Skip to content

PRAXO-CORE 2.3.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 02:40
· 46 commits to main since this release
v2.3.3
207fe36

PRAXO-CORE 2.3.3

Released: 2026-10-24

This patch closes a tool-authorization gap after preparation callbacks and
makes release checks propagate command failures. It changes no exported
pkg/... declarations.

Tool Authorization

Original policy denials still stop preparation. Final tool names are checked
against the allowlist, and changed JSON arguments or names are reauthorized
before any tools in the prepared batch execute. This covers middleware, HITL
edits, hooks, event/stream callbacks, and later callbacks modifying earlier
calls. Unchanged calls keep one tool-policy request.

When policy is enabled, tool arguments must be JSON-serializable. Callbacks
must not mutate retained arguments asynchronously. A nil policy still permits
actions and an empty tool allowlist still permits all registered tools; configure
both explicitly for least privilege. Tools remain responsible for their own
side effects and resource-level checks.

Verification

  • Full core tests, vet/build, Linux race/fuzz, staticcheck, and govulncheck.
  • Three-platform tests, including release-gate failure injection.
  • Nine independent modules checked with Linux race and govulncheck.
  • Strict bilingual documentation build and unchanged API snapshot.

Existing consumer checks before publication use the previous released version.
Post-publication checks must pin 2.3.3 to verify this fix without local replaces.
These checks do not establish production or deployed IAM validation.

Upgrade

go get github.com/axisvela/praxo-core/v2@v2.3.3

Use Go 1.26.10, the tested toolchain. No source migration is required from
2.3.2. api/2.3.3.txt is identical to api/2.3.2.txt. Optional adapter versions
are unchanged; consuming products must upgrade their core dependency to receive
the runtime fix.

Release Tag

No signing key was configured for this release environment. The tag is
annotated rather than cryptographically signed; checksums and an SBOM are
published by the release workflow.

Evidence Boundaries

This release does not establish production, deployed remote-peer, complete v2 IAM, instance-lease, or LIMENORA reverse-ingress validation. Database-dependent tests may skip without a configured test database. The release tag is annotated but not cryptographically signed.

Assets

  • Source archive: praxo-core-2.3.3.tar.gz
  • SBOM: sbom.json
  • Checksums: SHA256SUMS
Assets 5
Loading