v0.4.0

cleat 0.4.0

See the CHANGELOG for full details.

Downloads

cleat and cleat-gen: Linux and macOS, amd64 + arm64.

cleat-worker: Linux only (amd64 + arm64). The worker requires CGO for
the wasmtime runtime, so there is no cross-compiled macOS build. On macOS,
install it from source with

go install github.com/cleat-team/cleat/cmd/cleat-worker@latest

or use the Docker image. Every published cleat-worker binary is executed
with --verify-backend before release.

Changelog

• f314b4c Release v0.4.0
• fdf9285 build(deps): Bump the go-minor-and-patch group across 1 directory with 7 updates (#3158)
• 7abb69a build(deps): bump actions/download-artifact from 7 to 8 (#2836)
• f906e8e build(deps): bump actions/setup-go from 6 to 7 (#2092)
• 1a70425 build(deps): bump actions/setup-go from 6 to 7 (#2835)
• c9483c5 build(deps): bump azure/setup-helm from 4 to 5 (#2837)
• ae57678 build(deps): bump the go-minor-and-patch group across 1 directory with 5 updates (#2600)
• 0765f80 build(deps-dev): Bump the web-toolchain group across 1 directory with 2 updates (#3157)
• e496b98 build(deps-dev): bump @sveltejs/vite-plugin-svelte (#2599)
• b39a9c5 build(deps-dev): bump brace-expansion in /packages/cleat-as (#2752)
• 4aed654 build(deps-dev): bump fast-uri from 3.1.6 to 3.1.8 in /packages/cleat-as (#2611)
• 76d4fb8 build(deps-dev): bump the web-toolchain group across 1 directory with 3 updates (#2598)
• 0ec0ffd chore(ci): Test Python 3.12 and 3.13 are required checks, and 3.10/3.11 say why not (#2580)
• f1c3825 chore(release): back-merge main into develop after v0.3.2 (cleat#2058) (#2499)
• cec3791 chore(release): back-merge main into develop — lineage, after the first was squashed (cleat#2058) (#2500)
• a8b6bc0 chore(release): fold CHANGELOG and bump SDK manifests to 0.4.0 (cleat#3181) (#3182)
• 25cbe0d ci(multi-db): add check-skip-budget steps to multi-db-ci.yml (part of cleat#2444) (#2686)
• ea7b9b3 ci(plugin-harness): upload Layer 3 -- Multi-DB's test-report.json (cleat#2661) (#2682)
• 6270200 ci(scripts): guard the documentation surfaces against the bare @cleat_entry form (cleat#3119) (#3125)
• 30a75ed ci(tier1-gate): skip tier1-coverage/engine/rest entirely on merge_group (#2766)
• e3c9b46 docs(auth): anchor the CodeQL disposition on the rule id, not an alert number (#2593)
• e8f7f5b docs(changelog): fold [Unreleased] into 0.3.0, and stop citing deleted migrations (#2558)
• 7485400 docs(changelog): scheduledbackup's DSN migration previously worked, not failed silently (#2765)
• 7c5f7d8 docs(claude): a title/body-only PR edit no longer cancels its in-flight run (#2785)
• 49c73f7 docs(claude): the -p 1 rule has a second reason, recorded (#2507)
• 8e7739a docs(claude): the body-edit rule does not extend to a merged PR (#2502)
• 5dd08b6 docs(cleat-worker): record the deferral decision for knownBrokenPluginDown repairs (cleat#2739) (#2768)
• 70026bc docs(cmd): the schema-sidecar comments cite a test file that has never existed (#2990)
• 2c09cf3 docs(cmd/cleat,engine): the SDK submodule is tagged, so the "never been tagged" claims are history (cleat#3078) (#3084)
• df05834 docs(cmd/cleat-worker): the list-filter enumeration is CALLER-SETTABLE filters (cleat#3019) (#3052)
• 1958fc6 docs(contributing): raise engine test timeouts to match measured reality (cleat#2252) (#2832)
• f55a6ee docs(contributor): a verify step's duration is the reading its conclusion cannot give (#2451)
• cf4e313 docs(debug-workflows): the watch-mode exit list had two conditions that are not exits (cleat#3027) (#3088)
• f8b7141 docs(deploy-workflows): the lock file is not maintained by hand (cleat#3027) (#3030)
• d0b69f2 docs(deploy-workflows): three dead links, a byte count, and the rollback pin (cleat#3027) (#3089)
• e146f32 docs(durable-calls,worker-config): give the MySQL time_zone pin a concrete DSN syntax (#2935)
• 46394c9 docs(engine): claimWorkflowsOnce's doc comment is #1926-stale (cleat#2780) (#2784)
• 89f84dc docs(examples): all three DBOS ports pin 5.2.11, and two files still said otherwise (#3043)
• 7065700 docs(examples): fix stale Saga compensation-error comment (cleat#2519) (#2713)
• 6f87432 docs(examples): fix third-party-plugin's header contradicting its own ABI-layer comment (#2843)
• 0abd027 docs(examples): re-base DX_COMPARISON's DBOS column onto the functional API (#3021)
• 336b516 docs(examples): stop DX_COMPARISON.md stating closed gaps as open, and two DBOS contradictions (cleat#2996) (#3017)
• 76609e9 docs(operations): a cleat deploy registers a definition for one tenant (#2719)
• 1e79a05 docs(plan): give the component out-pointer state its own heading (§3.267) (#3061)
• 9311fd5 docs(playbook): the ingest route's event type is a header (#2563)
• aee5780 docs(playbooks): the B2B "one binary" claim is a product story, not a process count (cleat#2670) (#2953)
