Skip to content

v0.99.33

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Sep 21:32
v0.99.33
8c80b29

Upgrade notes

  • --team-secure, and therefore --secure, now force --require-fencing-epoch.
    • Upgrade every seat's client before upgrading a team-secure hub.
    • Clients up to 0.99.32 keep the lease epoch only in the process that claimed. On an upgraded
      team-secure hub, their synapse release or commit-hook release from a new process is refused.

Added

  • Opt-in pool advertisements for fleet planning (F03 option A).

    • synapse entitlements advertise --pool ID --alias NAME shares one pool of
      the private ledger with fleet planners. It carries the alias, unit,
      capabilities and eligibility, and per window a remaining-balance bucket.
      It never carries ids, labels, credential references, products, sources or
      amounts.
    • The hub needs a proven sender, the new always-enforced
      entitlement-advertise ACL grant and a durable journal. It records the
      advertisement as an audit-only entitlement_advert journal row, which
      feeds AEF receipts and is never broadcast to seats.
    • --dry-run prints the exact payload.
    • Wire: entitlement_advert and entitlement_advert_result.

  • Peer hubs can prove their id with a signature (PEER-SIGNED-REGISTRATION).

    • synapse hub --peer-identity-key FILE --peer-identity-key-id ID signs
      every first frame this hub sends to a multi-hub peer: watch pulls,
      forwarded claims and messages, operator relays and dead-letter forwards.
      The signature is the same one a seat puts on its registration.
    • An identity-bound peer that trusts the key admits these frames without a
      client certificate. The certificate does not survive a TLS-terminating
      proxy; the signature does.
    • Read-only log pulls therefore work behind such a proxy. Mutating forwards
      still need the peer's certificate-bound serving grant.
    • The transports gain an optional signer: network_fetcher,
      forward_claim, relay_operator_action, forward_dead_letter, the
      *Peer route records and MultiHubWatch. It is keyword-only with a
      None default, so existing callers are unchanged.

  • Governed online identity enrolment (SOL4-ID-01).

    • synapse hub --identity-enrollments FILE lets an operator add or rotate
      identity keys on a live hub with synapse identity enroll, instead of
      editing the --identity-trust file and restarting. The trust file is never
      rewritten and stays authoritative for its names. The enrolled keys live in a
      hub-owned, owner-only store in the same format and load on top of the trust
      file at start-up.
    • Gates. Every request needs:
      • a cryptographically proven requester;
      • the new identity-enroll ACL grant on the name;
      • the <project>/identity-enroller role grant;
      • the name's project in --identity-enrollment-namespace (none by default);
      • a per-operator rate bound (--identity-enrollment-rate, default 10 per
        hour);
      • a durable journal.
    • Rotation is a compare-and-swap on --expected-key-id. It keeps the old
      key as revoked history and closes a live socket that proved it (code
      4018).
    • Audit. Each change writes an identity_enrollment audit trail
      (approved, then applied or not_applied) that feeds AEF receipts.
    • Revocation. synapse identity revoke revokes an enrolled key without
      a replacement, behind the same gates, and closes its live socket.
    • Wire. New wire types identity_enroll, identity_revoke and their
      _result verdicts.

  • Opt-in strict lease fencing (FENCE-01 narrow slice).

    • synapse hub --require-fencing-epoch refuses a task update, release,
      handoff or checkpoint that names no lease epoch. Previously such a
      mutation was checked only against the owner name, so a writer holding a
      superseded lease could still act by leaving the epoch out.
    • The shipped client now remembers the epoch of its own claim_granted and
      handoff_granted frames. It sends that epoch when the caller names none,
      so it passes the flag unchanged. It forgets an epoch when the release is
      granted or the task is handed to another agent.
    • The epoch also survives across processes of one identity. The CLI claims in
      one process and releases in another: synapse lock then synapse release,
      or git-claim then the commit hook.
      • SynapseAgent keeps each granted epoch in an owner-only file under
        $XDG_DATA_HOME/synapse/lease-epoch/<identity>/<hub>/<task>.
      • Every path part is escaped, so it cannot climb out of the store.
      • Writes are atomic, and failures are ignored.
      • It is on by default so no call site can forget it;
        persist_lease_epochs=False keeps it in memory.
      • Proven with the real synapse commands against a strict hub: the release
        from a second process is granted, and it is refused once the store is
        removed.
    • Proven on real hubs: an epoch-less release from a superseded writer
      succeeds by default and is refused under the flag.
    • Normative text: INV-EF-2 now states the epoch-less case; the new INV-EF-4
      covers strict fencing. The invariant registry is updated.
    • expected_version stays optional. Direct file writes remain outside hub
      fencing.
    • --team-secure (and so --secure) now forces the flag. The startup report
      lists "lease mutations fenced by epoch".
    • The first-party clients name the epoch too, so they keep working on such a
      hub.
      • TypeScript client: release(taskId, epoch?) and leaseEpoch().
      • VS Code extension: the release of the active file names the epoch.
      • Both take the epoch from their own grant. Their real-hub acceptance
        tests now run against a strict hub, and both fail without the change.

Changed

  • Claude Code plugin validated with Claude Code 2.1.284.
    • The installer's tested host, the CI host (integrity-locked npm package),
      the integration catalog and the vendor-watch matrix all move from 2.1.280.
    • 2.1.280 stays the rollback version.
    • The exact host passed the strict plugin validator, the isolated plugin
      install/upgrade/removal and the live hub claim hook journey.
    • Its 2.1.281 to 2.1.284 release notes change no surface the plugin uses.

Deprecated

  • The composite Action at the repository root (uses: anulum/synapse-channel@<tag>) is
    deprecated and warns on every run. With an empty version it installs the latest release without
    a hash.
    • Use anulum/synapse-policy-check-action
      instead. It installs one exact, hash-verified release into an isolated environment and can
      verify the release's GitHub build attestation.
    • The root Action keeps its inputs and behaviour for existing workflows.

Artifact checksums (SHA-256)

477549e85382bf7815d068df00bfbd41773cf2aea09df060d377acae655ba267  synapse_channel-0.99.33-py3-none-any.whl
bee7034e131a391fca5a3708fbeb56c6d724fcde2ed39bb47ce9de211797f5c5  synapse_channel-0.99.33.tar.gz
0363a3395085a305a9d671ead3f17d76db06414dfba1918a67205be75a3fd503  synapse-channel-v0.99.33-sbom.cdx.json
Assets 12
Loading