v0.4.0

0.4.0 (2026-08-21)

⚠ BREAKING CHANGES

• routing: remove the legacy governance and guardrail APIs in favor of typed, bounded request/response middleware.

Features

• backends: add Azure Blob object store (0d16157)
• backends: add Azure Blob object store (e49a2a4)
• backends: add conditional object erasure (2f984d7)
• backends: add conditional object erasure (3431dd8)
• backends: add object-store CAS contract (5d19a59)
• backends: add object-store CAS contract (0b42810)
• blob: add read-only revision hydration (d60701d)
• blob: add read-only revision hydration (#398) (c73ae3c)
• blob: decode canonical resource documents (a180bdb)
• blob: decode canonical resource documents (#397) (d9d9294)
• blob: implement blob-backed flat namespace control plane (cbdf03a)
• blob: persist candidate sequence floors (4f6f156)
• blob: persist sequence floors and signed recovery candidates (57b7b53)
• blob: read authenticated immutable objects (7e91263)
• config: add blob control-plane contract (7f617a2)
• config: add blob control-plane contract (a8c4fc8)
• convergence: wire blob secrets into snapshot compilation (5436b5c)
• desired-state: add blob publication protocol (da10795)
• desired-state: add blob publication protocol (2588a80)
• desired-state: add flat namespace projection (b623c6a)
• desired-state: add flat namespace projection (#394) (9ab3628)
• desired-state: authenticate blob publication (8b5148f)
• middleware: add the request-path primitive (#365) (b9b6248)
• operations: register content middleware through policy (#367) (0aa3ba9)
• publication: add authenticated immutable object reads (#396) (c359efb)
• routes: add namespaced inference contract (39ae8ce)
• routing: add deterministic request-path redaction (#370) (7e2edec)
• routing: opt byte-faithful routes into buffered middleware responses (#368) (1abef95)
• secrets: add namespace blob envelope codec (f8fd49e)
• secrets: add namespace blob envelope codec (3ad4bb9)
• secrets: bind blob secrets to authenticated candidates (1ee9474)

Bug Fixes

• auth: compare projected workload-key digests in constant time (bd6bedf)
• backends: align Azure CAS contract (dee7cb3)
• backends: distinguish missing CAS targets (5fef93a)
• backends: harden Azure Blob edge cases (4f49f90)
• backends: keep maintenance trait unambiguous (14d05bb)
• budget: honor static-only namespace bypass in memory (b3c9c0e)
• ci: align endurance policy tests (6977cf7)
• ci: bound musl package installation (#376) (10a4008)
• ci: pin scheduled fuzzing to GNU target (#351) (4639bf5)
• config: align Azurite URL contract (be73a5c)
• config: harden blob control-plane contract (ad5d58c)
• deploy: set fsGroup on persistent cache PVCs (c6f4a54)
• desired-state: fence blob activation (e7c75bd)
• desired-state: harden blob publication bounds (6ff36fb)
• desired-state: tighten blob activation boundary (3843696)
• policy: allow mixed flat static-only namespaces (dfb604d)
• preserve exact rollout trace evidence (#378) (6b35561)
• qualification: align restore provenance validation (cfb4ac2)
• qualification: align restore provenance validation (c81469d)
• qualification: align rollout shared alias (#380) (205a7aa)
• qualification: bound model cancellation fault timing (#374) (42b90f3)
• qualification: close Devin review gaps on PR 385 (413a242)
• qualification: repair rollout and capacity evidence (#377) (e9aa36c)
• qualification: reproduce rollout float fold (5322691)
• qualification: reproduce rollout float fold (d946f23)
• qualification: verify rollout control plane structurally (e1c7eac)
• routes: align stateful checks with namespaces (a3e4845)
• routes: avoid retaining refused namespace text (555a557)
• routes: keep namespace error tests clippy-clean (c37b83d)
• routes: redact invalid namespace debug output (bcff46b)
• secrets: bind blob opens to signed provenance (7d058b8)
• secrets: harden blob envelope cryptography (0d6c736)
• secrets: separate blob crypto authorities (d3ba6d8)
• stateful: close flat namespace audit gaps (0cd1349)
• stateful: fence flat namespace recovery (cd177a2)
• stateful: harden flat namespace projection (031612d)
• stateful: preserve legacy cache recovery (424e484)

Refactors

• usage: move accounting holds into middleware (#371) (5b1cfff)

Documentation

• architecture: adopt blob-backed flat namespaces (0053fca)
• architecture: adopt blob-backed flat namespaces (#385) (596ab92)
• auth: keep authentication at outer boundary (#372) (d22392a)
• publication: clarify immutable read authorization boundary (d15111a)
• qualification: align rollout evidence schema (#379) (558fd4a)
• qualification: reconcile wave two closure evidence (#352) (4e70a6d)
• secrets: clarify decrypt ring key limit (6e7d2a8)

Tests

• compat: qualify namespaced provider SDK routes (d87c78a)
• compat: qualify namespaced provider SDK routes (a10f9e1)
• fuzz: pin blob seed bytes in smoke (9782290)
• fuzz: pin flat-v2 seed SHA-256 outcomes (65f8e33)
• qualification: allow active cohort evidence (1db3b2c)
• qualification: allow active cohort evidence (d32ad16)
• qualification: harden production evidence cohort (#373) (c56c004)
• secrets: harden blob envelope boundaries (60dc4f0)

Continuous Integration

• bump the github-actions group across 1 directory with 4 updates (#369) (5c02e4f)
• qualification: dispatch exact-head evidence (#375) (bb3625d)
• qualification: gate endurance on CI smoke, not a 12h soak (c122abd)
• qualification: pause legacy postgres lanes (e3f99af)
• qualification: pause legacy Postgres lanes (f68c524)