• 9d98685 docs(playbooks): the routes hitch point names plugin.Router, not *http.ServeMux (#2514)
• 1db7e35 docs(plugin): SecretOnlyFields covers input only -- document what protects output (cleat#2587) (#2594)
• 7c15e2a docs(plugin): cite cleat#1611 on the three oauthprovider trace-debt entries (#2823)
• 0ba61d9 docs(plugin): correct a stale "SQL Server does not have admin.plugin_tables" claim, audit its readers (cleat#2238) (#2816)
• 76c4728 docs(plugin-security),plugin: the registry IS populated, and the claim it is not is load-bearing in two places (#3093)
• 0ff0109 docs(plugins): fix RegisterRoutes example signature (cleat#2619) (#2707)
• 5c2092e docs(plugins): fix stale Environment block, add a wrong-field guard (#2844)
• 311dce7 docs(plugins): fix use-plugins.md's rejected err.Error() construct (cleat#2516) (#2790)
• 9087d35 docs(plugins): the tenant-isolation docs named a table and a function that do not exist (#3082)
• 128f2a5 docs(python-sdk): the README's examples use the preferred decorator form (cleat#3015) (#3116)
• 8db5c1d docs(python-sdk,migration): use the parenthesised @cleat_entry form at the sites a reader copies (cleat#3115) (#3118)
• 3cea6d2 docs(quick-start): audit corrections from running the guide (cleat#3027) (#3066)
• 69a0ca7 docs(reference): state both mysql:// failure shapes, and what the tools now do (cleat#3067) (#3074)
• c5e67dc docs(release): homebrew-bump has two failures, only one of which is a rotation (cleat#2498) (#2504)
• 8395ac2 docs(release): read the enqueue from the queue, not from the command's output (#2537)
• 6bf43b4 docs(release): read the queue as a queue, and what its refs and runs mean (#2557)
• 6dfbcb5 docs(release): the back-merge flip precedes the ENQUEUE, not the merge (#2503)
• 4e237d6 docs(release-process): point version-string check at the SDK agreement script (cleat#2454) (#2715)
• 03a68ad docs(rotate-payload-encryption-key): cleat#2311 is fixed, and this section rests on it (cleat#3027) (#3092)
• ca3ddda docs(sdk): the compatibility rule for cleat/pluginclients (cleat#2597) (#2671)
• 9b43d9d docs(signals-and-human-loop): repair the AwaitSignals examples, and un-exclude the doc (cleat#3079) (#3094)
• b0ea5cb docs(test-workflows): join the one example a join can fix, and name the two it cannot (#3104)
• d73e9eb docs(test-workflows): join the workflow goroutine instead of sleeping at it (#3096)
• 34b5ee7 docs(test-workflows): paraphrase the harness comment, don't quote a sentence of it (cleat#3098) (#3130)
• eb76d34 docs(test-workflows): the timeout pair is blocked on the released SDK, not the harness (cleat#3098) (#3126)
• d9d7b3d docs(test-workflows): two published examples did not compile (cleat#3027) (#3086)
• b24ba16 docs(testdata): the pytyped fixture said the bare @cleat_entry form was broken; #2985 fixed it (#3014)
• eba04ea docs(tiers): fix stale formal-specs entry — TLC does run (#2709)
• 555cfa4 docs(use-plugins): the install path is unwired, and the bundled/installed split was inverted (cleat#3027) (#3085)
• de62867 docs(worker): fix a false claim that BatchHeartbeat is still live (#2781)
• 0809c59 docs(worker-config): give MySQL's --db example the bare DSN form, not mysql:// (#2961)
• 953dfbf docs(workstream): R11 — routing is two acts, and the coordinator is not the lane (cleat#3007) (#3037)
• 86e60e0 docs(workstream): the clone's git identity is a placeholder and only the CLA notices (#2495)
• 5cd0667 docs(workstream): the clone's identity is no longer a placeholder (#2556)
• 1776da3 docs(workstream): the shared-files table names the skip-ledger directory, not only the single file (#2981)
• 6f4d42b docs(your-first-workflow): the walkthrough does not run as written (cleat#3027) (#3068)
• d502242 docs+ci: guard the DBOS pair's README line counts against its own counter (#2623)
• 4519c32 examples: build the ai-agent-platform scenario, and fix the two defects it found (#2574)
• b15272e examples: run the integration-hub scenario on MySQL and SQL Server too (#2560) (#2566)
• 43068c6 examples: run the integration-hub scenario, with its app and its page (#2552)
• 63f24b3 examples: run the order-lifecycle scenario on MySQL and SQL Server, not just PostgreSQL (#2560) (#2565)
• 41f1855 feat(agentworkflow): a budget ceiling, tenant echo and artifact write (cleat#3022, part A) (#3025)
• 95c4be3 feat(agentworkflow): a configurable tool-error mode and an approval-gate tool kind (cleat#3022, part B) (#3029)
• 2682ddf feat(auditlog): close record_event's AtLeastOnce residual by default (cleat#2618) (#2624)
• fd9584d feat(auditlog): convert record_event to plugin.RegisterTyped, add its typed client (#2712)
• c306b19 feat(auditlog): record_event host function for cleat#2534 Stage 2 (#2616)
• ee3c5c9 feat(auth,cmd): an operator credential confined to /api/admin/* (cleat#2169) (#2982)
