uvp-agents: v0.4.0

0.4.0 (2026-10-18)

Features

• templates: expose the template store as CLI and MCP tools (a58e644)
• templates: expose the template store as CLI and MCP tools (962a5ff)
• templates: generate a workspace from a stored template package (f12049f)
• templates: generate a workspace from a stored template package (538e189), closes #271 #236
• templates: generate a workspace from a stored template package (#272) (f12049f)
• workspace: build Node frontend apps with an explicit command (6a0d7fa), closes #238
• workspace: generate and build Node frontend apps (fcb8f77)
• workspace: generate built-in static frontends from a selection (0494ed2)
• workspace: generate built-in static frontends from a selection (4542a53), closes #237
• workspace: generate Node frontend apps from a selection (a36b745), closes #238

Bug Fixes

• cli: say the build failed when an earlier dist/ still exists (49cbf23)
• contracts: name the package tree, not a suite (4ecfb32)
• docs: name the exit-2 template store failures (f17f9cc)
• docs: name the exit-2 template store failures (7e62fac), closes #269
• docs: separate a held lock from the exit-1 refusals (8071eec), closes #269
• frontends: align the generated project with its review notes (9fc15e7)
• frontends: distinguish a withdrawn or silent probe from a missing Node (1a7af8d)
• frontends: resolve the committed lockfiles from the public registry (ffaaac5)
• templates: accept the routes a registry index mirrors (b59e081)
• templates: answer the store's failures in the error contract (8da47b5)
• templates: answer the store's failures in the error contract (5641454), closes #264 #263
• templates: record what the template tools examined (cb4e765)
• templates: record what the template tools examined (05b1254), closes #265 #263
• templates: refuse control characters in a route (23fbf0b)

Documentation

• correct the tool count and the frontend build's written files (91dfab6)
• workspace: address the static-frontend review notes (f09d5b2), closes #237

Tests

• conformance: exercise the frontend build with Node present and absent (eeeb4ab)
• frontends: assert the generated Node range and lockfile identity (0d00a1c)
• frontends: expect the host's npm spelling at the boundary (8d1c3dc)

Continuous Integration

• release: mirror GitHub Packages automatically when release-please publishes (d09b48d)
• release: mirror GitHub Packages automatically when release-please publishes (1ef7677)

uvp-agents: v0.3.0

0.3.0 (2026-10-18)

Features

• doctor: require pkg-config on the archive route and surface its remedy (c4475d2)
• doctor: require pkg-config on the archive route and surface its remedy (f95400b)
• domain: add the uvp.template/1 manifest schema and validator (dd454a7)
• domain: add the uvp.template/1 manifest schema and validator (c6b1908), closes #236
• init: add the evidence-log module with a recorded payload policy (be99c25)
• init: add the evidence-log module with a recorded payload policy (78d183a)
• init: compose application modules into generated workspaces (804efbe)
• init: compose application modules into generated workspaces (5c17d11)
• registry: read, cache, and search the template registry index (a8791a4)
• registry: read, cache, and search the template registry index (bfafd17)
• search: add deterministic template search over the local store (e274a51)
• search: add deterministic template search over the local store (fd073db)
• store: add the local template package store (b5abe0b)
• store: add the local template package store (9672605)
• store: export, inspect, and scan template packages (20de099)
• store: export, inspect, and scan template packages (65aa184)
• templates: add a websocket-test console template (730992a)
• templates: add a websocket-test console template (37ff885)
• workspace: report the routes a generated service registers (43f4d69)
• workspace: report the routes a generated service registers (1cc6ea6), closes #221

