v0.12.1

Fixed

• The PyPI publisher now recognises Core Metadata 2.5, so it no longer rejects valid packages before upload. f00aa54

Compare v0.12.0...v0.12.1 (v0.12.0...v0.12.1)

v0.12.0

Breaking

• Every Queue pull now returns a fresh fence token that callers must pass to ack, nack, fail, release and visibility-extension operations; batch acknowledgement is atomic, and release_jobs has been replaced by the single-job release function. abcc896

Fixed

• Once a Queue worker has timed out, it can no longer alter a job that another worker has pulled. abcc896
• Opening the same Meter period twice used to credit an account twice, so Meter now records the first result and returns it on retry. 65999e6
• Dropping an old ledger partition used to remove part of the arithmetic behind an account's balance, so Meter now carries those totals forward before removing the partition. 65999e6
• Meter now rejects negative carry-over limits and keeps period labels independent of account identifiers, preventing long identifiers from exceeding PostgreSQL's index limit. 65999e6
• Presence hooks now enqueue Queue jobs correctly while row-level security is active. 51a2038
• Ruff is pinned to 0.16.1, so make all applies the same checks on every run, and the SDK, tests, documentation generator and generated examples comply with those checks. 56ef0bb
• Concurrent tests now bind their state explicitly, database error assertions are narrower, and time-dependent tests use timezone-aware values. 56ef0bb
• Contributor guidance no longer requires commit bodies to include migration details. d27cfcf

Compare v0.11.0...v0.12.0 (v0.11.0...v0.12.0)

v0.11.0

Breaking

• Several public APIs now reject oversized limits and collections with typed errors rather than clamping them or accepting unexpectedly large requests. 943dcf1
• Authn cleanup and Outbox trimming now each apply one direct-deletion budget per call; Authn cascades and Outbox topic discovery remain outside their respective budgets. 943dcf1

Added

• Public scale checks now exercise the changed Authz and Queue paths on PostgreSQL 14 and 18. 943dcf1
• Repository release tooling now validates release state, drafts notes, updates the SDK version, and publishes the commit and tag through a repeatable workflow. 27b1f9d

Fixed

• Queue pulls now reject invalid resolved visibility timeouts before changing jobs, and global schedule ticks have an index matching their ordering. 943dcf1
• Authz resource listings now traverse descendants once across overlapping grants instead of repeating expansion for every grant. 943dcf1
• Authn history reads use chronological indexes and paginate impersonations before joining related user and session records. fd5a33f
• Authz direct checks and batch filtering avoid unnecessary graph traversal, subject listings avoid repeated or tenant-wide membership work, and expiration extensions reject null or non-positive intervals. 1f3929e
• Config mutations now share a consistent per-key lock order, activation is safe against cleanup races, literal prefixes escape SQL wildcards, and null cleanup retention is rejected explicitly. a0ce8d0
• Reactivating an already active Config version now avoids redundant row and partial-index updates. b27a94f

Compare v0.10.0...v0.11.0 (v0.10.0...v0.11.0)

v0.10.0

Breaking

• Schedule failures are now isolated and exposed through get_schedule and list_schedules, changing the queue.schedules schema and both public return shapes. cbd7b93
• Re-granting an existing authorization tuple now preserves its expiration; applications that used grants to change expiry must use the dedicated expiration functions. e021708

Added

• Maintenance notes now explain why check and explain intentionally use separate membership walks. 4f3793d

Fixed

• Authorization checks and listings now respect userset subject_relation qualifiers. 37bad85
• list_subjects and count_subjects now agree with permission checks when expanding groups and usersets. d0deb83
• Child-resource grants no longer flow upward through reserved parent hierarchy edges. 5814f32
• Queue schedules now reject invalid or oversized expressions while accepting Sunday as either 0 or 7. 144814a
• Meter ledger immutability now prevents truncating both the parent ledger and Postkit-created partitions. e8b19e1
• Operator impersonation audit logging is now restricted appropriately. 3bd0d56

Full changelog: v0.9.0...v0.10.0

v0.9.0

Added

• The memory module: a durable agent memory built on an append-only episode log, distilled facts and entities as graph nodes joined by typed edges, and recall that fuses vector similarity with full-text ranking then expands over edges. 25dbd25

Fixed

• The restrictive policies write-protecting seeded global rows in the lease, queue, outbox, and presence config tables and in authz.permission_hierarchy now cover DELETE, closing a hole where a session with its tenant set to global could delete the defaults that row-level security then blocked re-inserting. 25dbd25

