v0.7.0

Build f9f433ee, canonical digest 9de209f5e0d40b51 — sorted keys, no
whitespace, which is what check-spec-freshness.sh compares and what the
release refuses to proceed without. Against 0.6.0, the last release published
to any registry: 535 → 544 paths, 723 → 736 operations (+16, −3), 352 → 352
schemas (+3, −3).

The first v0.7.0 tag, on 2026-09-22 at build 34cc8169, published nothing:
the platform deployed 3a9d4c08 between the regeneration and the tag, and the
release job refused the stale document in its first step, before any registry
was touched. 5732283f, c5694dc0 and f9f433ee followed while the refresh
was in CI. This entry describes the second cut.

The minor moves, and that is the point. A caret under 1.0 does not cross
the minor, so ^0.6.0 admits 0.6.1 automatically and refuses 0.7.0. This
release removes exported names and adds required request fields; on a patch
those would have arrived in builds nobody touched, and the first anyone heard
of it would have been a red compile. The number is the announcement.

Removed — three operations and eighteen exported names

The SPEC-package surface is withdrawn on the platform (uarp f058b582), so
it leaves the clients:

• GET and PUT /admin/config/spec-packages, and
  POST /admin/config/spec-packages/{packageId}/stripe-price.
• Eighteen names disappear from the TypeScript models (1679 exports → 1720,
  with these gone): SpecPackage, SpecPackagePricing,
  SpecPackagePricingBillingInterval, SpecPackageIncludedInPlan,
  SpecPackageProgram, SpecPackageProgramNav, SpecPackageProgramPage,
  AdminSpecPackagesList, UpdateAdminSpecPackagesRequest,
  CreateAdminSpecPackageStripePriceResponse,
  CreateSpecPackageCheckoutSessionRequest,
  ListBillingSpecPackagesResponsePackage and its …Entitlement,
  DeleteCustomPlanForce, and the four *_VALUES consts of those enums.

GET /billing/spec-packages and its checkout do NOT leave: the withdrawal
left the list answering [] and the checkout answering 410, both marked
deprecated, and both stay generated for clients that still call them.

Changed — six operations now require body fields they did not

Breaking for any call site that compiled without them:

Operation	Newly required
POST /governance/goals	title, description, rationale, expected_impact, alignment_justification, resource_estimate_usd
POST /governance/improvement/{agentId}	title, description, rationale, changes, baseline_success_rate, failed_run_ids
POST /governance/arbiter/cases	description, rule_ids
POST /bridge/delegate	message
POST /marketplace/listings/{listingId}/subscribe	stripe_subscription_id
POST /programs/{programId}/apply	start_date

POST /a2a/tasks tightens without a new top-level field: each entry of
messages now requires role ('user' | 'agent', no longer any string) and
a non-empty parts typed as A2APart[] rather than bare objects, and the
list itself needs at least one entry. The handler refused all of these with
422 already; the types now say so before the request is sent.

The first three were unusable in 0.6.0 rather than merely under-declared:
CreateGoalRequest shipped with one field beside a doc comment naming seven,
so no client generated from that document could form a valid request. They
compile differently here because they now describe what the handler actually
demands.

Added — a failed run says why, in a field

• Run.error_code and Run.error_details, and the same pair on
  TenantOverviewRunsRecentItem — the thinner shape the fleet board reads.
  error_code is absent when the failure carries nothing to branch on, which
  is deliberate; error_details carries what the code cannot
  (retry_after_ms, quota_exhausted, stale_seconds).
• ErrorCode and ERROR_CODE_VALUES, 78 values — among the newest,
  approval_rejected for a run that stopped because a person refused its tool
  call, and kb_embedding_failed. New, not widened: 0.6.0
  declared no code on Error at all, in the tag or in the published
  tarball, so there was nothing for a client to branch on.

Until this release no generated client could learn why a run failed except by
matching English in error — a sentence with no Accept-Language behind it.

Added — the rest of the surface

• SpecToolCatalogSpec with tools_waiting and
  status: 'ready' | 'needs_connection': an installed SPEC that is waiting on
  a connection says so instead of vanishing.
• UsageQuotaCounter and its eight kinds (runs, tokens, tokens_daily,
  tool_calls, agents, teams, knowledge_bases, workspaces).
• GET|PUT /agents/{agentId}/mcp-servers with McpServerAuth — the connect
  surface between an agent and the MCP servers its tenant has installed.
• Billing: GET|PUT|DELETE /billing/budget, GET|PUT /billing/overage,
  GET /billing/promo, POST /billing/promo/redeem.
• GET /admin/data-explorer/export, POST /admin/data-explorer/import,
  POST /auth/oauth/nonce (served undocumented until uarp #487),
  GET /bridge/agent-specs, GET /companies/{companyId}/events.
• SubjectSweep, TenantSocialLinks.
• GET /agents/{agentId}/memory/core and ListCoreMemoryBlocksResponse —
  every core memory block of an agent in one call, beside the per-label routes.
• GET /agents/{agentId}/experiments and ListExperimentsResponse — an
  agent's evaluation experiments, newest first.
• InboxItem.tools (InboxItemTool): an approval row names each tool the
  run waits on, with how many calls named it, as data rather than prose.
• Run.approvals (RunApproval, decision 'approved' | 'rejected'): each
  human decision on a tool approval the run waited for, oldest first. Absent
  on runs from before 2026-09-22, when nothing was recorded.
• POST /runs/{runId}/resume takes an optional ResumeRunRequest; a string
  input.note is handed to the model as a user turn when the run continues.
• Objective.strikes_used and abort_reason, AARRootCause.code,
  AARObjectiveOutcome.abort_reason, MissionStartResponse.run_started.
• PUT /agents/{agentId}/memory/core/{label} documents 409, and the public
  session upload, respond and share routes document 410 for an agent made
  private after the session opened.

Fixed — the tooling that made the last cut cost two attempts

• scripts/update-spec.sh gains --allow-shrink "<reason>". Its guard
  correctly refuses a document smaller than the vendored copy, but its advice
  on refusal was to pass a different url, which cannot work: the guard weighs
  whatever is fetched, so the only url that satisfies it is a document stale
  enough to still carry the withdrawn surface. The override requires a reason
  and NAMES what leaves — paths, operations and schemas, each listed.
• scripts/set-version.sh now moves three things it silently left behind:
  generator/package-lock.json, the crate's own version in
  packages/rust/Cargo.lock, and the generator goldens, which bake
  SDK_VERSION in four languages. That last one is why the first v0.6.0 tag
  published nothing — 40 of 100 generator tests red at the tag, every language
  job dead before its publish step. Measured again here: 48 of 114 red
  immediately after the bump, before the refresh.
• scripts/check-prose-schema.ts reports 0 divergences over all 736
  operations.

Known

• The SwiftPM mirror is stuck at 0.5.13 (2026-08-21) because
  SWIFT_MIRROR_TOKEN expired; 0.5.15, 0.5.21, 0.5.24 and 0.6.0 never reached
  it. Swift consumers do not get this release until that token is reissued —
  this is not something the tag can fix.
• examples/react-landing still asks for uarp-sdk: ^0.6.0. It cannot ask
  for ^0.7.0 before 0.7.0 exists on npm, so that bump follows the publish
  rather than preceding it.