Skip to main content

​
Current release

v7.2.0 — Security hardening batch + precision advisory

Fail-closed security hardening (expression, auth, sandbox, event loop) plus a new float-precision advisory. Additive minor — no breaking wire changes.

​
Install

​
Release history

v7.2.0 — Precision advisory and security hardening batch (September 7, 2026)

Fail-closed hardening batch + one additive capability. Expression/auth/sandbox/event-loop security fixes restoring intended behavior, plus a new advisory flag for binary floating-point constants.
API-key migration required. API keys issued before v7.2 stop working — re-issue them after upgrading. Self-hosted deployments must also set a distinct QWED_API_KEY_LOOKUP_SECRET (the server fails closed at startup without it). See Authentication.
Full Release Notes → · GitHub Release
Verification Context (VC) v1.0 shipped end-to-end (PRs #302–#316). A formal specification with a machine-readable JSON Schema, a typed document model with fail-closed invariants, public proof_ref generation and resolution, to_verification_context() on all 13 verifiers, dedicated API endpoints, the qwed context CLI group, SDK re-exports on the Python client, and Docker-action VC outputs. Additive semver minor — no breaking wire changes.
Fail-closed conversion: a VERIFIED diagnostic without a valid attestation demotes to UNVERIFIABLE in the VC document; malformed diagnostics convert to BLOCKED instead of crashing.
Full Release Notes → · GitHub Release ↗
Engine migration to DiagnosticResult complete (META #216). SchemaVerifier, SQLVerifier, CodeVerifier and SecureCodeExecutor, and StatsVerifier — plus fact/image batch verification — now return the unified DiagnosticResult contract. Truth and admission are separated: proven-unsafe code and proven-malicious SQL are VERIFIED (the proof succeeded) with an explicit admission: BLOCKED, and successful stats execution is UNVERIFIABLE because execution is not verification. SDK 6.0.0 → 7.0.0 across Python, TypeScript, and Rust.
Breaking wire changes: POST /verify/code returns VERIFIED for proven-unsafe code (gate on admission / developer_fields.is_valid, not status), and POST /verify/stats returns the DiagnosticResult shape with UNVERIFIABLE on execution success instead of the legacy SUCCESS shape.
Full Release Notes → · GitHub Release ↗
Trust Boundary Completion epic closed (Issue #263, 12/12 sub-issues, 21 PRs). All /verify/* endpoints return unified DiagnosticResult. Control plane requires and verifies attestation at the admission boundary before admitting VERIFIED. VERIFIED is a protocol guarantee backed by deterministic proof_ref — heuristic and advisory analysis now reports UNVERIFIABLE with structured advisory_checks. Covers consensus, batch math, control-plane attestation, and agent state. SDK 5.3.0 → 6.0.0 across Python, TypeScript, Rust, Docker, and Kubernetes.
Breaking change: /verify/* responses now use the unified DiagnosticResult schema. Migrate consumers of the previous ad-hoc dict responses.
Full Release Notes → · GitHub Release ↗
Unified 3-layer DiagnosticResult model with agent_message (agent-safe), developer_fields (structured evidence), and proof_ref (sha256 proof hash — the authority bit). Tri-state status only (VERIFIED / UNVERIFIABLE / BLOCKED). Frozen dataclasses prevent post-construction bypass. Advisory checks structurally separated from verdicts. Migration helper for legacy engine dicts. 83 tests. Additive — no breaking changes.Full Release Notes → · GitHub Release ↗
Emergency security patch fixing High severity (CVSS 8.8) authenticated RCE via unsafe SymPy parse_expr(). Added safe_parse_expr() wrapper with denylist, stripped __builtins__, allow-listed math namespace. Cache Redis fail-closed. CodSpeed benchmarks.Full Release Notes → · GitHub Release ↗
Cache keys bound to full trust context (provider/model/policy/session) — prevents cross-context replay. Attestation path hardened with AttestationStatus enum and is_issued contract. Audit chain isolated per-org with BEGIN IMMEDIATE transactions. Reasoning proof prerequisites enforced. Symbolic/batch verifiers return BLOCKED on missing proof. Unknown agent actions denied. additionalProperties: false strictly enforced. SDK 5.1.1 across Python, TypeScript, Rust.Full Release Notes → · GitHub Release ↗
AgentStateGuard for deterministic state verification · Legacy CodeExecutor hard-blocked · Default-deny for unknown tools · Bounded math tolerance · verify_logic_rule / verify_identity fail-closed · Ambiguous math expressions blocked · Schema uniqueItems fail-closed · SDK 5.1.0 across Python, TypeScript, Go.Full Release Notes → · GitHub Release ↗
98 commits · Fail-closed verification boundary · INCONCLUSIVE status for LLM-translated math · trust_boundary metadata in responses · Mandatory ActionContext for agents · Replay/loop detection · Redis fail-closed rate limiting · Docker required for stats/consensus · security_checks field removed · Admin-only /metrics · SDK 5.0.0 across Python, TypeScript, Go.Full Release Notes → · GitHub Release ↗
TypeScript SDK alignment · POST /verify/process endpoint · Agent security checks (exfiltration, mcp_poison) · Security fixes (info disclosure, symbolic precision) · @qwed-ai/sdk@4.0.1.Full Release Notes → · GitHub Release ↗
147 commits · Agentic Security Guards (RAGGuard, ExfiltrationGuard, MCP Poison Guard) · SovereigntyGuard · ToxicFlowGuard · S-CoT Guard · Process Determinism (ProcessVerifier) · Critical security fixes (eval removal, sandbox escape, CVE patches) · Docker hardening · Sentry + CircleCI + SonarCloud + Snyk integration.Full Release Notes → · GitHub Release ↗
Security patch — CodeQL remediation (50+ alerts), workflow permissions lockdown, PII protection, Snyk partner attribution.GitHub Release ↗
Optimization Engine, Vacuity Checker, Dockerized GitHub Action, improved logic verifier.GitHub Release ↗

PyPI

Python package

Docker Hub

Container image

npm

TypeScript SDK

crates.io

Rust SDK

GitHub

All releases

Go Module

Go SDK