Changelog¶

Generated by git-cliff from the commit subjects. Do not edit by hand: each release rewrites this file. Fix a wrong entry by fixing the commit message convention, not the file.

0.10.0 - 2026-10-22¶

Breaking changes¶

docs: Generate the API reference on main, not in git (#1529)
catalog: A metric lists one shared calendar per source (#1523)
exec-bigquery: Run a domain_delegation caller as their address (#1457)
exec-datafusion: Merge the arms of a drill-across plan (#1513)
federation: Carry a truncated crossing key into the fact leg (#1514)
federation: Name the refusals of a declared key cast (#1515)
federation: Carry up to three lookup legs in a plan (#1500)
domain: A plan key may truncate its column to a grain (#1496)
catalog: A relationship may declare how its two keys compare (#1495)
config: A direct workload-identity source needs a delegation hop (#1461)
identity: Stop verifying past a key set source's declared ceiling (#1497)

Features¶

domain: Declare the refusals for planning several lookup legs (#1535)
federation: Join a declared key pair through its cast (#1527)
domain: Declare the drill-across refusals and run a plan's legs (#1524)
domain: Add the drill-across plan for several metrics (#1498)

Fixes¶

examples: Run the cube and metrics-layer examples from their READMEs (#1520)
exec-clickhouse: Swap a reloaded fixture table in, never empty it (#1518)
examples: Run the federated example as its README documents (#1511)
xtask: Refuse a failed git call in the causality gate (#1509)

Documentation¶

slides: Add a why-sutura slide after the problem statement (#1533)
catalog-datahub: An endpoint joins only through the urn it names (#1526)
slides: Keep build steps off the public slides page (#1525)
slides: A meetup deck, and deck-only diffs skip the Rust legs (#1512)
examples: Add a settings example for an API gateway upstream (#1510)

Tests¶

xtask: Give the slow gate cells a load-tolerant nextest ceiling (#1507)

Build¶

deps: Unvendor utoipa-swagger-ui, use the published 10.0.2 (#1517)
deps: Bump webpki crates for RUSTSEC-2026-0381 and -0382 (#1506)

CI¶

examples: Run the runnable examples on change (#1519)
Bump the github-actions group with 2 updates (#1501)

0.9.0 - 2026-10-19¶

Breaking changes¶

exec-bigquery: Run a google_login caller as their Google login (#1445)
federation: Refuse a cross-source relationship with truncated key (#1488)
http: Read the inbound key set from an https URL (#1483)
app: Refuse run_sql over an unserved source shape as a 409 (#1469)
http: Build the request state only from settings /v1 may serve (#1465)
chart: Refuse an inbound block with no mode and extraEnv security names; fix stale /v1 prose (#1459)
config: Read every Oracle source over verified TLS only (#1446)
config: Declare one of three BigQuery caller-identity modes (#1442)
chart: Musl image default, telemetry values, gateway refusal (#1431)
catalog-rdbms: Read an Oracle dictionary over verified TLS only (#1432)
config: Refuse /v1 start-up without inbound identity (#1420)
federation: Pin each table's schema from the catalog (#1389)
app: Refuse a federated leg that is not among the cut's legs (#1382)
http: Honour tools.run_sql.enabled on every agent route (#1384)
domain: Run a federated plan's legs through a cut and a runner (#1358)

Features¶

http: Admit a gateway assertion once when single use is declared (#1486)
xtask: Add a shard input to the claim-mutation-kills run (#1479)
http: Keep a rotated-out key set verifying behind a gateway (#1474)
http: Read a PEM key file with a thumbprint key id (#1460)
identity: Record the OAuth client a token names on each audit line (#1463)
identity: Accept a path or client-id audience, opt-in scp/roles, a gateway grant (#1434)
exec-clickhouse: Run a federated leg (#1433)
mcp: Log and count /mcp questions as /v1 does (#1424)
chart: A values flag to run the performance image (#1418)
domain: A typed refusal for a run_sql plan over several sources (#1408)
identity: Accept a gateway assertion that replaced Authorization (#1410)
config: Let run_sql start over an acknowledged shared source (#1391)
app: Name a federated leg the charged cut did not give out (#1386)

Fixes¶

ci: Pass minimum-gb via env, seed the falsifier at the registry counts, keep the walk out of .sutura-dev (#1473)
deps: Vendor utoipa-swagger-ui to move zip off the yanked 8.x (#1472)
http: Name the tools.run_sql.enabled switch in the /v1 refusal (#1458)
xtask: Carry a test file moved between compiled paths as moved (#1454)
config: Name the hop position in a delegation refusal (#1453)
deps: Bump rustls to 0.23.46 for RUSTSEC-2026-0346..0349 (#1444)
xtask: Give causality's base run the head run's tier (#1438)
xtask: Read the causality diff as plain text (#1427)
xtask: Hold a test file deleted whole to the removed-test rule (#1406)
chart: Mirror the binary's token refusal; pin no UID by default (#1412)
mcp: Name the switch when the deployment turned a tool off (#1405)

Refactoring¶

domain: List every refusal beside the enum, not in a test file (#1487)
Move items out of five files near the line cap (#1485)
config: Name the inbound key source as a KeySetLocation (#1467)

Documentation¶

adr: Fan-in lookup legs also serve a chain that crosses twice (#1477)
Say what a key-set look logs; name every fixtures item (#1492)
adr: Decide a digest per metric for a remote leg (#1491)
adr: Decide the leg transport between two sutura nodes (#1478)
federation: Record the cut findings for PR 5b (#1476)
release: Pin the signer workflow in the verify commands (#1475)
examples: Start sutura and post the question in metrics-layer (#1449)
examples: A federated demo over Postgres, ClickHouse and DataHub (#1440)
Published-port record, gateway guide, pinned helm (#1416)
adr: Federated legs run as the caller (#1381)
cube: State which identity each Cube hop uses (#1378)

Tests¶

federation: Pin the exact compare of a text join key (#1484)
cli: No-echo cell for E19 over /mcp (#1480)
cli: No-echo cell for the Cube warehouse token and E19 (#1466)
federation: A key read as integer and as text is refused when run (#1468)
cli: No-echo cells for E14, E36 and E16 (#1451)
chart: Ask the /v1 start-up refusals in the chart cells (#1450)
http,tls: No-echo cells for E33, E2 and E7 (#1398) (#1415)
chart: Hold refusal cases to the binary's start-up refusals (#1419)
cube: Declare regions multi-valued; fail at the mint if no list (#1383)
serve: Pin the delegation refusal sentence (#1380)
app: Refuse a live bigquery cell outside CI (#1376)
Read live bigquery env through support modules (#1379)

Build¶

nix: Vendor BigQuery driver options for a caller's own credential (#1441)
Bump insta in / (#1430)
Pin the Keycloak image by digest (#1390)

CI¶

Bump the github-actions group with 3 updates (#1452)
deps: Group action bumps weekly, add a pin refresh task (#1448)
Run check-claim-mutation-kills on demand (#1396)

0.8.0 - 2026-10-12¶

Breaking changes¶

config: Refuse a delegation key that is present with no value (#1371)

Fixes¶

fuzz: Bound the sql_expression ASAN memory growth (#1377)
runtime: Keep bound query values out of logs (#1374)
xtask: Refuse a causality trailer on a merge commit (#1370)

Documentation¶

chart: Describe sutura in plain words (#1375)