• 5af2f9f feat(auth,engine,cleatctl): per-tenant operator opt-in for the public exposure class (cleat#1986) (#3148)
• 22b73e7 feat(auth,plugin): a tenant-lifecycle capability grant, and its first use (#2590)
• fa8ce33 feat(backendkit): a method for a plugin's own HTTP routes (#2562)
• 00af795 feat(catalogdiff): compare column collation on every dialect (cleat#2882) (#3121)
• f53b693 feat(ci): a claim about a required check must name it, and the claim is then tested (#2530)
• dc82445 feat(ci): a job restricted away from pull requests must say why (#2531)
• 2a02ab1 feat(ci): advisory check for a PR that declares no closing reference (cleat#1962) (#3180)
• e957224 feat(ci): check that a client generated from /api/openapi.json refuses a misspelled call (cleat#2972) (#2986)
• 2cd2948 feat(ci): check the playbooks' live "still to build" claims against the tracker (cleat#2603) (#3109)
• feea90a feat(ci): guard against a local package's package-lock.json drifting from its package.json (#2585)
• 512edac feat(ci): guard that every Lint job step carries the if: always()/wrapper shape (#2912)
• e76f09f feat(ci): guard that every MSSQL MERGE carries HOLDLOCK or a recorded exemption (#2909)
• 2827d47 feat(ci): wire check-sdk-version-agreement.py --self-test into Lint (cleat#3184) (#3186)
• de221b9 feat(cleat)!: ship the agent loop as a workflow (cleat#1983) (#2979)
• 44701fe feat(cleat): a saga publishes its own query state (cleat#2627 half i) (#2951)
• 9beb8ca feat(cleat-worker): declarative ambiguity resolution via --ambiguity-lookup (#2891)
• 85243ea feat(cleat/agentworkflow): a declarative tool can map its own arguments (cleat#3169) (#3174)
• 7f82b16 feat(cleat/agentworkflow): the approval gate reports that it is waiting (cleat#3170) (#3172)
• 1c7752c feat(cmd/cleat,wasm): a workflow declares its exposure class in source (cleat#1986 slice 2c-i) (#3031)
• 032f21b feat(cmd/cleat-mcp): expose deployed workflows as MCP tools, gated by the exposure classes (#3011)
• 9a8708f feat(cmd/cleat-worker): an internal workflow definition is not reachable over HTTP (cleat#1986 slice 2b) (#3002)
• 6236d22 feat(cmd/cleat-worker): wire the reaper to cleat#2196's veto channel (4/4) (#2946)
• 976346a feat(cmd/cleat-worker): worker-to-worker auth + /internal/holds listener (cleat#2196) (#2934)
• fe21eea feat(cmd/cleat-worker,docs): an operator credential can act on a named tenant (cleat#2169) (#3012)
• 287e9d2 feat(docs): a guard for documented calls that name a method which does not exist (#2529)
• 2309f86 feat(engine): StaleHolderReaper -- list and exclude-on-reclaim for stale runs (cleat#2196, 1/4) (#2926)
• 7811095 feat(engine): a blocking durable wait for external events (cleat#2998) (#3049)
• 7719033 feat(engine): pod addressability for reaper-to-worker veto channel (cleat#2196) (#2930)
• c6f0ee8 feat(engine): workflow_defs gets a closed exposure class (cleat#1986, slice 1) (#2888)
• 681b337 feat(engine,build): typed invocation part 1 — JSON Schema emitter + storage (cleat#1980) (#2892)
• 14ab08d feat(engine,cmd): the deploy paths honour a source-declared exposure class (cleat#1986 slice 2c-ii) (#3033)
• e593e3d feat(engine,cmd): validate start input against the definition's schema (cleat#1981) (#2927)
• 795f325 feat(engine,cmd): wire the tenant public-exposure opt-in into enforcement (cleat#1986) (#3154)
• b9f0e81 feat(engine,cmd/cleat-worker): exclude internal definitions in the query, not after paging (cleat#3009) (#3016)
• c66ecac feat(engine,cmd/cleat-worker): same-key idempotency replay for ambiguous calls (#2911)
• 07bf078 feat(engine,cmd/cleatctl): carry a definition's exposure class through the stores (cleat#1986) (#2989)
• 4573d1b feat(eventtriggers): add Keys to awaitEventInput and correlate the claim query (cleat#2625 P1 read side) (#2668)
• e93c099 feat(eventtriggers): key slots and correlation groundwork (P1 of event routing design) (#2646)
• ddd991f feat(examples): DBOS pair for the integration-hub wedge -- a boundary DBOS does not have (#2621)
• e06aed8 feat(examples): executed DBOS counterpart for order-lifecycle (cleat#2597) (#2607)
• 73d70f1 feat(examples): run the order-lifecycle scenario end to end in CI (#2512) (#2523)
• a41365c feat(examples): the b2b-saas-control-plane DBOS counterpart, run end to end (cleat#2681) (#2954)
• b6fb97b feat(examples): the b2b-saas-control-plane scenario, run end to end (#2716)
• 1679470 feat(examples): the wedge -- a tenant's own uploaded step, and its sandbox refusal (cleat#2597) (#2617)
• fa1bf57 feat(examples/ai-agent-platform): migrate onto the shipped agent workflow (#3176)
• 85dafe1 feat(hooks): refuse a push whose branch name is outside the six prefixes (#3013)
• 0cfe41e feat(integration-hub): a bilateral infinite-loop tenant behaviour (cleat#2628) (#2638)
• 39711bb feat(migrations): MySQL and SQL Server get a least-privilege cleat_app login (cleat#2203) (#2929)
