Truss v0.0.44

Truss v0.0.44

Release scope

Published 2026-10-21 (UTC). Python embedder delivery completing the adopted Hohfeld feedback, following
E0/E1 in v0.0.43. The release cohort is Python >=3.11, PostgreSQL 18.6
(pgserver-pg18==18.6.1), psycopg 3.3.6, Weft 0.4.48, UMF core 0.10.0 and
embedded V8 (mini-racer==0.14.1). Native identifier 0.72-candidate is
unchanged; the manifest digest identifies this release's distinct bytes.

Audience and channels

Python hosts and adapter developers receive the API and compatibility details
through these GitHub release notes and the package guide.
Database operators must follow the fresh-install and hold guidance below.
Qualification receipts belong to the delivery plan.

Highlights

• An explicit batched scalar import profile accepts 1,024 records and performs
  fixed client work per chunk, retaining ordered per-record create/skip/reject
  results, partial progress, exact source provenance and honest durability.
• Conditional reader-catalog observations, module source revisions,
  document/global registration expectations, a cheap registrar probe and
  validated paired DDD optional fields reduce host coordination work.
• Condition-only preview, person status, typed install refusals, authorized role
  recovery, atomic grant batches and independent group/load audit grants are
  public typed APIs.

Changes and fixes

BatchedImportInput selects truss-batched-scalar-import/0.1 with chunks of
1–128 records. Legacy ImportInput retains its 128-record bound and settlement
contract. A batch result wraps the original tagged report; an empty load has
its own pending/committed/rolled-back/commit-unknown/unresolved disposition.
Envelope and native resource limits remain independent of record count.

At 128 records, measured builder plus executor client submissions fall from
1,674 to nine in an already adopted transaction, excluding context acquisition
and settlement. A 1,024-record invocation uses three builder and 27 executor
submissions. Native enforcement still contains individual records server-side;
this release does not claim set-based native DML or a tenfold latency gain.

The conditional catalog API returns a snapshot or unchanged result with an
opaque validator. Both paths recheck current complete visibility before
publication. Validators are not credentials. Each module exposes its source
catalog revision. Registration can compare the global head or exact submitted
document revisions (zero requires absence); exact authorized replay retains
its original meaning. Known paired umf.ddd/0.1.0 optional field additions use
the pinned original UMF validator; unknown or incompatible edits still refuse.

Preview evaluates all predicates in one statement snapshot, then performs a
fresh authority/basis check before releasing observations. It admits read-only
transactions and produces no mutation receipt, mutation row/advisory locks, reservation or durable
write. Conditions remain bounded at 3,072 under the existing group profile.
A concurrent revocation during observation withholds all results.

Installer attempts serialize before namespace discovery and return typed known
refusals. Passive catalog checks reject incompatible objects before executing
marker reads. Person status discloses minimal installation/catalog state;
original role names require separate administrator recovery. Grant batches
preflight every indexed error before changing any configuration.

Audit access is an independent qualified document/module grant. Pages authorize
the entire retained owner union, including deleted entities, unchanged operations,
endpoints and cascade effects. Filters include scope, type/entity/business key,
native actor, original x-action, observation time and group. Pages are newest
observed first with a fixed committed visibility frontier; observation time is
not a claimed commit timestamp/order. Load listings aggregate observed committed
chunks into an explicitly partial or complete invocation summary with counts,
initiator and observation range. Exact original load origin is retained privately,
including empty attempts; public audit projections exclude raw origin, input,
key and property values.

Breaking changes and required actions

The new routes are explicit opt-ins. Preserve exhaustive narrowing of tagged
results, including BatchedImportExecutionResult, PreviewRefused,
InstallRefused and indexed grant-batch refusals. Existing import routes retain
their selected bounds and behavior. Ordinary consumers need a separate audit
grant to read group/load metadata; reader/writer membership does not imply it.
Consumers may adopt conditional catalog validation to avoid full warm projections.

Migration or rollback guidance

Install in a fresh database without an existing truss namespace. In-place
installation upgrades, automatic reset and a verified historical export/import
migration remain unsupported. Keep an existing database with its matching runtime
cohort; a package downgrade is not a database rollback. Hold rollout if fresh
installation or selected workflow checks fail. Preserve existing data while
investigating through the repository issue tracker.

Known issues and support

The original Hohfeld adapter does not automatically select these new APIs.
Its complete-record relationship projection still requires unused aliases and
retains the declared related-key cap. Its nine corpus limits and seven
replica-only exclusions remain explicit; selected consumer success is not full
provider conformance. Restrictive delete, explicit owned cascade and advisory
preview are the adopted variants; unconditional cascade and reusable authority
or receipt tokens are not introduced.

Hosted CI selects Linux x86_64 only. Local native evidence selects macOS ARM64.
Windows, managed services, all stress cases, a complete protected security profile
and upgrade support are not inferred. SQL/operation limits remain 10s/30s.

Qualification and references

PR21 was independently reviewed
and merged. Candidate Linux CI
and tagged Linux publication
passed. Each reports 494 unittest executions: 493 passed and one optional generated-
client preflight skipped. All 76 new API/review controls passed. The explicit
client/native opt-in path passed in the separate local 70-test selection.

The installed local wheel passed 74 new API/wire controls, two final read-only/
owned-audit controls,70 regressions and 44 host/guard controls. Original Hohfeld
sample workflows passed 21; corpus13 passed 63 with nine declared limits and seven
replica-only exclusions. Warm original consumer traces report 29 execute calls+
2 rollbacks for a read with facts and 31 execute calls+1 rollback+1 commit for
an update across two transactions. These are scoped statement budgets, not a
universal latency promise.

Public artifact verification
passed for all ten fresh unauthenticated assets (nine checksum entries), all 428
runtime files,436 RECORD members, package metadata/licenses, source-build files,
full release pins and published contracts/ABI. Public tag source:
5834509d641a2961b1871d00cb1fd59962c5f086.

• Wheel SHA-256: 7cdea3af955feb11bd3cb4ca58b2f0cd9f336412d64de14bcba272711f1638d8.
• Source archive SHA-256: 35d7a2d3cae87017be40eaa02006f05732a201a65a52f795d2960dbe54f9af5a.

The complete delivery record
and request-disposition review
retain exact scope, source identities and remaining declared consumer limits.
Historical v0.0.43 receipts retain their original bytes and platforms.