0.7.0 - 2026-10-12¶

Breaking changes¶

identity: Declare a BigQuery delegation as a list of hops (#1365)
exec-oracle: Read Oracle answers as streamed Arrow batches (#1366)
exec-clickhouse: Run each query as the verified caller (#1357)
cube: A Cube catalog and source, run as each caller (#1352)
identity: BigQuery runs as the caller's own WIF principal (#1353)
config: One off-host predicate for every caller-facing refusal (#1361)
identity: Exchange an Oracle caller's token through ordered hops (#1355)
exec-oracle: Vendor a patched Oracle driver and ship the Oracle source (#1330)
config: Delete two unread keys, make a dev knob dev-only (#1328)
federation: A distinct count across two sources is pulled up, not refused (#1313)
catalog-rdbms: The live reader dials through the ADBC connector (#1287)
exec-duckdb: Answer over the ADBC driver, delete duckdb-rs (#913) (#1289)
causality: Code-only scanning, plus the area-d gating batch (#1276)
exec-postgres: Answer every postgres source over ADBC (#913) (#1242)

Features¶

identity: Exchange a BigQuery caller's token through ordered hops (#1367)
exec: Read DuckDB and Postgres table schemas through ADBC (#1356)
domain: Add the table-schema port and pin its set by the bundle (#1354)
semantic: Refuse a federated join whose key types differ (#1349)
http: Count each refusal under its own reason (#1346)
catalog: Every catalog refreshes every 900 s by default (#1325)
semantic: A via chain may cross a data system at any hop (#1339)
serve: A question uses the catalog snapshot from the last refresh (#1331)
config: Federated answer row ceiling is a setting (#1316)
serve: The refresher offers each new bundle to Surface::adopt (#1329)
exec-clickhouse: Run each statement as the caller's declared user (#1322)
catalog: Page through OpenMetadata and DataHub catalogs (#1323)
catalog: A live OpenMetadata tier for the golden catalog (#1318)
config: /mcp counts a declared hop or host name as off-host (#1314)
Upgrade gh-stack (#1248)
config: /mcp without leg 1 on a declared single-user deployment (#1312)
A kind: duckdb source with raw SQL, stopped at the deadline (#1298)
examples: Multi-player with Keycloak, DataHub and BigQuery (#1302)
domain: Knowledge notes on models, columns and relationships (#1306)
adbc-postgres: One shared Postgres ADBC connector crate (#1283)
adbc: DuckDB as a third linked ADBC driver (#1245)
xtask: Causality reads a gate-checked Live-Cell trailer (#1272)
exec-postgres: Kerberos sign-in on the linked static libpq (#913) (#1244)
serve: Compose the delegation exchange in direct mode (#1258)
exec-postgres: The ADBC transport at parity with tokio-postgres (#913) (#1228)
identity: A delegation exchange port for direct mode (#1208) (#1219)
exec-postgres: The ADBC transport ships, channel enforced, not yet default (#913) (#1204)
catalog-local: A cube measure can be a cross-model ratio (#1148, PR 4) (#1201)
demo: Just demo-mcp serves /mcp behind the dev Keycloak tier (#63) (#1192)
exec: Link the PostgreSQL ADBC driver statically on musl (#913) (#1196)
catalog-wren: Convert_cubes emits kind: cube and refuses a dropped time dimension (#1148, PR 2) (#1193)
domain: Refuse an anchor on a cross-model ratio at load (#780, PR 5) (#1194)
catalog-local: A cube document expands to one metric per measure (#1148, PR 1) (#1189)
exec: PostgreSQL over the shared ADBC crate, behind a default-off feature (#913) (#1182)
catalog: Read an Oracle documentation schema (#972, PR 2) (#1165)
exec: The raw SQL path carries the caller's per-request deadline (#1144) (#1162)
semantic: A cross-model ratio plans as two fact statements through one calendar (#780) (#1158)
catalog: Parse an Oracle dictionary connection (#972, PR 1) (#1160)
mcp: List the scoped physical schema when enabled (#1145)
exec: One shared ADBC crate holds every unsafe FFI call (#913) (#1146)

Fixes¶

runtime: Keep source passwords out of every reply and log line (#1368)
http: Spend one rate-limit bucket across /v1 and /mcp (#1363)
exec-oracle: Keep the time of day of a DATE (#1362)
xtask: Read compound amendment ordinals (#1360)
ci: Ship-check and ci-aggregate gate what they skipped (#1327)
xtask: Report a failing and an unstartable docker apart (#1315)
http: The catalog carries the caller's knowledge, as MCP does (#1305)
http: /mcp gets the same layers as /v1, and one Host list (#1308)
One CLI digest per catalog, quiet EPIPE, a sutura-dev package (#1300)
nix: Link BigQuery and preset PostgreSQL drivers on darwin (#1299)
gates: Ban tokio-postgres from the shipped binary, one falsifier cell per gate, Kerberos on one thread (#1303)
catalog-local: A tree states its declaration, wren writes one (#1288)
exec-bigquery: A driver error never renders its console job link (#1284)
xtask: Causality refuses an added test with no base result (#1268)
http-client: Show refused endpoints without userinfo (#1265)
ci: Judge the PR title in a required pr-title workflow (#1257)
xtask: Causality proves each added test red on base (#1243)
xtask: Hold shipped adapter requirements in required list (#1252)
http-client: Route loopback requests directly (#1235)
xtask: Derive catalog scope from workspace members (#1221)
xtask: Guidance absences read through the census text (#414) (#1226)
causality: Tier-backed claim cells are attested against a nix Postgres (#1195)
causality: Rolling cluster B part 2 - manifest restore, NoTier, refuse untrailered claim patches, name a cfg gate, modified-test Claim-Cell prose (#1188)
tls: A refused client key names only what was checked, and exec-area cells (#1183)
gates: Rolling cluster B - Oracle tier, push ci, cachix refusal (#1171)
gates: Rolling cluster - orphaned claim patches refused, dev tooling, adapter mutation attribution, ignored helpers (#1161)
release: A version bump cannot drift the fuzz lock or publish an unformatted changelog (#1157)

Refactoring¶

oracle: One packet-trace refusal for source and catalog reader (#1351)
domain: A lookup leg reads a checked set of tables (#1338)
Allocation sweep, part 2 (#1214) (#1304)
cli: The refresher reads its digest from the watch channel (#1301)
cli: Log the old digest before replacing it (#1256)

Documentation¶

catalog: Show the refresh interval on each catalog page (#1359)
adr: Federate with DataFusion for the SQL tool and the metrics (#1350)
chart: Concise chart page and its Artifact Hub metadata (#1347)
Shorter SECURITY.md, the #140 record and docs fixes (#1345)
One deployment diagram (#1343)
Shorter serving and questions pages (#1337)
Logos, foldable integration groups, shorter worktrees section (#1333)
Drop proof and limit text from published pages (#1334)
Architecture identity legs and a deployment view (#1335)
ADRs off the site, integrations index, STE pages, embed check (#1324)
Tabs, one page per adapter, archify architecture diagram (#1317)
Sweep stale statements and add a log format how-to (#1309)
Concise install and single-player pages (#1296)
State each source's sign-in identity and its limit (#1262)
ADR citations and nextest ceiling clarity (#1241)
ADR current-state claims match what is built (#949) (#1234)
http: The trusted-proxy list is shared per request, not per connection (#1214) (#1223)
A README for what is built today (#1215) (#1225)
Per-request deadlines are described as built (#1216)
An ADR for cube documents (#1148, PR 3) (#1191)
Correct stale prose, ADR knowledge channels, the #1151 follow-up and a Claim-Cell guide (#1173)

