Skip to content

Commit e779ba5

Browse files
hardening/v1.0.0: Gold-standard release hardening (#169)
Gold-standard v1.0.0 hardening: 14 commits across 7 phases. - Import time: 1900ms → 16ms (PEP 562 lazy loading) - Proxy security: CORS opt-in, auth tokens (hmac.compare_digest), body limits - Thread safety: patch locks, counter locks, guarded record() - DX: _MissingIntegration proxy, langchain extra, deprecated params removed - Performance: regex pre-compilation in ComplexityDetector - Cleanup: rich optional, Python 3.13, @huggingface/transformers migration - CHANGELOG.md, metadata fixes, complete @xenova migration All CI green: 33 jobs passed across Python 3.9-3.13 (ubuntu/macOS/windows), TypeScript, n8n, security scan, linting, and type checking.
1 parent 4d04406 commit e779ba5

File tree

36 files changed

+1151
-1314
lines changed

36 files changed

+1151
-1314
lines changed

.github/models.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ ml_models:
4747

4848
installation:
4949
python: "pip install fastembed"
50-
typescript: "npm install @xenova/transformers"
50+
typescript: "npm install @huggingface/transformers"
5151

5252
# Heuristic Models (No ML Required)
5353
heuristic_models:

.github/workflows/test.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
fail-fast: false
1616
matrix:
1717
os: [ubuntu-latest, macos-latest, windows-latest]
18-
python-version: ['3.9', '3.10', '3.11', '3.12']
18+
python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
1919

2020
steps:
2121
- name: Checkout code
@@ -134,7 +134,7 @@ jobs:
134134
pnpm --filter @cascadeflow/core build
135135
136136
- name: Run TypeScript tests
137-
run: pnpm --filter @cascadeflow/core test || echo "No tests defined yet"
137+
run: pnpm --filter @cascadeflow/core test
138138

139139
- name: Upload coverage
140140
if: always()

