v0.5.0

cleat 0.5.0

See the CHANGELOG for full details.

Downloads

cleat and cleat-gen: Linux and macOS, amd64 + arm64.

cleat-worker: Linux only (amd64 + arm64). The worker requires CGO for
the wasmtime runtime, so there is no cross-compiled macOS build. On macOS,
install it from source with

go install github.com/cleat-team/cleat/cmd/cleat-worker@latest

or use the Docker image. Every published cleat-worker binary is executed
with --verify-backend before release.

Known issue: the Go module checksum

The v0.5.0 tag was re-pointed from fe052198 to 8f9a59b4 after the first release run failed on a stale dashboard bundle (#3467, #3471). By then, proxy.golang.org had cached github.com/cleat-team/cleat@v0.5.0 from fe052198, and sum.golang.org had recorded its checksum. Neither record can be changed.

• Through the default proxy, go get and go install …@v0.5.0 resolve to fe052198. It differs only in the embedded dashboard bundle, which was built from the same source by an older toolchain.
• With GOPROXY=direct and the checksum database on, go stops with verifying module: checksum mismatch … SECURITY ERROR. Fetch v0.5.0 through the proxy.
• Two hashes are expected. The proxy's tree is h1:d14Li81arnskubHoHeQa4QxoS91dOR+3mSBHKyccLkw=; the re-pointed tag's tree is h1:+CPzCpD2346iAGAmzIHcJZeadwPKdR5deZ0jp6mTW2Q=. If a go.sum holds the second (for example, written on a machine that fetched directly), a proxy user fails the same way. Replace that line with the first. Any other hash is not this issue.
• The binaries, .deb packages, container image, Homebrew formula and Helm chart on this page are built from 8f9a59b4. The cleat/v0.5.0 module is tagged only after this re-point, so it is not affected.

