What changed, and what it means for a pack you already hold.
Sectum AI ships five Apache-2.0 packages at one version, each signed with Sigstore and published to PyPI through a Trusted Publisher. When a release changes what an evidence pack asserts, that is stated first: a verdict you acted on is worth more than a tidy release note.
2 August 2026
v0.8.1: documentation corrections
Documentation only. No code, no behaviour change, and no effect on an evidence pack. Three places where our own docs described the tool inaccurately, found by auditing the documentation against the code after v0.8.0.
- The KV-cache timing example claimed 24 trials per tenant pair. The probe runs 24 per condition, 48 timed prompts per pair.
-
The same example quoted the confirmation bar as
p < 0.01. The probe applies a Bonferroni correction across tenant-pair comparisons, so the real bar on a four-tenant run isp < 0.00083. The docs described the tool as twelve times less rigorous than it is. - Two pages headlined "zero false positives by construction". What the invariants actually pin is that every confirmation ties back to a planted marker. That bounds confirmations; it does not prove each one correct. Corrected to say so.
1 August 2026
v0.8.0: fifteen correctness fixes in the evidence path
Every fix in this release corrects something the tool claimed but had not measured, or, in one case, claimed on the strength of noise. They came out of a full-repo review of the evidence path.
Erasure verdicts
The Datadog adapter searched a hardcoded fifteen-minute window, so any span older than that read as absent, and absent is how the erasure check concludes a trace is gone. A subject-erasure fingerprint of a single token (an email address, an account number) was never probed for memorisation, and reported clean.
Cross-tenant detection
A judge answering "no" could veto a leak whose canary was sitting verbatim in the observation, and an out-of-range similarity threshold could switch the semantic detector off entirely without a trace in the evidence.
Side-channel findings
The KV-cache timing probe measured its two conditions in blocks, so machine drift landed on whichever ran second. Ten microseconds per call of drift was enough to flag every tenant pair against a model with no cache at all. The conditions are now interleaved.
The signed pack
verify crashed on a malformed bundle instead of refusing it,
a hallucinated judge quotation could reach the audit PDF, the regression
gate read "not measured" as "improved", and the pack asserted framework
controls the run had never established.
If you are holding an earlier pack
Several of these change what a pack asserts, so a pack produced before v0.8.0 may state a verdict this version would not. Re-run before relying on an erasure attestation, a KV-cache side-channel finding, or a per-model retrieval gradient.
One change is breaking for configuration:
detection.semantic_threshold now rejects values outside
[0.0, 1.0]. Such a value previously loaded and silently disabled
the semantic detector, so a config carrying one will fail to load until it is
corrected, which is the point.
Why we publish this
Sectum AI exists to check whether a system claims more isolation than it can demonstrate. A tool making that argument does not get to be quiet when the same defect turns up in its own evidence path. Every fix above is in the public changelog, the commit history, and the signed release, verifiable without taking our word for any of it.