AI Fabric Framework 0.3.2

AI Fabric 0.3.2 Release Notes

• Released: 2026-07-03
• Version: 0.3.2
• Release tag: ai-fabric-framework-v0.3.2
• Release branch: main
• Maven version: 0.3.2
• Release scope: open-source Java framework only. Hosted Platform/Product control-plane workflows are not part of this framework release.

AI Fabric 0.3.2 is a patch release for governed action confirmation and parameter validation.
It keeps hard validation fail-closed while making user-visible provenance enforcement configurable.

What Changed

• Added ai.orchestration.action-param-provenance-mode with WARN as the default.
• Supported modes:
  • WARN: report user-visible provenance gaps in result metadata without blocking.
  • BLOCK: preserve strict blocking for user-visible provenance gaps.
  • OFF: skip user-visible provenance checks.
• Required params that are missing, blank, placeholder-like, hidden/system-owned, or evidence-bound without trusted evidence still block in every mode.
• Pending confirmation turns now trust the already-stored, user-visible, non-evidenceBound action params when the user confirms with a short reply such as Yes, confirm.
• Account Resolver real app explicitly uses WARN so confirmation flows can proceed while exposing validation diagnostics.
• Real app examples and Docker defaults now point at AI Fabric 0.3.2.

Migration Notes

Applications using 0.3.1 can move to 0.3.2 by updating the BOM version:

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>io.github.loom-ai-labs</groupId>
      <artifactId>ai-fabric-bom</artifactId>
      <version>0.3.2</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

The default provenance policy is now WARN. If an application needs the previous strict behavior for
user-visible string params, configure:

ai:
  orchestration:
    action-param-provenance-mode: BLOCK

Do not use provenance WARN as a substitute for trusted resource resolution. Hidden/system params and
evidenceBound resource handles still require trusted backend, pinned target, attachment, or resolver evidence.

Verification

Targeted local verification:

mvn -pl ai-fabric-core -Dtest=ActionParamValidationSupportTest,IntentHandlingStepPendingConfirmationLoopBreakerTest test

Release gate verification used for this patch:

.github/scripts/validate-framework-release-guards.sh
mvn -B -V --no-transfer-progress -f ai-infrastructure-module/pom.xml -Prelease \
  -Dai.vector-db.lucene.cleanup-on-close=true \
  -pl '!integration-Testing/testcontainers-support,!integration-Testing/integration-tests,!integration-Testing/relationship-query-integration-tests,!integration-Testing/chat-session-integration-tests,!integration-Testing/behavior-integration-tests' \
  install
mvn -B -V --no-transfer-progress -f examples/real-apps/pom.xml install

The real-app reactor was resumed in chunks on the local machine because disk space was constrained; each resumed
module completed tests and packaging successfully.