|
| 1 | +# Changelog |
| 2 | + |
| 3 | +All notable changes to this project will be documented in this file. |
| 4 | + |
| 5 | +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), |
| 6 | +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). |
| 7 | + |
| 8 | +## [1.0.0] - 2026-03-07 |
| 9 | + |
| 10 | +### Added |
| 11 | + |
| 12 | +- **Harness API** — `init()`, `run()`, `@agent()` for zero-change observability, scoped budget runs, and decorated agent policy. Three modes: `off`, `observe`, `enforce`. |
| 13 | +- **SDK auto-instrumentation** — Patches OpenAI and Anthropic Python SDKs to intercept every LLM call for cost tracking, budget enforcement, compliance gating, and decision tracing. |
| 14 | +- **Six-dimension optimization** — Cost, latency, quality, budget, compliance, and energy tracked across every model call. |
| 15 | +- **KPI-weighted routing** — Inject business priorities (`quality`, `cost`, `latency`, `energy`) as weights into model selection decisions. |
| 16 | +- **Compliance gating** — GDPR, HIPAA, PCI, and strict model allowlists; block non-compliant models before execution. |
| 17 | +- **Energy tracking** — Deterministic compute-intensity coefficients for carbon-aware AI operations. |
| 18 | +- **Decision traces** — Full per-step audit trail: action, reason, model, cost, budget state, enforcement status. |
| 19 | +- **Budget enforcement** — Per-run and per-user budget caps with automatic stop actions when limits are exceeded. |
| 20 | +- **Framework integrations** — LangChain (Python + TypeScript), OpenAI Agents SDK, CrewAI, Google ADK, n8n, Vercel AI SDK. |
| 21 | +- **TypeScript SDK** — `@cascadeflow/core`, `@cascadeflow/langchain`, `@cascadeflow/vercel-ai`, `@cascadeflow/ml`, `@cascadeflow/n8n-nodes-cascadeflow` published on npm. |
| 22 | +- **Proxy Gateway** — Drop-in OpenAI/Anthropic-compatible HTTP server with mock and agent modes, streaming, tool calling, and embeddings support. |
| 23 | +- **OpenClaw Server** — Standalone OpenAI-compatible server for OpenClaw deployments with semantic routing. |
| 24 | +- **Paygentic integration** — Usage reporting and billing proxy for Paygentic platform. |
| 25 | +- **Tool risk classification** — `ToolRiskClassifier` for per-tool-call routing based on risk level. |
| 26 | +- **Circuit breaker** — Per-provider circuit breaker with configurable thresholds and recovery. |
| 27 | +- **Dynamic configuration** — Runtime config updates via file watcher with change events. |
| 28 | +- **Rule engine** — `RuleEngine` for declarative routing and policy rules. |
| 29 | +- **Agent loops** — Multi-turn tool execution with automatic tool call, result, re-prompt cycles. |
| 30 | +- **Semantic quality validation** — Optional ML-based quality scoring via FastEmbed embeddings. |
| 31 | +- **15-domain auto-detection** — Code, math, medical, legal, finance, data, and more with per-domain routing pipelines. |
| 32 | +- **Complexity detection** — 500+ technical terms, mathematical notation detection, density-aware scoring for long documents. |
| 33 | + |
| 34 | +### Changed |
| 35 | + |
| 36 | +- **Lazy imports** — `import cascadeflow` no longer eagerly loads all providers, numpy, or heavyweight submodules. Import time reduced from ~1900ms to ~20ms via PEP 562 lazy loading. |
| 37 | +- **`__all__` reduced** — From 127 to ~20 essential public symbols. Non-essential exports remain accessible but are not star-exported. |
| 38 | +- **`rich` moved to optional** — No longer a core dependency; falls back to stdlib logging when not installed. Install with `pip install cascadeflow[rich]`. |
| 39 | +- **Integration import errors** — Failed optional integration imports now return proxy objects that raise `ImportError` with install hints on use, instead of silently returning `None`. |
| 40 | +- **Proxy CORS default** — `cors_allow_origin` changed from `"*"` to `None` (opt-in) for secure-by-default deployments. |
| 41 | + |
| 42 | +### Removed |
| 43 | + |
| 44 | +- **Deprecated `CascadeAgent` parameters** — `config`, `tiers`, `workflows`, `enable_caching`, `cache_size`, `enable_callbacks` removed from constructor. Use `HarnessConfig` or dedicated APIs instead. |
| 45 | +- **Submodule `__version__` strings** — Removed from `quality`, `streaming`, `telemetry`, `ml`, `tools`, `routing`, `interface` subpackages. Use `cascadeflow.__version__` instead. |
| 46 | +- **Benchmark infrastructure** — `tests/benchmarks/`, `benchmark_results/`, and related docs removed (moved to separate benchmark repo). |
| 47 | + |
| 48 | +### Fixed |
| 49 | + |
| 50 | +- **Thread safety** — Added `threading.Lock` around SDK patch/unpatch state. `HarnessRunContext` counters guarded with lock for multi-threaded use. |
| 51 | +- **Trace buffer** — `_trace` changed from `list` with manual slicing to `collections.deque(maxlen=1000)` for bounded memory. |
| 52 | +- **Regex pre-compilation** — `ComplexityDetector` now pre-compiles all regex patterns in `__init__()` instead of per-`detect()` call. |
| 53 | +- **Proxy body limit** — Added `max_body_bytes` (default 10MB) to `ProxyConfig`; returns 413 for oversized requests. |
| 54 | +- **Proxy auth** — Added optional `auth_token` to `ProxyConfig`; returns 401 for unauthenticated requests when set. |
| 55 | + |
| 56 | +### Security |
| 57 | + |
| 58 | +- Proxy gateway CORS tightened to opt-in (`None` default). |
| 59 | +- Request body size limit prevents memory exhaustion attacks. |
| 60 | +- Bearer token authentication for proxy gateway endpoints. |
| 61 | +- Updated `SECURITY.md` supported version to 1.0.x. |
| 62 | + |
| 63 | +[1.0.0]: https://github.com/lemony-ai/cascadeflow/releases/tag/v1.0.0 |
0 commit comments