Truss v0.0.43

Truss v0.0.43

Published Python embedder release. Independent review and the candidate and tagged release matrices passed. Fresh public downloads passed checksum, metadata, complete RECORD, release-pin and exact source correspondence checks for all 413 runtime files in both wheel and source archive.

Scope and package cohort

Python >=3.11 and UMF 0.10.0 remain the selected interface/source versions.
Optional integrations retain psycopg[binary]==3.3.6, weft-sql==0.4.48,
experimental umf_access==0.1.0.dev5 and local
pgserver-pg18==18.6.1. Embedded JavaScript uses mini-racer==0.14.1.
The native identifier remains 0.72-candidate; the changed manifest digest
distinguishes these runtime bytes from the prior release.

These notes and the Python package guide
describe consumer-visible changes. Existing installations still require their
matching release cohort; this release supports fresh installations only.

Changes and fixes

This release retains the experimental synchronous registered umf.access/1
action host and strict native group-response admission from
v0.0.42. Exclusive leases, original source/request correspondence,
private staged receipts, confirmed settlement and uncertain-write handling keep
their existing contracts. The v0.0.42 qualification receipt
covers its registered create-action fixture under ordinary module ACLs. The combined-source checks below exercise that same generated create-action fixture; additional generated handlers and the protected profile remain unqualified.

The owned scalar-graph profile admits at most 1,024 operations and 3,072
preconditions per atomic group. The 1 MiB original group-input limit, scope,
lock, result and time bounds still apply independently. Conditions retain
unique IDs, original failure order and locked-prestate evaluation. Groups are
never silently split to fit a bound.

The query and disclosure original-source guards select frozen reference-wheel
cohorts using exact installed Weft 0.4.48 native-module identities for macOS
ARM64 and Linux x86_64. Release CI separately verifies the downloaded wheel
against that frozen archive digest and every RECORD entry before installation. Unknown
modules and crossed wheel/module selections still refuse; the existing macOS
consumer bytes remain unchanged. Both native query/disclosure gates passed on Ubuntu 24.04 x86_64 and macOS 14 ARM64, separately from the retained earlier packaging evidence.

Repeated exact object targets reuse one successfully validated type-metadata
row within an inventory invocation. All four validation passes and every
per-condition authority check remain. No authorization decision, object state
or condition truth is cached; SQL/operation deadlines remain 10s/30s.

Batched key conflicts report the original zero-based input ordinal, including
live keys, duplicate creates and retained deleted-key reservations. Multiple
conflicts select the earliest conflicting operation. A whole-group finalization
failure without qualified operation provenance omits the ordinal rather than
identifying an arbitrary operation. Failed groups retain operation-local rollback
and leave caller settlement under host control.

The owned edge import builder also contains a nested relationship permission
refusal instead of dereferencing it as a definition. It preserves its existing
outer execution-error contract and passes through unrelated original errors.

Contained permission denials have typed results across group context,
catalog references/planning and direct object/key/edge/page/traversal reads.
They disclose no hidden entity existence, role inventory or native diagnostic
prose. Transport failure, cancellation, retry, unusable transactions and unknown
commit remain outer execution failures.

Valid unnamed Records and Fields retain their stable UMF IDs. Regression
qualification confirms registration, create/update/query and reopen behavior;
this release adds no UMF authored-name requirement.

The package guide documents current import/group limits and complete-entity
relationship output collisions. When selecting a.*, choose an unused alias
for an additional RELATED_KEYS output, for example
RELATED_KEYS(a."A-B",100) AS "_A-B". Duplicate output names retain the explicit
WFT-OUTPUT-NAME refusal. Complete relationship columns still refuse above
100 keys; bounded explicit related-key projections retain their reported
truncation semantics.

API compatibility and required actions

Consumers must update exhaustive result handling for these widened unions:

Surface	Permission refusal
group_context_in_transaction	UnauthorizedPerson, code unauthorized_person
Catalog revision, group preparation and type/relationship references	CatalogRefused, code unauthorized
Direct object/key/edge/page/traversal reads	ObjectReadRefused, code unauthorized

Narrow the value inside Ok before using a context, reference or read result.
A permission refusal is distinct from an absent entity and an unavailable
observation. Group apply retains GroupFailed(UnauthorizedPerson()).

