v26.10.4

Workspace creation now returns a clear 400 workspace_scope_mismatch when the body id differs from X-Workspace-Id. The request is rejected before a row or lifecycle event is written. Matching requests retain 201 and their existing response.

The API reference now describes the actual workspace lookup error and list behavior. Python and Java SDK instructions explain how to select the workspace being created. Server and SDK versions are aligned at 26.10.4; dependency pins, RLS policies, SDK methods and request/response schemas are unchanged. The published Python SDK 26.10.3 remains compatible with the corrected server.

Local qualification covers the production non-bypass PostgreSQL role, actual HTTP and SDK calls, persisted rows and outbox events, foreign-scope visibility and rejected credentials. The configured unit suite passes 1,219 tests, with 52 integration tests passing and three optional backend integrations skipped. Python and Java SDK suites pass 61 and 62 tests.

Lifecycle-event delivery remains best-effort after a successful workspace write. Platform API keys retain their existing trusted operator authority.

Install the Python SDK from the release wheel:

uv add https://github.com/fireflyframework/flycanon/releases/download/v26.10.4/flycanon_sdk-26.10.4-py3-none-any.whl

For the standalone server, follow the released-server installation guide. Verify downloaded files against SHA256SUMS. Java consumers use com.firefly:flycanon-sdk:26.10.4 through GitHub Packages.