• 40e7d94 feat(plugin): add Step and RunID to plugin.CallContext (#2618)
• 5dc0429 feat(plugin): declare every plugin.ForTenant call site (cleat#2164) (#2738)
• 0603359 feat(plugin): typed plugin clients, replacing hand-written JSON around PluginCall (#2657)
• 0b64a11 feat(python-sdk,cmd/cleat): JSON Schema emitter for Python entry points (cleat#2914) (#2933)
• 68632ee feat(python-sdk,engine): Python exposure declaration, @cleat_entry(expose=...) (cleat#1986) (#3147)
• 79da4b4 feat(scheduledbackup): implement plugin.HasHealth, driven by DSN-unavailable attempts (#2764)
• 8677be2 feat(tenantlifecycle): tenant-scoped trial-status route for cleat#2534 Stage 3 (#2683)
• db7ce2d feat(webhookingest): adopt correlated await via eventtriggers' P1 mechanism (cleat#2649) (#2697)
• 9bdda3a feat(webhookingest): retire signal_workflow_id/signal_name (cleat#2689) (#2833)
• baf3be6 feat(worker): give sharded deployments a per-shard reserved heartbeat pool (#2925)
• cd392ad feat(worker): serve GET /api/openapi.json from the deployed entry-point schemas (cleat#2913) (#2971)
• f8ff5b2 fix(auditlog): settle() waited for the loss count, not for the host to be told (#2571) (#2578)
• cafb1a4 fix(auditlog): the chain hashes metadata as the database stores it, not as supplied (#2591)
• df8b2ba fix(backendkit): classifyError exposes the upstream status, so 4xx stops flattening to 502 (cleat#2718) (#2810)
• b927400 fix(blobstore): admin.drop_tenant left dropped tenants' blob_content ref_count stuck forever (cleat#2250) (#2872)
• 99e3834 fix(blobstore): blobPut enforces max_blob_size, not just PUT /blobs (cleat#2275) (#2723)
• 41ecc40 fix(blobstore): match backend case-insensitively; refuse unknown values (#2824)
• 3d3a6e7 fix(blobstore): retry on MSSQL deadlock in the stale-refs sweep (cleat#2303) (#2827)
• c1a98ea fix(catalogdiff): mssql comparator compares a FOREIGN KEY's actions and trust bit (#2732)
• 370007b fix(ci): EXPRESSION_ALLOWLIST keys on expression text, not step position (cleat#2797) (#2809)
• 805f469 fix(ci): Lint job runs every guard, even when an earlier one fails (#2896)
• 6b872cf fix(ci): a curly quote fails the lint job in Python sources; Go is out of scope, and why (cleat#2987) (#2988)
• 587fbfd fix(ci): anchor the goreleaser dist rule so the embedded bundle stays committable (#2509)
• 3817689 fix(ci): cap the jobs that hung in #2862, raise tier1-rest's eaten buffer (#2879)
• bd693b9 fix(ci): check-skip-budget.sh rejects shifted ledger lines and resolves suffix/named-line overlap (#2753)
• e129091 fix(ci): check-workflow-concurrency.sh no longer confuses a build input with a trigger (#2734)
• 3b15681 fix(ci): closing-reference regex no longer flags a paren-wrapped #N (cleat#2800) (#2807)
• 58b13b9 fix(ci): detect a negated closing keyword that still closes the issue it names (cleat#2436) (#2703)
• d8b255e fix(ci): gate check-plan-references.py's full mode, with a shrink-only baseline (#3054)
• 455e6a0 fix(ci): guard a cluster-only skip-ledger line for an engine/ test (cleat#2158) (#2771)
• f9105b3 fix(ci): point the skip-budget overflow error at the overlap fix it needs (cleat#3159) (#3160)
• 9062b25 fix(ci): python-sdk release artifacts had no unique suffix at all (#2889)
• e8e1548 fix(ci): run CI on PRs whose base is a release branch (cleat#2483) (#2492)
• b94b146 fix(ci): share the on: trigger parse between two workflow guards (#2893)
• 03c12fe fix(ci): the coverage floor names the package it scores, and two jobs stop overclaiming (#2494)
• 4af39cb fix(ci): the coverage job runs with the database its floors were calibrated against (#2508)
• a4174c1 fix(ci): the docs-method guard no longer assumes an open paren (#2548)
• e3e420e fix(ci): the integration-hub restart tells compose to act, instead of waiting on a read that can be wrong (cleat#2965) (#2970)
• 84da780 fix(ci): tier-1 log upload no longer fails the gate on a network hiccup (#2846)
• ddeb0d9 fix(ci): tier-2 log upload no longer fails the required gate on a network hiccup (#2848)
• d5d8535 fix(ci): tier1 shard logs collide under one filename once merged (cleat#2877) (#2884)
• 551f18d fix(ci): tier1-push-failure-notifier dedups per run+attempt, not per run (#2907)
• 2746770 fix(ci): tier1-push-failure-notifier scopes per-shard log selection to each shard's own highest attempt (#2905)
• 0ff4798 fix(ci): upload-artifact names keyed only on github.sha will 409 on a re-run (#2875)
• 787b59d fix(ci): upload-artifact names keyed only on run_id will 409 on a re-run (#2861)
• 092067a fix(cleat): a saga that succeeds after a failed one clears the earlier failure keys (cleat#2967) (#3162)
• 752f433 fix(cleat): name the WASM artifact after cleat.yaml's name:, not the entry point or source file (#2692)
• a070834 fix(cleat-worker): anchor /livez recovery grace on the last known-good call (#2728)