CHANGELOG.md

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
## [1.0.0] - 2026-03-07
9+
10+
### Added
11+
12+
- **Harness API**`init()`, `run()`, `@agent()` for zero-change observability, scoped budget runs, and decorated agent policy. Three modes: `off`, `observe`, `enforce`.
13+
- **SDK auto-instrumentation** — Patches OpenAI and Anthropic Python SDKs to intercept every LLM call for cost tracking, budget enforcement, compliance gating, and decision tracing.
14+
- **Six-dimension optimization** — Cost, latency, quality, budget, compliance, and energy tracked across every model call.
15+
- **KPI-weighted routing** — Inject business priorities (`quality`, `cost`, `latency`, `energy`) as weights into model selection decisions.
16+
- **Compliance gating** — GDPR, HIPAA, PCI, and strict model allowlists; block non-compliant models before execution.
17+
- **Energy tracking** — Deterministic compute-intensity coefficients for carbon-aware AI operations.
18+
- **Decision traces** — Full per-step audit trail: action, reason, model, cost, budget state, enforcement status.
19+
- **Budget enforcement** — Per-run and per-user budget caps with automatic stop actions when limits are exceeded.
20+
- **Framework integrations** — LangChain (Python + TypeScript), OpenAI Agents SDK, CrewAI, Google ADK, n8n, Vercel AI SDK.
21+
- **TypeScript SDK**`@cascadeflow/core`, `@cascadeflow/langchain`, `@cascadeflow/vercel-ai`, `@cascadeflow/ml`, `@cascadeflow/n8n-nodes-cascadeflow` published on npm.
22+
- **Proxy Gateway** — Drop-in OpenAI/Anthropic-compatible HTTP server with mock and agent modes, streaming, tool calling, and embeddings support.
23+
- **OpenClaw Server** — Standalone OpenAI-compatible server for OpenClaw deployments with semantic routing.
24+
- **Paygentic integration** — Usage reporting and billing proxy for Paygentic platform.
25+
- **Tool risk classification**`ToolRiskClassifier` for per-tool-call routing based on risk level.
26+
- **Circuit breaker** — Per-provider circuit breaker with configurable thresholds and recovery.
27+
- **Dynamic configuration** — Runtime config updates via file watcher with change events.
28+
- **Rule engine**`RuleEngine` for declarative routing and policy rules.
29+
- **Agent loops** — Multi-turn tool execution with automatic tool call, result, re-prompt cycles.
30+
- **Semantic quality validation** — Optional ML-based quality scoring via FastEmbed embeddings.
31+
- **15-domain auto-detection** — Code, math, medical, legal, finance, data, and more with per-domain routing pipelines.
32+
- **Complexity detection** — 500+ technical terms, mathematical notation detection, density-aware scoring for long documents.
33+
34+
### Changed
35+
36+
- **Lazy imports**`import cascadeflow` no longer eagerly loads all providers, numpy, or heavyweight submodules. Import time reduced from ~1900ms to ~20ms via PEP 562 lazy loading.
37+
- **`__all__` reduced** — From 127 to ~20 essential public symbols. Non-essential exports remain accessible but are not star-exported.
38+
- **`rich` moved to optional** — No longer a core dependency; falls back to stdlib logging when not installed. Install with `pip install cascadeflow[rich]`.
39+
- **Integration import errors** — Failed optional integration imports now return proxy objects that raise `ImportError` with install hints on use, instead of silently returning `None`.
40+
- **Proxy CORS default**`cors_allow_origin` changed from `"*"` to `None` (opt-in) for secure-by-default deployments.
41+
42+
### Removed
43+
44+
- **Deprecated `CascadeAgent` parameters**`config`, `tiers`, `workflows`, `enable_caching`, `cache_size`, `enable_callbacks` removed from constructor. Use `HarnessConfig` or dedicated APIs instead.
45+
- **Submodule `__version__` strings** — Removed from `quality`, `streaming`, `telemetry`, `ml`, `tools`, `routing`, `interface` subpackages. Use `cascadeflow.__version__` instead.
46+
- **Benchmark infrastructure**`tests/benchmarks/`, `benchmark_results/`, and related docs removed (moved to separate benchmark repo).
47+
48+
### Fixed
49+
50+
- **Thread safety** — Added `threading.Lock` around SDK patch/unpatch state. `HarnessRunContext` counters guarded with lock for multi-threaded use.
51+
- **Trace buffer**`_trace` changed from `list` with manual slicing to `collections.deque(maxlen=1000)` for bounded memory.
52+
- **Regex pre-compilation**`ComplexityDetector` now pre-compiles all regex patterns in `__init__()` instead of per-`detect()` call.
53+
- **Proxy body limit** — Added `max_body_bytes` (default 10MB) to `ProxyConfig`; returns 413 for oversized requests.
54+
- **Proxy auth** — Added optional `auth_token` to `ProxyConfig`; returns 401 for unauthenticated requests when set.
55+
56+
### Security
57+
58+
- Proxy gateway CORS tightened to opt-in (`None` default).
59+
- Request body size limit prevents memory exhaustion attacks.
60+
- Bearer token authentication for proxy gateway endpoints.
61+
- Updated `SECURITY.md` supported version to 1.0.x.
62+
63+
[1.0.0]: https://github.com/lemony-ai/cascadeflow/releases/tag/v1.0.0

README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@
3939

4040
cascadeflow works where external proxies can't: per-step model decisions based on agent state, per-tool-call budget gating, runtime stop/continue/escalate actions, and business KPI injection during agent loops. It accumulates insight from every model call, tool result, and quality score — the agent gets smarter the more it runs. Sub-5ms overhead. Works with LangChain, OpenAI Agents SDK, CrewAI, Google ADK, n8n, and Vercel AI SDK.
4141

42-
```python
42+
```bash
4343
pip install cascadeflow
4444
```
4545

46-
```tsx
46+
```bash
4747
npm install @cascadeflow/core
4848
```
4949

@@ -289,7 +289,7 @@ For advanced quality validation, enable ML-based semantic similarity checking to
289289
**Step 1:** Install the optional ML packages:
290290

291291
```bash
292-
npm install @cascadeflow/ml @xenova/transformers
292+
npm install @cascadeflow/ml @huggingface/transformers
293293
```
294294

295295
**Step 2:** Enable semantic validation in your cascade:

SECURITY.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ We release security updates for the following versions of cascadeflow:
66

77
| Version | Supported |
88
| ------- | ------------------ |
9-
| 0.7.x | :white_check_mark: |
10-
| < 0.7 | :x: |
9+
| 1.0.x | :white_check_mark: |
10+
| < 1.0 | :x: |
1111

1212
We recommend always using the latest version for the best security and features.
1313

@@ -351,5 +351,5 @@ Security researchers who have helped improve cascadeflow security:
351351

352352
This security policy may be updated from time to time. Please check back regularly for updates.
353353

354-
**Last Updated:** October 2025
355-
**Version:** 1.0
354+
**Last Updated:** March 2026
355+
**Version:** 1.1

0 commit comments

Comments
 (0)