Changelog

• fe05219 Release v0.5.0 (#3466)
• 8f9a59b Release v0.5.0 (re-point: rebuilt dashboard bundle, D31) (#3471)
• 275a689 build(deps): Bump body-parser in /examples/order-lifecycle-dbos-port (#3382)
• 5ca861b build(deps): Bump ip-address (#3381)
• 95e3086 build(deps): Bump source-map-js from 1.2.1 to 1.2.2 in /web (#3163)
• b99185b build(deps): Bump the go-minor-and-patch group across 1 directory with 2 updates (#3367)
• eaab441 build(deps): Bump the go-minor-and-patch group across 1 directory with 4 updates (#3352)
• b553b22 build(deps-dev): Bump fast-uri from 3.1.8 to 3.1.9 in /packages/cleat-as (#3380)
• 7a31f7e build(deps-dev): Bump the web-toolchain group across 1 directory with 3 updates (#3350)
• abdcf3c build(deps-dev): Bump the web-toolchain group across 1 directory with 3 updates (#3366)
• e675673 build(deps-dev): Bump vite (#3414)
• da4b385 build(deps-dev): Update ruff requirement in /python-sdk (#3351)
• e5d635d build: bump Go toolchain to go1.27.2 and golang.org/x/net to v0.60.0 (cleat#3251) (#3256)
• b567919 chore(migrations): re-compact migrations/mysql/ to a fresh three-file baseline (#3353)
• a020296 chore(migrations): re-compact migrations/postgres/ to a fresh three-file baseline (#3358)
• c8ccaed chore(release): back-merge main into develop after v0.4.0 (#3190)
• 83dd092 chore(release): back-merge main into develop — carry the cleat/v0.4.0 module-tag commits (#3199)
• 0466f48 chore(release): fold the CHANGELOG into 0.5.0 and move the SDK manifests to 0.5.0 (#3456)
• eb707d3 ci(develop-image): an rc-* image is published only from a commit that was reviewed (cleat#3398) (#3415)
• b09ee56 ci(develop-image): publish cleat-worker:rc- from release/** branches (cleat#3398) (#3410)
• 4b90361 ci(multi-db): raise the MySQL and SQL Server engine test timeout to 1800s (#3459)
• 54aa0f8 ci(upgrade): seed a database with the published v0.4.0 and assert the RC refuses it and serves a fresh one (cleat#3386) (#3407)
• e403af3 docs(ci): the benchmarks job header no longer stores a trend artifact (#3215)
• 3a21785 docs(engine): close out cleat#2139's remaining question with two measurements (#3221)
• db700c6 docs(engine): correct two guard-coverage comments in mssql_schedules.go (#3293)
• 58c4d64 docs(engine): record that the tenant-predicate guard does not recurse into subqueries (#3297)
• 7983bcd docs(how-to): join the two timeout tests now that v0.4.0 ships WaitForParked (cleat#3098) (#3201)
• 9cd79ef docs(lint): document gosec's package-wide taint analysis vs per-file _test.go exclusion (cleat#3239) (#3265)
• 317c919 docs(lint): explain and document gosec's G701 CHA-caller-order non-determinism (cleat#3247) (#3270)
• c05f7ea docs(plan): 3.212 is FIXED (five wired, two composed); 3.317 names the PR that landed it (cleat#3245) (#3417)
• 70ab703 docs(scripts): correct gen-mysql-baseline.py's stale collation claim (cleat#3219) (#3220)
• e6cfb28 docs(tiers): B5b merged, and SQL Server's "needs no grant" is now measured (cleat#3441) (#3451)
• ddde898 docs(tiers): cross-tenant-claim and cross-tenant-schedules describe rotation, not admin.claim_workflows (cleat#3441) (#3445)
• 82d19bb docs(tiers): reclassify formal-specs from tier 3 to tier 2 (cleat#2708) (#3233)
• ef23248 docs(tutorials): the Homebrew tap now serves v0.4.0, resolving cleat#3065 (#3227)
• 374042d docs(workstream): retire the dead golangci-lint v1/GOTOOLCHAIN=go1.25.11 caveat (#3267)
• b47d009 feat(backendkit): UpdateWorkflow, CancelWorkflow, StreamWorkflow and an API-key option (cleat#3368) (#3388)
• 08ab4e1 feat(ci): publish cleat-worker:develop- on every push to develop (cleat#3370) (#3373)
• 03cf812 feat(ci): split Tier 1 Gate's rest shard, extending engine's sharding to it (#3308)
• a09759d feat(ci): wire scripts/check-pr-routed-sha.py into the Lint job (#3300)
• 55760e3 feat(cleat-worker): --enable-workflow-fetch serves cleat_fetch through the egress guard (cleat#3377) (#3404)
• ad46140 feat(cleatctl): reseal-payloads re-seals the six tables cleat#2312 added (cleat#3241) (#3250)
• 81fdd89 feat(cmd/cleat): add agent-workflow template (#3194)
• eb15038 feat(cmd/cleat-worker): CORS allowlist for the HTTP API (cleat#2345) (#3282)
• f83a199 feat(cmd/cleat-worker): file-sourced version numbers for the payload key ring (cleat#3203) (#3229)
• a5a57ca feat(cmd/cleat-worker): wire SIGHUP to reload secret and payload key rings (cleat#2298, PR 2/2) (#3205)
• 4e51b70 feat(engine): add concurrency_key/parent_workflow_id/run-limit columns to workflow_leases (cleat#3245 piece B blocker) (#3334)
• d66cf3f feat(engine): cleat#3245 Phase 3 step 1 -- workflow_leases and workflow_payloads (schema only) (#3280)
• 2021087 feat(engine): cleat#3245 Phase 3 step 2 piece 1 -- startNewRun dual-writes workflow_leases/workflow_payloads (#3298)
• e1d883b feat(engine): cleat#3245 Phase 3 step 2 piece 2 -- claim/release dual-write workflow_leases (#3299)
• 095ede1 feat(engine): cleat#3245 Phase 3 step 2 piece 3 -- heartbeat dual-write workflow_leases (#3302)
• 7c444c1 feat(engine): cleat#3245 Phase 3 step 2 piece 4a -- completion family dual-write workflow_leases/workflow_payloads (#3303)
• 70470cf feat(engine): cleat#3245 Phase 3 step 2 piece 4b -- finalize_workflow_status dual-write via migration 017 (#3304)
• 2daca2c feat(engine): cleat#3245 Phase 3 step 2 piece 4c -- RetryWorkflow/AdminReReplay/admin-force/terminate dual-write (#3305)
• 90bef3a feat(engine): cleat#3245 Phase 3 step 2 piece 4d -- ContinueAsNew dual-write (#3306)
• 3ffbc26 feat(engine): cleat#3245 Phase 3 step 2 piece 5a -- signal delivery dual-write (#3310)
• 4532eed feat(engine): cleat#3245 Phase 3 step 2 piece 5b -- promise delivery dual-write (#3312)
• 1013273 feat(engine): cleat#3245 Phase 3 step 2 piece 6a -- sticky worker dual-write (#3322)
• 9c013c3 feat(engine): cleat#3245 Phase 3 step 2 piece 6b -- reclaim dual-write (#3323)
• c58772b feat(engine): cleat#3245 Phase 3 step 2 piece 6c -- defer-phase mark-side dual-write (#3324)
• 670c3d3 feat(engine): cleat#3245 Phase 3 step 3 piece A -- heartbeat staleness reads from workflow_leases (#3331)
• 2fdfd1d feat(en...