• 0f2e82f fix(cleat-worker): log the API address the socket actually bound, not the configured one (cleat#3136) (#3137)
• a9a42b0 fix(cleat-worker): log the bound address for --pprof-addr and --internal-addr too (cleat#3139) (#3141)
• bffecfc fix(cleatctl): backup history shows a NULL config_id as '-', not the zero UUID (#2730)
• 6ec4929 fix(cleatctl): check-db detects a superseded, unpinned SECURITY DEFINER function overload (cleat#2449) (#2702)
• 1ca8883 fix(cleatctl): inline-statement guard migrates tenant_quota and tenant_trials (#2727)
• ff9391e fix(cleatctl): mssqlPostureOf consults admin.rls_predicate_form, not just membership (cleat#2760) (#2808)
• 340a862 fix(cleattest): record plugin calls in the history the call assertions read (#2546)
• 1985855 fix(cleattest): sequence repeated OnPluginCall(...).Return() calls (#2606)
• 69de7b3 fix(cli): plugin install and list said nothing about the plugin never running (#2724)
• c2a8864 fix(closure): E008 catches interface dispatch through a field or a call result (cleat#2799) (#2801)
• b7775e5 fix(closure): E008 names the call and a column, not just the line (cleat#2516) (#2791)
• 221d09e fix(cmd/cleat): bind-then-log the fullstack scaffold's proxy, close the last cleat#3131 site (#3145)
• 1d2aa5a fix(cmd/cleat): deploy reads the entry-point-schema sidecar cleat build writes (#3151)
• 1d9561d fix(cmd/cleat): discover the quick-start tests' worker port from its log (cleat#3131) (#3140)
• 553abe9 fix(cmd/cleat): fail loudly on a cleat.yaml that isn't valid YAML at all (#2858)
• 4287b88 fix(cmd/cleat): hold each reserved TCP port across the other picks, release before the bind (cleat#3122) (#3128)
• 35b13e6 fix(cmd/cleat): let docker allocate the fullstack test's ports, and read back what it bound (cleat#3131) (#3135)
• f1229ae fix(cmd/cleat): metadata's WorkflowName no longer carries a .wasm suffix (#2849)
• c99ab12 fix(cmd/cleat): the documented-invocation scan read .py sources raw, so a docstring escape became a shell token (cleat#2984) (#3020)
• 32fab2e fix(cmd/cleat): unify entry_points: schema and check it against the build (cleat#2698) (#2812)
• 35bca49 fix(cmd/cleat-mcp): log the address the socket actually bound, not --addr (#3161)
• 19f7cc5 fix(cmd/cleat-mcp): tasks/cancel never worked -- no request body, worker needs one (cleat#1982) (#3149)
• f77539c fix(cmd/cleat-worker): GET /api/schedules hides an internal definition's name (cleat#3001) (#3120)
• 5d0c898 fix(cmd/cleat-worker): a definition-not-found 404 names the workflow (#3167)
• d017980 fix(cmd/cleat-worker): migrations-outside-repo test no longer hardcodes a port (cleat#3143) (#3146)
• 15cd3a7 fix(cmd/cleat-worker): remove the duplicate authResolver build (#2694)
• 76ddef9 fix(cmd/cleat-worker): scope runIsFenced to the execution's generation (cleat#2956) (#2977)
• e05d062 fix(cmd/cleat-worker): the eight routes that never verified their target now answer not-found (#3038)
• 8ce6ae5 fix(cmd/cleat-worker): the fence cancels only the generation it judged (cleat#2942) (#2950)
• 97d779a fix(cmd/cleat-worker,engine): a stopped run is released, not failed (cleat#2942) (#2957)
• dedd605 fix(cmd/cleatctl): deploy stamps the version it assigns into the binary (#2945)
• a0a8c06 fix(cmd/cleatctl): refuse a mysql:// DSN before the driver sees it (cleat#2962) (#3064)
• 79d0971 fix(cmd/cleatctl): wire the deploy dedup guard, normalising workflow_version (cleat#2947) (#3050)
• 0146a08 fix(compose): the dev MySQL healthcheck probed the socket, not TCP (#2577)
• b7ab545 fix(conformance): the binding table's control could not fail, and now can (cleat#2542) (#2570)
• 6417bf5 fix(deploy): the SQL Server app-role script reported success when it had failed (cleat#2939) (#2948)
• 97dfb66 fix(docs): 42 more migrations/postgres/NNN citations the rebaseline deleted (cleat#2725) (#2772)
• 79f10fb fix(docs): README's Quick Start could not reach done (cleat#2788) (#2798)
• 9b4be4c fix(docs): error-codes.md names three methods that do not exist — and the guard now reaches prose (#2561)
• 927603c fix(docs): exercise docs/tutorials/quick-start.md in CI (cleat#2802) (#2841)
• 3771a47 fix(docs): playbook citations of migrations the rebaseline deleted (#2726)
• a87b510 fix(engine): ConsumeSignal wraps DELETE+increment in one MSSQL transaction (cleat#2758) (#2778)
• 615659d fix(engine): MSSQL reap/stall-shape queries no longer overflow past ~24.86 days (#2751)
• f28b2a1 fix(engine): MoveToDeadLetterQueue now preserves the final failing replay's query state (#2662)
• be5c0e2 fix(engine): PG OpenIsolatedStore matches OpenStore; key RLS exemption by statement, not line (#2741)
• 44f0bff fix(engine): a WASI-policy trap no longer reports as a false success (#2613)
• 0c317c0 fix(engine): assert the concurrency-key reap by key, not by table-wide count (cleat#2922) (#2960)
