From 212dcd23bab0863656ec2ff3292417328cab1b24 Mon Sep 17 00:00:00 2001 From: Harshith Date: Sat, 24 Oct 2026 21:08:01 +0530 Subject: [PATCH] release: 0.2.4 Version 0.2.4 with what merged since 0.2.3: - #12: a policy replaced through the API survives a restart (saved under SENTINEL_DATA_DIR/policies, serialized, atomic) and every reload is recorded as a PolicyChanged span (review F21). - #11: retention no longer keeps forever the traces whose span timestamps were left empty by 0.2.2 after a rollback. - #13: versions.lock past new advisories (certifi, which ships in the container image, and the filelock/virtualenv pre-commit tooling). The CHANGELOG [0.2.4] section opens with an upgrade note: no configuration changes; back up the new policies directory with the database (compose already keeps it on the data volume); and a rollback to 0.2.3 ignores saved policies and cannot replay policy-change runs. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release.yml | 2 +- CHANGELOG.md | 9 +++++++++ pyproject.toml | 2 +- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d3a5695..38eec3d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,7 +1,7 @@ name: release # Publishes to PyPI when a version tag is pushed: -# git tag -a v0.2.3 -m "..." && git push origin v0.2.3 +# git tag -a v0.2.4 -m "..." && git push origin v0.2.4 # # Uses PyPI Trusted Publishing (OIDC): GitHub proves the workflow's identity to # PyPI directly, so there is NO API token to store, rotate, or leak. This must be diff --git a/CHANGELOG.md b/CHANGELOG.md index 1acf65b..d27f5f0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,15 @@ All notable changes to this project are documented here. Format follows ## [Unreleased] +## [0.2.4] — 2026-10-24 + +**Upgrade from 0.2.3.** No configuration changes. Policies replaced through +the API are now saved under `${SENTINEL_DATA_DIR}/policies/`: back that +directory up along with `sentinel.db` (with `deploy/compose.yaml` it is already +on the data volume). To roll back to 0.2.3: it ignores the saved policies, so +each tenant returns to its configured policy, and it lists `policy-change` +runs but cannot replay them. + ### Added - Every policy reload is recorded: a `PolicyChanged` span (applied, ignored, rejected or failed, with the versions and the SHA-256 of the submitted text) diff --git a/pyproject.toml b/pyproject.toml index 749cd03..d2cb1c7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta" # (`sentinel`, `sentinel-mcp`, `mcp-sentinel` and `sentinely` were all # unavailable on PyPI, so the published distribution is `sentinel`.) name = "sentinel-prox" -version = "0.2.3" +version = "0.2.4" description = "Provenance-aware security proxy for AI agents: block prompt-injection actions at the MCP tool boundary." requires-python = ">=3.11" authors = [{ name = "Pali Krishna Harshith" }]