Tests¶

http: Wait for the held question instead of sleeping (#1364)
http: Hold too_many_filters in the refusal table and counter (#1348)
bounds: A federated two-source bench beside answer_path (#1311)
Compound gates and postgres deadline cells prove their own rule (#1286)
app: The whole golden corpus runs on the live BigQuery dataset (#1282)
serve: The delegation exchange in a spawned sutura binary with the ADBC driver (#1281)
app: Run the golden bigquery row against a real dataset (#1264)
http-client: Bound FakeServer::finish so an undialled cell fails (#1275)
catalog-datahub: The golden catalog round trips a live DataHub (#1273)
serve: The delegation exchange behind the served HTTP surface (#1269)
conformance: Register wren in the METADATA catalog matrix (#1267)
catalog-datahub: Live dataset and relationship page cells (#1251) (#1260)
xtask: The falsifier sweep reaches check-catalog-opened-once (#1233)
catalog-rdbms: Live Oracle cells for the catalog reader (#1232)
Wall-clock cells wait on events, not speed (v2) (#1224)
catalog-rdbms: Golden the Oracle reader's assembled output (#972) (#1200)
conformance: The two-fact ratio per dialect and executed (#780) (#1184)
catalog-rdbms: Pin the conversion's content and the Oracle accessors (#1185)
Serialise the real-cargo fixtures and warm the demo xtask build (#1177)
served: A datahub catalog lists its declared version (#970) (#1176)
catalog: Provoke the catalog and bounded-read refusals no cell reached (#1174)
mcp: An rdbms catalog boots and lists over stdio (#970) (#1164)

Build¶

chart: Register the chart on Artifact Hub (#1336)
Ship the RDBMS catalog (#1321)
Tests leave the commit hook; nextest stopgap ceilings (#1297)
Ship the ClickHouse adapter (#1237)
Utoipa 6, utoipa-axum 0.3, utoipa-swagger-ui 10 (#1205)
Bump getrandom in / (#1207)
Bump rmcp in / (#1206)
ci: Group utoipa in Dependabot and keep pr-cache off Dependabot PRs (#1199)
Bump rustix in / (#1198)
Oracledb 26.0.0-beta.4, polyglot-sql 0.13.1, rustix 1.1 and the open patch bumps (#1190)
Stop opting out of the next trait solver (#1197)
fuzz: Move yoke-derive off the yanked 0.8.3 to the root lock's 0.8.2 (#1178)
Group Arrow and cover the fuzz lock in Dependabot (#1163)

CI¶

docs: Publish only main and release versions (#1344)
cache: Publish the musl ADBC drivers, drop the dead target cache (#1310)
Run causality and the Postgres driver step as their own jobs (#1307)
Run the live DataHub acceptance cells when catalog_datahub is selected (#1251) (#1261)
release: Build and publish the performance images and binaries for every target (#1172)

0.6.1 - 2026-09-28¶

Fixes¶

release: Keep fuzz/Cargo.lock and the changelog in step with the version bump (#1150)

Documentation¶

examples: Package the demo as an example, compose-first single-player, exempt the changelog (#1151)

Tests¶

served: An rdbms catalog boots and lists; two composition refusals name the field (#1147)

0.6.0 - 2026-09-28¶

Features¶

config: Refuse three trust-weakening settings unless opted in (#1125)
catalog: Read bounded Postgres dictionaries (#1105)
config: Allow directory-free rdbms catalog declarations (#1098)
xtask: Attribute a Cargo.lock change to the adapters it reaches (#1059)
query: Execute several metrics of one model in one question (#968) (#1044)
catalog: Read a directory of open data contracts (#973) (#1043)
domain: A second fact leg and its combiner caller (#780) (#1042)
catalog: Read an OpenMetadata catalog over HTTP (#970) (#1041)
config: An rdbms catalog's own connection, predicate and bounds (#1032)
query: Ask several metrics and filter by an allowed set (#968) (#1020)
catalog: A compound join of typed key terms (#967) (#1019)
cli: Sutura import wren converts a WrenAI project (#1027)
cli: Sutura mcp opens the declared catalog (#970) (#1009)
config: A declared refresh interval for a remote catalog (#1023)
catalog: Column type, description and key evidence (#995)
mcp: Read knowledge and operator instructions through describe_catalog (#971) (#1017)
semantic: A ratio term can name a fact model, refuse its plan (#1014)
config: Declare okf, openmetadata and rdbms catalogs (#970) (#1007)
metrics: Export the running spend total as a counter (#993)
identity: A cross-posture federated answer is disclosed per leg (#961)
bigquery: Self-build and adopt the ADBC BigQuery driver (#913) (#929)
cli: An oracle source, declarable behind a default-off feature (#977)
xtask: Mint a new ADR by its UTC second, freeze the ordinals (#976)
cli: A clickhouse source, declarable behind a default-off feature (#964)
exec: Postgres and oracle execute a federated leg (#959)
governance: Let the agent surface push spend headroom (#892) (#921)
federation: Cut the unreachable fact-leg top pushdown (#890) (#922)
metadata: The OpenMetadata adapter - a registered declaring catalog (#152) (#917)
identity,#105: The idp tier can mint an ID token with a third-party aud (#909)
metadata: An OKF Table Schema catalog, measured against its declaration (#153) (#903)
identity: Scope describe_catalog by caller identity - one token-holder's catalog view (#148) (#894)
identity: Link leg 1's verified document to the pool leg 2 exchanges against (#817) (#888)
infra: The leg-2 grant APIs + a docker Keycloak tier (#376, #105) (#886)
governance: A headroom gauge for the per-replica spend ledger (#884)
federation: The two-case rule for top, and a configured row ceiling (#870)
bigquery: Bind execute_packs! over a canned transport (#885)
vendor: Compare VENDOR.md's mimalloc count against its repeaters (#882)
vendor: Compile mimalloc guarded mode in, dormant by default (#857)
A served binary executes as a verified caller through the declared impersonation map (#829)
surface: Top: { n, by, direction } bounds a wide group-by (#777) (#856)
outbound: Rotate declared trust bundles without a restart (#823)
mcp: Ship the rendered agent prompt as MCP initialize.instructions (#838)
xtask: Causality accepts a declared claim-cell arm (#835)
surface: Resolve a relative time range at the deployment's clock (#830)
identity: Per-metric visibility, steps 2-4 (#825)
cli,app,domain: A closed enum over the shipped warehouse kinds (#827)
e2e: Wave-one E2E over the real docker DataHub tier plus its hosted job (#791)
http: A budget refusal counts as itself in sutura_questions_total (#818)
infra: Provision a disposable cross-dataset venue (#118) (#754)
bigquery: Add the iamcredentials impersonation hop (#774)
cli: Fold sutura-serve into sutura serve (#784)
datahub: The reader honours security.outbound.transport_anchors (#768)
bigquery: Mint subject assertions at job time (#729)
serve: Mount the agent surface only where a caller is verified (#378) (#758)
nix: Probe all-features fat LTO builds on musl (#766)
serve,config,catalog: Serve a datahub catalog behind a feature (#750)
mcp: The agent surface's http feature and streamable transport (#752)
config,bigquery: Security.outbound reaches the BigQuery wire (#742)
identity: The agent surface asks per request, or refuses (#732)
catalog: A real HTTP AspectReader for DataHub, behind a feature (#720)
identity: Asked is one value both transports read (#715)
tls: A shared outbound TLS read, and a unix-socket refusal (#705)
identity: Cache an exchanged credential, off by default (#704)
engine: Stop a question at its deadline (#708)
bigquery: Derive the job's timeouts from the port's deadline (#695)
governance: A per-replica spend counter refuses at the ceiling (#684)
postgres: Honour the deadline via SET LOCAL statement_timeout (#687)
prompt: Frame the raw SQL tool, and a served Postgres showcase (#686)
app: A raw SQL tool, off by default (#666)
bounds: Carry one deadline through the execution port (#661)
warehouse: A dry run's PreFlight carries its own byte estimate (#662)
catalog: An authored metric loads, pins, is refused at boot (#658)
http: Serve protected-resource metadata (#624)
postgres: Serve configured sources over TLS (#653)
catalog: An RDBMS dictionary as the narrowest metadata source (#151) (#597)
causality: A declared test-file cleanup is verified, not assumed (#636)
observability: Export authenticated operator metrics (#625)
ci: Refuse a store-cache key that drops a dependency input (#630)
demo: Add local chat demo (#608)

