v0.17.2

0.17.2 (2026-11-13)

Features

• agency: a callback that throws is one typed event, never its message (02e045f)
• api: a session's sends and streams carry guards, and its history holds what was delivered (ffc7426)
• api: guards on generateText and streamText, at every tool loop (7f19cf3)
• api: the guard run, its report and the stop error (67d5195)
• guardrails: a caller can pick which block decides a reply (278ea39)
• library: a later page stays marked incomplete when its first page left stored words out, and a passage answered from outside the search fails it (cf9660f)
• library: searchGroups on LibraryIndex: each group of the caller's items counted, ranked, paged by a cursor and marked (9b747b4)
• logging: events for governed actions and agency callback failures (6cff25d)
• memory: a memory question reserves room for exact-words hits past the hybrid cut, and supplied candidates join the pool inside the call's scopes, written nowhere (2857254)
• memory: memory rerank is set in recall.rerank (none, local, llm) and never fails a turn; a manager's rerankerService is no longer read for memory recall (db32ef8)
• memory: retrieval 'hybrid' fuses the dense, exact-words and recency legs into one deduped pool shown as one Relevant Memories section (cfdd41d)
• reranking: the local cross-encoder takes a pinned revision and a cache-only load, lists three models by their current ids and defaults to cross-encoder/ms-marco-MiniLM-L6-v2, and the LLM judge counts the scores it put in (cd05cb3)
• safety: action limits in a shared store (280d5c7)
• safety: evidence a governed call carries, checked against the host's store (6eac2be)
• safety: governTool, a tool held to evidence, limits and an audit record (d23385e)
• vector-store: lexicalGroupSearch on PostgresVectorStore: the stored words one edit away, the match across an item's passages, the count, the page and the listing (7362b4f)
• vector-store: the optional lexicalGroupSearch member and its types (7ec3ac8)
• voice: the realtime voice returns what it says it read and whether that matches the text (#809) (f613e09)

Bug Fixes

• aborts while the guards judge end the call, a passed guarded stream keeps the call's text, the picker reads answers in registration order (f8addaa)
• agency: read an approval decision before approvalDecided runs (9c29b6a)
• api: a GMI session refuses guards instead of dropping them (1565f5c)
• api: a schema retry, a retriever and a capped step keep nothing a guard took out (b4efc3b)
• api: an abort while the guards judge a refused or dry-run reply ends the stream with the reason (bd029a2)
• api: an abort while the reply is judged rejects; a dry-run stream resolves the call's own text (61c3f0a)
• api: guards keep an emptied turn, a rewritten stream, the whole report and an abort (2513b41)
• api: memory recall on a guarded call reads the turn as it was sent (3591067)
• api: read the run's fields once instead of aliasing this in the output stage (64cfa5c)
• ci: the bump's integrity check fails an entry replaced by a source with no integrity (17dee29)
• deps: bump @framers/* deps to latest published versions (31d6936)
• guardrails: a reply a picker lets pass reports flag or allow, not block (54861d3)
• library: a grouped search holds a cursor's rank to what a Postgres numeric holds and its carried stored words to what a tsquery holds, so an edited cursor is refused as a cursor and never reaches a statement (229f734)
• library: a grouped search holds a date to a real day and time to the microsecond, and a source id to a text without NUL, in an item and in a cursor's key, so an edited cursor is refused as a cursor and two instants never stand level (f15312f)
• library: a grouped search keeps the stored words one edit away to what one tsquery holds beside the search's own words, and a cursor carries only words the store draws (3698c48)
• library: a later page asked under another scope restarts, and a page size past a Postgres integer is answered (f2b9ec9)
• library: a later page's cursor carries the stored words the index handed that page, never the store's answer, and the store contract states what a later page echoes (da193cf)
• library: cap a grouped search's expansion at 64 stored words a word in the index, the store and the cursor check, and state the rule a store's answered expansion keeps (3632ddd)
• library: hold a carried stored word to 2046 bytes, as Postgres releases before 1fc1b82b2f refuse a tsquery word of 2047 (5e9ab35)
• library: the grouped search reads a passage's tenant, groups and source id by type, as the index checks them; one module holds the forms the index and the store both read (0012a7a)
• logging: list LibraryCursorError among the error types a log line may carry (dbbc040)
• memory: a dedupe-dropped memory that Related Context shows is recorded as shown, and the bridge's trace entry names a hybrid recall with the capture off (c4beafb)
• memory: a kept text carries the best score and place of the texts it stands for, a supplied id only the store holds is counted, a supplied line reads relevance 1.00, and the memory-question rule reads a typographic apostrophe and handles a rejecting predicate (9381189)
• memory: a memory deleted while the rerank runs leaves the recall and its record, and stopping a reranker settles its pending rerank at once (2bfffae)
• memory: an undated candidate is never the newer in the dedupe, a drop is rechecked when its holder's text changes, a kept correction keeps its own ranks, a supplied id never names a stored memory, a policy reads recalled memories only, and supplied candidates are bounded (1bd9114)
• memory: hybrid dedupe counts one-character words, so two memories that differ in a one-digit or one-letter value are two (b0e1c7b)
• memory: hybrid dedupe keeps the newer of two near-duplicates whose words differ, counts a one-letter stop word, and a recall with no scopes names its scoped legs absent (c955f54)
• memory: hybrid dedupe keeps two memories that state different numbers or codes, so a correction in a long memory is never dropped as the duplicate of the value it corrects (cdeca7d)
• memory: hybrid recall keeps its fused order under a reranker, records nothing for a suppressed recall, drops a trace deleted mid-turn, leaves no two near-duplicates kept, merges only valid shares and refuses unknown or unbounded constants (cf0d431)
• memory: hydration reads scope_id, so a row whose metadata names no scope id loads under its column's (a32cb53)
• memory: the dedupe settles when a memory folded into a newer text is kept again (51058c4)
• memory: the hybrid record leaves out a memory deleted while the rerank ran before it places the reranked cut, so each candidate is listed once (2343470)
• memory: the hybrid rerank blend reads the best recalled fused score, rerank sends every candidate maxCandidates allows, and a judge the turn stopped waiting for starts no further model call (137a771)
• memory: the recall constants type is writable, so a manager's constants lay over the starting ones (6bd41ea)
• memory: the record lists a reranked hybrid cut in its final order, an answer missing a candidate is an error, a stopped reranker's late answer is dropped, and rerank.revision is a whole commit id (231d40d)
• reranking: a judge ranking that names none of its candidates reports listwiseFailed, so memory rerank keeps the recall order (a69711e)
• safety: cap evidence at 20 quotes of 4,000 characters each (6e6874e)
• safety: check a dry run's answer against the tool's output schema (7a596be)
• safety: count minQuotes by distinct messages (31f2a75)
• safety: drain each window's purge past one page (8026fa8)
• safety: hold the standalone evidence check to the quote caps (35e159e)
• safety: keep a running action's reservation when an account is forgotten (41cecdb)
• safety: keep governed actions bound to checked inputs (9019016)
• safety: record a wrapped tool's own refusal before approval (6a0b9ca)
• safety: renew a governed action's lease while its tool runs (b92721d)
• safety: reserve a limit rule listed twice once (a29aded)
• safety: settle every reserved unit when one settle fails (1cd469c)
• safety: units given back before a tool starts keep the action's attempts (7b7f72c)

Code Refactoring

• safety: read a verdict's confirmation once (fd0ee79)