Repository navigation
Completed semantic uncertainty now returns review; evaluation and provider errors
remain failures. This minor release introduces Decision/Profile v0alpha2 and
regression ResultSet v0alpha2 while preserving published v0alpha1 contracts.
Upgrade validators, profiles and native/WASM consumers together; see the
migration guide.
Changed
-
Breaking: introduce Decision and EvaluatorProfile v0alpha2. Completed indeterminate
evidence returns review withevaluation.indeterminate_rule; failed evidence
remains failure and matched deny retains highest precedence. Published
v0alpha1 contracts remain immutable. The new runtime rejects legacy profiles
and requests; generated regression result sets use v0alpha2. See the
migration guide for profile digest,
trust, validator, regression, native/WASM, and coordinated consumer changes. -
Give the built-in local fixture profile a new v0alpha2 identity and digest.
Security
- Update the pinned validation toolchains to Go 1.26.9 and 1.27.2 and the
preferred development/release toolchain to Go 1.27.2 for upstream
standard-library security fixes. Keep the Go 1.26.0 module language floor.
See the advisory record
for the ten reported GO-IDs and fixed-in versions. - Update indirect
golang.org/x/textto v0.41.0 for GO-2026-6629. The reported
affected package was not imported in the scanned build configuration.