Fixes¶

mcp: Render initialize.instructions over the caller's view (#1127)
causality: A signature change no longer reads as an added test (#1134)
gates: Account for skipped proofs and inline allow entries (#1128)
causality: Keep a module a kept file declares at base (#1103) (#1115)
devco: Kill #1059's lockfile cell by its own assertion (#1118)
causality: A claim cell that skips its tier is inconclusive (#1092) (#1109)
xtask: Ten gates stop reading comments, literals and missing lists as evidence (#1113)
xtask: Follow integration modules and outer test count (#1099)
Give the review-held claims of #1037 a mechanism (#1053)
xtask: Key a moved test on its token stream (#1094)
bounds: Cap catalog walk entries, config depth, TLS and rdbms reads (#1090)
catalog: Refuse a DataHub dimension with an empty via chain (#1060) (#1077)
xtask: Close nine gate escapes and pin three unexercised rules (#1064) (#1082)
query: Bound question inputs and adapter results (#1089)
xtask: A fully waived deletion still proves the added tests (#1068) (#1076)
causality: Find claims in mixed files beside pure tests (#1084) (#1088)
xtask: Gate CLI errors and public module reachability (#1029) (#1086)
causality: Route unbuildable base to claim cells (#1083)
xtask: Close four gate escapes in one batch (#1081)
xtask: A pure move of a test is not a deletion (#1080)
xtask: Resolve mixed claim cells per commit (#1078)
xtask: Follow nested path modules in causality (#1075)
xtask: Name a Claim-Cell against its own commit tree (#1054) (#1057)
cli: Bound operator instructions at startup (#1056) (#1065)
ci: Clean first-party artifacts before shipped-feature builds (#1050)
causality: A deleted assertion or edited helper needs proof (#1055)
xtask: Read guidance hosts and pages from census (#1058)
catalog: A relationship declares one pair or its keys, not both (#1040)
xtask: Census the one-bound and guidance doors (#1038)
causality: A changed test body needs the same proof as an added one (#1026)
sql: Render Oracle's row limit as FETCH FIRST n ROWS ONLY (#1030)
catalog: Open each catalog document once and refuse what the opened handle is not (#1022)
cli: Give every mcp settings tree its own directory (#1034)
causality: A tests-only diff needs a Claim-Cell too (#1024)
xtask: Pin check-feature-remedies' census walk against real trees (#1010)
ci: Give the docker probe 60s on the jobs that bring up a tier (#1015)
Audit slices of #639 and #949 - reconcile spent work, name one live gap (#1011)
ci: Bind Cachix publishers to cache scope (#1006)
clickhouse: Widen 64-bit sums and bind conformance (#997)
ci: Attribute adapter API pages and snapshots (#1004)
xtask: Census feature-remedy source files (#1001)
demo: Spare preexisting services during exclusive start (#992)
clickhouse: Ask for a Decimal as exact quoted text at full scale (#991)
causality: A Claim-Cell declaration answers for the commit that carries it (#954) (#958)
ci: A category the ci job never republishes skips on every diff (#960)
clickhouse: An outer join returned '' where the engine says NULL (#955)
xtask: Close three nix-venue gate holes (#952) (#953)
causality: A committed claim mutation can rot unnoticed (#951)
ci: Narrow causality's push base to HEAD^, not the frozen marker (#948)
xtask: Four rules the tree believed it enforced, and a typed spend-gauge handoff (#935 #936 #937 #938 #892) (#940)
causality: Re-anchor a claim mutation onto the moved target_for (#941)
causality: Consult a complete claim declaration on an inseparable plan (#837) (#924)
sutura-sql: Bump polyglot-sql, drop the unclosed-paren guard (#589) (#914)
xtask: Say when a declared claim cell was not consulted (#907)
xtask: Stop test-causality's verdict conflating NAMED with MEASURED (#902)
xtask: A variant in_scope drops from both halves is a problem (#899)
cli: Guard #861's mixed-serve regression without a tier (#898)
xtask: Stop the caller's nextest profile reaching the nested run (#896)
xtask,ci: Stop the claim arm's false verdict and scope merge_group's diff (#883)
xtask: Exempt a claim-mutation patch's bytes from text-hygiene (#881)
xtask: Move check-examples off the transitional census door (#868)
vendor: Define MI_PADDING_CHECK_BYTES on the cargo mimalloc path (#871)
xtask: Read fuzz/'s own cargo metadata as a second workspace (#872)
cli: Serve two kinds together, each answering its own question (#861)
xtask: Move check-shipped-binaries' page walk onto Census::inspect (#860)
xtask: Move check-bounded-wait off the transitional census door (#853)
conformance: A per-case order opt-out over collation (#848)
xtask: Exempt generated docs/api/*.md pages from the byte cap (#847)
cli: Drop a crate-boundary justification the #784 fold removed (#840)
Name a composition refusal's kind, fix a stale tier citation (#834)
nix: Arm the datahub teardown trap before start; ship all-features (#832)
xtask: ADR-number uniqueness gate, and the last unused-deps door (#826)
nix: Split the postgres tier provisioner out of postgres-tier.nix (#824)
domain: Refuse a federated join whose link columns disagree in type (#822)
nix: Make checks.shipped-features per-artefact (#821)
xtask: Key a src/ file's test by the #[path] that claims it (#819)
nix: Keycloak-tier unknown-lock refusal and a late teardown trap (#815)
mcp: Seal an MCP error message behind a private-field newtype (#811)
cli: Correct C3's compile-error claim to name where it lives (#810)
nix: Postgres stop refuses rather than deleting a live cluster (#808)
mcp: Ban a caller's text reaching rmcp's error constructor (#782)
docs: Amend eleven ADRs that still named sutura-serve as live (#805)
xtask: Ratchet the retired leg-2 multiplayer wording (#806)
nix: Stop refuses rather than deleting a live JVM's state (#803)
docs: Stop README claiming multiplayer ships and is selectable (#800)
docs: Digest arity claim in a third phrasing (#798)
docs,flake: Retire present-tense two-binary prose after the fold (#797)
docs: Serving's answer above the fold, three stale corrections gone (#793)
xtask,docs: A partial move, a deleted ratchet, a stale citation (#788)
domain: Restore the concession a rewrite dropped in bundle.rs (#787)
config,http: Refuse userinfo in a resource identifier (#789)
xtask: Three gate items that do not bind - hooks, venues, answer path (#773)
xtask: Print the live claim count, drop an untrue anchor (#770)
http: Make an echoed detail a type error, not a review (#769)
docs,demo: Seven audit residues, and a skipped teardown (#767)
xtask,http: Enrol TlsNotUsable and split refusals.rs to fit it (#764)
xtask: Two gates drop a read in silence, and a defaulted preflight (#759)
causality: A manifest resolution failure is its own outcome (#757)
xtask: Teach blank_comments a string, char and raw-string state (#756)
ci: Stop failing a dependabot pull request by construction (#749)
config: Key the rate limiter like the metrics token (#743)
xtask: Two scanners narrower than their rule, and two stale pages (#744)
xtask: Count $XDG_* shell roots in check-worktree-state (#741)
Two bigquery tasks abort on a deleted file, and a false limit (#740)
deps: Bump rustls past RUSTSEC-2026-0285 (#738)
deps: Rustls 0.23.45 for RUSTSEC-2026-0285 (#737)
xtask: Tie a yes cell to its section, like unrun/wired (#725)
fuzz: The authored-SQL limit contradicted the page it cited (#731)
bigquery: PRICES_DRY_RUN checked, expires_in re-pinned (#730)
xtask: Action-shell drops two reads, and a false tier claim (#727)
catalog: Bound a bundle, and a note that renders as it hashed (#723)
Closed transport-mode enum, and a dead PgType arm cut (#721)
demo,xtask,dev: Pair a pin, scan Dockerfiles, split the cap (#722)
answer-path: A deterministic federated failure is typed and non-retryable (#717)
docs: Eight controls described wrongly, plus the operator page (#713)
docs: Shipped-artifact claims, and a stray merge log (#714)
xtask: Check-worktree-state's file tally can drop below the census (#689) (#707)
dev: Serialise the tier writer, gate a backtick, watch the tree (#711)
xtask: Guard run_sql through check-boundaries (#703)
xtask: Combine four gate-claims-and-scope branches (#693)
xtask: Derive the 422-refusal count instead of registering it (#696)
postgres: PgType::Numeric is fixture-only, say so to dead-code (#694)
ci: Restore two skipped obligations, and correct an instrument that measured nothing (#665)
Worktree-owned state's git half, and the demo readiness latch (#688)
xtask: Share the gate read, so check-guidance cannot pass over a file it did not open (#681)
catalog: Bound local catalog intake, stop re-cloning contributions (#677)
query: Share the question conversion, bound the response size (#669)
docs: Stale ADR and serving.md claims across seven records (#667)
demo: Close review follow-up gaps (#664)
domain: Plan bindings and the contribution manifest are parsed, not trusted (#656)
http: The key refresh is bounded and survives an abandoned look (#657)
http: Hold the TLS key opaque and read it off the executor (#649)
xtask: Refuse a version written where no mechanism compares it (#641)
app: Classify source refusal during preflight (#637)
gates: Two gates whose claim was wider than their mechanism (#629)
xtask: Hold two never-write sentences by a gate (#632)
docs: Three statements the tree has since falsified (#622)
ci: Three comments still name the 32-core runner #614 moved (#616)
xtask: Narrow the row to the one sentence it can refuse (#612)
release: A gate holds the image-record grammar, not a coincidence (#609)
xtask: Gates over a rustdoc blind spot, a false prescription and a superseded cause (#606)
dev: The worktree is the tier identity, and with-tier reads the endpoint file (#607)
test-infra: Provision the identity values as secrets, not vars (#605)
docs: ADR and plan statements that no longer describe the tree (#602)

