v0.43.0

Added

• synapse worker prints a loud egress warning to stderr before starting whenever
  the chosen backend will send channel context off the local machine — the openai
  provider (which also forwards the API key read from --api-key-env) or any provider
  pointed at a non-loopback --base-url. Local backends start silently.
• The hub's per-agent claim and offer quotas and the per-claim declared-path cap are
  now configurable with synapse hub --max-claims-per-agent N, --max-offers-per-agent N,
  and --max-paths-per-claim N (defaults 128, 64, and 512), for test labs, large
  monorepos, and managed deployments. A claim declaring more distinct paths than the cap
  widens to own its whole worktree — conservative, so it never misses a conflict.
• A hub started on a durable log larger than --compact-hint-threshold N records
  (default 100000) now logs a one-off hint to run synapse compact. The log is never
  compacted automatically — pruning is safe only below a sequence the read-side has
  already consumed, which the hub cannot know — so this surfaces unbounded growth
  without ever dropping an unconsumed finding or checkpoint.
• Two more knobs are now reachable from the CLI: synapse hub --takeover-cooldown S
  (seconds a name is protected from a second takeover, blunting an eviction storm) and
  synapse mcp --request-timeout S (seconds the MCP bridge awaits a hub reply). Both
  carry their previous defaults.
• synapse git-hook test reports whether the auto-release post-commit / post-merge
  hooks are installed and whether the synapse executable each one invokes still
  resolves, so a missing hook or a moved binary is caught up front instead of silently
  no-opping the next time a claim should have auto-released. It exits non-zero on any gap.
• synapse hub and synapse worker configure logging on startup with
  --log-format {text,json} and --log-level LEVEL. The JSON format emits one structured
  object per line (timestamp, level, logger, message, plus any contextual fields) for log
  aggregators; human-readable text stays the default.

Security

• A declared claim path that is over-long (more than 4096 characters) or carries
  non-printable characters now widens the claim to its whole worktree rather than being
  trusted or scanned, consistent with the existing path-count bound. Claims stay
  advisory-only — the hub never reads the filesystem — so this only bounds work and noise.
• A hub can now apply a per-host frame-rate ceiling with synapse hub --host-rate N
  (and --host-burst), charging every inbound frame — heartbeats included — to a token
  bucket keyed by the connection's remote host. This bounds a single host that would
  otherwise flood the hub by cycling agent names or with bare heartbeats, independently
  of and in addition to the per-agent --rate. Off by default.
• Inbound wire frames are rejected before parsing when their array/object nesting
  exceeds 64 levels, so an adversarially deep payload (within the size cap) can no
  longer drive the JSON decoder into a RecursionError and tear down the handler.
  A frame over the depth bound is refused as malformed, like any other bad JSON.
• The SQLite event log's write-ahead-log sidecars (<db>-wal, <db>-shm) are now
  restricted to owner-only access (0o600) alongside the main database file. WAL mode
  creates them on the first write under the process umask, so they previously held the
  same plaintext chat and findings as the locked-down main file while remaining
  group/other readable.
• A token-protected GET /metrics / /health no longer accepts the token as a
  ?token= query parameter by default — only an Authorization: Bearer header —
  because a query token can leak into access logs, shell history, and proxy records.
  The query form is available opt-in with synapse hub --metrics-query-token-ok.
• A secured hub now caps the number of sockets in their pre-authentication window
  with synapse hub --max-unauth-clients N (default: same as --max-clients), so an
  authentication-stall burst cannot occupy the connection table for the whole
  --auth-timeout. A connect over the cap is closed with code 4014.

Changed

• VALIDATION.md no longer hard-codes a module count or raw statement/branch totals
  that drift as the package grows; it defers the live counts to the CI-synced README
  capability inventory and states the gate-enforced 100% coverage instead.

Upgrade notes

• No breaking API or wire changes; an in-place upgrade is safe. Every new hub knob
  (--max-claims-per-agent / --max-offers-per-agent / --max-paths-per-claim,
  --takeover-cooldown, --compact-hint-threshold) defaults to the previous behaviour.
  One default tightens for a token-secured --metrics hub: the metrics token is now
  read only from an Authorization: Bearer header unless you pass
  --metrics-query-token-ok. Inbound frames nesting deeper than 64 levels are now
  rejected as malformed, which no real Synapse envelope reaches.