v0.9.1

0.9.1 (2026-09-01)

Bug Fixes

• coerce: guard the discriminator read, which was the last unguarded line (#16) (994703b)

v0.9.0

0.9.0 (2026-09-01)

⚠ BREAKING CHANGES

• logging: the JSON log record's message field is renamed from msg to
  message. A dashboard, alert or saved query selecting on msg will stop
  matching and must be updated. The text format is unchanged, as is every
  call site. Approved by the maintainer before committing, per AGENTS.md.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

• docs(observability): describe the record shape the emitters now write

The guide listed msg among the fields a caller cannot replace, which was the
old key and is now the parameter name instead. It also did not say what the
record contains, so the one thing worth knowing -- that the text is under
message because that is what RunPod's viewer reads -- had to be discovered
from the source.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

• docs(logging): correct the record shape in the _format_json docstring

The one-liner still said "Always includes ts, level, logger, msg" while the line
below it emitted message. A docstring describing a record shape is the thing a
maintainer reads instead of the dict literal, so a stale one sends the next
reader to build against a field that is no longer written.

Caught in review on the same PR that renamed the key.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com

Bug Fixes

• logging: name the JSON message field message, as RunPod reads it (#15) (0678193)

v0.8.1

0.8.1 (2026-09-01)

Bug Fixes

• coerce: close the last two routes out of the rejection envelope (#14) (f236a2a)

v0.8.0

0.8.0 (2026-08-31)

Features

• share the metric catalog and the single-value input validators (#13) (5b900c8)

v0.7.2

0.7.2 (2026-08-27)

Bug Fixes

• net: let a caller-supplied URL refuse the local-fetch bypass (e106c3f)
• net: tell an operator something they can act on, and stop calling file_url operator-owned (a609974)

v0.7.1

0.7.1 (2026-08-27)

Bug Fixes

• release: write the version into both distributions, not just the root (50d5e31)

v0.7.0

0.7.0 (2026-08-27)

Features

• transport: make the cap refusal opt-in, and measure a whole response (c6c485c)
• transport: refuse a response the gateway would silently discard (152cc00)

Bug Fixes

• transport: actually call the cap check, and fix two gaps in its messages (aa770c5)

v0.6.0

0.6.0 (2026-08-26)

Features

• client: require 3.10.12 and delete the data-filter emulation (c44f8bb)
• client: share the response-reading half with consumers (1dca841)
• client: ship the client half as its own distribution (ac92805)

Bug Fixes

• client: apply the quotas to tar, check member paths, keep setgid (2730aba)
• client: bound tar detection, shut the socket down, normalise names (aca7f12)
• client: bound tar member metadata before it is read (3891a83)
• client: canonical member paths, prepended data, a deadline that bounds (9a19afe)
• client: case collisions, a counted directory, and zstd errors (306e193)
• client: charge metadata before the constructor, and four more boundary gaps (74540c0)
• client: check every redirect hop, and four smaller gaps (1adb549)
• client: close five leaks in the error boundary, and correct one claim (b30dd48)
• client: close four more boundary gaps, one of them a wrong answer (756b49e)
• client: close the boundary class, not the four reported instances (37a010e)
• client: container-aware collisions, ZIP64 stubs, header-phase cancellation (f3c8e4d)
• client: detect the outer container, and bound what a response can cost (679c293)
• client: judge the requested origin when a proxy carries the request (c8052af)
• client: make the isolation promise real, and close three more type gaps (ebc047f)
• client: more zip constructor failures, and strict name encoding (b4e565a)
• client: one filename rule, incremental quotas, a download deadline (77ba730)
• client: parent components, ZIP64 offsets, and real cancellation (2168780)
• client: proxied IPv6 origins, symlink aliasing, and a live probe control point (60ae2ff)
• client: rename the URL helper, and guard destination resolution (c122dd5)
• client: repair two tests that were not testing anything, and three defects (861e4ae)
• client: routability policy, cumulative metadata, duplicate names, cap access (54d98c6)
• client: start the deadline before open, preflight the zip entry count (c4454cb)
• client: the legacy tar fallback needs a real mode, not None (200cb17)
• client: transcribe the data filter's mode rules, and catch timestamp errors (8a49c3a)
• client: validate the whole authority, and finish the legacy tar fallback (6036e25)
• client: zip name decoding, symlink loops, and name length (c8ced3e)
• obs: restore the re-exports the split dropped, and assert the surface (148156e)
• test: assert the destination mode, not a umask computation (980a846)

Refactoring

• bring every file under a 500-line cap, and enforce it (09c9662)
• client: split responses.py into modules under 500 lines (bda2c69)

Documentation

• agents: describe the consumer generically (6a5590f)
• agents: never mark a change breaking without asking (ff59acc)
• drop review-process narration from comments and docstrings (8503ea8)
• net: say which URL check is the complete one (cb9536d)

v0.5.0

0.5.0 (2026-08-21)

⚠ BREAKING CHANGES

• obs: probe_enabled() and WorkerConfig.probe_default are removed, _ENABLE_PROBE and _DISABLE_PROBE are no longer read, and probe_filesystem() no longer raises PermissionError. A worker that wants a gate implements one: it reads whatever variable it documents and calls probe_filesystem() only when it decides to. A worker that had probe_default=True deletes that line and keeps calling the function. The hyphenated token is the spelling git can parse as a trailer, since a trailer token may not contain a space.

Refactoring

• obs: hand probe policy back to the worker (2392cdb)

Documentation

• keep the migration gate fail-closed (9e23b6f)
• record who owns a worker-specific knob (f5765c6)

v0.4.0

0.4.0 (2026-08-21)

⚠ BREAKING CHANGES

• config: Before 0.3.1, filesystem probes were enabled by default,
  _DISABLE_PROBE controlled them, and direct probe_filesystem() calls were
  not rejected by an internal policy guard. Probes are now disabled by default,
  _ENABLE_PROBE is authoritative, and disabled direct calls raise
  PermissionError. Version 0.4.0 adds WorkerConfig.probe_default and accepts
  _DISABLE_PROBE as a deprecated fallback. Unknown non-blank override
  values disable probes.

Features

• config: make filesystem probe policy worker-defined (db5ff55)

Documentation

• repo: document consumer compatibility policy (5c20870)