Performance¶

ci: Publish the self-built ADBC driver closure from main (#1035)
ci: Start the driver check early, batch builds, cache deps (#1036)
app: Run a federated answer's two legs concurrently (#916) (#1012)
ci: Fix the pr cache, decouple identity, reach two silent gates (#994)
ci: Stage the check graph so the order is the execution order (#642)
api-docs: One cargo doc invocation for every member (#628)
ci: Move the cache-writer jobs to the 16-core runner (#621)
ci: Move the mostly-cached jobs to the 16-core runner (#614)
ci: Cap the job below the merge queue's timeout (#599) (#611)
ci: Read the stores on every path, and stop paying for caches nothing reads (#604)
xtask: Document binary-only crates in the library target directory (#601)

Refactoring¶

tests: Split three test files at the line cap (#1129)
catalog: Move the wren converter into sutura-catalog-wren (#1046)
catalog: Share one bounded document read (#1045) (#1052)
xtask: Seven gates scope their walk inside Census::inspect (#414) (#912)
xtask: Move the edge-policy tables out of boundaries.rs (#820)
bigquery: Withdraw the row-level-security cell (#719)
config: Split sources/tests.rs at the line cap (#712)
Split three files off the 1000-line cap by subject (#635)
xtask: Move the task table out of main.rs and split it by area (#633)

Documentation¶

Correct stale prose, a leg-2 claim and a converter comparison (#1143)
Correct doc comments and skill prose that no longer match the code (#1138)
ADR amendments and stale prose, cluster 3 (#1087)
skills: Correct stale sentences in the skills and concepts (#1079)
Correct stale current-state claims, record join-key comparison (#1067)
oracle: Record current adapter and rendering limits (#1072)
metadata: What an open data contract can carry (#973) (#1039)
Drop the second-project venue the tree still promised (#989)
adr: Draft the channel for rules, model glossary and join caveats (#999)
identity: Correct cross-posture and shipped-source claims (#998)
adr: A knowledge-only metadata source speaks through a metric (0036) (#918)
Split the nav by audience and take the decisions off the built site (#325) (#925)
adr,#760: BigQuery accepts agent identity, but WIF stays for CI (#908)
metadata: The field-by-field finding for an OpenMetadata catalog (#152) (#906)
identity: Record what each venue may claim, and widen check-venues to read it (#905)
identity: The agent-identity evaluation for the BigQuery credential (#760) (#880)
domain: Restore doc comments trimmed to fit the byte cap (#850)
identity: The exchange row is yes; retire the old wording (#812)
adr: Amend two ADRs whose argument, not just citation, went stale (#801)
adr: Re-verify 15 stale citations, two are false claims (#794)
Three claims that outran their mechanisms - counts and a citation (#786)
A deadline nobody overrides, written down twice (#746)
adr: Two records claim things the tree falsifies (#745)
adr: Decide caller-specific metadata visibility (#623)

