Skip to content

v0.4.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@araujof araujof released this 06 Oct 02:49
· 32 commits to main since this release
v0.4.1
a178f14
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Optional bounded PDP decision cache. A cache: block on a global.pdp[] entry stores Allow and Deny for a positive TTL and a positive entry cap. Omission leaves evaluation unchanged. Keys are a digest of dialect, call arguments, the full attribute bag, and structured request input, so request data is not retained. Dispatch errors are never stored, expired entries are never returned, FIFO eviction stays inside the cap, and a PPE configuration generation change drops the map. External PDP policy can still go stale until the TTL expires; docs/pdp-decision-cache.md states that. (#67)
  • PDPs can evaluate host-supplied LLM request JSON and native tool arguments. (#144)
  • Added verdict audit sinks, durable effect logs, and keyed content provenance. (#84)

Changed

  • Breaking: OPA and CEL now use native JSON for tool: route args; RoutePayload struct literals require structured.
    See migration guidance. (#144)
  • Breaking: cloned extensions drop HTTP transport, and effects are limited to sequential and transform modes. (#84)
  • Missing required LLM requests and overly deep structured input now deny. (#144)
  • PDP-generated errors hide input values; Cedar schemas require structured_context: true for structured input. (#144)
  • The reference audit logger uses sink mode when hooks: is absent. (#84)
  • Serial and transform plugin panics are contained and report plugin_panic. (#84)

Documentation

  • Documented Kuadrant/PPE attribute mapping and policy parity. (#131)

New Contributors

Contributors

Full Changelog: v0.4.0...v0.4.1

Contributors

maleck13, araujof, and 2 other contributors
Assets 2
Loading