Skip to content

hotato 1.8.0

Choose a tag to compare

View all tags
@quantumCF quantumCF released this 16 Jul 17:32
v1.8.0
aa925f0

Fail-closed behavior across the evidence pipeline.

Integrity

  • Content-addressed reads re-hash on every serving boundary: a blob whose bytes do not match its address is refused, not served.
  • Blob deletion resolves through a no-follow directory handle, so a swapped symlink stays inside the store.

Capture

  • Provider recordings are validated before they are written to --out, so a rejected download never lands on disk. The Vapi adapter refuses a non-audio response instead of treating it as a recording.

Verification

  • record verify --evidence-root requires each reproduction artifact to be present before checking its digest.
  • The reference-agent refund example describes exactly what the fixture proves.

Install: pip install hotato==1.8.0 — or uvx hotato start --demo for the zero-setup first run.

Every artifact carries a PyPI Trusted Publishing (OIDC) build-provenance attestation, verifiable with gh attestation verify <file> --repo attenlabs/hotato.

Assets 2
Loading