v2.5.4 — hardening release (audit follow-ups + tag-freshness CI gate)
v2.5.4 — hardening release (audit follow-ups + tag-freshness CI gate)
Closes the last outstanding items from the 2026-05-19 fresh audit:
- C-1 part B — MCP-side Origin allowlist in callbacks/router.py
- M-1 — Traceback path redaction in callbacks/router.py
- N-1 — First-run UX hint in autostart.py when default-secure mode has no secret installed
- N-2 — 8 H-1 regression tests (previously zero coverage)
- NEW — Cross-runtime schema parity test (snapshot-style)
- Section C — Mock-eval scenarios scaffolded (3 skipped pending fixture capture)
- Tag-freshness CI gate prevents the v2.5.3 dual-state failure from recurring
Both .tox rebuilt against v2.5.4 sources. All 13 version manifests synced.
2141 → 2170 tests passing. PR #55 squash-merged to main as ea1e8df.
Governance hardening landed via gh api:
- Branch protection on main (6 required CI checks)
- Dependabot security alerts + auto-fix
- delete_branch_on_merge enabled