From 700895feeea6d5b9dad11b5ccefbd4d3f93a28b6 Mon Sep 17 00:00:00 2001 From: Harshith Date: Mon, 19 Oct 2026 23:53:08 +0530 Subject: [PATCH] release: 0.2.3 Version 0.2.3: the catalogue fixes merged in #8 (atomic Cosmos writes, explicit fail-closed checks, a Cosmos extra that lets Cosmos persistence start at all, indexed SQLite timestamps, verb-based attack labels) and the project site, README and community files merged in #9. Publishing it also refreshes the PyPI page, which still shows the 0.2.2 README and project URLs. The CHANGELOG [0.2.3] section opens with an upgrade note: no configuration changes; Cosmos users need the extra; and the SQLite store migrates in place, so a rollback should restore a backup rather than run 0.2.2 on the migrated file, because spans 0.2.2 writes get no value in the new timestamp column and upgrading again does not fill it in. It also names the two removed helpers, create_cosmos_store and build_web_server. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 2 +- CHANGELOG.md | 15 +++++++++++++++ pyproject.toml | 2 +- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4e09008..d3a5695 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,7 @@ name: release # Publishes to PyPI when a version tag is pushed: -# git tag -a v0.2.2 -m "..." && git push origin v0.2.2 +# git tag -a v0.2.3 -m "..." && git push origin v0.2.3 # # Uses PyPI Trusted Publishing (OIDC): GitHub proves the workflow's identity to # PyPI directly, so there is NO API token to store, rotate, or leak. This must be diff --git a/CHANGELOG.md b/CHANGELOG.md index 6759edd..d11ea2a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,17 @@ All notable changes to this project are documented here. Format follows ## [Unreleased] +## [0.2.3] — 2026-10-19 + +**Upgrade from 0.2.2.** No configuration changes. If you use Cosmos DB, +install `sentinel-prox[cosmos]`: without the extra, Cosmos persistence +could not start in 0.2.2 either. The SQLite forensic store adds an indexed +timestamp column, and fills it in, the first time 0.2.3 opens an existing +database. Back up `sentinel.db` before upgrading, and to roll back, restore +that backup rather than running 0.2.2 on the migrated file: spans 0.2.2 +writes get no value in the new column, and upgrading again does not fill +it in. + ### Added - A documentation site, built from `website/` with VitePress and published to GitHub Pages: quick start, how it works, policy guide, configuration, @@ -33,6 +44,10 @@ All notable changes to this project are documented here. Format follows - The hackathon pitch decks, submission documents and video script (`deck/`). They remain in the git history. The large-file check is back to its default limit, which the decks had needed raised. +- Two unused helpers: `sentinel.forensics.store.create_cosmos_store` (a + duplicate of the Cosmos factory the service actually uses) and + `sentinel.toolservers.web_fetch.build_web_server`. Code that imported + either needs to build the store or server itself. ### Security - The Cosmos store writes spans with `create_item`, which fails atomically if diff --git a/pyproject.toml b/pyproject.toml index 9f3e75c..749cd03 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta" # (`sentinel`, `sentinel-mcp`, `mcp-sentinel` and `sentinely` were all # unavailable on PyPI, so the published distribution is `sentinel`.) name = "sentinel-prox" -version = "0.2.2" +version = "0.2.3" description = "Provenance-aware security proxy for AI agents: block prompt-injection actions at the MCP tool boundary." requires-python = ">=3.11" authors = [{ name = "Pali Krishna Harshith" }]