v0.7.1

First release, extracted from cairn-provider-garmin 0.7.0. Implements the
cairn-core 0.7 worker contract and is released in lockstep with cairn-core
0.7.1; cairn-provider-garmin 0.7.1 is built on it.

Added

• Worker: NATS connection (enrollment token or user/password), the core
  release check (ADR 0005), presence heartbeat, manifest publish with
  provider_meta, one durable pull consumer per registered job kind
  (fetch_source, parse_blob, backfill, reconcile, import_metrics,
  import_gear) with ack extension, bounded retries, parser_too_old
  back-off and RetryLaterError, the discover, OAuth-exchange and webhook
  verify responders, and the webhook event consumer.
• Results: claim-checked publish_result, publish_failure envelopes,
  publish_reconcile_result, enqueue_fetch with deterministic msg-ids.
• archive: envelope, best-effort archive, result upload, download with
  re-presign. creds: cairn.creds.<provider>.get. reconcile: window,
  watermark and coalescing helpers. versions: release and parser rules.
• TokenSource over cairn.tokens.* with an in-process cache, worker-driven
  refresh and a cross-instance refresh lock in the cairn_rate_limits KV
  bucket (lock.<provider>.<account_id>, compare-and-set lease).
• oauth: exchange_code (body or Basic client auth, PKCE verifier, extra
  parameters, account id from the response or a lookup) and refresh_grant.
• RateLimiter: the Go worker's KV bucket semantics (<provider>:<app_id>:<window>,
  CAS reservations, sync_usage, force_refill) with per-second, minute,
  quarter-hour, hour and day windows plus custom ones.
• webhooks: constant-time HMAC sign/verify (hex/base64, body or
  timestamp+body) and the verify wire types.
• cairn_provider_sdk.testing: in-memory fakes (FakeNC, FakeJS, FakeKV,
  FakeMsg, FakePullSub, make_worker) and an integration kit
  (NatsServer, bootstrap_core, FakeCore, BlobStore).
• The generated contract stubs cairn.v1 and cairn.worker.v1 ship in the
  distribution; scripts/sync-proto.sh regenerates them from cairn-core.
• examples/minimal: a runnable worker for a fake provider, tested end to end.
• cairn_provider_sdk.testing: validate_activity, validate_metric,
  result_problems and assert_importable apply core's import rules to a
  result (activity: known type, time order, durations, IANA timezone;
  metric: user, account and external_id set, a timestamp, one value, a
  health data type or valid store key, the value shape a reserved key
  dictates; a value sent both as a data type and as its reserved store
  twin), as the Go SDK's sdktest does. FakeCore records the problems of
  every result it collects and close() fails on any.

Install

uv add "cairn-provider-sdk @ https://github.com/opencairn-org/cairn-provider-sdk-python/releases/download/v0.7.1/cairn_provider_sdk-0.7.1-py3-none-any.whl"

The wheel and sdist are the ones make build produced in the verifying run.
checksums.txt is signed keyless with cosign (checksums.txt.sigstore.json), the
build is attested by GitHub Actions and the attached SPDX file is the wheel's SBOM. Verify with

cosign verify-blob --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/opencairn-org/cairn-provider-sdk-python/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com checksums.txt
gh attestation verify cairn_provider_sdk-0.7.1-py3-none-any.whl --repo opencairn-org/cairn-provider-sdk-python