0.8.1

No breaking changes. Every 0.8.0 call shape is asserted unchanged in both lanes.

Framework adapters take the same terms as tool()

governTool, governTools and governedHooks now accept principal, agent, resource, context and the approval hook, each a value or a function of the call arguments.

Before this, a policy whose verdict depended on Cedar context could not be satisfied through an adapter at all. There was no way to supply context, so the rule failed closed on the documented integration path, and every decision was attributed to the agent rather than to the subject the call was made for.

Python framework plugins can already express intent, resource and context per call on the run handle. They cannot express an acting subject, and that limit is now stated rather than implied: passing principal, context or resource to a governed_plugin factory is refused by name with a message saying where the term actually goes.

A context binding may be asynchronous

counterSource may be async, because a durable store is a network call, but a context binding was synchronous, so a durable count could not reach a quota policy through a governed tool. A binding may now return a promise, awaited before the decision.

In Python this needs an async def tool body, since the decision is made before the body runs. On a synchronous body it fails closed with a TypeError naming the fix, and nothing is authorized.

authorize takes an already-resolved context in both lanes. Handing it an unresolved awaitable now raises UnresolvedContextError before anything reaches the engine and writes no decision record, where it previously coerced to an empty context and read as an ordinary denial.

A third breaking change in 0.8.0, now documented

The 0.8.0 notes listed two breaking changes and there were three. context.actor and context.actor_chain became reserved: the SDK sets them on every authorize and refuses a caller value that differs. An application that already used actor for a value of its own upgrades to a runtime throw on a path that worked in 0.7.x. An identical value is still accepted.

The migration is a rename, with a before and after in both languages and in a policy, in the identity model page. There is no transitional flag, and the page says why: a flag that let a caller supply the key would make every rule that reads it forgeable for as long as it was on.

Install

pip install "watchlight==0.8.1"
npm install @watchlight/sdk@0.8.1

Requires watchlight-engine >= 0.2, < 0.3 and @watchlight/engine ^0.2.0, both unchanged.