v1.2.0

Backward-compatible improvements to runnable MCP onboarding, operator guidance, and packaged compatibility evidence. GitHub/source release and npm Trusted Publishing require separate approval and execution; a source release alone does not publish to npm.

• Runnable protectTool() server/client example using the official MCP v2 SDK on real loopback HTTP (#253).
• Bilingual operator-safe lost-ACK and read-only reconciliation playbooks (#254).
• Official-SDK E2E for concurrency, denials, conservative cost handling, and safe client-facing error boundaries (#255).
• Correct version/peer documentation and verify exact v1.2.0 candidate tarballs in a clean external consumer (#256).
• No intentional change to existing public APIs, accounting lifecycle, or persisted Store schemas.

---

The attached .tgz files are the exact package artifacts validated by this release workflow. Verify them with SHA256SUMS and GitHub artifact attestations. Their presence does not mean the packages were published to npm; registry publication remains separately authorized.

v1.1.1

Security and test-reliability maintenance patch. Preparing source artifacts does not authorize a GitHub Release or npm publication; those remain separate explicitly approved steps.

Security and compatibility

• Eliminated the currently reported lockfile dependency advisories by narrowly overriding affected brace-expansion, @grpc/grpc-js, and source-map-js resolutions, and updated the development-only MCP client SDK to a patched version. The published MCP server peer floor remains ^2.0.0.
• Isolated the Cloudflare local workerd integration CI state from prior runs so retained test budgets cannot falsely deny a fresh conformance scenario.
• No accounting lifecycle, persisted Store schema, published runtime dependency, or public API semantics were intentionally changed. Release validation and authorization are separate steps (#246).

---

The attached .tgz files are the exact package artifacts validated by this release workflow. Verify them with SHA256SUMS and GitHub artifact attestations. Their presence does not mean the packages were published to npm; registry publication remains separately authorized.

v1.1.0

Post-v1 integration and operations release. v1.1.0 adds narrowly scoped Cloudflare retry ergonomics and MCP operation-identity guidance without changing the frozen accounting lifecycle or persisted Store contracts.

Added

• Added privacy-bounded, best-effort operational telemetry for Cloudflare exact retries (retry.scheduled, retry.recovered, retry.failed) without exposing usage identities, endpoints, or raw errors (#239).
• Added optional mcp-usage-control-cloudflare/exact-retry support for bounded exact replay of scalar markLiable(), renew(), and settle() after retryable transport failures, while initial reserve, growth, and vector transitions remain single-attempt (#232).

Changed

• Hardened the Cloudflare exact-retry helper with bounded exponential equal-jitter backoff between eligible attempts, added exact-subpath checks to the GitHub Release packed-byte smoke, and moved the development test runner to patched Vitest 4.1.11 with source-only test discovery (#237).
• Recorded the MCP single-round read operation-identity decision: no weak JSON-RPC/session-derived dedup helper is added; applications without a retry-stable logical key should use a fresh server-side ID per dispatch, while products that need retry-stable metering must provide an explicit validated logical action ID (#233).

Release boundary

• Keeps the v1 reserve -> liability -> grow -> renew -> settle accounting model, replay scope, provider storage contracts, and Node.js 22+ runtime floor unchanged.
• Keeps ambiguous initial Cloudflare reserve recovery explicit through read-only reconciliation; v1.1.0 does not introduce blind reserve retry.
• Aligns all five public package manifests at 1.1.0; supported release evidence remains Node.js 22/24 with the aggregate test (22) gate.
• This GitHub/source release does not itself publish to npm. Registry publication remains a separate manually authorized Trusted Publishing workflow using the exact validated GitHub Release tarballs.

---

The attached .tgz files are the exact package artifacts validated by this release workflow. Verify them with SHA256SUMS and GitHub artifact attestations. Their presence does not mean the packages were published to npm; registry publication remains separately authorized.

v1.0.0

First stable GitHub/source release. v1.0.0 is a feature-free promotion of the accounting, recovery, storage, MCP-integration, and release-safety surface hardened through v0.13. npm publication remains separately authorized under #6 and is not part of this source release.

