Skip to content

v2.3.0 — Security Hardening, Duck-Type Guard, Tune CLI

Choose a tag to compare

View all tags
@anulum anulum released this 02 Mar 20:00
· 2989 commits to main since this release
v2.3.0
e03d356

Security

  • Constant-time API key comparison via hmac.compare_digest (REST + gRPC + WebSocket)
  • WebSocket auth enforcement — X-API-Key checked before ws.accept()
  • gRPC auth interceptor + optional TLS via tls_cert_path/tls_key_path
  • Rate limiting wired — SlowAPIMiddleware actually added to FastAPI app
  • SBOM — CycloneDX artifact in publish workflow
  • LLM judge privacy warning in config, scorer, and README
  • AGPL compliance guidance in SECURITY.md

Changed

  • strict_mode rejects: returns 0.9 (reject) instead of 0.5 (neutral) when NLI unavailable
  • guard() duck-type detection: supports vLLM, Groq, LiteLLM, Ollama — any client with chat.completions.create or messages.create
  • Config.build_scorer(): single method wires all config fields through to CoherenceScorer
  • BatchProcessor: as_completed() for completion-order processing
  • gRPC StreamTokens: real CoherenceScorer scoring replaces fake hash→sin callback

Added

  • director-ai tune <file.jsonl> CLI — grid-search over thresholds × weight pairs
  • Lite scorer, multi-turn sessions, ONNX GPU batching, plugin backends, gRPC transport, multi-GPU sharding
  • Safety contract tests (13 new), security hardening tests (15), fuzz tests (4)
  • Public API freeze (PUBLIC_API.md), deprecated aliases emit DeprecationWarning
  • CI version consistency check — fails if pyproject.toml/init/CITATION.cff versions diverge

Fixed

  • CycloneDX SBOM CLI flags (-o/--of for v7.x)

Stats

  • 1090 tests, 10 skipped, 0 failures
  • 22 files changed, ~810 insertions

Full changelog: CHANGELOG.md

Assets 2
Loading