Truss v0.0.48

Truss v0.0.48

Release scope

Published for Python embedders and operators. Python3.11+, PostgreSQL18.6,
psycopg3.3.6, mini-racer0.14.1, UMF0.10 and Weft0.4.51 form the selected tuple.
Native0.74-candidate has manifest SHA-256
c4339ac7f09ab5a004c272ab00962107a970938004c1765ec4163e4d5ca9b6f0.
The public verification record binds the exact source, platform assets, compiler
cohort, checksums and selected test receipts: public release validation.
The final asset count is 15; the release page is
https://github.com/DocumentDrivenDX/truss/releases/tag/v0.0.48.

Highlights and changes

• Finite person entrypoints return typed nonmembership refusals while actual
  damaged EXECUTE grants remain native execution errors. Statement-stable data
  sources retain their original snapshot with independently current authorization.
• Frozen complete group requests support observer-only recovery. Missing,
  conflicting or unauthorized observations never execute the group again.
• Empty Records allow the paired core/DDD required-field addition; populated
  Records refuse it, including retained matching values. Existing qualified
  core-only retained-value rebinds continue to work.
• Weft-owned descriptors, explicit ordered entity facts and relationship
  projections, typed resolver diagnostics, selected indexed predicates and key
  pages use query ABI1.2. Other domains retain bounded complete fallback reads.
• Completion and group dry-run force only Truss's deferred constraints and
  publish observation carriers after host-owned rollback. They preserve prior
  caller work and produce no durable receipt or committed created identity.
• Authorized cross-module audit discovery, whole mutation metadata up to4,096
  events within its byte bound, and optional reader-authorized archived key/version
  projections. Relationship-only load discovery/details now retain exact owners
  and actor names; old incomplete headers remain unavailable.
• Deduplicated import owner inventories reduce measured residual import work;
  all original inputs still receive authorization checks. Performance evidence
  is workload-specific and establishes no general latency/p95 target.
• Original arras.view version0.1.0 Record/Field metadata is preserved through queries
  under its exact owning-document declaration; unsupported selected declarations
  refuse. Unknown unselected content and source bytes/pins remain intact.
• The independent corpus archive and installed runner are release assets.

Required actions and migration

Only the latest runtime is supported. Admitted previous databases migrate
forward without a release-age cutoff. Previous application releases do not
remain supported. This release retains the original0.0.44, shared0.0.45/46 and
0.0.47 migration sources and all immutable prior recipe/receipt evidence.

Quiesce writers and back up both database and host recovery registry. Follow
the migration guide:
inspect status, prepare and retain the reference, apply that reference, reconcile
uncertain settlement, and verify before resuming latest application work.
Startup never migrates. One complete route publishes one final receipt; prior
receipts remain unchanged. Install the matching Weft0.4.51 query dependency.

Exact text ACL inventories now distinguish sibling overloads. Separately pinned
supplements strengthen old-profile admission without rewriting published source
profiles. Native drift refuses before effects. Logical restores require the
original backup-metadata companion for PostgreSQL's omitted row-type ACLs.

Hold and recovery

Hold on drift, failed verification or uncertain settlement. Reconcile the same
original attempt; do not repeat effects with a new request. Pre-commit failure
rolls back; committed changes require a forward fix or the qualified backup
restore/remigration workflow. Installing an old package is not database rollback.

Qualification and known limits

The source-F local candidate remains separately recorded in the
source-bound qualification packet.
It passes 80 migration cases, 62 independent corpus cases, six compiler-cohort
controls, 14 policy executions covering 10 distinct controls, and the original
1,000-object/1,000-edge workload. The actual compiler/build source is
557153731e9f5d0583193a1189a07c6ed485d3d3; all 455 runtime payloads match source,
wheel and sdist. Earlier skipped/failed attempts remain preserved, including the
statement-timeout failure and same-limit serialized retry. The archive's reviewed
one-pin producer update preserves the old source, corpus and refusal log; no
assertion changed.

Public receipts separately bind the clean published wheel to the selected
platform gates: 80 lineage cases on Linux and macOS, 62 independent archive cases
on Linux and macOS, the selected 30-driver checks and the two-instance uvx
restart check: Linux 80-case migration receipt, macOS 80-case migration receipt,
Linux 62-case conformance receipt, macOS 62-case conformance receipt,
30-driver receipt, two-instance uvx receipt. The public
verification record checks the final asset inventory and exact count
(15): public release validation.

No pre-0.10 or protected-profile migration, downgrade, managed-service support,
other driver qualification or perpetual old runtime execution is added. Unknown
extension content remains preserved. Ordinary receipts remain indefinitely
retained; expiry observer fixtures do not establish an expiry writer. Broader
query domains and p95 targets remain outside the selected evidence.