Skip to content

CHAP v0.2.9: complete package publish and consolidated 0.2.x hardening

Choose a tag to compare

View all tags
@brightbeamarsalan brightbeamarsalan released this 15 Aug 01:57
· 95 commits to main since this release
v0.2.9
5c2586a

CHAP 0.2.9

First release with the full set on npm and PyPI. The MCP and A2A coordinators and all
five framework adapters, previously unpublished, now ship alongside the coordinators.
Both MCP adapters move to the 2026-07-28 protocol revision while continuing to serve
2025-11-25 clients, and the release consolidates the security, audit-integrity and
robustness work that landed across the 0.2.x line.

The CHAP wire format is unchanged. Both coordinators remain at parity.

Breaking changes

Read these before upgrading from 0.2.8.

  • Node 20 is the floor. Node 18 reached end of life in April 2025 and lacks a
    standard globalThis.crypto, which sent id generation down a fallback that threw in
    an ES module. engines is now >=20 across every package.
  • The Python mcp extra moves to >=2,<3. The transport is built on the mcp 2.x
    SDK, which implements the 2026 boundary natively. Installing chap-coordinator[mcp]
    will move you to a new SDK major.
  • The MCP transports refuse requests they previously served. A request declaring a
    protocol version the adapter does not implement is now refused with
    UnsupportedProtocolVersion (-32022); a request declaring a version but omitting
    clientCapabilities is refused with InvalidParams (-32602). resultType, ttlMs
    and cacheScope are emitted to 2026-era callers and withheld from handshake-era
    ones, which receive the result shape their own revision defines.

MCP 2026-07-28

The 2026 revision is stateless: instead of negotiating once through an initialize
handshake, every request carries its protocol version and client capabilities in
_meta, and the server accepts or rejects each request independently.

  • server/discover is implemented in both languages, advertising
    ["2026-07-28", "2025-11-25"] because both eras are served.
  • Only 2026-07-28 may be declared per request. The 2025-11-25 revision is reached
    through initialize, as its own revision defines, and an
    UnsupportedProtocolVersion payload names only the declarable versions so a retry
    cannot land on the same refusal.
  • Results are typed and cacheable for a 2026-era caller.
  • The Python transport is built on the mcp 2.x SDK; the TypeScript adapter implements
    the same rules against SDK 1.x. Both were verified against the same probe suite and
    answer it identically, error codes, messages and payloads included.

Security

Key lifecycle bound to signatures, membership floors on mutating methods, step-up fixed
and scoped, adapters can no longer fabricate decisions, SCITT verification fails closed,
and an optional read-authorisation gate. See the changelog for the full list.

Fixed

Reads no longer mutate the audit chain, chain verification runs from genesis and no
longer reports an unchained workspace as tampered, overrides diff against the artefact
under review, cross-implementation hashing is aligned, and signed workspaces and
in-flight reviews survive a restart.

Documentation

The evidence-chain link formula in the specification and in the conformance test vectors
described two different constructions, neither matching the implementations. Both now
state the implemented form, so a third-party implementation can reproduce a chain the
references accept. The one-entry-per-message invariant is scoped to state-changing
messages, with the four read-only methods named.

Install

# npm
npm install @brightbeamai/chap-coordinator
npm install @brightbeamai/chap-coordinator-mcp
npm install @brightbeamai/chap-coordinator-a2a

# PyPI
pip install chap-coordinator
pip install chap-langgraph
pip install chap-pydantic-ai
pip install chap-llama-index
pip install chap-ag2
pip install chap-google-adk

Full detail in CHANGELOG.md.

Assets 2
Loading