v0.3.0

Added

• Optional configured FastAPI feedback-router factory with typed submission,
  dispatch-result, and arm-owned status contracts. The fastapi extra covers
  this factory and the access-log admin router without adding FastAPI to
  core-library installs.

Compatibility

• Existing payload, dispatch, event, and access-log APIs remain available.
  FastAPI is now an optional dependency: core consumers keep their existing
  dependencies, while router consumers install the fastapi extra.

v0.2.1

Changed

• _is_localhost_or_tailnet (admin router origin check) now also accepts the Docker default bridge subnet (172.16.0.0/12, RFC 1918 private). Docker's default bridge networking rewrites inbound source IPs to the bridge gateway, so an admin request that originated from a tailnet client arrives at the in-container code with a Docker-private source IP. Allowing this range is safe because RFC 1918 private addresses are not routable from the public internet; they only appear as source IPs when a request originates from a container on the same host. Surfaced when Wave B was deployed to the Dockerized hub on LLT and admin endpoint returned 403 from external tailnet clients. See Wave B brief v3.1 amendment.

Added

• test_admin_docker_bridge_origin_allowed test (172.17.0.1 source → 200).

v0.2.0

Added

• Wave B HTTP observability substrate with a separate HttpEvent sink namespace.
• Pure ASGI HttpLoggingMiddleware with bounded queueing, fail-soft overflow, route-template path capture, and static content-type exclusion.
• SQLite WAL SqliteAccessLogStore with indexed filters, composite-cursor pagination, summaries, and hard retention caps.
• Hardened build_access_log_router admin factory for tenant-scoped access-log reads and summaries.
• Pydantic observability schemas with UTC timestamp validation and extra="forbid".

Security

• Admin access-log reads fail closed, require role gating, rate-limit per principal, and audit reads via the Wave A feedback-event sink.
• Query strings and request/response bodies are never persisted in access-log entries.

v0.2.0a3

No changelog entry for v0.2.0a3

v0.2.0a2

No changelog entry for v0.2.0a2

v0.2.0a6

No changelog entry for v0.2.0a6

v0.2.0a5

No changelog entry for v0.2.0a5

v0.2.0a4

Pre-release: fix_pr.py wires real OpenAI Codex for bug-kind feedback (drafts single-file fix → PR for Christian's review). Workflow now needs contents:write permission to push branches; satellites must bump their workflow files (will be done in follow-up commits per consumer).

v0.2.0a1

Pre-release: real Claude answer-draft for question-kind feedback. Other 3 skeletons (fix_pr, trinity_dispatch, sandbox_repro) still pending. Includes shared _llm_helpers.py with substrate-body parsing, prompt-injection-resistant content wrapping, and atomic status-label transitions (fixes v0.1.1 label-accumulation bug).

v0.1.1

Graceful skip when org-level LLM API keys (CODEX_API_KEY, GEMINI_API_KEY, ANTHROPIC_API_KEY) aren't yet configured in the agent-dispatch environment. Substrate ships live with zero API secrets required; automation lights up incrementally as keys are added.