Skip to content

v1.0.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 26 May 19:45
· 662 commits to main since this release
v1.0.2
68de607
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Friday 1.0.2 — public v1 local candidate hardening patch

Release Claim

Final release SHA: 68de607b17214db0fdf400c29b8bbe0876eb21fb

Same-SHA R5 proof: Real Green Gate workflow_dispatch run 26469316019 — status=passed, scenarios 94/94, blocked_reasons=[], evidence_kinds_observed includes real-runtime, real-provider, real-browser, and manual-external. Discord, Telegram, and Lark/Feishu trusted-inbound channel artifacts all validate valid:true against the release SHA.

Friday 1.0.2 is a public v1 local candidate delivered through npm/source distribution only. It is a hardening patch over 1.0.1, not an expanded capability claim.

What Changed Since 1.0.1

  • Replaced the Lark/Feishu @larksuiteoapi/node-sdk dependency with Friday's native protobuf/WebSocket client, removing the transitive axios audit highs from the default public npm install surface.
  • Truth-labeled plugin trust-on-install so it no longer renders as cryptographic signature verification.
  • Made desktop policy and permission-decision dependencies fail closed with typed 503 responses instead of synthetic/no-op behavior.
  • Wired memory dedup as advisory-only and non-destructive; duplicate-like memories still store successfully while emitting advisory evidence.
  • Added provider capability-lane advisories in settings so lane-specific setup/proof failures are visible without claiming a full capability-health dashboard.
  • Cleaned stale config-manager naming and comments that implied persistent behavior was stubbed/no-op.

Still Proof-Pending / Not Claimed

The 1.0.1 dogfood partial_pass carry-forwards remain true in 1.0.2:

  • autonomous self-repair execute -> rollback;
  • autonomous self-upgrade mutation;
  • skill install/update/delete through the canonical approval workflow;
  • end-to-end link-to-skill candidate -> tests -> approval -> run;
  • queue/retry receipt loop;
  • audit tamper-negative proof;
  • R1 Lark/Feishu listener-shutdown polish;
  • speed/cost UI surfacing;
  • memory per-item confidence / last_accessed cognition polish.

Also not claimed: desktop distribution, Homebrew, notarized macOS, mobile, all integrations live, release-complete-all, or AGI. Slack HTTP Events-API inbound and QQ remain unsupported. Slack Socket Mode stays distinct from Slack HTTP.

Distribution

  • npm/source distribution only: @thesongzhu/friday@1.0.2
  • No desktop/Homebrew/notarized macOS/mobile release claim is made.
Assets 4
Loading