Release v0.4.1

Fixes

Neo4j Plugin — Crash on Startup

• Fixed a panic in neo4rs 0.8.0 (connection.rs:287 — unwrap() on None) caused by plugin ABI probes firing real database queries before user credentials were injected via configure.
• Removed all pre-configure functional probes from the plugin loader. Liveness verification is now done post-configure via nil-input smoke tests with no external side effects.

OpenBao — Missing mount Config

• Added the mount field to OpenbaoSecretsConfig (defaults to "secret"). Users migrating from 0.3.0 with a non-standard KV mount path can now configure it without env-var workarounds.

MCP — Tokens Blocking Server Connections

• Fixed a bug where missing OAuth tokens in the secrets backend would permanently block MCP servers from connecting (pending-auth). Servers that don't require authentication now connect without a token.

Plugin-Level Debug Logs Leaking at Info Level

• The emit_log JSON-RPC handler now routes debug-level messages through the logging framework, respecting the configured log level. Previously, all plugin messages printed unconditionally.
• Moved Telegram inbound/outbound message content and Ollama API call details from info to debug level.

Backward Compatibility

Validation Layer — 0.3.0 Schema Check

• Added utils/validation_layer/src/backcompat/ to automatically verify that all 10 built-in plugin JSON schemas remain backward-compatible with the 0.3.0 Viper-based config. Detects renamed properties, changed types, and missing required fields at plugin validation time.

Neo4j Config — user / username Alias

• The Neo4j plugin now accepts both user (0.3.0 Viper key) and username (current schema key) at runtime, ensuring existing configs work without modification.

Schema Corrections

• Neo4j: Missing "required" field — added ["uri", "user", "password"].
• Slack: app_token was missing from required alongside bot_token.
• Secrets JSON: Added "required": ["path"].

Defaults

• A2A: Disabled by default (a2a.enabled: false), matching setDefaults().