Skip to content

v0.1.2 — Pro £49 pivot + self-audit honest disclosure

Choose a tag to compare

View all tags
@jaquelinejaque jaquelinejaque released this 16 Jun 00:58
· 49 commits to main since this release
v0.1.2
e870a42

v0.1.2 — Pro £49 pivot + self-audit honest disclosure

Two days ago I ran Quorum against its own source. The thing I built to catch what unit tests miss caught two things my unit tests missed: a deprecated Gemini embedding endpoint that was about to 404, and a stale __version__ string. v0.1.1 fixed those. v0.1.2 ran the same audit one level deeper — at the security/billing/consensus-core layer — and the honest scorecard is now committed under docs/AUDIT_FINDINGS_v0.1.2.md.

What changed

Pricing pivot — Pro £49/mo as the headline tier

  • README, landing page (quorum-ai.dev), and Show HN copy all re-cut to lead with Pro £49/mo for solo devs, indie hackers, and agency engineers.
  • Free is now a small sandbox row. Team / Enterprise / Compliance moved to "talk to us — jaqueline@hsp-protocol.com".
  • BYOK ("Quorum never proxies your provider keys") promoted to the section intro on every surface.
  • Billing module: pro is now the first key in TIERS (Python insertion order guarantees next(iter(TIERS)) yields Pro); new DEFAULT_TIER, get_default_tier(), list_tiers(self_serve_only=...) public API; contact_sales: bool on TierConfig so any contact-sales tier routes to the sentinel (not just Enterprise).

Self-audit — 5 high-severity findings fixed

  • H-1 Gemini API key moved from URL query string to x-goog-api-key header. URL is no longer in proxy access logs or httpx.HTTPError.request.url.
  • H-2 Anthropic provider sanitises upstream error bodies — UTF-8 replace errors handler, CR/LF stripped — to block log injection and codepoint corruption.
  • H-3 OpenAI provider wraps the entire request path in structured exception handling; no more raw KeyError/JSONDecodeError past the provider boundary.
  • H-4 consensus() now raises ValueError on prompts >32 kB; provider responses truncated to 16 kB before embedding and before vector-memory ingest. Closes the prompt-amplification attack that could fan out one oversized request into N provider bills + 2N embeddings + 1 permanent memory write.
  • H-5 Stripe webhook verification delegates to stripe.Webhook.construct_event when the SDK is available; hand-rolled HMAC is now only the dev/test fallback. Also: SHA-256 email idempotency key on Customer.create closes the at-least-once retry TOCTOU window.

Full findings: quorum/docs/AUDIT_FINDINGS_v0.1.2.md

Honest loop classification — 13 self-evolution loops

The README originally implied all 13 were live. They aren't. Real status at v0.1.2:

  • Functional (3): memory (Loop 1), router (Loop 4), RLHF (Loop 6).
  • Partial (2): hebbian (Loop 7), meta-learner (Loop 10).
  • Skeleton (9): A/B, adversarial, architecture search, competition, distillation, federated, self-prompt, synthetic data, bootstrap.

Each is enumerated in the audit findings doc with file path, LOC, and what's missing for v1.0.

Why this matters

Anthropic, OpenAI, and Google cannot ship a multi-vendor consensus engine without commoditizing their own answer as one vote among several. A solo team can. That is the entire wedge. Pricing Pro at £49/mo for solo devs is the cheapest way to test whether that wedge has a market — and disclosing the gap between "13 loops shipped" marketing and "3 functional, 2 partial, 9 skeleton" reality is the cheapest way to test whether honesty has one.

Live

  • https://quorum-ai.dev (DNS still propagating in some regions)
  • Origin: https://quorum-api-86770458722.europe-west2.run.app/v1/healthz

Install

pip install quorum-consensus

License

  • Engine: Apache 2.0.
  • HSP transport layer: PCT/US26/11908 with commercial-use carve-out in LICENSE-HSP. Self-host, fork, audit, ship internal tools — permitted. Resell the consensus protocol as a service — talk to me.

Outstanding for v1.0.0

Punch list in docs/AUDIT_FINDINGS_v0.1.2.md under Open blockers. Highlights: meta-learner first (Loop 10 is the highest-leverage skeleton because the other 8 produce its training data), per-tier size caps, per-class Hebbian shards, learned RLHF reward model, Quorum-on-Quorum CI job.

Generated with the same tool the release describes. Quorum eats its own dog food.

Assets 2
Loading