director-ai Files

Security

• Constant-time API key comparison via hmac.compare_digest (REST + gRPC + WebSocket)
• WebSocket auth enforcement — X-API-Key checked before ws.accept()
• gRPC auth interceptor + optional TLS via tls_cert_path/tls_key_path
• Rate limiting wired — SlowAPIMiddleware actually added to FastAPI app
• SBOM — CycloneDX artifact in publish workflow
• LLM judge privacy warning in config, scorer, and README
• AGPL compliance guidance in SECURITY.md

Changed

• strict_mode rejects: returns 0.9 (reject) instead of 0.5 (neutral) when NLI unavailable
• guard() duck-type detection: supports vLLM, Groq, LiteLLM, Ollama — any client with chat.completions.create or messages.create
• Config.build_scorer(): single method wires all config fields through to CoherenceScorer
• BatchProcessor: as_completed() for completion-order processing
• gRPC StreamTokens: real CoherenceScorer scoring replaces fake hash→sin callback

Added

• director-ai tune <file.jsonl> CLI — grid-search over thresholds × weight pairs
• Lite scorer, multi-turn sessions, ONNX GPU batching, plugin backends, gRPC transport, multi-GPU sharding
• Safety contract tests (13 new), security hardening tests (15), fuzz tests (4)
• Public API freeze (PUBLIC_API.md), deprecated aliases emit DeprecationWarning
• CI version consistency check — fails if pyproject.toml/init/CITATION.cff versions diverge

Fixed

• CycloneDX SBOM CLI flags (-o/--of for v7.x)

Stats

• 1090 tests, 10 skipped, 0 failures
• 22 files changed, ~810 insertions

Full changelog: CHANGELOG.md