• df3490e fix(engine): batch-flush gate follow-ups from #2355's review (#2685)
• 83222fc fix(engine): checkSecretOnlyFields matches raw JSON bytes, catching an escaped reference ResolveSecretRefs could never resolve (cleat#2336) (#2923)
• f5c56c5 fix(engine): choose run ids that cover every shard, so the sharded-heartbeat test cannot flake (cleat#2963) (#2964)
• 0b4b14e fix(engine): classify DB-originated finalize errors into CleatError (cleat#2805) (#2829)
• a74fd43 fix(engine): close the reclaim-race window in the per-step event fence (cleat#2244) (#2815)
• 18a0821 fix(engine): correct three stale migration-history comments in schema_bootstrap_test.go (cleat#2417) (#2710)
• 44b4492 fix(engine): delete the three baselined MSSQL error classifiers (cleat#2792) (#2804)
• 6cae18b fix(engine): enforce API-key expiry on PostgresStore/MySQLStore/MSSQLStore (#2921)
• 7db8326 fix(engine): guard and fix MSSQLStore.WithTenant plain reads (cleat#2210) (#2756)
• 489c484 fix(engine): promise and update settlement wakes a running workflow (cleat#3171) (#3175)
• 190f9f9 fix(engine): raise MySQL finalize's retry budget from 8 to 16 (cleat#2033) (#2919)
• e62410d fix(engine): record event_awaiters.id's MySQL asymmetry as compensated (#2856)
• c9e8891 fix(engine): remove a dead OR tenant_id IS NULL clause on MSSQL (cleat#2635) (#2706)
• e8cdef6 fix(engine): scope the drop-tenant ratchet past plugin-registered tables (cleat#2959) (#3156)
• c992976 fix(engine): the UUID-projection guard prescribed the form that ships the bug (cleat#2983) (#2994)
• 181a8f4 fix(engine): the stale-holder tests pass a zero margin, not a 1ns one (cleat#3032) (#3034)
• e05286d fix(engine,auth,cmd/cleatctl): require LOWER on MSSQL UUID projections (cleat#2993) (#3008)
• 0a285de fix(engine,cmd/cleat-worker): a keyless worker refuses to start once payload encryption has ever been enabled (cleat#2324) (#2924)
• cc0f83e fix(engine,cmd/cleat-worker): routing rule deletion is scoped by workflow name (cleat#3168) (#3177)
• d83a633 fix(engine,plugins): assess and close 11 of 12 MSSQL MERGE HOLDLOCK candidates (#2917)
• dfb5981 fix(engine/testutil): derive the MSSQL plain-predicate replay list instead of hardcoding it (cleat#3173) (#3178)
• d718ea2 fix(eventstore): hot-stream appends serialize on a per-stream row lock instead of retrying (#2885)
• fc8e0d4 fix(eventtriggers): PublishEvent rejects invalid JSON before the INSERT (#2680)
• 3173a81 fix(eventtriggers): SQL Server claim no longer locks every candidate it examines (#2869)
• 478752c fix(eventtriggers): awaitEvent marshals its output before committing the claim (cleat#2654) (#2665)
• 3a0066b fix(eventtriggers): await_event reads oldest-first and claims atomically (cleat#2641) (#2645)
• e34949a fix(eventtriggers): enter the cross-tenant bypass before migration backfills on TenantScoped tables (#2862)
• 41019fc fix(eventtriggers): give TestV8BackfillPreservesTheOldSweepSelection/mssql its own database (#2874)
• 4c47933 fix(eventtriggers): replace idx_ingested_events_correlate with a processed-excluding index (cleat#2669) (#2675)
• 6271813 fix(eventtriggers): retryEvent's dispatch bookkeeping no longer shares a flag with the awaiter backstop claim (cleat#2663) (#2822)
• b2f1ac4 fix(eventtriggers): the legacy-replay test calls real functions instead of hand-copying them (cleat#2664) (#2684)
• 61b34de fix(examples): bump the two older DBOS ports onto the SDK the third one uses (#2958)
• 94f109f fix(examples): distinguish a worker that never restarted from one that is not ready yet (#2803)
• 8831dbe fix(examples): regenerate widget-store-as's stale package-lock.json (#2584)
• 6be41eb fix(examples): the DBOS order-lifecycle pair was not equally scoped (cleat#2997) (#3035)
• b6de717 fix(githooks): validate Claude-Stream with git's own trailer parser (cleat#2588) (#2634)
• 49c6d24 fix(jobqueue): restore task_queue.payload NOT NULL on MySQL (cleat#2282) (#2721)
• 04a9ea0 fix(llm): a model absent from the price table is no longer priced as a mid-range one (cleat#2572) (#2586)
• 58b7231 fix(make): tools-go's version check uses GNU-only grep -oP (cleat#2583) (#2605)
• 70bbea1 fix(makefile): make setup's own next-steps recommend two broken commands (#2581)
• a8af24d fix(migration): catalogdiff compares MSSQL security policies, triggers, schemas and roles (#2865)
• 617f2b7 fix(monitoring): counter HELP/TYPE lines must name the actual sample (#2814)
• 32275fc fix(monitoring,cmd/cleat-worker): /metrics does not render an internal definition's name (cleat#3001) (#3123)
• 0d2a875 fix(oauthprovider): a typed-nil hostResolver defeats the --require-host-match guard (#2688)
• a5f30f9 fix(order-lifecycle): guard the page's vocabulary, which nothing executed (#3105)
• 9a0b84d fix(plugin): RegisterTyped rejects an unknown request field (cleat#2660) (#2676)
