.5 \
  --certificate-identity-regexp 'https://github\.com/Polycentric-Labs/evidentia/\.github/workflows/release\.yml@refs/tags/v.*' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Verify (SLSA build provenance):

gh attestation verify oci://ghcr.io/polycentric-labs/evidentia:v0.10.5 \
  -R Polycentric-Labs/evidentia

See docs/sigstore-quickstart.md
for the full verification narrative.

Assets 3
Loading