Skip to content

v0.14.1 — per-key identity

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 19:43
v0.14.1
9033d1f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights — per-key identity

v0.14.1 retires long-lived bootstrap/static NATS tokens. Every self-minting principal (an agent pod, a tool pod, a scriob pod) now holds its own Ed25519 key and presents a short-lived, self-minted identity JWT as its NATS connect credential — re-minted on every (re)connect, verified by the Hub auth-callout responder against the principal's stored public key.

  • NatsClient.connect(auth_token=...) accepts a zero-arg token provider re-minted per (re)connect (never a bare string); IdentityMinter self-mints the short-lived EdDSA JWTs; static_token_provider wraps a standing credential for platform services that bypass the callout.
  • NatsClient.is_healthy — a readiness gate that trips on a persistent authorization-violation reconnect loop (the "wedged auth" signal).
  • Tool pods: per-key-only serve entrypoint (static fallback removed), reply inbox scoped on the pod id (no more _INBOX.* permissions violations), and a resilient initial-connect retry that survives unordered platform startup (then fails visibly).
  • Hardening: IdentityMinter.from_pem maps an encrypted-key TypeError to IdentityTokenError; auth-violation detection also matches the typed nats.errors.AuthorizationError.

Also in this release

  • memory — pgvector cast / search_path fixes for the agent L3, extraction user_id threading, robust JSON-payload extraction from LLM responses, agent-owned namespace resolution.
  • models — shared NameTranslatingChatMixin (closes the OpenAI ainvoke/invoke gap); dotted tool-call name forward-translation.
  • core / nats — cross-worker cancel-by-key primitives; agent-pod ratelimits KV bucket grant.
  • channels — drop pre-startup Slack replays + edit/delete subtypes.

Notes

  • PyPI publishing is held for this release — the PyPI account is in timeout while v0.14.0 is still being pushed, so the pypi-publish job is intentionally commented out in the release workflow. The built sdists + wheels are attached to this GitHub release; the PyPI upload will follow once the account is available.

Full unit suite: 9375 passed, 2 skipped.

What's Changed

  • ci: publish all packages to PyPI via trusted publishing on release by @pacepace in #139
  • v0.14.1 — per-key identity + bundled memory/models/nats fixes by @pacepace in #140
  • v0.14.1 release → main by @pacepace in #141

Full Changelog: v0.14.0...v0.14.1

Contributors

pacepace
Assets 48
Loading