v0.77.0

Cotal 0.77.0 is out!

Grab it: npm i cotal-ai@0.77.0

Changes in this release

• A frozen registration finished after its spec write committed no longer fails once its reopen commits. The same-op resume in registerServiceInstance and the cotal reconcile-gate repair used to throw when the governance slot release or the progress-cursor read after that reopen failed, although the gate was already open at the new epoch with the spec published, and a caller that retried the resume advanced the epoch a second time. The release is now best-effort on both completing paths, as it already was on the normal registration path: a slot it leaves is behind the live gate generation, which deregistration treats as orphaned and the next registration replaces.
• Moving a manager or auth-plane identity record from its older .cotal/auth place no longer follows a symlink at either place. A .cotal/space.<hex>/ entry that linked to the older record read as the same record, so the move deleted the older regular file and left only the link, which every reader refuses. An older entry swapped for a link to a different record during the move could also pass as that record. Both cases now refuse as not a regular file and keep the older record.
• validateUserToken and the IdpConfig of verifyIdpToken and createIdpBridge no longer take clockToleranceSec. Both verifiers allow a fixed 5 seconds of clock skew, the default they already applied. Nothing in the repository passed the option, and a NaN value, such as Number() of an unset environment variable, turned off the expiry, not-before and issued-at checks so an expired or post-dated token was accepted, while a large value widened them by that many seconds.

What's Changed

• fix(core): never fail a completed registration after its reopen commits by @davidfarah2003 in #3558
• fix(workspace): lstat both entries when an identity record move finds one in place by @davidfarah2003 in #3566
• fix(auth)!: fix the token verifiers' clock tolerance at 5 seconds by @davidfarah2003 in #3567

Full Changelog: v0.76.0...v0.77.0