Skip to content

v0.26.0 — security: verifier-provider attaches credentials only to an explicit host allowlist (#241)

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Sep 20:08
· 28 commits to main since this release
v0.26.0
4077ee3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.26.0 — security: verifier-provider attaches credentials only to an explicit host allowlist (#241)

Shipping release (behavior of a distributed example adapter + operator-facing docs change).

Changes

  • adapters/hermes/examples/verifier-provider.py: VERIFIER_API_KEY is attached only when the VERIFIER_API_BASE host is in the allowlist (default: Anthropic). Opt-in override via VERIFIER_API_ALLOWED_HOSTS (documented for the z.ai route). Rejection happens before any request object is built; malformed or empty allowlist entries fail closed; hostname match is case-insensitive.
  • adapters/hermes/INSTALL.md: allowlist contract and the VERIFIER_API_ALLOWED_HOSTS opt-in documented.
  • tests/hermes-verifier-examples.test.sh: tests [18]-[20] cover the rejection path (3 modes), fail-closed parsing, and case-insensitive matching (30 PASS).

Review: 5-seat heterogeneous panel (Kimi / Codex / GLM / Grok / Opus), r1 blind + cumulative delta, 5/5 GO at 06ecebd; human risk review by the owner (risk-reviewed label). Completion record and L1-8 release correction (v0.24.0 → v0.26.0 because main advanced to v0.25.1 while the PR awaited risk review): PR #262.

Assets 2
Loading