Skip to content

v0.0.56

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jul 16:31
v0.0.56
This tag was signed with the committer’s verified signature.
sebastienrousseau Sebastien Rousseau
SSH Key Fingerprint: f6FG+guRNtT3R36oQFS4oWCx1d10nm+BoaIL3Tkh1r4
Verified
Learn about vigilant mode.
02990b4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Pain001 Release v0.0.56

Release Date: 2026-07-18
Tag: v0.0.56
Python: 3.10+
Status: Stable

Executive Summary

A feature release that ships the plugin substrate to PyPI for the first
time, layered on top of the 0.0.55 path-injection hardening. The plugin
work had been developed in parallel with the 0.0.55 security release; this
release merges it forward with every job-store containment guarantee fully
preserved.

What's in v0.0.56 at a glance

  • Plugin substrate (pain001.plugins): a formal, versioned plugin
    contract — AbstractLoader / AbstractValidator / AbstractScheme /
    AbstractWriter Protocols (contracts.py) — plus a process-level
    PluginRegistry (registry.py) that registers built-ins eagerly and
    discovers third-party plugins via importlib.metadata entry points. Built-in
    loader adapters live in _builtins.py; the contract API version is pinned in
    _version.py. import pain001.plugins now works from a PyPI install.
  • GPG-encrypted-input loader (pain001[gpg]): builtins_gpg.py registers
    an opt-in loader that decrypts .gpg / .asc inputs in memory via
    python-gnupg and dispatches to the inner-extension loader
    (batch.csv.gpg → gpg → csv). Decrypted bytes still flow through the
    existing path-validator and schema guards.
  • OpenTelemetry observability surface (pain001[otel]): opt-in distributed
    tracing (traced, init_otel, set_span_attributes), off by default and
    enabled with OTEL_ENABLED=true. Metric events attach the active span's
    (trace_id, span_id, is_remote) so metrics correlate back to traces.
  • Security carried forward from 0.0.55: pain001/api/job_store.py keeps
    the _validate_job_id safe-token guard
    (^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$, fullmatch, raising ValueError),
    the FileJobStore._path realpath + commonpath + startswith
    containment barrier, and RedisJobStore._key validation. The
    pain001/api/app.py _gate_output_dir containment and mcp>=1.28.1 bump
    are unchanged.

Quality

  • 1,422 tests passing, 100% line + branch coverage against a 100% enforced
    floor.
  • mypy --strict clean (including the new plugin surface), 100% docstring
    coverage (interrogate), pydoclint clean, bandit clean, pip-audit reports no
    known vulnerabilities.
  • Both the new plugin/GPG/OTel tests and the 0.0.55 job-store security
    regression tests pass together at 100%.

Upgrade notes

No breaking API or configuration changes. The GPG and OpenTelemetry surfaces
are opt-in via the pain001[gpg] and pain001[otel] extras and are inert
unless installed and enabled. The job-id validation behaviour from 0.0.55 is
retained: callers relying on job identifiers containing path separators will
receive a ValueError — use plain identifier tokens (UUIDs are ideal).

Assets 7
Loading