v0.3.2

v0.3.2

Released 2026-08-20.

Wreath 0.3.2 adds durable organisation state and reusable application contracts,
ships Wreath's independent format-aware gzip implementation, and shortens the
native compressed-response path. Existing applications keep their current wire
formats and Python call sites unless a client explicitly advertises dcz; the
other new surfaces are opt-in additions.

Breaking changes

• A client that advertises equal-quality dcz, gzip, zstd now selects the
  prepared-response ladder: exact DCZ first, then prepared-fragment gzip, then
  format-aware gzip. To retain the previous zstd-on-tie result, give zstd a
  strictly higher q-value or omit dcz.

Added

• Contract and compile_contract compile a dataclass into a reusable,
  transport-neutral validation and native JSON codec with an explicit input and
  output size ceiling.
• ActionTokens, TokenPurpose, and the TokenLedger protocol provide bounded,
  expiring, purpose-scoped action tokens with key rotation and explicit
  single-use replay ownership. MemoryTokenLedger is included for bounded
  single-process use.
• wreath.email is now the public import surface for Wreath's existing SMTP,
  DKIM, suppression, unsubscribe, and transactional-versus-marketing mail
  declarations.
• FilterField, FilterSet, and Listing add bounded, allow-listed ORM
  filtering and reusable filtering/sorting declarations without interpreting
  arbitrary lookup suffixes or relationship paths.
• MessageEnvelope adds opt-in event identity, versioning, correlation,
  causation, and trace context. Plain message payloads retain their existing wire
  shape, and Message.envelope() distinguishes the new envelope from legacy
  payloads during rolling deployments.

Changed

• Gzip encode and decode now use Wreath's separate native kernels. The public
  gzip encoders accept an optional format or HTTP content-type hint for JSON,
  HTML, GraphQL, log-like, and plain-text policy while continuing to emit
  standard RFC 1951/1952 streams.
• DCZ still requires HTTPS and the client's exact Available-Dictionary hash;
  a response is never dictionary-compressed merely because the coding was
  advertised. All gzip fallbacks remain standard RFC 1952 streams.

Fixed

• PostgresOrganizationStore makes organisations, memberships, invitations,
  and consumed invitation state durable across workers and API restarts.
  Invitation acceptance consumes the token and writes membership atomically,
  and the store contributes its three-table schema during application startup.
• Outbound HTTP deadlines in the portable base wheel use CPython's
  cross-platform monotonic clock. This removes the direct POSIX
  clock_gettime(CLOCK_MONOTONIC, ...) call that prevented the 0.3.1 native
  core from compiling with MSVC.

Performance

• On the retained holistic operations-dashboard instruction account,
  format-aware Wreath gzip retires 4,690,494 userspace instructions per request.
  The exact-dictionary DCZ path retires 2,426,742, 48.26% fewer than that full
  Wreath request; the equivalent FastAPI stack retires 93.24 times as many. The
  harness verifies decoded response and policy facts before retaining a sample.
• A cache-policy sweep across 30 JSON, GraphQL, HTML, text, and log documents
  reduced native gzip encode instructions by 4.79%, L1D misses by 12.87%, and
  LLC misses by 52.07%. The shipped representative encoder retires 49.04
  instructions per input byte with 91.62% L1D and 93.92% LLC hit rates.
• Native protobuf, GraphQL parsing, observability, PostgreSQL, SQL, signature,
  request, and response kernels received allocation, dispatch, and duplicate-work
  cleanup while preserving their public Python APIs.

Docs & internals

• The documentation now has task-oriented capability, cookbook, reference, and
  repository maps, plus dedicated reference pages for contracts, email, and
  action tokens.
• Reproducible instruction artifacts and counter harnesses now retain ranges,
  alternating process slopes, A/A controls, decoded-output checks, and the exact
  installed comparison stacks. No wall clock, cycles, or IPC enters the headline
  compressed-request result.