PauseMesh 0.3.0-alpha.1

PauseMesh v0.3.0-alpha.1 adds shared PostgreSQL persistence for callbacks that may reach different application replicas, without widening the continuation primitive into an agent framework.

Highlights:

• optional pausemesh/postgres entry point with an externally owned pool
• explicit, checksum-validated migration; constructors perform no DDL
• transactional stream-head compare-and-swap across replicas
• bounded replay validation and append-only database guards
• host-owned ReadinessProbe and fail-closed /readyz, independent from /healthz
• PostgreSQL 17 integration CI, adversarial fake-pool tests, package-consumer smoke, ADR, and deployment runbook

Operational boundary: the deployment owns credentials, TLS, roles, migration execution, timeouts, pool lifecycle, HA, backups, and tenant authorization. The built-in CLI remains SQLite-only. The runtime database role should not have DDL, delete, or truncate privileges.

Verification: 193 regular tests, a real multi-replica PostgreSQL 17 integration test, clean tarball consumer import, three operating systems in CI, CodeQL, and an independent storage review.

PauseMesh 0.2.0-alpha.1

Experimental protocol-conformance prerelease.

Highlights

• MCP 2025-11-25 elicitation with negotiated capabilities, strict form schemas, trusted URL policy, and immutable request receipts
• A2A 1.0 task interruption with explicit server-owned task/context bindings and out-of-band authorization
• AG-UI whole-cohort interrupts with immutable receipts, deterministic idempotency, schema policy, bounded input, and CAS cancellation
• streaming HTTP payload caps before JSON parsing
• Node.js 24 built-in SQLite storage with no native database build step
• clean ESM package, migration guide, changelog, ADR, and real consumer-install smoke

Verification

• 164 tests
• 84.24% statement and 80.80% branch coverage
• Linux, macOS, and Windows CI: https://github.com/aantenore/pausemesh/actions/runs/29578302843
• CodeQL and GitGuardian green
• production dependency audit found no known vulnerabilities
• two independent P0-P2 audits found no residual issues

Compatibility

Requires Node.js 24+ and pnpm 11. The package is ESM-only. Adapter callers upgrading from 0.1 must supply explicit protocol-owned bindings; see the README migration table.

SHA-256 for the npm tarball: 7284c6560c9dd569435b1bf84aca16c1bfeb951c93b263e0f27afc7bd59d0858.