Tests¶

Pin refusals across domain, app, cli, config, runtime (#1142)
exec: Provoke fifteen Postgres and DuckDB refusals (#1139)
http: Provoke four uncovered transport refusals (#1140)
catalog: Provoke 23 local, DataHub and OKF refusals through the port (#1135)
exec: Provoke twelve BigQuery and DataFusion refusals (#1133)
Semantic and sql cells, placeholder-count refusal (#1132)
xtask: Seed jscpd clone falsifier (#1126)
xtask: Seed refusal coverage falsifier (#1124)
xtask: Seed skill and release falsifiers (#1123)
xtask: Seed architecture falsifiers (#1121)
Refusal cells for app, catalog-wren and config (#1106)
xtask: Seed classification and inconclusive falsifiers (#1117)
xtask: Seed fuzz and scope falsifiers (#1116)
xtask: Seed threshold and example falsifiers (#1112)
transports: Provoke seven refusals through http and mcp (#1101)
xtask: Seed docs and API link falsifiers (#1111)
catalog: Provoke eighteen catalog refusals through the port (#1108)
xtask: Seed boot order and bound falsifiers (#1110)
xtask: Seed shell and CRAP falsifiers (#1107)
xtask: Seed bounded wait and attribution owner falsifiers (#1104)
xtask: Seed three gate refusal paths (#1102)
xtask: Seed dependency gate falsifiers (#1100)
exec: Provoke six adapter refusals through the port (#1091)
cli: Prove bounded instruction file read (#1073)
app: Tighten the knowledge and federated-leg review leftovers (#1051)
conformance: A two-warehouse execute_packs! arm and federated pack (#1033)
e2e: Serve a DataHub metric through ADBC BigQuery (#1005)
golden: Execute the clickhouse corpus against a nix tier (#978)
bounds: The request deadline's default is measured, and a load reading that failed open (#140) (#944)
sql: A dialect declares what backs its goldens, and the declaration expires (#919) (#942)
mcp: Two agent-route callers offer two distinct subject tokens (#900)
http: Pin the spend-headroom gauge tracking the ledger's own state (#901)
xtask: Pin outstanding.retain to the read arm on an absent anchor (#895)
cli: Guard trusted_tables against a widened source filter (#869)
identity: The byte join holds on the agent route (#859)
cli: Drive the golden corpus over the served HTTP surface (#124) (#846)
demo: Assert dev-down --only demo scopes the docker teardown (#841)
xtask: The claim arm's fixture cells, plus a wiring test (#836)
serve: Answer the wave-one question over /mcp behind leg 1 (#813)
e2e: Wave-one datahub-bigquery E2E task + showcase (draft) (#762)
serve: Hold the Keycloak two-subjects cell on unmasked subs (#755)
serve: Verify a real Keycloak-issued token on the composed binary (#751)
deadline: A ceiling widens under load, stays strict in CI (#747)
bounds: Measure bounded resource usage (#668)
http: Bound nextest and finish two #674 comments (#728)
conformance: Hold PRICES_DRY_RUN against every accepted pre-flight (#699)
security: Fuzz the catalog document and key-set document parsers (#697)
serve: A Postgres source that impersonates does not boot (#698)
security: Fuzz the unauthenticated token path (#648)
conformance: Execute fixed-point totals exactly (#620)
domain: Gate the serialized-form list, correct four claims (#631)
domain: Hold every parsed newtype to the digest's serialized form (#617)
conformance: A null group key, the i64 boundary and a fraction (#583) (#615)

Build¶

nix: Self-build the ADBC PostgreSQL driver per release triple (#1028)
chart: Derive resource bounds, publish to OCI, add kind smoke (#963)
Bump rmcp from 3.3.0 to 3.4.0 (#946)
Bump jsonwebtoken from 11.0.0 to 11.1.0 (#945)
deploy: The chart gate's local half, and an RDF source declined with its measurement (#149 #155) (#939)
deploy: Helm template goldens per values file (#149 branch 2) (#845)
vendor: Bump vendored mimalloc C from 3.5.0 to 3.5.3 (#851)
deploy: Pin helm/kubeconform, gate the chart in nix (#149 branch 1) (#843)
deploy: Add charts/sutura, a chart for the published serve image (#842)
Bump datafusion from 55.0.0 to 55.1.0 (#736)
Bump ureq in the patch-level group across 1 directory (#739)
Bump rmcp from 3.2.0 to 3.3.0 (#735)
Lint and format markdown, YAML, TOML with dprint and Python with ruff (#627)

CI¶

Report what it cannot hold - order and delivery (#763)

Batch¶

Docs truth, identity fixes, and two off-the-cap refactors (#690)

Batch¶

The declared via chain and the Oracle adapter with its venue (#781 #127) (#932)
A real IdP mints a third-party aud, and corpus cases become data (#105 #116) (#934)
A census door, the demo container gate, the ClickHouse adapter and BigQuery qualification (#414 #639 #920 #118) (#931)
Outbound client identity, a bench harness, Oracle rendering, the spend counter and the docs cleanup (#911 #915 #127 #139 #927) (#930)

Spike¶

metadata: What a BPMN file actually carries (#154) (#926)

0.5.1 - 2026-09-11¶

Fixes¶

release: Read the image-record header and untagged list reference (#596)

Performance¶

ci: Read the cachix stores in docs, and free two paid jobs (#594)

0.5.0 - 2026-09-11¶

Features¶

app: C2 BootRoot single root of trust (conf266) (#575)
Use new rust compiler for traits (#590)
identity: R1 digest-only AssertionDigest (conf266) (#566)
agents: Ponytail on by default, and inherited by subagents (#577)
conformance: Corpus as files (#350) (#555)
mcp: Honor peer cancellation (#553)
conformance: Compile packs behind a default-off feature (#549)
release: Export portable provenance bundles (#505)
domain: One answer's legs decide identity the same way, or it is refused (#484)
gates: Needle-substring lint in check-expect-thresholds (#497)
Jscpd copy/paste gate (issue #474) (#483)
federation: The shipped engine executes a leg, so a published build answers two sources (#441)
ci: Three OSS-readiness scans, and two badges held against what they claim (#422)
xtask: A worktree's state is its own, held by a gate (#417)
xtask: An absence a doc comment claims, read against the code (#406)
nix: The artifact/sweep pairing is held by a gate, not review (#368)
xtask: A venue a job reaches, whose run nobody has seen - and what a Reached by may get away with (#396)
xtask: The causality gate reads its base and its manifests (#384)
The conformance suite's own coverage - a gate and its cost (#375)
docs: The site build joins validate, and a dead href is a gate (#361)
xtask: An example no test reaches for is a directory of prose (#294)
datahub: The deployment-defined property, measured against a real DataHub - and the closedness claim gated (#256)
identity: Serve attaches the exchanging broker, and the expiry floor lands (#284)
xtask: The compose tier's one bounded wait is held by a gate (#280)
xtask: The boot order the pre-flight relies on is a gate (#251)
xtask: The acceptance job's five properties are asserted, not configured (#255)
dev: Keycloak as a nix-native tier, provisioned without a human (#250)
xtask: The identity venue map is held by a gate, not by recall (#254)
xtask: A just task a failure prints is resolved by a gate (#253)
dev: Every discoverable service declares its CI venue (#239)
cli: The agent surface refuses a table the dataset does not hold (#236)
cli: Open a BigQuery dataset behind a default-off feature (#230)
cli: Open the data system the deployment declared (#229)
dev: A provisioned DataHub tier behind a compose profile (#227)
example: The DataHub multi-player shape, and its fixture proof (#211)
metadata: A DataHub metric carries a whole certified metric (#210)
serve: A table the dataset does not hold stops the boot (#212)
xtask: No first-party Deref, and no Borrow at all (#203)
xtask: A transport cannot declare the port it calls (#201)
xtask: An adapter cannot reach an adapter of its own kind (#200)
xtask: A refusal variant nothing provokes is a failure (#199)
clippy: Ban the one call that lets a credential out (#198)
xtask: Gate serde against a newtype's own constructor (#197)
cli: Serve the MCP agent surface over stdio via sutura mcp (#189)
catalog: DataHub as the first declaring SemanticCatalog (#195)

