Repository navigation
Conversation
Add bounded extension descriptors, immutable manifests, schema validation, secret-reference preservation, dependency ordering, and prepared runtime generations with persistence before publication and bounded retirement. Wire explicit distribution assembly into all three public entries, Caddy and standalone startup, Admin manifest and extension APIs, and CLI apply/export. Persist extension envelopes through the existing SQLite store and preserve numeric precision in configuration comparison and YAML export. Reject duplicate JSON keys before secret validation, stop admissions and cancel active mutations during shutdown, isolate callback failures, and order ready dependencies lexically. Document the implemented contracts and exercise public signature closure, independent consumers, and real processes. Validation: make verify-release passed, including independent consumer acceptance, package tests, race checks with the existing upstream Anthropic exclusion, go vet, formatting, dependency verification, and all three builds. Claude AGW and Claude Kimi completed with no findings; Grok's integer export finding was fixed and its repeat review completed with no findings.
…livery Add bounded trusted attribution and sanitized public event contracts, with isolated sink workers and deadline-aware lifecycle owned by the existing observability pipeline. Wire explicit distribution producers and sinks into Caddy and standalone runtimes, publish limiter admission and extension mutation events, and expose delivery health in metrics. Include public conformance suites, independent consumer and process coverage, contract documentation, and reviewed fixes for error redaction, cancellation health, module identity validation, runtime correlation, provision-only cleanup, and mutation publication ordering. Validation: make verify-release passed before squash; the final source tree is preserved.
Compose module-owned Admin routes through prepared generation resources with bounded dependencies, trusted request attribution and owner-scoped event publication. Validate namespaces and overlapping declarations before assembly, and retain leases through request completion and shutdown. Apply the shared full-body 4 MiB boundary and compression rejection to Community and contributed Admin routes. Preserve generic JSON panic responses with operator diagnostics, prove authenticated Caddy and standalone behavior through the independent consumer, and document the candidate contract.
Define the domain-owned LimiterBackend contract, memory reference backend, and shared conformance suites for independent consumers. Select prepared backends through extensions, preserve unchanged quotas, and fence policy generations across mutations and backend switches. Enforce cancellation, bounded cleanup and admission budgets, fail-closed and explicit degraded fail-open without retrying uncertain consumes. Integrate bounded events and metrics, prove both server entry points and independent backend lifecycle behavior, and document candidate contracts. Keep retired generations fail-closed and release the authentication index lock before backend cleanup. Validation: focused regression and race tests; make verify-release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.7.0 supplies reusable Caddy, standalone and CLI entries and the compile-linked extension foundation: ConfigStore-owned configuration, authenticated Admin contributions, trusted attribution, bounded public events and a generation-fenced VirtualKey limiter backend SPI.
Extension configuration is managed through Admin API or Bundle apply; static extension inputs have been removed. Model availability extensions and other domain products remain outside this release. The v0.8 domain catalog stays on its separate branch.
Validated clean candidate:
6765a7e7a2279dc1799bbac8fbb46a9eef68d1e6(Go 1.26.3).make verify-release: passed.make smoke-release: passed.make test-extension-consumer-candidate COMMUNITY_COMMIT=6765a7e7a2279dc1799bbac8fbb46a9eef68d1e6: passed.Community edition and built-in module metadata report
0.7.0. Published-dependency consumer gates run after the tag is published; only their successful results and paired release CI establish the designated protected surfaces. Full release notes:docs/releases/v0.7.0.md.Merge policy: merge dev into main with a merge commit (
--no-ff), preserving the staged foundation history.