v0.2.0

What's Changed

🔧 CI & build

• ci: retire the orphaned coverage badge pipeline by @EricAndrechek in #520
• build(lint): enforce WH001 everywhere, drop vendored skill by @EricAndrechek in #522
• feat(settings): hot-reload the settings directory at boot and runtime by @taitelee in #508
• feat(stream)!: positional rows on NATS and SSE, columns sent apart by @EricAndrechek in #554
• feat(cache): shared redis cache, snapshot keys, uncached write pipes by @EricAndrechek in #614
• ci(integration): split the suite into parallel parts, select by tag by @EricAndrechek in #756
• fix(build): pin Go toolchain to go.mod and show pnpm install errors by @EricAndrechek in #757
• ci: save the large caches only from main by @EricAndrechek in #758
• ci: reuse Go build objects across pushes of a PR that changes deps by @EricAndrechek in #794
• ci: pull Docker Hub test images through the mirror.gcr.io cache by @EricAndrechek in #808
• ci(e2e): cache the oldest-Node download of the SDK dist smoke by @EricAndrechek in #803

📚 Documentation

• docs: update README.md by @jfwoods in #502
• fix: admin_role added to policy type in typescript sdk by @EricAndrechek in #504
• feat(docs): expand PostHog instrumentation on the docs site by @jfwoods in #505
• feat(settings): add settings-directory validation and validate CLI by @taitelee in #500
• feat(docs): add "was this page helpful?" feedback widget to docs pages by @jfwoods in #507
• fix(docs): point the live demo at the new WaveHouse Cloud backend by @EricAndrechek in #542
• fix(policy): reject no-op rules, drop the policy HTTP surface by @taitelee in #541
• fix(cors): make cors.allowed_origins [] deny every browser origin by @taitelee in #546
• feat(discovery): widen schema discovery with DDL, position, version by @EricAndrechek in #550
• feat(policy)!: role-first policies.json with split permission types by @EricAndrechek in #551
• feat(ingest)!: require a declared Content-Type and honor it by @EricAndrechek in #552
• refactor(ingest): buffer the body, add type-layer seams and encoder by @EricAndrechek in #553
• docs(api,deployment): examples and BYOS notes for the positional wire by @EricAndrechek in #555
• deps: bump astro to 7.2.10 with a policy-clean lockfile by @EricAndrechek in #579
• feat(config): refuse unbound WH_* env and unusable data_dir at boot by @taitelee in #569
• refactor(app): extract the process wiring from main.go into internal/app by @taitelee in #585
• refactor(mq): seal the MQ boundary behind an intent-level broker API by @taitelee in #586
• feat(tenant): resolve X-Tenant-ID before auth and thread the tenant by @taitelee in #593
• feat(settings): nested settings directory with a per-tenant registry by @taitelee in #598
• feat(cors): decide the allowlist from the request's tenant by @taitelee in #600
• feat(cache): key the query cache and singleflight by tenant by @taitelee in #601
• feat(dedupe): one store per tenant under data_dir//dedupe by @taitelee in #602
• feat(clickhouse): tls, headers, pool sizes and a connection ceiling by @taitelee in #603
• fix(auth): refuse tokens when no secret and no JWKS URL are configured by @taitelee in #607
• feat(auth): one token verifier per tenant, fetched off the boot path by @taitelee in #604
• feat(mq): lead every subject with the tenant by @taitelee in #609
• feat(clickhouse): one pool per tuple and one schema registry per tenant by @taitelee in #610
• feat(app): end a removed tenant's streams, one Pebble for every tenant by @taitelee in #611
• feat(mq): give every tenant a queue of its own by @taitelee in #612
• fix(config): keep an explicit false/0/"" from config.yaml by @EricAndrechek in #632
• fix(discovery): jitter the refresh retry backoff by @EricAndrechek in #616
• refactor(keyenc): one key escaping, keep '-', DLQ counts per table by @EricAndrechek in #655
• fix(ingest): retry ClickHouse outages instead of dead-lettering by @EricAndrechek in #619
• feat(config): choose each layer's implementation at boot by @EricAndrechek in #618
• feat(coord): leases, in-process implementation by @EricAndrechek in #615
• fix(api): map ClickHouse query failures by class, not HTTP status by @EricAndrechek in #627
• feat(app): process roles by @EricAndrechek in #622
• test(mq): one conformance suite for every Broker by @EricAndrechek in #623
• fix(dedupe)!: reserve/commit ids, windowed ingest, retention, dynamodb by @EricAndrechek in #625
• fix(mq): keep one tenant's failed queue join from ending ingest for all by @taitelee in #680
• feat(mq): external nats broker with sharded, pinned ingest workers by @EricAndrechek in #624
• fix(app): rediscover a tenant's schema when a reload moves it by @taitelee in #682
• fix(settings): refuse boot on a nested directory that serves no tenant by @taitelee in #711
• feat(sdk): add codegen --tenant and --operator-key flags by @taitelee in #729
• build(test): keep make ci's time limits from killing healthy runs by @taitelee in #734
• chore(docs): point the live demo at project 86g987n8jcn6mttdgqrr by @EricAndrechek in #736
• build(deps): move to otel 1.47 and hold grpc off 1.84 by @EricAndrechek in #742
• feat(stream): give each tenant its own keepalive wheel by @taitelee in #738
• build(deps): disable pnpm's hoisted fallback so phantom deps fail by @EricAndrechek in #748
• test(sdk): smoke-load built entry points at the oldest Node by @EricAndrechek in #749
• fix(agents): key review markers to the reviewed commit and worktree by @EricAndrechek in #755
• docs(tenant): fix the multi-tenant bootstrap, header and stream 404 docs by @taitelee in #761
• docs: sync the development guide with the Makefile and tree by @EricAndrechek in #759
• build(go): move to go1.26.9 and x/net v0.60.0 for security fixes by @EricAndrechek in #785
• build: share the Go build cache across worktrees with -trimpath by @EricAndrechek in #793
• fix(cache): retry Close's last bump delivery in its budget by @EricAndrechek in #791
• feat(settings): a tenant's secrets live in its config.json by @taitelee in #786
• fix(sdk): give CommonJS consumers their own type declarations by @EricAndrechek in #792
• ci: add make ci-remote and make the repo's hooks fail closed by @EricAndrechek in #798
• feat(api): /readyz consults the external queue, not just ClickHouse by @taitelee in #802
• docs(deps): document the Dependabot release-age lockfile fix by @EricAndrechek in #801
• ci(lint): lint integration-tagged Go files and fix what it finds by @EricAndrechek in #807
• docs(release): prepare the 0.2.0 changelog and upgrade guide by @EricAndrechek in #821

