v0.30.0

Highlights

A caller can say who it is. A telemetry row used to name what ran — operation, provider, model, configuration — and who was logged in, but never which piece of software placed the call. A wizard task, a scheduler run and a downstream extension all looked like the operation they used. Any options object now takes ->withCallerSource('my_extension', 'operation'), and that identity is persisted on the telemetry row without ever reaching the provider. Unannotated calls keep writing an empty origin, so existing rows and consumers are untouched. The channel rides the options path deliberately: the alternatives were a positional metadata array the feature services do not expose, or a global "current caller" that breaks the moment one call runs on behalf of another (@CybotTM, ADR-177).

The driving consumer is nr-llm-compat, which reroutes third-party AI extensions through nr-llm without modifying them and tags every intercepted call — which turns telemetry into an inventory of the AI software actually running on an installation.

Both telemetry write sites were moved together: the streaming dispatcher records the caller source exactly as the middleware does, so a streamed call is not silently anonymous.

Also in this release

• A forced skill is now resolved by the same rule as a forced snippet, so the two stop disagreeing about what "forced" means (@CybotTM, ADR-175).
• ADR-176 separates a per-call outcome from the approval gate — the record that the outcome work in 0.31.0 builds on (@CybotTM).
• ADR-169 is accepted and the management-grant reservation retired (@CybotTM).
• step-security/harden-runner moved to v2.21.0.

Upgrading

Additive. AbstractOptions gained the wither and its two getters; the telemetry table gained two columns that default to empty. Nothing needs to change in a consumer that does not want to name itself, and a caller that does name itself makes a claim nobody verifies — the attribution is an observability signal, not an access control.

Installation

composer require netresearch/nr-llm

Publication status

• TER: extensions.typo3.org/extension/nr_llm — 0.30.0 verified
• Packagist: packagist.org/packages/netresearch/nr-llm — 0.30.0 verified
• Documentation: docs.typo3.org/p/netresearch/nr-llm/0.30/en-us/ — render verified

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-llm-0.30.0.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-llm-0.30.0.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.