Bug Fixes

• doctor: name how to install libuvcpp when discovery finds none (4726813)
• doctor: name how to install libuvcpp when discovery finds none (262052c)
• domain: close the review notes on the template package schema (f11e57a)
• domain: close the review notes on the template package schema (1508f7c), closes #236
• evidence-log: drive the ring past its bound and clarify the schema (cb2986b)
• http: destroy an abandoned HTTP/2 session instead of closing gracefully (507fd99)
• registry: accept the generator's index shape and bind the cache to the URL (285140a)
• release: check the version from the staged helpers on a bootstrap tag (04ea6df)
• release: check the version from the staged helpers on a bootstrap tag (38eff70)
• scan: report a home path whose user name ends the path (3ae159f)
• scan: report a home path whose user name ends the path (81ccd94), closes #255
• store: bound the reader's memory by checking each file's size first (ffa8350)
• store: bound the reader's memory by checking each file's size first (934c74d)
• store: name an unreadable record instead of calling the package invalid (017a6ff)
• store: name an unreadable record instead of calling the package invalid (6702581)
• store: roll back a package when metadata cannot be published (7b062a3)
• store: treat .. as a segment and harden the scan's accounting (0f57376)
• templates: compile the generated sources as UTF-8 under MSVC (4f4b827)
• templates: compile the generated sources as UTF-8 under MSVC (dd150fe)
• templates: keep the websocket-test log parseable and its console upgradable (46431b8)
• toolchain: explain a runtime-only libuvcpp package (8141304)
• toolchain: explain a runtime-only libuvcpp package (915cb3d), closes #213
• toolchain: find an installed MSVC that is not on PATH (3930a7b)
• toolchain: find an installed MSVC that is not on PATH (11cb1d5)
• toolchains: ask the pkg-config question CMake's FindPkgConfig asks (d1ca987)
• toolchains: gate the pkg-config validator at CMake 3.29.1 (72ca40e)
• toolchains: run a batch pkg-config candidate through cmd (33e6494)
• web: bound the WebSocket opening handshake and settle an aborted response (81a7ea8)
• web: destroy the pre-upgrade request when the handshake deadline fires (5be6fbb), closes #182

Code Refactoring

• domain: drop the unread staticPrefix field (3bccfe5)
• domain: drop the unread staticPrefix field (4a93335)

Documentation

• check, docs:build, and oxfmt pass on this tree. (c868f4d)
• cli: name the Git Bash/MSYS path-conversion workaround (b612ac6)
• cli: name the Git Bash/MSYS path-conversion workaround (ca21a44)
• installation: clarify local and global installs when uvp is not found (44f980f)
• installation: clarify local and global installs when uvp is not found (cda1469), closes #215
• registry: state the proxy limitation of the default transport (64ac69a)
• release-notes: draft the first-release notes and upgrade guidance (2944b95)
• release-notes: draft the first-release notes and upgrade guidance (3c4e413)
• release: attribute the bootst...

uvp-agents: v0.2.0

0.2.0 (2026-10-17)

⚠ BREAKING CHANGES

• toolchain: a uvp.json that already carried a toolchain field was ignored before and is honoured now, so such a workspace changes where it is built. uvp_verify refuses one until the call passes toolchain: "local".
• web: uvp_assert_exchange's output replaces the passed and failed counters with satisfied, unmet and undetermined, drops not_evaluated[] in favour of rows carrying status, and replaces each results[] row's passed: boolean with status: "satisfied" | "unmet" | "undetermined". The assertion engine's AssertionOutcome changes with it. docs/public/tool-catalog.json and the shipped skill are regenerated from the contracts.
• soap: uvp_soap_call's input schema gains max_body_bytes. Nothing behind it breaks — the default is the number that was fixed before it, so a call a caller already writes sends the same request and gets a byte-identical answer — but a change to an existing tool's input schema is breaking by docs/releasing.md's compatibility promise, and the reason is the reader it names: a client that cached the input schema and compares it against the catalog now finds a property its copy does not have, and a failed schema comparison has to be looked at whether or not anything broke behind it.
• web: base64 appears beside a lossy text where it did not before, and on uvp_soap_call's body the field is new. Both output schemas are closed (additionalProperties: false), so a client that cached the previous schema and validates against it rejects a body carrying a field that schema did not declare — the reader docs/releasing.md promises to keep working.
• web: uvp_http_request and uvp_soap_call gain text_lossy on their body object, optional, and it is breaking anyway: the catalog's objects carry additionalProperties: false, so a client that cached the previous output schema and validates against it rejects a body that now carries the field. That is the reader docs/releasing.md promises to keep working, which is why the commit is marked rather than filed as the additive change the shape of it suggests. A caller whose text is the bytes reads nothing new, which is the ordinary case; when it is not, the field names whether the peer's bytes or a cap of the caller's caused it.
• tls: uvp_http_request's tls object no longer carries verified or errors. verification is one of verified, failed, not_checked, or undetermined, and reason carries the failing code when there is one. A caller reading tls.verified reads tls.verification === "verified"; a caller reading tls.errors reads tls.reason, which is present exactly when OpenSSL had something to say. A certificate this client will not accept now exits 2 as target_unavailable rather than 1 as endpoint_unreachable, and is no longer retryable.
• uvp_websocket_probe no longer always returns handshake. On the native stack it is absent, because the C ABI does not report the upgrade response; a caller that reads handshake.status must now handle its absence, which is a statement about the stack rather than a malformed result, and not_observable says which other fields the same stack cannot fill. The tool also declares spawnsProcess: true unconditionally — the effect set is a closed set of booleans and cannot express "only when --stack libuvcpp is used" — so a caller that treated this tool as one that runs nothing must not.