v0.4.0

cleat 0.4.0

See the CHANGELOG for full details.

Downloads

cleat and cleat-gen: Linux and macOS, amd64 + arm64.

cleat-worker: Linux only (amd64 + arm64). The worker requires CGO for
the wasmtime runtime, so there is no cross-compiled macOS build. On macOS,
install it from source with

go install github.com/cleat-team/cleat/cmd/cleat-worker@latest

or use the Docker image. Every published cleat-worker binary is executed
with --verify-backend before release.

Changelog

• f314b4c Release v0.4.0
• fdf9285 build(deps): Bump the go-minor-and-patch group across 1 directory with 7 updates (#3158)
• 7abb69a build(deps): bump actions/download-artifact from 7 to 8 (#2836)
• f906e8e build(deps): bump actions/setup-go from 6 to 7 (#2092)
• 1a70425 build(deps): bump actions/setup-go from 6 to 7 (#2835)
• c9483c5 build(deps): bump azure/setup-helm from 4 to 5 (#2837)
• ae57678 build(deps): bump the go-minor-and-patch group across 1 directory with 5 updates (#2600)
• 0765f80 build(deps-dev): Bump the web-toolchain group across 1 directory with 2 updates (#3157)
• e496b98 build(deps-dev): bump @sveltejs/vite-plugin-svelte (#2599)
• b39a9c5 build(deps-dev): bump brace-expansion in /packages/cleat-as (#2752)
• 4aed654 build(deps-dev): bump fast-uri from 3.1.6 to 3.1.8 in /packages/cleat-as (#2611)
• 76d4fb8 build(deps-dev): bump the web-toolchain group across 1 directory with 3 updates (#2598)
• 0ec0ffd chore(ci): Test Python 3.12 and 3.13 are required checks, and 3.10/3.11 say why not (#2580)
• f1c3825 chore(release): back-merge main into develop after v0.3.2 (cleat#2058) (#2499)
• cec3791 chore(release): back-merge main into develop — lineage, after the first was squashed (cleat#2058) (#2500)
• a8b6bc0 chore(release): fold CHANGELOG and bump SDK manifests to 0.4.0 (cleat#3181) (#3182)
• 25cbe0d ci(multi-db): add check-skip-budget steps to multi-db-ci.yml (part of cleat#2444) (#2686)
• ea7b9b3 ci(plugin-harness): upload Layer 3 -- Multi-DB's test-report.json (cleat#2661) (#2682)
• 6270200 ci(scripts): guard the documentation surfaces against the bare @cleat_entry form (cleat#3119) (#3125)
• 30a75ed ci(tier1-gate): skip tier1-coverage/engine/rest entirely on merge_group (#2766)
• e3c9b46 docs(auth): anchor the CodeQL disposition on the rule id, not an alert number (#2593)
• e8f7f5b docs(changelog): fold [Unreleased] into 0.3.0, and stop citing deleted migrations (#2558)
• 7485400 docs(changelog): scheduledbackup's DSN migration previously worked, not failed silently (#2765)
• 7c5f7d8 docs(claude): a title/body-only PR edit no longer cancels its in-flight run (#2785)
• 49c73f7 docs(claude): the -p 1 rule has a second reason, recorded (#2507)
• 8e7739a docs(claude): the body-edit rule does not extend to a merged PR (#2502)
• 5dd08b6 docs(cleat-worker): record the deferral decision for knownBrokenPluginDown repairs (cleat#2739) (#2768)
• 70026bc docs(cmd): the schema-sidecar comments cite a test file that has never existed (#2990)
• 2c09cf3 docs(cmd/cleat,engine): the SDK submodule is tagged, so the "never been tagged" claims are history (cleat#3078) (#3084)
• df05834 docs(cmd/cleat-worker): the list-filter enumeration is CALLER-SETTABLE filters (cleat#3019) (#3052)
• 1958fc6 docs(contributing): raise engine test timeouts to match measured reality (cleat#2252) (#2832)
• f55a6ee docs(contributor): a verify step's duration is the reading its conclusion cannot give (#2451)
• cf4e313 docs(debug-workflows): the watch-mode exit list had two conditions that are not exits (cleat#3027) (#3088)
• f8b7141 docs(deploy-workflows): the lock file is not maintained by hand (cleat#3027) (#3030)
• d0b69f2 docs(deploy-workflows): three dead links, a byte count, and the rollback pin (cleat#3027) (#3089)
