Skip to content

GuideCheck 0.5.0

Choose a tag to compare

View all tags
@snapsynapse snapsynapse released this 10 Jun 05:17
· 33 commits to main since this release
v0.5.0
8a2f362

Audit-driven release. Highlights:

Security

  • package-registry JSON anchors bind the hash to assistant-guide-specific metadata instead of accepting the first sha256 field anywhere in the registry record
  • hosted verification enforces a five-fetch per-request budget with exact fetch deduplication, uses one deterministically selected unbranded content-variation probe, warns on off-domain recommended verifiers, and warns when package-registry assistant-guide URLs disagree with canonical-url

Added

  • version-sync check in make test across every version-bearing surface, including byte-identity of the published .well-known guide copy
  • exact warning pinning on all 68 local-file fixtures (warnings_exact / forbidden_warning_ids), so false-positive warnings fail tests
  • deterministic anchor-channel tests for dns-txt, repository-file, signed-security-txt, and transparency-log
  • first standalone conformance-kit artifact (fixtures, schemas, finding-ids, verifier-conformance) for independent verifier implementations

Changed

  • finding-ids.md is normative for the finding-id registry
  • ADOPTION reframes MCP/A2A as ecosystem integrations of the core profile
  • INTENT records the Level 5 ownership decision (GuideCheck owns the runtime fixture suite and evaluator, gated by pre-level-5 readiness)

Fixed

  • published docs/.well-known/assistant-guide.txt resynced with the repository guide; the new version-sync check makes this drift a test failure

Full changelog: https://github.com/snapsynapse/guidecheck/blob/main/CHANGELOG.md

SHA-256 of the artifacts is in the attached SHA256SUMS files.

Assets 7
Loading