• 29f59d0 fix(plugin): a field's type can reference a defined type, not just inline it (#2806)
• 3fd0a91 fix(plugin): detect plugin.json manifest drift from real Go types (cleat#2656) (#2775)
• 276bf24 fix(plugin): harden the total-coverage ledger scanners past CallExpr.Fun (cleat#2740) (#2773)
• 6ff666b fix(plugin): stop three tree-scanning guards from reading assertGoCompiles' scratch dir (cleat#2811) (#2818)
• 19f6c98 fix(plugin): wrap RunDownMigrations Phase 2 in a per-version transaction (#2859)
• caad605 fix(plugingen): Go backend generates FuncRegistry registration code, not a broken caller client (#2783)
• 11987f2 fix(plugins): guard 10 unsafe MySQL CREATE/DROP INDEX migrations, slice 1 (cleat#2880) (#2910)
• 4cbd37c fix(plugins): guard 11 unsafe MySQL ADD/DROP COLUMN migrations (cleat#2880) (#2900)
• 49ab3dc fix(plugins): guard 11 unsafe MySQL CREATE/DROP INDEX migrations, slice 2 (cleat#2880) (#2916)
• 210310a fix(plugins/kvstore): fix two concurrent-write races in upsertKV/handlePut (MSSQL HOLDLOCK, MySQL status code) (#2903)
• 6075d4a fix(plugins/scheduledbackup): TestNextRun_Feb29NonLeapYear can now fail (#2851)
• 6840595 fix(python-sdk): _from_dict builds kwargs from init's signature, so a required InitVar is passable (cleat#2940) (#3057)
• 53bcb7d fix(python-sdk): a payload the constructor takes nothing from is refused, not dropped (cleat#3058) (#3060)
• ad23259 fix(python-sdk): record plugin calls in the history the call assertions read (#2568)
• 87a1364 fix(python-sdk): refuse an assertion over a plugin name that can never match (cleat#2567) (#2579)
• f13d4f9 fix(python-sdk): the bare @cleat_entry form registers under a name (cleat#2976) (#2985)
• a3127de fix(ratelimiter): a spent bucket refused the PUT that would raise it (#2559)
• 64ebc9f fix(reaper): a persistent stall-probe failure now trips the chronically-skipped alarm (cleat#2193) (#2735)
• 4287ea7 fix(release): the AssemblyScript package set moves to 0.4.0
• 96275d9 fix(scenario): stop when the worker is gone, and dump the logs that show why (#2564)
• 21daf28 fix(scheduledbackup): warn when the CLI writes a config the backup will fail to reach (#2763)
• ba6ebd4 fix(scripts): a closing keyword in a code span is inert and says nothing (cleat#3028) (#3047)
• ab261d9 fix(scripts): a closing phrase inside quotation marks is cited text, not this body's attempt (cleat#3095) (#3101)
• f65d470 fix(scripts): a missing PR_NUMBER no longer exits with a finding's status (#3023)
• 88dc2c9 fix(scripts): an emphasised closing keyword is a closing attempt (cleat#3102) (#3110)
• 657bc25 fix(scripts): an uncompilable pattern is UNMEASURED, not a pass (cleat#3103) (#3107)
• 550bb41 fix(scripts): attribute the last five test-go/commands skips and lock the ratchet (cleat#2928) (#2943)
• 808e7ca fix(scripts): check-dbos-pair-loc.py now checks the integration-hub wedge pair (#2749)
• 09cd598 fix(scripts): check-dbos-pair-loc.py's self-test now runs the real producer (cleat#2633) (#2637)
• cc7367b fix(scripts): check-plan-references.py resolves §N.M citations into other documents' own namespaces (#2868)
• 6a093c3 fix(scripts): check-plugin-table-namespace.py strips comments before matching (#2693)
• 21a96cf fix(scripts): check-skips.sh cross-checks skip-baseline.txt against the runtime ledger (#2761)
• e7fac82 fix(scripts): doc-comment guard keys a method on (receiver, name), not bare name (#2774)
• b5e370a fix(scripts): exclude a test fixture from check-sdk-version-agreement discovery (cleat#3183) (#3185)
• 3f08fd8 fix(scripts): migration-citation guard covers mysql/mssql and bare-number citations (cleat#2817) (#2819)
• becdb86 fix(scripts): name every test in multi-db's two UNATTRIBUTED remainders (#2863)
• 2aca774 fix(scripts): sum behaviour assertions on both sides of the DBOS pair tables (#3040)
• 51aa105 fix(scripts): the DBOS pair counter's fixtures are checked against the program (#3044)
• 2a7f9c8 fix(scripts): the Python surface check compares the two sets, not just each count to its own document (#2576)
• 05b97fc fix(scripts): the doc-comment guard reads a lone argument as "use the defaults" (cleat#2479) (#2582)
• 74b27bc fix(scripts): the negated closing-reference wrapper asserts its own usage (cleat#3024) (#3045)
• 5101eeb fix(scripts): wait for the field each B2B assertion reads, not a neighbour of it (cleat#2966) (#3133)
• 2ec848d fix(slacknotify): the leftover-key WARN said "no effect", but its presence gates the boot (#3070)
• 328933c fix(testdata): delete a runbook carrying a plaintext database credential (#2640)
• 9540c74 fix(tests): two multi-dialect loops continue past a missing backend with no skip event (#2883)
• f693b38 fix(testutil): MSSQLAdminDB's self-heal now sees live callers across processes (#2899)
• 4317658 fix(testutil): self-heal a leftover MSSQL admin predicate on schema setup (#2855)
