v0.6.0

The trust receipt becomes five sections on every answer, the guard reads your SQL in your own engine's grammar, and a self-hosted server that cannot record a query no longer runs it.

Full notes: CHANGELOG.md

Upgrading

Updating the plugin now upgrades the agami-core library with it. Before this release the launcher only checked whether the library imported — which a stale one does — so a plugin update could leave new skills running against an old library. Since 0.6.0 changes the receipt shape, that combination would have failed every charted query on receipt.columns is missing. The launcher now compares the installed distribution against the plugin version and reinstalls with --upgrade when it is behind.

If you pin agami-core yourself, read the breaking changes below before upgrading.

Breaking

• max_rows is no longer an argument to execute_sql, and --max-rows is gone from the CLI. Ask for the rows you want in the statement.
• A result over AGAMI_SQL_MAX_ROWS is refused, not trimmed. truncated is gone from a successful result.
• Agami no longer rewrites your SQL to fix a fan-out join — your statement runs byte for byte.
• Four correctness checks (fan trap, chasm trap, SUM of a rate, SUM of a balance across time) report instead of refusing; what they found rides on the receipt under aggregates.
• sensitive is a description, not a gate — marking a column sensitive no longer blocks projecting it. If a value must not come back, exclude the column from the model or deny it to the connecting role.
• The model_safety refusal rule is gone; every refusal now names the gate that chose it.
• Receipt: the old flat keys are replaced by five sections (tables_used → tables.items[], relationships → joins.items[], metrics → columns.items[] with a non-null metric, warnings → derived from joins.items[]). scope gained a set-operation arm ordinal (main#1), which breaks an equality branch on main / cte:x.
• sm prepare returns {sql, findings, units} and always exits 0; sm preflight returns {findings: [...]}; sm receipt --applied-filters is gone.
• Adapters.governance is removed. Adapters is not keyword-only, so a positional 4th argument now binds as executor — construct it by keyword.

Operators, read this

AGAMI_GOVERNANCE_ENFORCED ships off by default. A fresh server does not enforce table scope, column scope, the SELECT * ban, or the engine-mismatch check until you turn it on. The read-only guard, the dangerous-function guard, the statement timeout and the row cap enforce in both postures, as does a read-only database role. Nothing ever claims the checks ran — every answer and audit row says when they are off, and the server logs a warning at startup. See self-hosting and SECURITY.md.

Also: a datasource that does not declare storage_connections[].storage_type now refuses queries — an engine we cannot name is one we cannot parse for.