🧹 Other changes

• fix(ci): make classify-paths fail loudly when grep fails by @EricAndrechek in #549
• deps: crypto package bump to fix vuln by @EricAndrechek in #560
• test(mq,app): fit the unit budget; fail fast on an uncreatable store by @EricAndrechek in #647
• test(mq): tolerate the nats version advisory and speed up topology tests by @EricAndrechek in #745
• test: fix five flaky tests at their cause by @EricAndrechek in #744
• fix(agents): stop the reviewer skip from refusing the first reviewer by @EricAndrechek in #782
• test(integration): wait for live fan-out in the NATS e2e test by @EricAndrechek in #788
• test(integration): stop the stuck-shard test racing its batch window by @EricAndrechek in #789
• test(mq): wait for the holder before TestExternalNATS_ResetOrphaned asks by @EricAndrechek in #804
• test(mq): poll the shard's pending count in TestExternalNATS_ShardUnits by @EricAndrechek in #814
• test(unit): run internal/app's tests in parallel to fit the unit budget by @EricAndrechek in #811

📦 Dependencies

• deps: bump github.com/moby/go-archive from 0.2.0 to 0.3.0 by @dependabot[bot] in #496
• deps: bump the go-deps group with 3 updates by @dependabot[bot] in #511
• ci: bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the actions-deps group across 1 directory by @dependabot[bot] in #513
• deps: bump starlight-links-validator from 0.25.2 to 0.25.3 in the npm-deps group by @dependabot[bot] in #512
• deps: bump the go-deps group across 1 directory with 17 updates by @dependabot[bot] in #533
• deps: bump the npm-deps group across 1 directory with 2 updates by @dependabot[bot] in #534
• deps: bump the go-deps group with 2 updates by @dependabot[bot] in #570
• ci: bump the actions-deps group across 2 directories with 1 update by @dependabot[bot] in #573
• deps: bump the npm-deps group across 1 directory with 3 updates by @dependabot[bot] in #574
• deps: bump the go-deps group across 1 directory with 15 updates by @dependabot[bot] in #806

Full Changelog: v0.1.0...v0.2.0