v0.0.6 - Production readiness and verifiable releases

🛡️ Production behavior you can trust

zuvloop 0.0.6 closes the gap between a fast event loop and one that can be operated, diagnosed, and released with confidence. Exception handling is safer, native behavior tracks CPython more closely, and platform-specific paths now run through much stronger compatibility gates.

pip install zuvloop==0.0.6

• Unhandled exceptions always reach the asyncio logger, while OpenTelemetry remains additive and fail-open (#91). Exporter failures, hostile reprs, and broken custom handlers cannot suppress the original diagnostic or destabilize the loop; telemetry strings and recorded exception data are bounded to 4 KiB.
• Exception handlers now run in the owning task or handle context, matching Python 3.14's contextvars semantics. SystemExit and KeyboardInterrupt continue to propagate through every defensive reporting layer.
• Scheduling handles align more precisely with CPython: timers are real asyncio.TimerHandle instances and preserve the original integer or float deadline, native handles expose their context, and thread-safe handles retain cross-thread cancellation behavior.
• Networking and process edge cases are stricter and more portable, including address validation, TLS transport checks, named-FIFO lifetime, sendfile file-like objects, Darwin IPv6 scope normalization, musl resolver parity, and subprocess exit races.
• Unsupported free-threaded CPython builds fail at compile time with an actionable message rather than producing a wheel whose GIL assumptions are unsafe.

📦 Verifiable builds and releases

• The native build toolchain and isolated build requirements are exactly pinned and hash-locked; GitHub Actions are SHA-pinned and run with least-privilege permissions.
• cibuildwheel invokes uv directly so hash verification is scoped to the project build without affecting platform bootstrap tools (#93).
• Release preflight verifies that tags belong to main, exercises native safety checks and CPython conformance, and publishes the exact wheel and sdist artifacts produced by the gated build.
• Published distributions receive GitHub artifact attestations plus a CycloneDX SBOM that includes the compiled libuv dependency before trusted PyPI publishing.
• Source distributions bring their pinned Zig toolchain into the isolated build environment and are tested on a host with no system Zig available.
• The aiohttp compatibility environment is locked with hashes, while immutable upstream aiohttp and uvicorn suites prevent dependency drift from changing the test inputs unexpectedly.

🧪 Broader release confidence

• Runtime coverage now includes glibc and musl, checked native builds, sanitizer runs, scheduled soak tests, CPython 3.14.0/current 3.14/3.15 prereleases, and installed-wheel conformance.
• Real aiohttp and uvicorn workloads, property tests, strict native stubs, and 100% branch coverage guard the public behavior users depend on.
• Compatibility, installation, instrumentation privacy, supported platforms, and the release architecture are now documented explicitly.
• README benchmarks were rerun on CPython 3.14.3 and libuv 1.51.0 (#90); zuvloop leads uvloop in 10 of the 11 published rows, with the aiohttp client result called out honestly.

Full changelog: v0.0.5...v0.0.6