Stable contract

• Promotes the frozen reserve -> liability -> grow -> renew -> settle lifecycle without adding a new accounting model, billing authority, or financial-ledger responsibility.
• Keeps atomic multi-budget/vector admission, replay fencing, conservative cost-liable expiry, bounded growth/settlement, lost-ACK reconciliation, and one-time MCP multi-round resume semantics unchanged.
• Keeps package names, public subpaths, Node.js 22+ floor, Store compatibility contract, and provider-specific durability/time/HA boundaries frozen for the v1 compatibility line.

Release and ecosystem boundary

• Aligns all five public package manifests at 1.0.0; supported runtime evidence remains Node.js 22/24 with the aggregate test (22) release-safety gate.
• Re-ran the stable-release competitive boundary review on 2026-09-04; broader billing, gateway, waiting-room, dashboard, and entitlement-control-plane features remain intentionally outside core.
• First-class MCP Tasks runtime support remains gated on upstream stabilization rather than freezing an experimental adapter into v1.

Distribution

• This GitHub/source release does not publish to npm. First registry publication remains a separate explicit operation under #6.
• The GitHub Release workflow must validate the exact tagged protected-main SHA, pack and clean-install the exact five tarballs, generate SHA256SUMS, and attest the package artifacts before creating the release.

---

The attached .tgz files are the exact package artifacts validated by this release workflow. Verify them with SHA256SUMS and GitHub artifact attestations. Their presence does not mean the packages were published to npm; registry publication remains separately authorized.

v0.13.0

Thirteenth GitHub/source release candidate focused on closing the final v1 correctness, operations, distribution, and compatibility blockers discovered after v0.12. npm publication remains separately authorized under #6 and is not part of this tranche.

Correctness and recovery hardening

• Made McpUsageFlowStore.consume() the authoritative suspended-flow expiry decision so a second application-host clock cannot reject a flow already accepted by the shared store; binding and one-time consume semantics remain fail closed (#191).
• Added advisory onLeaseRenewalState fencing transitions for automatic heartbeat renewal ambiguity: first failed renewal reports uncertain, later successful renewal reports confirmed, and observer failure cannot change accounting state (#194).
• Added read-only VectorOperationReconciliationStore and built-in Memory/Redis/Firestore implementations for ambiguous initial vector-reserve acknowledgements. Exact operation identity, dimension units, and budget topology must match retained state; Cloudflare remains an explicit scalar-only reconciliation exception (#195).

Bounded long-running operations

• Added explicit Redis/Firestore retireHistoricalBudgets() maintenance APIs. Only caller-selected exact historical keys may be retired; active pending/liable references block the whole operation and bounded inspection overflow fails closed (#193).
• Added shared UTF-8 identifier and scalar/vector topology bounds before provider mutation, including bounded nested vector fan-out and regression tests at max/max+1 boundaries (#196).

Distribution and CI contract

• Made shipped package READMEs standalone-safe for npm/tarball consumers by replacing repository-relative documentation links and stale literal tarball versions; CI now inspects the README bytes from the actual packed artifacts (#192).
• Retired Node 20 from the CI matrix and protected required contexts. test (22) remains the aggregate release-safety gate and Node 22/24 are the supported runtime evidence (#197).
• Added minimum/current peer-compatibility CI for @modelcontextprotocol/server and redis without broadening declared peer ranges (#198).

Release boundary

• All five public package manifests are aligned at 0.13.0 with engines.node >=22.
• The base reserve -> liability -> grow -> renew -> settle accounting model remains unchanged; v0.13 is a blocker-closure checkpoint, not a new billing model.
• npm publication remains independently gated by #6 and requires separate explicit authorization.

---

The attached .tgz files are the exact package artifacts validated by this release workflow. Verify them with SHA256SUMS and GitHub artifact attestations. Their presence does not mean the packages were published to npm; registry publication remains separately authorized.

v0.12.0

Twelfth GitHub/source release focused on product and operational hardening around the frozen v1 accounting surface. npm publication remains separately authorized under #6 and was not performed.

