Skip to content

IGL 1.5.0

Choose a tag to compare

View all tags
@cosudm cosudm released this 16 Oct 13:39
Immutable release. Only release title and notes can be modified.
v1.5.0
a16e677

The five runtime findings left open by the October 2026 security review are
closed, each with a regression test. The repository now runs a linter and a
type check on every pull request. The model the provisioning service reasons
with is loaded at a pinned revision and its bytes are recorded.

Security

  • F-05: the idempotency key is a SHA-256 execution identity over the actor,
    boundary, intent and parameters, the context selection, every compute step
    with its bound arguments and pinned model version, the declared outputs and
    the runtime build digest. Statements that differ in any material input are
    different work. Only a durably committed trace can answer an idempotency
    check. Interpreter.statementKeys() previews keys without running
  • F-06: journal records are frozen snapshots; runtimes work on copies. Reuse
    of a trace as context is its own reuse journal event and the counter is
    derived by replay, so the chain verifies after reuse, receipts stay valid and
    confidence decay survives a restart
  • F-07: nothing is visible until it is durable. A failed persist leaves no
    entry; write-behind entries stay pending until flush() succeeds and roll
    back when it fails; entries() returns durable entries unless asked for
    pending ones; the IOS runtime stages traces until durable; FileJournal
    fsyncs every append
  • F-08: checkpoints. journal.checkpoint(), verify({ checkpoint }), a
    checkpoint option on FileJournal and D1Journal that refuses a truncated
    or rewritten history, and Signer.verifyHeadReceipt(..., { extended: true })
    so a signed head receipt serves as the anchor
  • F-09: Traces=None returns no context. Every refusal or failure is journaled
    as a failure event with privacy-safe fields before any OnFail handler runs
  • Model provenance: provision/model.mjs loads Xenova/distilgpt2 at Hub
    commit a41c1048, hashes the cached files and records label@revision#digest
    as the model version in every AI assertion; IGL_MODEL_LOCAL_ONLY=1 refuses
    network fetches; health endpoints report the loaded revision and digest
  • UDM.Validate refuses a named ruleset UDM does not define
    (IGL_UNKNOWN_RULESET) instead of validating everything

Added

  • Platform: the refusal record. Every deny, and every escalate on a path that
    cannot park the work, now produces a signed governance receipt and an entry
    in the tenant's hash chain before the 403 leaves, and the 403 names the
    decisionId and receiptId. Every AuthorityDecision carries
    policiesMatched (id, name, version, effect and a SHA-256 of the rule as it
    stood) and subject (action, resource type and id, identity, organization,
    roles). Every receipt carries auditHead, the chain head at issue time, so a
    receipt held outside the system is a checkpoint the database cannot rewrite.
    Policies are immutable at the schema (triggers): a change is a new version.
    Conformance test: a denied investigation is checked the way an auditor would
  • test/audit.test.js: the review's probes, promoted into the suite (18 tests;
    169 in all). docs/audit/probes-2026-10.mjs now prints the properties holding
  • ESLint (flat config) and tsc --checkJs over src/, provision/,
    platform/api/src and platform/ops/src; npm run lint, npm run typecheck
    and npm run check; both run in CI before the tests
  • README: a Start Here section that routes runtime users, application builders
    and AI-client integrators to the right quickstart

Fixed

  • provision/cli.mjs had called provisionIdentity without the owner that
    F-02 made mandatory in 1.3.0, so the documented CLI command failed; it now
    acts as the local operator (IGL_CLI_TENANT, IGL_CLI_PRINCIPAL to change).
    Found by the type check on its first run
  • Dead imports and variables across the runtime, the platform service and the
    tests, found by the linter

Removed

  • examples/run-vdrpros.js and examples/vdrpros-ussh.igl: the one example
    that ran against stubbed runtimes (canned inference, constraint checks that
    always passed). Every remaining example runs the real runtime against the
    pinned model
  • spec/openapi-v0.1.yaml and the served copy: superseded by 0.2.0; the file
    is in the repository history
  • OPEN_SOURCE_CHECKLIST.md and SECURITY-REVIEW.md: an internal checklist
    whose items were done, and scan notes that the audit document supersedes
  • References in docs/SPEC.md, docs/SCOPE.md and source comments to design
    documents that are not in the repository now say so instead of linking to them

Changed

  • The README status line no longer says experimental. It says what is true:
    all nine findings of our own review are closed with tests, and an
    independent review has not happened yet
  • Attestation notes join clauses with a semicolon instead of a middle dot
Assets 3
Loading