v0.2.0

[0.2.0] - 2026-11-02

Added

• Durable Transactional Outbox Runtime (uns.Runtime & uns.Client):
  • Atomic SQLite/SQLAlchemy intake (uns_notifications, uns_events, uns_dedup) combining policy provenance resolution, idempotency verification (principal + source + idempotency_key), and deduplication window claiming (LEADER / FOLLOWER generations).
  • Fenced 60-second delivery leases (lease_token, lease_until) with pre-channel fencing (CHANNEL_ATTEMPT_STARTED), append-only per-channel attempt observations (CHANNEL_ATTEMPT_RESULT), LEASE_LOST recording, exponential retry backoff, and automatic follower settlement (DEDUP_SATISFIED on leader delivery; OBLIGATION_HANDED_OFF, DEDUP_OWNER_PROMOTED, and DEDUP_RELINKED on leader exhaustion).
  • Durable successor lineage (dedup_successor_id) and guarded replay (replay_blocked_by, replay_block_reason) preventing duplicate delivery when a successor obligation is pending or already satisfied (F-01, F-02).
  • Deadline/cancellation-aware SMTP admission and UNKNOWN provider outcome recording for timed-out in-flight sends (F-04a, F-04b).
  • Durable acknowledgment deadline sweeps (TIMED_OUT) and due-time ordered (callback_until, at, id) at-least-once terminal callback delivery (deliver_callbacks, F-06).
  • Operator dead-letter inspection (GET /api/v1/runtime/dead-letters), attributable cycle replay (POST /api/v1/runtime/notifications/{id}/replay), and non-replay failure resolution (DELETE /api/v1/dlq/{id}).
• Revision-Locked Policy Authority (uns.policy_runtime.PolicyRuntime):
  • Immutable ACTIVE policy snapshots (notification_policy_revisions, notification_policy_snapshots) locked at intake and read in a single lock-free SELECT during warm simulation/inspection (F-05).
  • Strict enforcement blocking producer overrides from weakening ACTIVE policies and blocking reserved adapter-steering metadata keys (slack_channel, email_to, pagerduty_severity, websocket_user_id).
• Unified HTTP, Console Read-Model, & WebSocket Service (uns / uns.app:create_app):
  • Consolidated FastAPI service mounting /api/v1/notifications/*, /api/v1/runtime/*, /api/v1/policies/reload, /ui/*, /ws/agents/{agent_id}, public /healthz, and authenticated /readyz and /metrics.
  • Pre-accept WebSocket authentication supporting native Authorization: Bearer headers and browser uns.v1 + bearer.<base64url> subprotocols with closed-list Origin validation.
• Trusted-Local MCP Server (uns-mcp):
  • Read-only default mode (stdio-local) and explicit --enable-writes mode (stdio-persistent) requiring UNS_DATABASE_URL, UNS_API_PRINCIPAL, and UNS_MCP_DELIVERY_CONFIRMATION_TOKEN with an owned lifespan recovery worker and runtime-bound read helpers (F-07).
• Explicit Database Maintenance & Archival CLI (uns-maintain & uns-migrate):
  • uns-migrate for idempotent additive schema bootstrap, successor-lineage reconstruction, and callback due-time normalization.
  • uns-maintain for bounded operational pruning, cursor continuation (--after-id), and O_EXCL mode-0600 SHA-256 verified JSON group archival (--archive).
• Responder & Operator Console (apps/ui) & Local Recording Stack:
  • React 19 + TypeScript 5.9 + ESLint 9 flat config + Vite SPA styled in the Modernist Swiss-grid design system (Archivo 800/600/400, warm paper #f3f2f2 / stone #eae9e9 / charcoal #201e1d / signal vermilion #ec3013, 0px corners, filled-delivery vs. outlined-response badge grammar) across six primary surfaces: /deliveries (with /deliveries/:id detail), /policy, /operations, /invariants, /audit, and /docs.
  • Server-verified session capability introspection (GET /ui/session), non-lossy capability pills (OPERATOR, RESPONDER, PRODUCER, READ-ONLY), tab-memory credential isolation, and multi-tab BroadcastChannel('uns_console_session') synchronization (UNS_SESSION_REQUEST, UNS_SESSION_GRANT, UNS_SESSION_SYNC, UNS_SESSION_EXPIRE, UNS_SESSION_CLEAR).
  • Responder obligation workflows (inline Acknowledge / Dismiss with responder notes, canonical owner vs. deduplicated follower lineage, automatic 409 Conflict recovery), operator dead-letter recovery (/operations full outer join of /api/v1/dlq + /api/v1/runtime/dead-letters, inline Replay / Resolve), Policy Workspace (GET /ui/policies/active, GET /ui/policies/revisions across ACTIVE/PREVIEW/DRAFT/RETIRED, dry-run simulator, tagged [TEST] live dispatch, atomic policy reload), dual-mode Audit Timeline (1e "By notification" lifecycle correlation with TIME TO RESPOND vs. 1d "All events" stream), and in-portal Documentation & Runbooks (/docs).
  • Persistent localhost recording deployment (deploy/local/, docs/LOCAL_DEPLOYMENT.md, docs/DEPLOYMENT_SMOKE.md) plus runnable first-party producer integration demo (examples/mip_producer_demo.py) and opt-in external channel smoke verifier (scripts/opt_in_channel_smoke.py).
• Live PostgreSQL 16 Operational Acceptance & Sustained Load Validation (tests/uns/test_postgres_and_load.py):
  • Out-of-the-box PostgreSQL driver support (psycopg[binary]>=3.2.0 in uns[sql] / uns[full]) verified in CI against postgres:16-alpine across schema migrations (uns-migrate), policy snapshot revision locking, deduplication leader/follower promotion, lease-fenced delivery, ACK/timeout callbacks, and SQLAlchemyReadModelAdapter queries.
  • Sustained concurrency and load suite validating 100-request burst intake and deduplication storm coalescing, 4-worker racing Runtime.dispatch(limit=...) lease contention with zero duplicate external sends, and concurrent policy reload interleaved with active intake.
  • Optional delivery_service and dlq_service dispatch integration on uns.signaling.send_signal().
• Comprehensive Documentation Suite (docs/):
  • Production Deployment reference (docs/DEPLOYMENT.md), complete API reference (docs/API.md), Support State Machine & Schema guide (docs/support/STATE-MACHINE-AND-SCHEMA.md), Troubleshooting Guides (docs/tsg/TSG-01 through TSG-06), User/Integrator Manuals (docs/user-guides/), and MkDocs Material GitHub Pages configuration (mkdocs.yml, .github/workflows/docs.yml).