Fixes¶

exec-bigquery: Source_refused from the transport's own refusal split (#579)
sql: Bound the parenthesis the pinned parser never closes (#146) (#592)
ci: Create target/ before the privileged cache restore (#591)
refusal: G4 per-variant witness keyed by domain code (conf266) (#573)
exec: A data-source refusal is a non-retryable class, distinct from transient (#574)
fuzz: Bound non-ASCII in SQL and repair the question_body dictionary (#146) (#582)
xtask: Refuse pub modules no first-party crate references (#131) (#581)
api: Public re-exports carry their docs (#470) (#580)
gates: Refuse intent-to-add source gaps (#578)
keycloak: Preserve status code contract (#576)
ci: Preserve pending BigQuery acceptance jobs (#567)
identity: Mask at the parse boundary, not at render (#388) (#572)
ci: State the pruning fallback cost (#556)
cli: A remedy naming variables that are not set (#435)
docs: Remove unresolved generated self link (#558)
xtask: Falsifier guard for the hygiene gates (closes #371 guard step) (#554)
docs: Point the backoff note at a public item (#550)
security: Typed ceilings on caller input, and the token hashed at parse (#547)
http,mcp: Caller-chosen values no longer reach a log or a body (#546)
domain: One refusal code the transports both read (#545)
dev: Preserve foreign keycloak claims (#548)
gates: Anchor the jscpd drift check, and hold its thresholds to the declared set (#542)
ci: Generate the attribution document instead of committing it (#536)
gates: Check binary-only rustdoc links (#504)
xtask: Name both missing advisory causes (#544)
config: Carry each key's layer origin into the refusal it is about (#543)
domain: Restate the limit UnsupportedAggregate cannot reach (#540)
identity: Mask opaque principal suffixes (#541)
xtask: A gate that cannot be switched off, and a file it cannot read (#534)
gates: Share the jscpd ignore config (#529)
xtask: An escaped backtick is prose, and a citation needs a test (#537)
http: Keep raw paths out of warnings (#523)
identity: Mask principals in diagnostic output (#530)
xtask: The witness counts the subjects the check reached (#516)
domain: Bind re-aggregated leaves to their tree (#524)
nix: The keycloak tier's start guard is the process, its status the records (#434)
xtask: Enrol NotValidated, and make the enrolled count a witness (#507)
xtask: A gate's inner walk reaches every subject it was offered (#509)
jscpd: Hygiene follow-ups — temp-dir leak and single-owner ignore set (#502)
gates: Enforce literal task filter parity (#503)
dev: A tier reads and writes only its own entry, and derives its own state (#454)
config: Retain file layers in startup failures (#493)
gates: The changed-package recipe sources the stable helper (#491)
Include enums in serde constructor coverage (#489)
gates: Refuse an unconfigured local Rust toolchain (#481)
xtask: Cover startup refusal names (#479)
bigquery: Distinguish unreadable inventories from absences (#475)
ci: Drop the publication-refusal witness, publishing is the success condition (#476)
xtask,serve: The guard takes the lock, the site cannot skip a join (#460)
bigquery: Redact session-user debug output (#473)
ci: Measure causality on the pull request head (#469)
ci: The publication the badge needs, and a witness that it landed (#456)
xtask: Distinguish venue commands and check named credential cleanup (#433)
exec-postgres: A fixture credential is configured, or it refuses (#461)
release: Every published byte is signed, sidecars included (#465)
ci: Preserve a failed check without an offline retry (#467)
bigquery: A listing short of its own total is unaccounted for, not absent (#439)
xtask: A green run over a revert the tests cannot reach is INCONCLUSIVE (#399)
xtask: A census reads its own subjects, and its sealed types hand out nothing (#438)
xtask: The #[ignore] line itself is not a run this venue reaches (#420)
domain: A violated many_to_one is refused at boot, not answered twice (#354) (#427)
docs: Fifteen unresolved intra-doc links, and the lint that keeps them fixed (#408)
Two intermittent test failures - the compose lock's release, and the serve harness's drain (#407)
xtask: A shipped-set value the gate cannot compare is a verdict (#373)
dev: Every devenv shell body is discovered, not matched by a needle (#409)
xtask: Ordinary CI is every file it calls, not one file name (#403)
devenv: ShellCheck reads every script body, and a gate keeps every body inside it (#395)
xtask: Check-examples resolves a line to the test around it, and to disk (#393)
docs: The guided path installs a published binary, not a toolchain (#385)
dev: The postgres tier is ephemeral, and heals a directory it wedged on (#379)
docs: ADR records that no longer describe the tree, held by a gate (#369)
serve: A refusal may not send an operator after a feature that does not exist (#367)
xtask: Check-arrow reads its allowlist on a single-major tree too (#374)
bounds: One process builds one Admission, and the reply is bounded (#364)
xtask: What the causality gate believes about its own diff (#359)
xtask: What a causality verdict may claim - the exit code and the sentence (#344)
federation: A null fact key, a colliding label and the null order (#331)
mcp: A question takes an execution slot, and its worker keeps it (#342)
nix: An inherited build root is regenerated, not required (#330)
Five gates that reported more coverage than they had (#322)
dev: One record for the tier's state, and a failed stop keeps it (#316)
xtask: A #[cfg(test)] helper is test code, and a verdict says how much it measured (#306)
xtask: A fence, a constant and a file, derived not believed (#309)
domain: The catalog's authored content is parsed and reconciled (#282)
dev: The unprovisioned remedy derives its venue in both arms (#268)
xtask: A causality verdict names the test it measured, and the name is a key (#279)
mcp: The prose setting reaches both halves of the catalog reply (#277)
bigquery: The listing's own total is decoded, so the cross-check has something to check (#272)
cli: The query command records the outcome it prints (#276)
domain: A leaf column's numeric type is established before any aggregate reads it (#270)
xtask: Six properties of the acceptance job read a line where a shape was meant (#269)
xtask: A daemon wedging mid-run fails dev-up rather than hanging it (#273)
xtask: A wedged daemon fails a gate rather than hanging it (#262)
xtask: The remedy a claim prints is checked, not trusted (#246)
xtask: A gated count that no page states is not a gate (#237)
dev: A stopped Postgres tier stops claiming to be there (#231)
Agentt guardrails and skills (#228)
http: The catalog body honours catalog_prose: omitted (#128) (#207)
ci: Prune pull request caches on close (#205)
ci: Prune unreachable caches daily (#191)

Performance¶

ci: Compute the full cross matrix only for a release (#587)
ci: Fix a no-op cache, read every store we write, and gate what made it invisible (#586)
ci: Close #560 + #561 + #562 + #564 — the CI-caching improvement batch (#571)
ci: Persist the writable causality target across runs (#563)
nix: A deps-only build states whether it compiles test targets (#510)

Refactoring¶

domain: Typed result labels, and a truthful failure (#432)
xtask: A gate's witness is minted by the walk, not by its own loop (#419)
Five files off the 1000-line cap, each at a named seam (#345)
xtask: What the acceptance job must hold is its own module (#323)
domain: The re-aggregation above the legs is its own module (#318)
ci: The cross link check is its own reusable workflow (#289)
bigquery: A resource name's position is a variant (#220)

