Skip to content

PRAXO-CORE 2.5.0

Released: 2026-10-24

PRAXO-CORE 2.5.0 is a framework-hardening release. It adds an additive conformance package and hardens local VFS path validation. Existing exported pkg/... declarations are unchanged.

Highlights

  • Conformance suite. pkg/conformance provides reusable checks for VFS backends, memory stores, sandbox runners, event sinks, policy hooks, gateways, models, streaming models, tools, and retrievers. conformance.Run executes named checks and reports all failures in one pass.
  • Windows VFS hardening. pkg/vfs/localfs rejects NUL bytes, drive-relative paths, reserved device names, alternate data streams, and trailing dots or spaces before resolving a virtual path.
  • Compatibility notes. Event and OpenTelemetry schema rules are published in docs/reference/events.md.
  • Plugin trust handoff. docs/security/plugin-trust.md documents the product-owned signature, trust-root, SBOM, materialization, and evidence checks required before starting a plugin host.
  • Workspace evaluation. docs/reference/workspace-session.md records the stateful workspace/session evaluation. E2B, Daytona, OpenSandbox, and CubeSandbox adapters exist as offline conformance-tested evaluation modules.

Upgrade

go get github.com/axisvela/praxo-core/v2@v2.5.0

No source migration is required from 2.4.0. api/2.5.0.txt differs from api/2.4.0.txt only by the additive pkg/conformance package. Optional adapter versions are unchanged.

Use Go 1.26.10, the tested toolchain.

Validation

  • Full local tests, vet, build, race, fuzz, staticcheck, and govulncheck pass.
  • API diff from 2.4.0 contains only pkg/conformance additions.
  • mkdocs build --strict passes.
  • The release publishes a source archive, SBOM, and checksums.

Limits

  • The workspace/session adapters are offline conformance-tested only. They have not been verified against live E2B, Daytona, OpenSandbox, or CubeSandbox providers and are not tagged as published adapters.
  • The workspace/session contract remains outside pkg/ until live verification and a two-provider promotion review.
  • The OpenTelemetry reference example and the RHEOVELA remote-worker contract are not part of this release.
  • TOCTOU containment, Linux cgroup containment, and deterministic WASM fuel remain open.
  • These checks do not establish production, deployed, or independent security validation.

Release Tag

No signing key was configured for this release environment. The tag is annotated rather than cryptographically signed; checksums and an SBOM are published by the release workflow.