Skip to content

v2.0.0-rc.2

Pre-release
Pre-release

Choose a tag to compare

View all tags
@thinksyncs thinksyncs released this 30 Aug 16:29
· 26 commits to main since this release
Immutable release. Only release title and notes can be modified.
v2.0.0-rc.2
This tag was signed with the committer’s verified signature.
thinksyncs Akira, ToppyMicroServices
GPG key ID: 40FF815AEF7C0197
Verified
Learn about vigilant mode.
39f946d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This prerelease hardens attestation dependency checks and adds a guarded macOS debug path.

Included:

  • Loopback-only --debug-simple A2A mode with signed simulated evidence and explicit non-production warnings.
  • Package-level vulnerability gates for the root, SNP, TDX, and Cocos modules.
  • A fail-closed guard that rejects any golang.org/x/crypto/openpgp production or test import.
  • OpenTelemetry core modules updated to v1.44.0.
  • Cocos updated to the published SNP v0.1.1 and TDX v0.1.2 module tags.

Limitations:

  • This is an experimental prerelease, not a production-readiness claim.
  • Live SNP, TDX, and TPM hardware qualification has not been performed.
  • A TDX strict-collateral success fixture is still missing.
  • GO-2026-5932 remains visible at module scope through transitive x/crypto use. The OpenPGP packages are not imported, and the upstream advisory has no fixed version.
Assets 3
Loading