release: v0.5.0

[aaltshuler]

Bumps workspace from 0.4.2 → 0.5.0. User-facing release notes at docs/releases/v0.5.0.md — that's the source of truth; this PR body is the operator-facing meta.

Three pillars

1. Lance 6.0.1 substrate (PR chore(lance): bump 4.0.0 → 6.0.1 (DataFusion 52→53, Arrow 57→58) #111) — DataFusion 52 → 53, Arrow 57 → 58. New optimizer rules now reach our predicates via PR exec/query: structured Expr pushdown via Scanner::filter_expr (unblocks CompOp::Contains) #113's structured Expr pushdown. lance-tokenizer replaces tantivy internally.
2. Cedar policy engine (PRs policy: codify signed-token-claim-only actor identity (MR-731) #101–tests: policy chassis e2e gap-fills (MR-722 follow-up) #106) — engine-wide Omnigraph::enforce(action, scope, actor) on every _as writer; server defaults to deny-all without a Cedar YAML; signed-token-claim-only actor identity.
3. Schema-lint v1 chassis (PRs schema-lint chassis v0: code-tagged diagnostics (MR-694) #87, schema-lint chassis v1.0: DropProperty Soft + code-tagged diagnostics (MR-694) #90, schema-lint chassis v1.1: DropType Soft (MR-694) #99, schema-lint chassis v1.2: --allow-data-loss flag + Hard mode (MR-694) — completes v1 #100, schema: HTTP allow_data_loss exposure + e2e drop coverage (MR-694 follow-up) #107) — OG-XXX-NNN codes, soft DropProperty/DropType semantics, --allow-data-loss for Hard mode, HTTP parity.

Plus structured Expr filter pushdown (PR #113 — unblocks CompOp::Contains via array_has), inline .gq sources on CLI/HTTP, optional CORS layer, and three bug fixes (merge-insert dup-rowid via FirstSeen, branch-merge coordinator restore, blob-column materialization in branch merge).

Commits on branch (3)

cec182d	gitignore: exclude docs/internal/ from publication (incidental)
d791a92	ci: skip docs/internal/ in agents-md cross-link check (matches gitignore)
332f47d	release: v0.5.0 — version bumps + release notes

The first two are pre-existing hygiene that surfaced during release verification (an untracked docs/internal/wal-pr-findings.md was tripping check-agents-md.sh). They land separately so the release commit is purely the version flip + release notes.

Sites bumped in the release commit

• 5 crate [package].version lines (omnigraph engine, cli, compiler, policy, server)
• 10 internal path-dep version = "..." constraints across the 4 manifests that depend on sister crates
• Cargo.lock (cargo update --workspace)
• AGENTS.md "Version surveyed:"
• openapi.json info.version (regenerated via OMNIGRAPH_UPDATE_OPENAPI=1 cargo test -p omnigraph-server --test openapi)

Verification

• rg '"0\.4\.2"' Cargo.toml crates/ openapi.json AGENTS.md empty
• cargo test --workspace --locked — 907/907 green
• cargo test -p omnigraph-engine --test failpoints --features failpoints — 19/19 (recovery canary)
• cargo test -p omnigraph-engine --test lance_surface_guards — 3/3 (substrate canary)
• cargo test -p omnigraph-server --test openapi — 60/60
• scripts/check-agents-md.sh — clean (34 links, 33 docs)

Tag-and-push (post-merge)

After this merges, tag v0.5.0 will trigger three workflows automatically:

Workflow	What it does	Prereq
release.yml	Build CLI + server binaries (Linux x86_64, macOS ARM64), attach to GitHub Release, update ModernRelay/homebrew-tap formula	HOMEBREW_TAP_TOKEN
publish-crates.yml	Publish to crates.io in dep order (idempotent — skips if version already present)	CARGO_REGISTRY_TOKEN
ci.yml	Full test suite on the tagged commit	—

🤖 Generated with Claude Code

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[cubic-dev-ai]

1 issue found across 11 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/releases/v0.5.0.md">

<violation number="1" location="docs/releases/v0.5.0.md:43">
P1: Release notes claim an optional CORS layer gated by `OMNIGRAPH_CORS_ORIGINS`, but no CORS implementation exists in the codebase. The existing user docs (`docs/user/server.md:95`) explicitly say CORS is not configured. Remove or mark the CORS feature description as not-yet-implemented.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Release notes claim an optional CORS layer gated by OMNIGRAPH_CORS_ORIGINS, but no CORS implementation exists in the codebase. The existing user docs (docs/user/server.md:95) explicitly say CORS is not configured. Remove or mark the CORS feature description as not-yet-implemented.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/releases/v0.5.0.md, line 43:

<comment>Release notes claim an optional CORS layer gated by `OMNIGRAPH_CORS_ORIGINS`, but no CORS implementation exists in the codebase. The existing user docs (`docs/user/server.md:95`) explicitly say CORS is not configured. Remove or mark the CORS feature description as not-yet-implemented.</comment>

<file context>
@@ -0,0 +1,171 @@
+  `omnigraph mutate` and the corresponding HTTP endpoints accept inline
+  `.gq` source, not just a file path. Easier ad-hoc queries, clearer
+  request logs.
+- **Browser CORS layer**: optional CORS layer on `omnigraph-server` for
+  browser-based UIs, gated by `OMNIGRAPH_CORS_ORIGINS`.
+- **Merge-insert dup-rowid fix**: Lance's `MergeInsertBuilder` could surface
</file context>