Truss 0.0.42

Truss 0.0.42

Release Scope

Truss 0.0.42 adds an experimental synchronous registered umf.access/1 action
host and strict native group receipt decoding. The release date is 2026-10-20;
the wheel and source archive are distributed through GitHub release assets.
The optional query compiler remains Weft 0.4.48, the typed-sdk extra selects
umf_access==0.1.0.dev 5, and native use selects psycopg 3.3.6.

Audience and Channels

Python embedders compose source/action bindings and supply exclusive psycopg
leases. New applications can use UMF's generated SyncClient and SyncActions.
Existing caller-owned group and legacy typed read APIs retain their ownership
contracts. Native runtime delivery remains pgserver-pg 18==18.6.1 for SQL
PostgreSQL 18.6.

Highlights

• Source-bound schema/action registration supports single actions, whole atomic
  batches and advisory validation through trusted native group handlers.
• Complete detached wire receipts remain private until exact COMMIT
  acknowledgement and successful lease release. Unsafe settlement/cleanup is
  quarantined, cancellation keeps its original exception, and writes never retry.
• Native results admit only declared outcome/disposition/durability combinations
  with original replay-observation/locator correspondence. Invalid output stays
  contained by the operation savepoint, preserving earlier caller work.

Changes and Fixes

Strict native JSON decoding rejects duplicate members, invented success branches,
request-free receipt claims and mismatched native failure/observation evidence.
Attempt custody is published only after valid result admission. Empty receipt
arrays/count maps remain valid, including no-op results.

Preflight resource refusals retain the registered source digest, so generated
clients recognize definite limits without misclassifying them as unknown writes.
The whole invocation deadline includes input decoding and checks the budget before
leasing, dispatch, commit and receipt release. Trusted Python callbacks cannot be
forcibly interrupted; an expired budget is enforced when they return.

Breaking Changes and Required Actions

The new transport requires explicit host composition: accepted-source observer,
decoder, native action handler, receipt validator, and release-only exclusive
idle/autocommit lease with discard(). It supplies no general action interpreter.
Preserve complete original request and flag custody in native replay input, and
map original native results rather than reconstructing receipts from current rows.

Readers of malformed native wire now receive an execution error instead of an
invented successful receipt. Caller-owned pending groups remain pending; the new
transport owns only its explicitly leased transaction. Reads and non-atomic batch
modes return UNSUPPORTED through this new transport.

Migration or Rollback Guidance

Adopt each binding with original source and native result conformance tests. Keep
idempotency identities for uncertain settlement and recover through the original
native request boundary. Do not automatically retry. Rollback reinstalls the
prior wheel and matching cohort; historical receipts retain their original
meaning. No new schema migration or release of database authority is introduced.

Validation

Local macOS ARM64 with CPython 3.11.17, psycopg 3.3.6/libpq 18.6 and PostgreSQL 18.6
passed the focused component and native cases. An unpublished wheel also passed
all component controls. Native cases include original source comparison, advisory
native apply/rollback, creates, ordered atomic batches, exact replay, changed
input/flag conflicts, late failure rollback, actual commit acknowledgement loss
and explicit recovery, cancellation identity and malformed-result containment.
Native no-op compatibility preserves versions, timestamps and journals. The
execution receipt retains
its original source tuple; release assets record final package bytes and the
additional Astra admission/deadline corrections. CI remains native Linux.

Known Issues and Support

Native qualification covers one registered create-action fixture under ordinary
module ACLs. Its replay checks use unchanged rows; replay after later edits or
deletion and arbitrary handler registrations are not established by that fixture.
Generated no-op/update/delete/link registrations, protected execution, non-atomic
batches, generic umf.access/1 reads and exhaustive resource/platform qualification
remain open. Existing no-op/native receipt controls do not qualify a new generated
handler. Report issues with source/host/compiler versions and original request
custody; never include credentials or private business payloads in public reports.