Skip to content

v2.4.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Aug 18:53
v2.4.0
571b971
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v2.4: Reproducible reports and distribution

API Relay Audit v2.4 adds reproducible report metadata, a user-authored
feedback entrypoint, stricter Anthropic stream completion checks, and a
DeepSeek Harness bundle. The release keeps the 14-step audit, runtime profiles,
threat taxonomy, and 6D risk matrix unchanged.

What Changed

  • #71 adds UTC
    generation time, tool version, profile, and an optional checkout commit to
    private Markdown reports.
  • #72 adds a local
    run feedback issue entrypoint without telemetry or automatic evidence
    publication.
  • #89 requires
    exactly one message_stop after message_start, with only trailing ping
    events allowed. Violations enter the existing D5 stream-integrity dimension.
  • #85 adds a DSH
    bundle for web and cc-tui profiles, per-invocation credential resolution,
    Claude runtime gating, workspace-contained outputs, and strict rejection of
    abbreviated adapter-controlled options.

DeepSeek Harness Distribution

Install the DSH bundle from the immutable release tag:

dsh plugin --profile web add "github:toby-bridges/api-relay-audit#v2.4.0"
dsh plugin --profile cc-tui add "github:toby-bridges/api-relay-audit#v2.4.0"

Distribution work for this release focuses on DeepSeek Harness. Existing
OpenClaw and Hermes skill files remain in the repository for direct users, but
they are not v2.4 registry distribution targets. See the
v2.4.0 DSH verification for exact
tool versions, immutable resolution, runtime checks, and secret-scan results.

Quick Start

AUDIT_SCRIPT_REF=v2.4.0
curl -fsSL "https://raw.githubusercontent.com/toby-bridges/api-relay-audit/${AUDIT_SCRIPT_REF}/audit.py" -o audit.py
python3 audit.py --key <YOUR_KEY> --url <BASE_URL> --output report.md

Verification

  • Full pytest, DSH adapter tests, version sync, standalone drift, and metrics
    drift must pass.
  • Standalone audit.py SHA-256: 43d237634fabf8618f458668acd70a1d0c15d3595f25e538285e56b057de9e71
  • The tagged audit.py, generated standalone output, release asset, and
    published SHA-256 file must be byte-identical before publication.
  • Published release checks: /releases/latest and /releases/tags/v2.4.0.
  • DSH web and cc-tui installations must pass connectivity checks without the
    test key appearing in argv, DSH state, logs, or reports.

Limits

  • API Relay Audit does not certify that a relay is safe.
  • Do not publish API keys, private relay URLs, headers, raw responses, wallet
    material, or user data with audit reports.
Assets 4
Loading