bastion agent 0.1.16

CHANGELOG.md

@@ -14,6 +14,89 @@ Changes to the release tooling (`publish.sh`, `build.py`, `verify_release.py`)
 and to the documentation are listed under the version whose source first
 carried them, although they do not change what the `.pyz` does.
 
+## 0.1.16
+
+- **Every `search` and `read_range` reply names its sanitize mode**
+  (`sanitize_mode`: `flag` or `sterilize`, the mode the sanitize stage
+  recorded for the text in the reply; `unknown` when that record does not
+  vouch for it; a search with no hits names the manifest's mode, or `none`),
+  so the bastion and the Host can say what was done to the text. Switching
+  the manifest's mode does not relabel text an earlier sweep wrote. In `flag`
+  mode, the mode the bastion deploys, names, street addresses and dates of
+  birth remain. The field is new; nothing else in either reply changes.
+- **Each GitHub release carries its files.** Pushing a release tag starts
+  `.github/workflows/release.yml`, which runs the release check against the
+  published manifest, rebuilds the `.pyz` from the tag, and only when the
+  sha256 matches attaches the `.pyz`, its `.sha256`, `version.json` and its
+  signature to the release (making the release, with this file's section for
+  it, when the tag has none). It can be run again by hand for the version
+  the manifest names; older releases, whose manifest is no longer served,
+  cannot be given their files afterwards. The manifest's `notes` now link to
+  that GitHub release instead of the tag page on the forge.
+- **`verify_release` refuses a tag without its release record** (an annotated
+  tag with the line `built from <built_from>`, as every release tag from
+  0.1.14 on has), instead of building from any tag of that name. It gains
+  `--expect-version`, which refuses a manifest naming another version, and
+  `--out DIR`, which writes the rebuilt `.pyz` and `.sha256`, the manifest's
+  exact bytes and its signature once everything matched.
+- **CI runs every test and pyflakes.** The test job installs `git` too, so
+  the release verifier's seven end-to-end tests, which were skipped in CI, now
+  run, and a skipped test fails the job. pyflakes 4.0.3 runs on both forges;
+  the 31 findings it had (unused imports and variables) are fixed, and the
+  packages' re-exports are listed in `__all__`.
+- **The README says what it means.** The agent is deployed from a grant and
+  can also be run by hand; what crosses the tunnel is the catalog cards and
+  sanitized excerpts; building and testing need PyYAML 6.0.3; the CI badge is
+  the GitHub one.
+- **The rules pass finds more personal data on its own,** which matters
+  because it is all that `flag` mode, the mode the bastion deploys, runs.
+  Newly found: international phone numbers (`+44 7700 900123`,
+  `+49 (0)30 1234567`, no separators, dots or dashes), national numbers with a
+  trunk `0` (`07700 900123`), a seven-digit local number after a word such as
+  call or phone, IBANs written in lower case, card numbers written with dots,
+  SSNs written with spaces, and nine-digit SSNs with no separators when `SSN`
+  or `social security` comes just before them. A bare nine-digit number, a
+  seven-digit number with no phone word before it (`Order 555-0142`), a number
+  that fails its checksum and a date are still left alone; a reference number
+  that starts with `0` (`0123-456789`) is now taken for a national phone
+  number. An expiry date or security code beside a card is still not found.
+- **A dotted number right after a version word is no longer taken for an IP
+  address** (`version 1.2.3.4`), and SSNs that are never issued (group `00`,
+  serial `0000`) are no longer masked.
+- **Every file is sanitized again once after this upgrade** (`SANITIZE_VERSION`
+  3), so text kept by the older rules is redone.
+- **The docs say what the deployed mode leaves in.** The README, SECURITY.md
+  and the sanitize, serve and PII docs say plainly that `flag` mode does not
+  find names, street addresses or dates of birth, and that `sterilize` mode
+  adds a model that looks for them.
+- **The PII service listens on 127.0.0.1 by default** instead of every
+  interface; `PII_BIND` still chooses another address. Its container image runs
+  as uid 10001 instead of root, so a volume mounted on `/data` must be writable
+  by that user, and a container that should be reachable needs `PII_BIND` set.
+- **CI also runs on GitHub** (`.github/workflows/ci.yml`): the same jobs, the
+  same pinned images.
+- **The README's license paragraph and SECURITY.md name each kind of Host**
+  (docs only) instead of only Privatae's platform: a
+  C-Series Host runs on your own machine and is open source (Privatae/cseries,
+  AGPL-3.0-only), C-Series Cloud and a network membership are optional and
+  paid, and a Host on Privatae's own platform is the case where the Host's
+  software is not open source.
+- **Security reports go to security@privatae.ai,** the address
+  privatae.ai/.well-known/security.txt names, and SECURITY.md links the
+  bastion's policy on GitHub, where anyone can read it.
+- **How this repository is published.** From this release on, GitHub receives
+  each change merged since the last release as its own commit, titled as the
+  change was, instead of one commit per release, and the README says so.
+- **The personal-data check reads what it used to miss.** A listed term
+  written right after a backslash escape (`\n`, `\t`, `\u00e9`) is found, and
+  so is any value inside a run of base64 or base64url that decodes to text.
+  The reserved entity ids are read from `/etc/privatae/reserved-entity-ids`
+  (one per line, `RESERVED_ENTITY_IDS_FILE` to point elsewhere) instead of
+  being written in the script; where that file is absent, as in public CI,
+  the entity-id check is skipped and the run prints a NOTE, as the term check
+  already does without its key. A file that holds no id, or a line that is
+  not one, fails the run.
+
 ## 0.1.15
 
 - **No change to what the agent does.** The README says how this repository