Release and supply-chain hardening

• Bound GitHub/source releases to a protected-main commit with successful exact-SHA aggregate test (22) evidence, preventing an arbitrary tag from bypassing the normal release path (#177).
• Publish the exact five package tarballs validated by the release workflow as GitHub Release assets, with SHA256SUMS and GitHub build-provenance attestations; reruns verify existing assets byte-for-byte rather than replacing them (#178).
• Added Dependabot coverage for pnpm/npm and GitHub Actions, PR dependency review, weekly high/critical dependency audit, and immutable SHA pins for third-party workflow actions (#179).
• Added a known-bad release / emergency hotfix runbook with provider-aware rollback, roll-forward, snapshot-restore, GitHub release, and future npm containment guidance (#180).

Product / operator usability

• Removed stale pre-v0.11 planning language from current operator/provider documentation while preserving historical release notes (#181).
• Added a maintained English/Japanese competitor capability matrix covering Upstash, Kong, OpenMeter, Unkey, and Envoy with explicit Covered / Adopt / Helper / Out-of-scope decisions (#182).
• Added timezone-aware calendar-window metadata from the same accounting-key calculation plus a non-authoritative scoped quota/reset projection. DST 23/25-hour days, month/year boundaries, and explicit-clock behavior are tested; opaque custom keys still never invent reset semantics (#183).
• Added a reproducible provider benchmark/cost-profile harness for Memory, Redis, Firestore Emulator, and Cloudflare workerd with p50/p95/p99, contention, vector/growth/reconciliation workloads, safe remote opt-in, and versioned Node.js 22 local baselines (#184).

Validation / release boundary

• Reduced the always-on Firestore progressive-growth ambiguity stress from 24 to 12 iterations while retaining exact-replay evidence for observed emulator INVALID_ARGUMENT ambiguity; higher iteration counts remain suitable for manual release stress.
• Full workspace checks pass with 154 core, 86 Cloudflare, 28 Firestore, 27 MCP, and 47 Redis tests; fresh workerd conformance/integration and Firestore Emulator conformance paths are green.
• All five public package manifests are aligned at 0.12.0 and retain engines.node >=22.
• npm publication is not part of this release. First registry publication remains independently gated by #6.

---

The attached .tgz files are the exact package artifacts validated by this release workflow. Verify them with SHA256SUMS and GitHub artifact attestations. Their presence does not mean the packages were published to npm; registry publication remains separately authorized.

v0.11.0

Eleventh GitHub/source release and final pre-v1 completion freeze. npm publication remains a separate explicitly authorized operation and was not performed.

Pre-v1 contract freeze

• Froze provider-backed cost-bearing work on the existing atomic reserve -> liability -> growth -> renewal -> settlement lifecycle without adding billing-specific authority to core (#152).
• Froze the supported runtime floor at Node.js 22+, with Node 22/24 as supported evidence and Node 20 retained only as compatibility evidence (#105).
• Finalized persisted-state upgrade/rollback/future-schema boundaries for Redis, Firestore, and Cloudflare Durable Objects without resetting existing accounting domains (#106).
• Froze package names, current public subpaths, lifecycle/status/error vocabulary, scalar/vector parity, and MCP multi-round naming/scope for v1 (#161).
• Hardened Redis renewed-lease proof and Firestore progressive-growth contention evidence without broadening ambiguous runtime retry semantics (#166, #157).

Release safety and real Cloudflare evidence

• Made the protected test (22) context the aggregate release-safety gate over supported Node/Redis/package/tarball/clean-consumer evidence plus applicable Cloudflare workerd and Firestore Emulator integration (#160).
• Completed a real zero-downtime production-dogfood credential rotation against the deployed usage-control service: overlap accepted new and old credentials, the Cloud Run caller moved to the new Secret Manager version, a real production MCP caller succeeded, and the rotated-out credential was rejected after retirement (#24).
• Preserved the existing Durable Object/accounting identity during rotation; no fresh ledger/accounting domain was created and no Firestore fallback was enabled.
• No genuine Workers Free-plan exhaustion/platform-overload event occurred naturally during validation. Shared quota was not intentionally burned to manufacture one, so the production claim remains explicitly limited to observed deployed behavior plus existing local/workerd synthetic 429/503 fail-closed evidence.

