Release v1.4.0 — memory, webhooks, HTTP security hardening

Author: Symbiont OSS Sync

CHANGELOG.md

@@ -5,10 +5,18 @@ All notable changes to the Symbiont project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [1.4.0] - 2026-02-15
+## [1.4.0] - 2026-02-16
 
 ### Added
 
+#### HTTP Input Security Hardening
+- **Loopback-only default binding**: `bind_address` defaults to `127.0.0.1` instead of `0.0.0.0`
+- **Explicit CORS origin allow-lists**: Replaced `cors_enabled` boolean with `cors_origins: Vec<String>`
+- **JWT EdDSA validation**: Full Ed25519 public key loading and JWT verification in auth middleware
+- **Health endpoint separation**: `/health` exempt from authentication for load balancers
+- **PathPrefix route matching**: Implement `RouteMatch::PathPrefix` in HTTP input routing
+- **Runtime agent execution**: Replace `invoke_agent` stub with real runtime dispatch
+
 #### Persistent Memory (`MarkdownMemoryStore`)
 - **Markdown-backed agent memory** implementing `ContextPersistence` trait
   - Facts, Procedures, and Learned Patterns sections in `memory.md`

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "symbi"
-version = "1.1.0"
+version = "1.4.0"
 edition = "2021"
 authors = ["Jascha Wanger / ThirdKey.ai"]
 description = "AI-native agent framework for building autonomous, policy-aware agents that can safely collaborate with humans, other agents, and large language models"
@@ -42,7 +42,7 @@ rust-version = "1.70"
 clap = { version = "4.0", features = ["derive"] }
 tokio = { version = "1.0", features = ["full"] }
 sysinfo = "0.30.13"
-symbi-runtime = { path = "crates/runtime", version = "1.1.0", features = ["http-input", "http-api", "vector-db"] }
+symbi-runtime = { path = "crates/runtime", version = "1.4.0", features = ["http-input", "http-api", "vector-db"] }
 cron = { version = "0.15", optional = true }
 chrono = { version = "0.4", features = ["serde"], optional = true }
 chrono-tz = { version = "0.10", optional = true }

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "symbi-dsl"
-version = "1.1.0"
+version = "1.4.0"
 edition = "2021"
 authors = ["Jascha Wanger / ThirdKey.ai"]
 description = "Symbi DSL - AI-native programming language with Tree-sitter integration"

crates/dsl/Cargo.toml

@@ -16,5 +16,5 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 tokio = { version = "1.0", features = ["full"] }
 chrono = { version = "0.4", features = ["serde"] }
-repl-core = { path = "../repl-core", version = "1.0.1" }
+repl-core = { path = "../repl-core", version = "1.4.0" }
 repl-proto = { path = "../repl-proto", version = "1.0.0" }

crates/repl-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "repl-core"
-version = "1.0.1"
+version = "1.4.0"
 edition = "2021"
 authors = ["Jascha Wanger / ThirdKey.ai"]
 description = "Core REPL engine for the Symbi platform"
@@ -24,7 +24,7 @@ serde_json = "1.0"
 uuid = { version = "1.0", features = ["v4", "serde"] }
 tokio = { version = "1.0", features = ["sync"] }
 tracing = "0.1"
-symbi-runtime = { path = "../runtime", version = "1.0.2" }
+symbi-runtime = { path = "../runtime", version = "1.4.0" }
 
 [dev-dependencies]
 tokio-test = "0.4"

crates/repl-core/Cargo.toml

@@ -18,4 +18,4 @@ path = "src/main.rs"
 tokio = { version = "1", features = ["full"] }
 tower-lsp = "0.20"
 serde_json = "1.0"
-repl-core = { path = "../repl-core", version = "1.0.1" }
+repl-core = { path = "../repl-core", version = "1.4.0" }

crates/repl-lsp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "symbi-runtime"
-version = "1.1.0"
+version = "1.4.0"
 edition = "2021"
 authors = ["Jascha Wanger / ThirdKey.ai"]
 description = "Agent Runtime System for the Symbi platform"
@@ -22,7 +22,7 @@ path = "examples/full_system.rs"
 name = "symbi-mcp"
 path = "src/bin/symbiont_mcp.rs"
 [dependencies]
-symbi-dsl = { path = "../dsl", version = "1.1.0" }
+symbi-dsl = { path = "../dsl", version = "1.4.0" }
 tokio = { version = "1.0", features = ["full"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"