• 28c3823 fix(tier2-gate): eventtriggers legacy-replay dialect test gets a zero skip budget (#2864)
• 276a694 fix(wasm): refuse a workflow import staging cannot satisfy (#2667)
• a32c27d fix(wasm): the section walk desynchronised on every custom section, losing or inventing imports (#3076)
• e42266a fix(wasm,python-sdk): recognize WASM Component Model binaries in metadata read/write (#2941)
• 58c8ed8 fix(webhookingest): guard v3/v4/v7's MySQL ALTER TABLE, re-run the newest plugin migration not the first (#2881)
• ff6c58f fix(webhookingest): the MySQL idempotency test skipped silently with no CLEAT_TEST_MYSQL (cleat#2887) (#3144)
• b8d5ba3 fix(worker): a failed run's published query state reaches FailWorkflow (#2648)
• 21ff717 fix: correct stale comments describing #1926's retired cross-tenant claim (#2769)
• 78c15d3 fix: stop naming a migration file the 0.3.0 compaction deleted (#2555)
• b642b5f fix: struct parameters bind by parameter name — five places said they bind by field (#2543)
• 9232c71 refactor(migration): share BaselineFiles between the drift test and verify.go (cleat#2472) (#2722)
• 394b7c0 test(auditlog): add SQL Server counterpart for cross-tenant RLS isolation (cleat#2714) (#2840)
• 14ed288 test(ci): the Python matrix covers 3.13, the newest version the package claims (#2462)
• 7b3c34a test(cleat): every root require must name the same version (cleat#2497) (#2505)
• 63738bb test(cleat-worker): assert the three list filters that reached the store unasserted (cleat#3053) (#3059)
• fe64c9a test(cleat-worker): exhaustive arithmetic sweep of the reaper recovery gate invariant (#2744)
• 216b74c test(cleat-worker): the document lists a Go and a Python fixture workflow (cleat#1980 item 2) (#3005)
• 6571fdf test(cleatctl): a Python fixture workflow deploys with a schema (cleat#1980 item 1, Python half) (#3000)
• c9301fc test(cleatctl): the sidecar cleat build writes is the one deploy reads (cleat#1980 item 1) (#2991)
• 2c036f1 test(cleattest): WaitForParked — the drain precondition the harness documented but never provided (cleat#3091) (#3124)
• 3c02943 test(cmd/cleat): a Gradle wrapper fetch failure names itself instead of reading as a manifest failure (cleat#3039) (#3055)
• c471833 test(cmd/cleat): compile the how-to pages' snippets, one file per block (cleat#3097) (#3113)
• e89a416 test(cmd/cleat): compile the template SOURCE against the tree (cleat#3100) (#3106)
• 2815b0d test(cmd/cleat): compile the tutorials' Go snippets, and check their links (cleat#3072) (#3080)
• c131d80 test(cmd/cleat): one home for the build-refusal tests' two checks, and disjoint failure text (cleat#3075) (#3077)
• eab6f54 test(cmd/cleat): rename the README guard to say what it actually covers (#2789)
• 91a70ea test(cmd/cleat): the Rust and AS absence-arms assert the build reached the stage (cleat#3063) (#3071)
• 0daa427 test(cmd/cleat): the absence-arms assert the build reached the checker (cleat#3056) (#3062)
• c2330c8 test(cmd/cleat): the scaffold helper can go now that the SDK submodule is tagged (cleat#3083) (#3099)
• 9f39254 test(cmd/cleat-mcp): close cleat#1982's clause 1 for real -- real binaries, real database, no fake (cleat#1982) (#3153)
• 483b46a test(cmd/cleat-worker): boot the worker on :0 and read the bound API address, not freePort (cleat#3138) (#3142)
• 3a23fbe test(cmd/cleat-worker): drain the local claim queue rather than trust a fixed limit (#2736)
• 2847220 test(cmd/cleat-worker): pin start-input validation against the schema cleat build emits, Go and Python (cleat#1981) (#2975)
• b763b6e test(engine): SQL Server retention-sweep concurrent-writer p99 latency harness (#2746)
• f7fd5c5 test(engine): TestReapStaleInstances asserted nothing a stopped reaper fails (#3046)
• d50c015 test(engine): demonstrate the mssql#2139 retry loop recovers from a transient (cleat#3117) (#3179)
• 394bb46 test(engine): fix RLS gap in TestARetiredSecretStopsResolvingAndSetSecretRevivesIt's cleanup (#2731)
• ddaef0a test(engine): re-measure the mssql#2139 latency bound per attempt, failing only if every one exceeds it (#3129)
• e773969 test(engine): widen isDialectSensitiveTestFile beyond literal sql.Open (cleat#2286) (#2720)
• aeb2d26 test(mssql): cover the five statements only review's probe ever ran (#3108)
• 858fc95 test(oauthprovider): a real-DB arm proving identityAllowed's tenant scoping (cleat#2378) (#2825)
• c4a6db7 test(scheduledbackup): backupDSN is fetched fresh, not cached (#2762)
• a8e1ed6 test(testdata): delete clew-lifecycle's tests, which assert the opposite of the code (#2592)
• 3762b34 test(testutil): add tenant_secrets and its siblings to the cleanup table lists (#2687)
• 368befb test(wasm): cover a root-module workflow importing a non-SDK root package (#2674)
• 4f719b8 tools: a committed job-log fetch helper (cleat#3132) (#3134)