Packaging / distribution boundary

• All five public package manifests are aligned at 0.11.0 and retain engines.node >=22.
• The final release gate covers real Redis, package/tarball inspection, clean-consumer imports, Cloudflare workerd, and Firestore Emulator evidence before the source tag is cut.
• npm publication is not part of this GitHub/source release. First registry publication remains deferred under #6 and requires separate explicit authorization.

v0.10.0

Tenth GitHub/source release focused on bounded operational usability and dogfood diagnostics. npm publication remains intentionally separate and deferred.

Added

• Added mcp-usage-control/operational with process-local bounded lifecycle counters, static runtime identity/capability metadata, and explicit scoped quota projection. The surface is diagnostic only and never becomes enforcement or billing authority.
• Added mcp-usage-control/settlement-outcomes with the canonical settlement vocabulary, bounded compatibility aliases, application-owned finite alias maps, and InvalidSettlementOutcomeError / invalid_settlement_outcome diagnostics that do not retain the rejected raw value.
• Added mcp-usage-control/thresholds with pure remaining-units / remaining-ratio evaluation and crossing helpers over an explicitly selected quota scope. Accounting-window identity/reset state and notification delivery remain application-owned.
• Added English/Japanese operational-usability guidance covering runtime identity, scoped remaining, settlement normalization, threshold crossing, privacy/cardinality boundaries, and the explicit non-claim around inferred active-reservation counts.

Operational safety / diagnostics

• Closed #76, #99, and #82 without changing Store accounting transitions or provider storage schemas.
• UsageOperationalMonitor exposes only evidence that can be represented without inventing a second accounting truth. Replayable/aggregate lifecycle events are not used to synthesize an authoritative active-reservation count.
• Invalid settlement vocabulary is distinguishable from Store/backend unavailability before settlement dispatch, while diagnostic delivery remains best-effort and cannot replace the canonical normalization error or alter enforcement.
• Observer/helper/notification failure cannot change admission, liability, renewal, settlement, replay, expiry, or quota outcomes.
• Authoritative remaining is projected only after the application selects the exact budget/window; unlike vector dimensions are never collapsed into one synthetic utilization total.

Packaging / release evidence

• All five public package manifests and the bounded core runtime identity are aligned at 0.10.0.
• CI verifies the new operational, settlement-outcomes, and thresholds files in the packed core tarball and imports all three subpaths from a clean consumer project.
• The release gate remains Node 20/22/24 with real Redis, Cloudflare local workerd integration, Firestore Emulator integration, package-content inspection, and clean-consumer verification.
• Source/local-tarball documentation no longer hard-codes an obsolete package version.
• npm publication is not part of this GitHub/source release. First registry publication remains a separately authorized operation tracked by #6.

v0.9.0

Ninth GitHub/source release preparation focused on repository-wide safety hardening. This preparation does not itself create the tag, GitHub Release, or npm publication; those remain post-merge release operations.

Safety hardening

• Closed the v0.9 repository-audit safety set #116-#127, covering retained-budget growth integrity, safe expiry/timer arithmetic, validation before mutation, unresolved MCP growth preservation, Firestore expired-liable reconciliation, Cloudflare remote/maintenance protocol validation, malformed-policy fail-closed behavior, vector-maintenance quota integrity, Redis recovery overflow, pre-auth reconciliation buffering, strict boolean authorization, and the cross-capability regression matrix.
• Preserved the existing scalar/vector accounting, replay, liability, expiry/recovery, and fail-closed contracts while tightening provider and capability intersections rather than adding a new product surface.