• e146f32 docs(durable-calls,worker-config): give the MySQL time_zone pin a concrete DSN syntax (#2935)
• 46394c9 docs(engine): claimWorkflowsOnce's doc comment is #1926-stale (cleat#2780) (#2784)
• 89f84dc docs(examples): all three DBOS ports pin 5.2.11, and two files still said otherwise (#3043)
• 7065700 docs(examples): fix stale Saga compensation-error comment (cleat#2519) (#2713)
• 6f87432 docs(examples): fix third-party-plugin's header contradicting its own ABI-layer comment (#2843)
• 0abd027 docs(examples): re-base DX_COMPARISON's DBOS column onto the functional API (#3021)
• 336b516 docs(examples): stop DX_COMPARISON.md stating closed gaps as open, and two DBOS contradictions (cleat#2996) (#3017)
• 76609e9 docs(operations): a cleat deploy registers a definition for one tenant (#2719)
• 1e79a05 docs(plan): give the component out-pointer state its own heading (§3.267) (#3061)
• 9311fd5 docs(playbook): the ingest route's event type is a header (#2563)
• aee5780 docs(playbooks): the B2B "one binary" claim is a product story, not a process count (cleat#2670) (#2953)
• 9d98685 docs(playbooks): the routes hitch point names plugin.Router, not *http.ServeMux (#2514)
• 1db7e35 docs(plugin): SecretOnlyFields covers input only -- document what protects output (cleat#2587) (#2594)
• 7c15e2a docs(plugin): cite cleat#1611 on the three oauthprovider trace-debt entries (#2823)
• 0ba61d9 docs(plugin): correct a stale "SQL Server does not have admin.plugin_tables" claim, audit its readers (cleat#2238) (#2816)
• 76c4728 docs(plugin-security),plugin: the registry IS populated, and the claim it is not is load-bearing in two places (#3093)
• 0ff0109 docs(plugins): fix RegisterRoutes example signature (cleat#2619) (#2707)
• 5c2092e docs(plugins): fix stale Environment block, add a wrong-field guard (#2844)
• 311dce7 docs(plugins): fix use-plugins.md's rejected err.Error() construct (cleat#2516) (#2790)
• 9087d35 docs(plugins): the tenant-isolation docs named a table and a function that do not exist (#3082)
• 128f2a5 docs(python-sdk): the README's examples use the preferred decorator form (cleat#3015) (#3116)
• 8db5c1d docs(python-sdk,migration): use the parenthesised @cleat_entry form at the sites a reader copies (cleat#3115) (#3118)
• 3cea6d2 docs(quick-start): audit corrections from running the guide (cleat#3027) (#3066)
• 69a0ca7 docs(reference): state both mysql:// failure shapes, and what the tools now do (cleat#3067) (#3074)
• c5e67dc docs(release): homebrew-bump has two failures, only one of which is a rotation (cleat#2498) (#2504)
• 8395ac2 docs(release): read the enqueue from the queue, not from the command's output (#2537)
• 6bf43b4 docs(release): read the queue as a queue, and what its refs and runs mean (#2557)
• 6dfbcb5 docs(release): the back-merge flip precedes the ENQUEUE, not the merge (#2503)
• 4e237d6 docs(release-process): point version-string check at the SDK agreement script (cleat#2454) (#2715)
• 03a68ad docs(rotate-payload-encryption-key): cleat#2311 is fixed, and this section rests on it (cleat#3027) (#3092)
• ca3ddda docs(sdk): the compatibility rule for cleat/pluginclients (cleat#2597) (#2671)
• 9b43d9d docs(signals-and-human-loop): repair the AwaitSignals examples, and un-exclude the doc (cleat#3079) (#3094)
• b0ea5cb docs(test-workflows): join the one example a join can fix, and name the two it cannot (#3104)
• d73e9eb docs(test-workflows): join the workflow goroutine instead of sleeping at it (#3096)
• 34b5ee7 docs(test-workflows): paraphrase the harness comment, don't quote a sentence of it (cleat#3098) (#3130)
• eb76d34 docs(test-workflows): the timeout pair is blocked on the released SDK, not the harness (cleat#3098) (#3126)
• d9d7b3d docs(test-workflows): two published examples did not compile (cleat#3027...

