v0.8.0

v0.8.0 — Role revisions and recovery composition

A breaking pre-v1 minor for framework-neutral identity and authorization. Requires PHP 8.5+ and Fight Common ^1.3, unchanged from the previous release.

Read the release and integration overview and matching tagged documentation before adopting this version. The signed source snapshot retains its truthful preparation wording; that wording is not a reason to move or recreate the tag.

Breaking integration requirements

• Role caller revisions: detail/list Views expose authoritative revision; custom rename/remove Commands require the displayed expected_revision. Persist incarnation/revision across all Role writers and hydration, include revision in registration comparisons, and implement transaction-duration RoleRepository::validateCurrent(). On RoleConflictException, read current state and reconfirm intent rather than silently substituting a newer token. See Role composition.
• Recovery composition: password-reset generations require persisted RecoveryAuthority; User repositories implement transaction-duration recovery validation. Reset workers require the shared User repository, and disable/delete handlers require the shared reset-grant repository. See operation outcomes and recovery composition.
• Update caller payloads, Views, constructors and persistence implementations to the current contracts. Regenerate consumer-owned OpenAPI documents against this version's components. No compatibility defaults, historical readers or migration/backfill routes are supplied; no destructive data reset is authorized.

Other changes

• Coarse constant failure notifications and safe context preserve the primary throwable; consumers still sanitize responses/logs and protect every entry point. Pre-commit rollback, post-commit publication and uncertain outcomes remain distinct. The recoverable Agent provision/rotation warning-result exception remains narrowly scoped.
• Managed-policy preview/apply share current reference eligibility. Preview is read-only, not a reservation or authorization; apply replans and retains final expected-state/reference fences.
• Refreshed package README and light/dark identity, focused integration routes, optional contributor workflows and release-documentation consistency checks.

Verified package evidence

• Signed annotated tag v0.8.0, object 6d696c0ae5bb843366b601633fed3af3311b7a48, identifies exact main merge 319738255e682d587642b67856039f882b9588d6 from PR #134.
• Independent release-content review accepted the prepared content; independent documentation QA passed 8 scenario groups / 14 walkthroughs, with no findings. The main merge preserves that exact tree.
• Fresh exact-main ./bin/release certify 0.8.0: 2399 tests / 45422 assertions, exact 7452/7452 statements, plus separate OpenAPI composition 16 tests / 659 assertions. No final warnings/skips.
• Packagist normalized version 0.8.0.0 source and distribution references match the certified commit. This is registry projection, not proof of consumer installation.

Package tests and publication do not qualify actual consumer persistence, concurrent writers, permissions, worker/provider behavior, restart, keys or deployment. Consumer integration/installation, enablement and production deployment remain separate decisions. This release does not select v1.0.0 or establish a new maintenance/support window.

Full changes: v0.7.0...v0.8.0