v0.89.0

Cotal 0.89.0 is out!

Grab it: npm i cotal-ai@0.89.0

Changes in this release

• Add a host-only, short-lived account census credential and a bounded pinned-server connection reader. The credential grants only one account's CONNZ request and account-qualified replies. Incomplete observations remain unknown; the reader does not grant eviction or prove terminal retirement.
• Add explicit bounded diagnostic pages for native run inventory, preserving legacy list requests and existing permissions. CLI and MCP callers can continue a pinned scan without a full-list reply or an absence claim.
• On Windows, publishing a process record now waits at most 5 s in total for files another handle holds open. Before, each of its three renames could wait 10 s on its own, so one publish could block for nearly 30 s under the publish lock, about the time a second writer waits for that lock before giving up (#4175). All the renames of one publish now share one 5 s budget, and a refusal that outlasts it still throws.
• Allow persona definition tools to select a manager instance while preserving the caller's existing manager binding and permissions.
• Bound an exchanged bearer by its IdP proof's expiry at signing time. The exchange now carries the proof's absolute exp, and a session-caller session's exp, through the credential hook to the issuer, which signs the earlier of now + ttl and that ceiling and refuses once it has passed. A slow mintConnectCredential hook could previously push the bearer, and the NATS user JWT the callout mints from it, past the proof's expiry, or mint a bearer after the proof had expired.
• Render a broker's TLS mismatch as a concise join refusal with operator guidance instead of a raw connection stack. Keep the TLS requirement and refuse plaintext connections.

What's Changed

• fix(workspace): share one rename retry budget across a pid publish by @davidfarah2003 in #4177
• test(smoke): count the delegated config connection in the TLS census by @davidfarah2003 in #4180
• test(auth): isolate terminal join smoke from endpoint results by @davidfarah2003 in #4178
• fix(cli): explain join TLS mismatch without a raw stack by @davidfarah2003 in #4176
• feat(core): add scoped account connection census by @davidfarah2003 in #4186
• fix(auth): bound an exchanged bearer by its proof's expiry at signing time by @davidfarah2003 in #4185
• fix(connector-core): allow persona definition to pin its manager by @davidfarah2003 in #4190
• feat(runtime): add bounded diagnostic run inventory by @davidfarah2003 in #4191
• test(manager): align invocation smoke with contract revision 29 by @davidfarah2003 in #4192
• docs: sync CLI reference, examples and setup prompt with the implementation by @davidfarah2003 in #4193
• docs: correct setup, credential, manifest and reference drift by @davidfarah2003 in #4194

Full Changelog: v0.88.0...v0.89.0