release: cmcp 0.5.0 - #615
Merged
Merged
Conversation
Ships GHSA-wh6r-6j4v-p4p6 and the compliance-domain work. Minor rather than patch: the policy bundle hash changes for bundles carrying non-ASCII text or float-typed numbers, and the catalog schema gains rotation_mode while compliance_domain stops being a closed enum. ASCII-only bundles hash exactly as before. The cross-boundary compliance control is the entry worth reading. It was dead for hipaa_phi, pci_data and mnpi because the hardcoded high-sensitivity set had drifted away from the schema vocabulary it guards, overlapping on "pii" alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
The distribution smoke test compares the runtime constant against package metadata and caught the pyproject-only bump. Two version strings is the trap; the test exists because of it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump and changelog for 0.5.0, shipping the security work merged today.
Minor, not patch. Two visible changes:
server.rotation_modeandcompliance_domainstops being a closed enum.The entry worth reading is the cross-boundary compliance control.
_HIGH_SENSITIVITY_DOMAINShad drifted to{"pii", "phi", "pci", "restricted"}while the schema permitted{hipaa_phi, pci_data, mnpi, pii, internal, external, public}. They overlapped onpiialone, so a session reading HIPAA PHI and then calling an external tool recorded no boundary crossing in its TRACE claim. That was silently true for the three most regulated domains the field exists to express.Publishing a GitHub release for
v0.5.0after this merges triggers the release workflow. GHSA-wh6r-6j4v-p4p6 gets published naming 0.5.0 as patched once it is on PyPI. This also unblocksagentrust-io/demos, whose catalogs need the extensiblecompliance_domain.🤖 Generated with Claude Code
https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t