v0.3.2

cleat 0.3.2

See the CHANGELOG for full details.

Downloads

cleat and cleat-gen: Linux and macOS, amd64 + arm64.

cleat-worker: Linux only (amd64 + arm64). The worker requires CGO for
the wasmtime runtime, so there is no cross-compiled macOS build. On macOS,
install it from source with

go install github.com/cleat-team/cleat/cmd/cleat-worker@latest

or use the Docker image. Every published cleat-worker binary is executed
with --verify-backend before release.

Changelog

• 5eac2aa chore(release): every manifest version becomes 0.3.2
• b43b1f2 chore(release): every manifest version becomes 0.3.2 (#2491)
• e15d485 fix(release): make a failed release run recoverable (cleat#2488) (#2490)

v0.3.1

cleat 0.3.1

See the CHANGELOG for full details.

Downloads

cleat and cleat-gen: Linux and macOS, amd64 + arm64.

cleat-worker: Linux only (amd64 + arm64). The worker requires CGO for
the wasmtime runtime, so there is no cross-compiled macOS build. On macOS,
install it from source with

go install github.com/cleat-team/cleat/cmd/cleat-worker@latest

or use the Docker image. Every published cleat-worker binary is executed
with --verify-backend before release.

Changelog

• bd196ae chore(release): every manifest version becomes 0.3.1
• ecbf376 chore(release): prepare v0.3.1 — the stale web bundle and every manifest at 0.3.1 (#2486)
• e5c2700 fix(web): rebuild the stale worker dashboard bundle

v0.2.0

cleat 0.2.0

See the CHANGELOG for full details.

Downloads

Pre-built binaries for Linux and macOS (amd64 + arm64) are attached below.

Changelog

• 467a689 Merge develop into main: cumulative pipeline implementation and refactor fixes
• 97abac8 feat(operations): operations readiness — benchmarks, event cap, WASM cache, fuel metering, plugin isolation, check-db (#5)
• fb4347d release: v0.2.0 — the first installable release (#462)