Release v0.4.0 · praxis-proxy/policy

Added named secrets: providers and values, startup resolution, and host-driven refresh. Built-in file and env providers support local and Kubernetes-mounted credentials. (#97)
Added a Vault KV v2 secret provider behind secrets-vault, with Kubernetes and AppRole authentication through the host HTTP transport. (#103)
Added an opt-in quota plugin backed by Limitador for per-principal LLM token budgets. (#116)
Added the ibmverify JWT claim mapper preset for scalar or array collection claims. (#134)
Added an identity/api-key resolver with file and HTTP directories, shared identity mapping, and bounded caching. Configure the backend with provider:; the facade exposes the resolver through the api-key feature. (#125, #135, #136)
Documented how to add and test provider-specific JWT claim mapper presets. (#128)

Consolidated the nine bundled extensions into praxis-policy-builtins, with one feature per extension. The facade's features, re-exports, and policy kind strings remain the same. Direct users of a retired extension crate must switch to praxis-policy-builtins with the matching feature to avoid duplicate registration. See the crate mapping. (#140)
JWT, OAuth, and CIBA configuration errors now name the plugin kind instead of the former crate name; update log or alert patterns that match this text. (#140)
Moved the configurable identity claim mapper to praxis_policy_core::identity::mapping. Rust callers using the JWT plugin's module paths must update their imports; ConfiguredClaimMap::new now takes a MappingProfile. The operator's claim_map: configuration is unchanged. (#119)
Exposed execute_with_retry for secret providers using the host transport. (#103)
Replaced serde_yaml with yaml_serde and updated regorus to 0.12.0. (#121, #114)

Kept dotted subject and client membership names from creating ambiguous flattened policy aliases. (#126)
Sized Vault login JSON buffers before serialization to avoid leaving credentials in a reallocated buffer; added an optional live Vault KV v2 test. (#141)

New Contributors

Full Changelog: v0.3.1...v0.4.0