Full changelog: v0.8.1...v0.9.0

v0.8.1

Breaking

• Queue max_attempts must be between 1 and 30 wherever it is accepted (push, push_batch, create_schedule, and queue.config.default_max_attempts); larger values are rejected. 06f1311
• Querying an audit or ledger partition by name now returns no rows for roles without BYPASSRLS; query through the parent table instead. e06fd21

Added

• set_expiration, clear_expiration, and extend_expiration accept an optional subject_relation, so an expiry change can target a userset grant. 4723648

Fixed

• Partitions of the audit_events tables and meter.ledger now enforce row-level security, closing a tenant-isolation bypass for roles granted direct access to the tables. e06fd21
• Retry backoff saturates at max_delay instead of overflowing the interval type near attempt 40, which made nack raise instead of scheduling a retry. 06f1311
• Expiration changes match the grant's subject_relation, so clearing the expiry on a direct grant no longer makes a coexisting userset grant permanent. 4723648

Full changelog: v0.8.0...v0.8.1

v0.8.0

Breaking

• Names everywhere (queue names, schedule names, outbox topics, consumers, event types, presence kinds) now accept any characters except control characters and leading or trailing whitespace, so previously rejected structured names like sensor:eu:42 validate. 97b9379
• authz ids and meter event types and units now reject control characters, so a value with an embedded newline that was accepted before is rejected. 97b9379
• NOTIFY channel names changed in queue, outbox, presence, and lease; derive channels with the new channel_name functions instead of hashing namespace and name yourself. 97b9379
• presence returns the EMPTY error code instead of WHITESPACE for whitespace-only kinds and hook queue names. 97b9379
• PostgreSQL must be built with ICU support, the default in official packages and images. 97b9379

Added

• Each notifying module has a public channel_name(namespace, name) function, the supported way to compute a LISTEN channel. 97b9379
• authz matches subject and resource ids by Unicode canonical equivalence, so a grant and its revoke agree even when the two calls spell the same id with different bytes. 97b9379

Fixed

• Two different namespace and name pairs could hash to the same NOTIFY channel and receive each other's notifications. 97b9379
• meter event types, meter units, and authz ids accepted control characters that could forge log lines. 97b9379
• check_all returned false when the same permission appeared twice in the request. 97b9379
• A hook queue name the queue module would reject now fails at configuration time instead of when the death alert fires. 97b9379

Full changelog: v0.7.0...v0.8.0

v0.7.0

Added

• Namespace-level pool accounts let allocate, consume, reserve, commit, and adjust fund and draw down a shared namespace balance by passing a NULL user_id. 992061a
• meter.commit and meter.release take an optional idempotency_key that replays the original result on an at-least-once retry instead of returning an ambiguous success=false. 992061a
• queue.ack takes an optional worker_id so a timed-out worker's late acknowledgement no longer settles the successor's in-flight attempt. 992061a
• Configured presence hook queue names are validated when the config row is written rather than staying latent until the hook fires. 992061a

Fixed

• presence.sweep runs each entity's transition and hook in its own subtransaction, so one failing death-hook no longer rolls back the whole pass or erases other tenants' deaths in sweep(NULL). 992061a
• The billing-period documentation examples now pass the resource argument. 0b1abf2

Full changelog: v0.6.0...v0.7.0

v0.6.0

Breaking

• authn.cleanup_expired no longer cleans operator impersonation sessions and no longer returns operator_impersonations_deleted; that table is cross-tenant, so its cleanup moved to the new authn.cleanup_expired_operator_sessions, scheduled once per deployment. 5bcf902

Added

• outbox.horizon_blockers now reports prepared transactions, which pin the delivery horizon until resolved and were previously invisible. 5bcf902

Fixed

• Presence state transitions write the entity row once instead of twice. 5bcf902
• The authn.cleanup_expired deletes now use their partial indexes instead of scanning the table. 5bcf902
• Cleanup functions reject non-positive batch sizes. 5bcf902
• The outbox README now documents what pins the delivery horizon and how to bound it. 5bcf902

Full diff: v0.5.1...v0.6.0

v0.5.1

Added

• outbox.has_pending reports whether readable events lie past a consumer's cursor without locking the cursor row (70fbc8b)

Fixed

• Tag messages keep their markdown headings instead of git stripping them as comments (9ba0743)
• The horizon blocker test checks its marker in one statement so a concurrent commit cannot race it (3f301b9)
• CI workflow actions are pinned to the same SHAs the release workflow uses (3f301b9)

Full diff: v0.5.0...v0.5.1