v0.41.0

Added

• The /health document now also reports the package version and
  uptime_seconds (alongside the existing status, hub_id, online-agent, and
  active-claim fields), so a probe can surface what is running and for how long.
  The hand-rendered Prometheus exposition is now also checked against the real
  prometheus-client parser in the test suite (a dev-only dependency), so a
  format drift is caught without taking a runtime dependency on the client.

Security

• Logs and at-rest files are tightened. A message payload logged at INFO is now
  truncated past 120 characters (with a count of what was elided), so one large
  message cannot bloat the log; and the durable event store and the relay-log
  mirror — both plaintext — are created with owner-only permissions (0o600)
  where the platform supports it, so a stray group/other reader cannot read the
  channel's content at rest.
• synapse git-hook install now bakes the absolute path of the synapse
  executable into the generated hooks (resolved from PATH at install time, or
  set explicitly with --synapse-bin), instead of invoking synapse by bare
  name, so a hook is not vulnerable to a later PATH hijack. It falls back to the
  bare name only when synapse cannot be resolved.
• Per-agent quotas bound how much state one agent can register, so a runaway or
  buggy agent cannot exhaust the hub. An agent may hold at most 128 live claims
  and 64 live resource offers; a claim or offer past the bound is refused, while
  renewing a held claim or refreshing an existing offer is always free. (Per-item
  size — a finding or capability card — is already bounded by --max-msg-kb, and
  the blackboard's progress notes by its existing retention bound.)
• The optional /metrics and /health endpoint can now require a token. With
  synapse hub --metrics --metrics-token <t> (or SynapseHub(metrics_token=...))
  both paths demand the token — presented as Authorization: Bearer <t> or a
  ?token=<t> query, compared in constant time — and answer 401 without it, so
  an exposed endpoint no longer leaks operational metadata. Without a token the
  endpoint stays open (the right default for a loopback bind); a hub that enables
  metrics on a non-loopback host with no --metrics-token now logs a warning.
• A secured hub (--token) now authenticates a connection before it learns
  anything about the channel. Previously the hub sent the WELCOME frame — which
  carries the online-agent roster and the connection count — on connect, before
  the first message was authenticated, so an unauthenticated client could read
  that metadata; and an idle unauthenticated socket held a connection slot
  indefinitely. The welcome is now withheld until the socket authenticates, and a
  secured hub closes a socket that does not send an authenticated first frame
  within --auth-timeout seconds (default 10), so an idle unauthenticated
  connection is reaped instead of consuming the --max-clients budget. An open
  (tokenless) hub is unchanged — it welcomes on connect as before.

Changed

• The scalability benchmark now measures the heap-based lease expiry honestly. It
  was still framed around the pre-0.40.0 linear claim scan (and populated claims in
  a way that bypassed the lease heap), so its numbers no longer described the code.
  It now reports the steady-heartbeat cost (near-constant in the claim count, as the
  heap intends) and the mass-expiry cost separately, and adds an event-replay
  profile (start-up rebuild cost up to 100k events). Live-hub storm scenarios are
  noted as needing an integration harness.
• File-scope path normalisation is now segment-based, so overlap detection is
  more accurate. .. segments resolve against the path (src/../tests now
  overlaps tests), duplicate slashes collapse (tests//app.py == tests/app.py),
  and a leading .. that escapes the tree root is kept literally so an out-of-tree
  path never falsely overlaps an in-tree claim. A claim that declares more than 512
  distinct paths is widened to the whole worktree rather than paying an unbounded
  pairwise-overlap cost — conservative, so a conflict is never missed.

Fixed

• Corrected two stale "Known limitations" entries in the README that 0.40.0 had
  made false: per-mutation cost is no longer linear in the active claim count (the
  lease-expiry sweep is heap-based since 0.40.0), and the hub does have an opt-in
  Prometheus /metrics + /health endpoint (added in 0.40.0). The metrics entry
  now states the opt-in, no-authentication, loopback-only posture honestly.

Upgrade notes

• No breaking API or wire changes; an in-place upgrade is safe. Two operator
  notes for a hub exposed off-loopback: a secured hub (--token) now requires
  the first frame to authenticate before it is welcomed or counted (tune the grace
  with --auth-timeout); and if you expose --metrics, set --metrics-token (or
  keep it on a loopback bind) so the endpoint does not serve metadata unauthenticated.