Skip to main content

​
Current release

v7.3.0 — Five advisories, tenant scoping and DoS hardening

Fail-closed security and soundness release covering five advisories (whole-tree SQL command classification, code-verifier process/file-network sinks, sandbox namespace isolation, SQL schema and tautology checks, logic DSL string constants), plus tenant-scoped admin endpoints, denial-of-service caps and credential-handling fixes. No breaking wire changes. Upgrade is recommended.

​
Install

​
Release history

v7.2.3 — Code, secret, and SQL verification security release (October 13, 2026)

Fail-closed security release. Fixes GHSA-6rxr-gq43-694g, GHSA-64xf-wffc-63fm, and GHSA-q5g6-6cw2-cjm3. A soundness eval report is attached to each release from v7.2.3 on.
Behaviour changes. The code verifier never admits shell or process execution, including through aliased imports. The secret scanner detects sk-proj-, sk-svcacct-, and sk-admin- keys. The SQL verifier analyses MySQL/MariaDB executable comments as SQL and, with schema_ddl, blocks undeclared tables with sql_verifier.schema_violation. No response fields are removed or renamed.
Full Release Notes → · GitHub Release ↗
Fail-closed security release (GHSA-4v5r-g7f4-vvgc, GHSA-mfh5-3c8f-975p, GHSA-j622-qffp-rc27, GHSA-mxwv-x5qm-mrmf). The local SDK SymPy validator rejects nested string literals. The Z3 evaluator rejects Python and/or/not and chained comparisons on symbolic objects, and the DSL compiler rejects string literals. verify_math compares at a precision scaled to the operands, beyond 15 significant digits. Compute-cost bounds now cover implicit multiplication and integer powers. No breaking wire changes.Full Release Notes → · GitHub Release ↗
Fail-closed hardening batch + one additive capability. Expression/auth/sandbox/event-loop security fixes restoring intended behavior, plus a new advisory flag for binary floating-point constants.
API-key migration required. API keys issued before v7.2 stop working — re-issue them after upgrading. Self-hosted deployments must also set a distinct QWED_API_KEY_LOOKUP_SECRET (the server fails closed at startup without it). See Authentication.
Full Release Notes → · GitHub Release
Verification Context (VC) v1.0 shipped end-to-end (PRs #302–#316). A formal specification with a machine-readable JSON Schema, a typed document model with fail-closed invariants, public proof_ref generation and resolution, to_verification_context() across the verifier classes (Math and the secure code executor convert through POST /verification-context/from-diagnostic), dedicated API endpoints, the qwed context CLI group, SDK re-exports on the Python client, and Docker-action VC outputs. Additive semver minor — no breaking wire changes.
Fail-closed conversion: a VERIFIED diagnostic without a valid attestation fails closed to BLOCKED in the VC document; malformed diagnostics convert to BLOCKED instead of crashing.
Full Release Notes → · GitHub Release ↗
Engine migration to DiagnosticResult complete (META #216). SchemaVerifier, SQLVerifier, CodeVerifier and SecureCodeExecutor, and StatsVerifier — plus fact/image batch verification — now return the unified DiagnosticResult contract. Truth and admission are separated: proven-unsafe code and proven-malicious SQL are VERIFIED (the proof succeeded) with an explicit admission: BLOCKED, and successful stats execution is UNVERIFIABLE because execution is not verification. SDK 6.0.0 → 7.0.0 across Python, TypeScript, and Rust.
Breaking wire changes: POST /verify/code returns VERIFIED for proven-unsafe code (gate on admission / developer_fields.is_valid, not status), and POST /verify/stats returns the DiagnosticResult shape with UNVERIFIABLE on execution success instead of the legacy SUCCESS shape.
Full Release Notes → · GitHub Release ↗
Trust Boundary Completion epic closed (Issue #263, 12/12 sub-issues, 21 PRs). All /verify/* endpoints return unified DiagnosticResult. Control plane requires and verifies attestation at the admission boundary before admitting VERIFIED. VERIFIED is a protocol guarantee backed by deterministic proof_ref — heuristic and advisory analysis now reports UNVERIFIABLE with structured advisory_checks. Covers consensus, batch math, control-plane attestation, and agent state. SDK 5.3.0 → 6.0.0 across Python, TypeScript, Rust, Docker, and Kubernetes.
Breaking change: /verify/* responses now use the unified DiagnosticResult schema. Migrate consumers of the previous ad-hoc dict responses.
Full Release Notes → · GitHub Release ↗
Unified 3-layer DiagnosticResult model with agent_message (agent-safe), developer_fields (structured evidence), and proof_ref (sha256 proof hash — the authority bit). Tri-state status only (VERIFIED / UNVERIFIABLE / BLOCKED). Frozen dataclasses prevent post-construction bypass. Advisory checks structurally separated from verdicts. Migration helper for legacy engine dicts. 83 tests. Additive — no breaking changes.Full Release Notes → · GitHub Release ↗
Emergency security patch fixing High severity (CVSS 8.8) authenticated RCE via unsafe SymPy parse_expr(). Added safe_parse_expr() wrapper with denylist, stripped __builtins__, allow-listed math namespace. Cache Redis fail-closed. CodSpeed benchmarks.Full Release Notes → · GitHub Release ↗
Cache keys bound to full trust context (provider/model/policy/session) — prevents cross-context replay. Attestation path hardened with AttestationStatus enum and is_issued contract. Audit chain isolated per-org with BEGIN IMMEDIATE transactions. Reasoning proof prerequisites enforced. Symbolic/batch verifiers return BLOCKED on missing proof. Unknown agent actions denied. additionalProperties: false strictly enforced. SDK 5.1.1 across Python, TypeScript, Rust.Full Release Notes → · GitHub Release ↗
AgentStateGuard for deterministic state verification · Legacy CodeExecutor hard-blocked · Default-deny for unknown tools · Bounded math tolerance · verify_logic_rule / verify_identity fail-closed · Ambiguous math expressions blocked · Schema uniqueItems fail-closed · SDK 5.1.0 across Python, TypeScript, Go.Full Release Notes → · GitHub Release ↗
98 commits · Fail-closed verification boundary · INCONCLUSIVE status for LLM-translated math · trust_boundary metadata in responses · Mandatory ActionContext for agents · Replay/loop detection · Redis fail-closed rate limiting · Docker required for stats/consensus · security_checks field removed · Admin-only /metrics · SDK 5.0.0 across Python, TypeScript, Go.Full Release Notes → · GitHub Release ↗
TypeScript SDK alignment · POST /verify/process endpoint · Agent security checks (exfiltration, mcp_poison) · Security fixes (info disclosure, symbolic precision) · @qwed-ai/sdk@4.0.1.Full Release Notes → · GitHub Release ↗
147 commits · Agentic Security Guards (RAGGuard, ExfiltrationGuard, MCP Poison Guard) · SovereigntyGuard · ToxicFlowGuard · S-CoT Guard · Process Determinism (ProcessVerifier) · Critical security fixes (eval removal, sandbox escape, CVE patches) · Docker hardening · Sentry + CircleCI + SonarCloud + Snyk integration.Full Release Notes → · GitHub Release ↗
Security patch — CodeQL remediation (50+ alerts), workflow permissions lockdown, PII protection, Snyk partner attribution.GitHub Release ↗
Optimization Engine, Vacuity Checker, Dockerized GitHub Action, improved logic verifier.GitHub Release ↗

PyPI

Python package

Docker Hub

Container image

npm

TypeScript SDK

crates.io

Rust SDK

GitHub

All releases

Go Module

Go SDK