workspace-2026.10.18.1

workspace-2026.10.18.1

This is an immutable, Git-only release of the tested workspace package set.
Consumers pin the annotated workspace tag (tag = "workspace-2026.10.18.1") as one Git reference for every package in this workspace, and record the commit 62fe2ddde77c49092fb70644af37a92e8fb31f06 from the attached manifest in their own reviewed pin record.
A published workspace tag is annotated and is never moved.
Package tags identify package versions within this release and are not pinning selectors.

ORM/macros 0.51.0: owned planning replay

owned-planning-replay = [] is default-off and is not enabled by any existing feature. Capture remains explicit per call and requires consent to retaining sensitive complete schema metadata in private custody. Offline verification returns passive facts and grants no apply authority; existing live apply checks remain required.

Capture, encoding, decoding and replay require Rust 1.97.1 at compiler commit 8bab26f4f68e0e26f0bb7960be334d5b520ea452, stock x86_64-unknown-linux-gnu host and target, with no compiler wrappers. Unqualified builds fail closed with LimitExceeded before these operations begin; ordinary planning remains available. SQLite and PostgreSQL capture are supported; MSSQL capture is unsupported.

Format 1 / recipe graphql-orm-owned-planning-8e1-v1 retain complete source-qualified evidence. The twelve authentic 8e1 fixtures, checksum provenance and algorithm-preserving instrumentation are committed in the source. Malformed-input/refusal/security/failure properties of the new replay feature remain inspection-only and runtime-unverified; existing release-workflow tests do not change that replay-specific coverage claim.

API, wire schema, limits and compatibility · Accounting schedule

Retained dependency findings

A fresh unsuppressed cargo-audit 0.22.2 scan of this release lockfile against RustSec database commit 999ec89d5d3f10f20be14750ec8c2d8b44e0ac9b exited 1, with findings. Its finding set matches the reviewed root report: quick-xml RUSTSEC-2026-0194/0195, rsa RUSTSEC-2023-0071, the LRU unsoundness warning and two maintenance warnings. The lock changes from 0.50.2 only align internal ORM/macros versions; external package records and the reviewed condition-source files are unchanged. This is not a clean dependency-graph or downstream safety claim. See the retained findings and applicability conditions.

Packages

Package	Version	Tag	Changes
graphql-orm	0.51.0	graphql-orm-v0.51.0	changelog
graphql-orm-ai	0.107.2	graphql-orm-ai-v0.107.2	changelog
graphql-orm-ai-tool-profiles	0.16.0	graphql-orm-ai-tool-profiles-v0.16.0	changelog
graphql-orm-backup	0.10.0	graphql-orm-backup-v0.10.0	changelog
graphql-orm-macros	0.51.0	graphql-orm-macros-v0.51.0	changelog
graphql-orm-operation-catalog	0.4.0	graphql-orm-operation-catalog-v0.4.0	changelog
graphql-orm-router	0.6.1	graphql-orm-router-v0.6.1	changelog
graphql-orm-router-protocol	0.2.1	graphql-orm-router-protocol-v0.2.1	changelog
graphql-orm-storage	0.7.4	graphql-orm-storage-v0.7.4	changelog

Wire and persistence contracts

Contract	Version
graphql-orm-ai-mutation-capability	1
graphql-orm-ai-query-capability	3
graphql-orm-ai-schema-module	0.72.0
graphql-orm-ai-subscription-capability	1
graphql-orm-ai-tool-manifest	2
graphql-orm-operation-assurance-manifest	1
graphql-orm-owned-planning-replay-format	1
graphql-orm-owned-planning-replay-recipe	graphql-orm-owned-planning-8e1-v1
graphql-orm-router-protocol	1.0
graphql-orm-semantic-catalog	2

The attached JSON manifest is the canonical release bill of materials.