Fixed & Hardened

• Same-Window Dedup Replacement & Callback Retention (uns.Runtime, uns.maintenance):
  • Linked dedup_successor_id and emitted OBLIGATION_HANDED_OFF when a new request replaces a failed solo leader within the same deduplication window, and preserved uns_dedup generation state while any retained notification shares dedup_key.
  • Refreshed per-callback lease timestamps (self.clock()) inside deliver_callbacks() and cleared callback_pending on 3rd-attempt exhaustion so exhausted callbacks do not block uns-maintain retention pruning.
• Email, Rate-Limiter, Policy Reload, & Audit Query Hardening:
  • Escaped HTML entities (html.escape) in EmailAdapter._build_html_body() and sanitized CR/LF characters from MIME header fields.
  • Keyed HTTP rate-limiter buckets by SHA-256 digests of verified API keys only, falling back to client IP for unauthenticated or invalid headers.
  • Constrained POST /api/v1/policies/reload to reject path traversal (..), enforce UNS_POLICY_DIR root boundaries when configured, and reject empty policy directories (loaded_count == 0).
  • Pushed event_type filtering and total_count computation into SQL WHERE / COUNT(*) clauses in SQLAlchemyReadModelAdapter.get_audit_events().
  • Bounded MetricsCollector sample storage with ring buffers (deque(maxlen=10_000)), validated X-Request-ID headers, capped serialized request metadata at 64 KiB, isolated RedisWebSocketSubscriber onto a dedicated thread pool, and hardened .github/workflows/python-tests.yml with strict mypy verification.