Repository navigation
johnnickell
John Nickell
Fight AccessControl v0.5.0
Breaking pre-v1 contract release. Requires PHP 8.5+ and Fight Common ^1.3.
Highlights
- Recoverable Agent provisioning and rotation with retained operation keys and safe outcomes; protected delivery, bounded restart recovery, maintenance and restoration admission guards.
- Package-owned human credential expiry discovery/cleanup, including email authority and reservation release after downtime or account-state changes.
- Complete Permission-based Feature lifecycle: declarations, atomic provisioning, preparation, fresh evaluation, revision-fenced management and reference-safe retirement.
- Agent name updates, minimal profile reads and protected self-service MCP profile Tools.
- Expanded OpenAPI components and corrected invitation-delivery status values.
Breaking integration changes
Consumers must implement current repository and authorization contracts, transaction-duration reference/authority fences, explicit delivery claim/outcome state, email reservation-revision binding and current Agent operation correlation/cohort/restoration readiness. The invitation status schema removes obsolete failed/confirmed; the old password-reset confirmation Command/component and raw-return Agent issuance APIs are removed. Managed policy requires the Agent repository.
Only the current pre-v1 API and persisted model are supported. There are no historical readers, legacy modes, compatibility shims or package-owned migration/backfill routes. No consumer data reset is authorized.
See the contract overview and changelog for detailed obligations and guide links. Package acceptance/publication does not qualify actual consumer databases, keys/sinks, scanner/runtime security, restore procedures, enrollment activation or credential use. Consumer adoption and deployment remain separate.