Features

• ci: check that the published tarball is reproducible (ab57236)
• ci: fail a docs page that Vue would interpolate (a68c284)
• cli: answer --version, which three documents already promised (80f1f3c)
• db: back rest-api with libuvcpp's pool when the db module is declared (d42ed51)
• doctor: a workspace's toolchain is the one the doctor reports (7455038)
• give capture an explicit recording limit, and refuse what it cannot forward (5a657f9)
• http2: carry the negotiated protocol from the template through the probe (d5239f1)
• http3: ask over HTTP/3, and generate a service that answers it (bfd6bf4)
• mutation: classify a sweep's survivors as compiling or refused (8c391b3)
• mutation: classify a sweep's survivors as compiling or refused (92fe3b0), closes #56
• mutation: print what the sweep's kills rest on (554a255)
• mutation: print what the sweep's kills rest on (65c5f68), closes #42
• probe WebSockets through libuvcpp's own client stack (f414200)
• release: a bill of materials for what ships, and the files[] promise behind it (d891cf0)
• report WebSocket frames where they happened, and answer expectations once (eed2fa7)
• return the load-test timings behind the percentiles, bounded and reported (4d9c6b2)
• soap: take the envelope cap from the caller, and keep the digest over the envelope (10d77a9)
• tls: serve TLS from a generated workspace, and let a pass check it (969e6fb)
• toolchain: a workspace names the image, and a call only chooses sides (d432a73)
• toolchains: add a run seam and a Windows MSVC lane (54e5376)
• toolchains: add a run seam and a Windows MSVC lane (617b001)
• toolchains: build inside a container image, without ever pulling one (13b07a2)
• toolchains: read the linker's failures, and pin the language it says them in (c48faa7)
• toolchains: run the container lane against a real image (d83e71d)
• verify: check the commands the pages name, and run the inventory they point at (6b48293)
• verify: fail a run whose own reporter flags drop the skip list (0d8732e)
• verify: fail an Actions reference that is not pinned to a commit (54eed32)
• web: one name for the third state, on the row a caller reads (aed9ab2)
• web: replay a capture against a live target (22cb133)
• workflows: compare two verification reports by semantic digest (6e00e3e)

Bug Fixes

• artifacts: the fixture names its outputs the way the host does (d71c27b)
• artifacts: the fixture names its outputs the way the host does (7967fed)
• assertions: make a non-pattern expectation a check that did not run (a3ab697)
• assertions: make a non-pattern expectation a check that did not run (1d703ed), closes #61
• assertions: model the third state instead of laundering it into a verdict (c658793)
• bound what a capture session holds, and report what it dropped (b906083)
• capture: close the proxy a session eviction drops (f25d24e)
• capture: close the proxy a session eviction drops (8917a1b), closes #96
• capture: name both reasons a replay skips an excha...