GroupOperationFailure.code remains group_failed. Its new operation_code
is one of invalid_input, key_conflict, expected_version, not_found or
dependencies; inner_error retains the complete original native artifact.
operation_index is now str | Absent. Handle ABSENT before converting or
indexing, and supply operation_code when constructing this carrier in fixtures.
Group-input invalidity retains its separate InvalidGroupInput result.

The retired rootless inventory component retains its 128-condition bound.
Its synthetic component check does not readmit retired group execution.
Legacy ImportInput remains bounded at 128 records; larger and batched import
delivery is outside this release.

Fresh installation and rollback guidance

Install into a fresh database without an existing truss schema. Installation
upgrades remain unsupported: upgrade_in_transaction refuses without issuing
SQL, and the CLI has no --upgrade option. No automatic migration or verified
export/import upgrade route is provided. Retain an existing database with its
matching runtime cohort; changing package versions is not an in-place migration
or rollback procedure.

Qualification and known limits

The combined-source local gate adds six generated/native tests and 36
action-transport, group-result-wire and whole-group tests. All six native tests
pass; the 36-test run passes with one generated-client preflight unit skipped
because its opt-in source-root/Bun environment was not enabled in that run. The
separate generated native test did run. The receipt records the exact Python,
dependency versions, frozen UMF generator source hashes and Truss runtime
source hashes. This local result is focused composition evidence. The hosted and downloaded-artifact gates are recorded separately below.

The earlier E0/E1 evidence
qualifies its local macOS ARM64, Python 3.11.17, PostgreSQL/libpq 18.6, psycopg
3.3.6 and Weft 0.4.48 payload before the v0.0.42 merge. That development wheel
has 412 exact matching
source/wheel/installed runtime files. All 65 selected broad tests and two final
targeted tests pass; final test-delta evidence binds the two updated methods
to their targeted run and the unchanged methods to the broad snapshot.

Coverage includes the 153-condition heterogeneous workload, repeated and mixed
3,072-condition workloads, 3,073 refusal, malformed identities, collision
ordinals/reservations, rollback, replay, current permission checks and unchanged
1,024-operation capacity controls. The mixed ceiling combines existence and
property equality over A/B identities. It does not qualify every possible
3,072-condition key-route or relationship workload.

For that earlier payload, static checks pass generated SQL/manifest
correspondence, 1,526 Python import edges, 18 boundary controls and
positive/exact-negative typed consumers.
Earlier failed attempts remain in the evidence. No deadlines were raised.

The candidate and tagged release matrices pass selected installed-wheel, native strict receipt, E1, query/disclosure, negative-control and public-workload gates on Ubuntu 24.04 and macOS 14. This is selected-workflow qualification; full test discovery, Windows, managed-service and upgrade qualification remain outside this release. The earlier three-schema and stress benchmark results retain their original scope; the new runs repeat selected schema registration, replay and public workflow controls.

Statement samples cover calls inside an already adopted transaction, excluding
setup, BEGIN/COMMIT, round trips and server-internal work. They establish no
end-to-end speedup, latency distribution or universal write count. No import
throughput improvement or larger-import capacity is claimed.

Verified delivery

• Reviewed and merged PR #18. Independent exact-head review completed with no findings.
• Candidate matrix and tagged release matrix.
• Release commit: c8af523ac3f7e64f3be180e81e04e2d11f53601e.
• Wheel SHA-256: ee81c0c9ac138046d56b5eccd7c84a8fe0c9085e62962c8a8f6e0a3c1e4463a6.
• Source archive SHA-256: 0df33beb2318496e0ab04bbb52cf363e76b3d6960488626a2ba594bc6a51765c.
• All 9 checksummed assets, 413 runtime files, complete wheel RECORD, exact metadata and release pins verified against the qualified source.

The retained published-delivery receipts and combined local composition receipt distinguish the final public artifacts from earlier development evidence.