Firestore release blocker

• Resolved #143 without weakening vector-growth-vs-settle-race: settlement remains required to complete, and committed growth must be observed by settlement when growth wins first.
• Added bounded jittered outer retry only for definitive Firestore transaction aborts: gRPC ABORTED (10) and HTTP 409.
• UNKNOWN, UNAVAILABLE, INVALID_ARGUMENT, and other ambiguous/provider failures are not added to the adapter outer-retry allow-list.
• Reduced the vector-settlement contention window by skipping budget reads/writes when settlement releases no capacity, and added a dedicated 24-iteration Firestore Emulator growth-vs-settle stress case.

Release evidence / boundary

• PR #144 passed the Node 20/22/24 CI/package matrix, Cloudflare local workerd integration, and Firestore Emulator integration before squash merge.
• All five public package manifests are aligned at 0.9.0 for release preparation.
• After this preparation merges and the normal release gate is green, the exact tested main content is eligible for the v0.9.0 tag and GitHub Release.
• First npm publication is separately and explicitly authorized for this v0.9 release execution; publication remains a distinct post-source-release operation and #6 closes only after registry/provenance verification succeeds.

v0.8.0

Eighth GitHub/source release preparation. npm publication remains intentionally separate and is not authorized by this change.

Added

• Added provider-neutral scalar operation reconciliation through optional OperationReconciliationStore, UsageOperationReconciliationInput, and the common absent / active / expired / settled result vocabulary while keeping base UsageStore source-compatible.
• Added portable runOperationReconciliationStoreConformance() / assertOperationReconciliationStoreConformance() coverage for retained lifecycle status, repeated read-only expired observation, and fail-closed expected-state mismatch.
• Added bilingual operation-reconciliation documentation defining safe reattachment, retention-horizon semantics, explicit indeterminate/fail-closed behavior, and the boundary from business-result replay.

Provider implementation / proof

• Memory: reconcileOperation() reads retained in-process scalar state without running expiry recovery or mutating accounting; process restart remains an explicit historical-absence limitation.
• Redis: a read-only Lua lookup uses Redis TIME, HGET, and ZSCORE; expected reserved units and budget hashes are verified, and malformed settled/tombstone state fails closed instead of becoming absent. Real-Redis CI runs portable reconciliation conformance.
• Firestore: a read-only transaction looks up the deterministic hashed reservation document and validates expected retained units/budget hashes without cleanup/recovery writes. Emulator CI runs portable reconciliation conformance under the existing bounded-host-clock contract.
• Cloudflare Durable Objects: the existing authenticated read-only reconciliation protocol now returns the core v0.8 result type through reconcileRemoteCloudflareOperation(); reconcileRemoteCloudflareReserve() remains as a v0.7-compatible alias and existing local/deployed lost-ACK proof carries forward.

Safety / compatibility

• Reconciliation never reserves/releases capacity, marks liability, renews, settles, or rewrites replay state. It is status proof only.
• absent means only that no state is retained at lookup time; it is not historical proof after a Store retention horizon and never automatically authorizes replay.
• Backend/transport failure, corrupt/unsupported state, scalar/vector mode mismatch, and trusted expected-state mismatch reject and remain indeterminate/fail closed rather than being mapped to absent.
• Mutable budget limits are not historical operation identity: reconciliation verifies budget keys plus expected retained scalar units, preserving the existing same-key mutable-limit contract.
• The v0.8 generic capability is intentionally scalar-only. Vector initial-reserve ambiguity remains fail closed unless a future provider-specific mechanism proves an equivalent read-only contract.
• Business side-effect/result replay remains application-owned and separate from usage accounting.
• #81 is adopted for the future v1 stable surface as an optional scalar Store capability. #76/#82/#99 become the next v0.9 product decision gate.

Release boundary

• All five package manifests are aligned at 0.8.0.
• The normal release gate remains Node 20/22/24, real Redis, Cloudflare local workerd, Firestore Emulator, package tarball/content, and clean-consumer verification.
• This preparation does not create the v0.8.0 tag, GitHub Release, or npm publication.