Documentation¶

gates: State accounting witness limits (#570)
adr: Close both CodeQL next steps with a measurement (#535)
git: Clarify published-branch rewrite authority (#501)
adr: Why a CodeQL Rust SQL-taint job is not shippable yet (#464) (#480)
build: Distinguish Cargo relocation from baked files (#488)
identity: Record startup refusal evidence limits (#482)
Surface the issue tracker and steer security reports to SECURITY.md (#478)
adr: The re-measurement is the argument for not acting (#471)
The tree stated both branch styles, and argued a refusal from the wrong one (#436)
Three corpora of already-false claims, and where the reader is blind (#442)
adr: Where a per-request principal reaches the agent surface (#380)
adr: 0017 said acceptance.rs still needed splitting, and #323 split it (#326)
Five prose corrections in the README (#315)
site: The implementation plans stop being published pages (#292)
adr: Which half of the DataHub property a deployment owns (#234)
skills: Name what stays advisory, and what the gates miss (#208)

Tests¶

bigquery: Preserve qualifiers in isolated fixture naming (#498)
federation: Exercise the remaining compile-time refusals (#500)
security: Fuzz the SQL and JSON parsers that read untrusted input (#494)
bigquery: One workload identity, exchanged per subject, against SESSION_USER() (#382)
Allow complete mutation runs through nextest profiles (#466)
serve: The four startup refusals, held on the binary that makes them (#444)
Assertions that read text where they meant a value (blocked on #394) (#397)
conformance: Postgres is bound, and an absent tier is not a pass (#398)
xtask: Every registered hygiene gate, run against a tree it must refuse (#390)
Slice C - the splitter, two executions and the combiner, joined (#355)
conformance: The packs crate, and two adapters held to it from their own crates (#352)
B0 - one typed comparison policy, and the reformatting golden compares two inputs (#333)
cli: Every command the pages print is run, or named as skipped (#293)
bigquery: The two-principal cell, and the half it cannot establish (#286)
bigquery: Make the acceptance leg re-entrant with per-run table names (#283)
bigquery: A real listing reaches the boot decision, and the soft edge names its status (#257)
identity: The exchange chain, joined through the transport (#252)
identity: Leg 1 on the composed binary, over a published key set (#238)
bigquery: A real dataset answers the pre-flight's listing (#221)
e2e: Ask the served deployment a question (#117) (#192)
identity: A mock issuer in the sandbox, provable every run (#193)

Build¶

Bump rmcp from 3.1.4 to 3.2.0 (#426)
Bump the patch-level group with 3 updates (#425)
xtask: Gate the hygiene classification, not its count (#247)
devenv: Upgrade the pinned stax to 0.110.0 (#194)

CI¶

fuzz: Drop the per-push leg, run the fuzzer at a release (#146) (#593)
Category filter over the workspace, named by adapter crate (#552)
cache: PRs publish to sutura-prs behind a PR-gated read (#551)
cache: Publish the cross, connector and fuzz closures to per-consumer caches (#539)
Make the host-utilisation numbers quotable from a job log (#531)
Fold every CI refinement into one change, and trust one binary cache (#520)
Retire the inert third-party binary cache and gate its return (#508)
gates: Anchor the event-scoped cross matrix in check-workflows (#496)
Chain doctest onto the nextest artifacts to drop a workspace recompile (#495)
Restore the Actions cache everywhere, write it only from main (#490)
Event-scoped cross matrix (PR 2/main 4/release 4) + binary-cache backstop (#472) (#477)
The shipped feature set gets a lint gate in CI too (#258)
The shipped feature set's tests are run by a gate, not compiled by one (#271)
cross: The documented feature-on source build is linked, not assumed (#259)

0.4.1 - 2026-09-01¶

Fixes¶

release: Create the licence artifact directory (#188)

0.4.0 - 2026-09-01¶

Features¶

catalog: Compose N metadata sources into one bundle (#115) (#181)

Fixes¶

release: Authenticate the early stale check with Git (#187)
release: Authenticate the stale-dispatch fetch on version-bump (#186)
ci: Reserve release builds for tags (#185)
release: Use one approved main release path (#184)

0.3.0 - 2026-09-01¶

Features¶

xtask: Ban #[expect] on count-threshold lints (#107)
catalog: Let a deployment declare several catalogs
catalog: Declare a catalog kind and dispatch it in the server
identity: Grant the two principals jobUser+dataViewer and record the cell state
test-infra: Run Pulumi through pixi, drop requirements.txt/venv
test-infra: Google identity E2E scaffold, config-driven Pulumi
Answer every file's licence mechanically, per the REUSE specification (#101)
ci: A curated licence review, with the config written here rather than cloned (#102)
release: The SBOM comes out of the binary, not out of Cargo.lock (#98)
federation: Execute a two-source question end to end (#89)
bigquery: A BigQuery source executes as the asking subject (issue 87) (#93)
serve: Register the BigQuery adapter so a deployment can serve kind: bigquery (#88)
identity: A credential the compiler refuses to print (#86)
catalog: A model may name a table outside its connection's dataset (#83) (#84)
bigquery: The wire, and the client decision that had to come first (#80)
postgres: A Warehouse adapter over Postgres, on a static credential (#78)
federation: Split, combine and serve a two-source question (#72) (#76)
catalog: Split the catalog matrix by adapter kind (#77)
bigquery: The fourth dialect, the adapter, and what a test runs against (#64)
xtask: Clean-branches, because --merged cannot see a squash merge (#74)
catalog: A metadata adapter says what it cannot supply (#59)
identity: A credential per leg, so nothing runs as the process (#58)
dev: The compose tier gets a reader, and the tier came up (#56)
config: A source registry, a declared posture, and two boot checks (#48)
surface: One tool set for two transports, gated by scope (#49)
identity: Leg 1, so a caller can prove who it is (#45)
domain: The two leg shapes, rendered and pinned before a combiner (#47)
dev: One service instance per worktree, on ports docker allocates (#34)
bounds: The engine gets a memory pool, and exhaustion becomes a refusal (#38)
identity: The principal chain, while both tail positions are still absent (#37)
mcp: The agent surface, one tool, schema generated not written (#35)
domain: A new aggregate cannot compile without saying how it federates (#33)
catalog: The knowledge layer, and an escape hatch for authored SQL (#23)
One catalog, CRAP delta control, and three CI holes (#21)
The query path - a catalog compiles to a plan, and the plan executes (#19)

Fixes¶

ci: One merge_group key; fix(release): push as the App, not the bot (#178)
release: Push the release commit under a dedicated App token (#172)
domain: Re-land the two-bound too-much-data refusal lost in the dev restructure (#91 / #158) (#165)
ci: Reuse warmed artifacts and skip needless cleanup (#162)
mcp: Honour catalog_prose: omitted on the describe tool, and share the injection corpus
licence: Attribute vendored crates, and check the licence values
mcp: The agent text half can no longer be forged by a cell or a description
sql: State null placement in ORDER BY so the dialects agree (#92) (#95)
xtask: A lock file naming no holder is not PID 0, and it is never visibly empty (#68)
identity: The anchor door was a shape check, not an authority (#61)
identity: A broker's answer was trusted, and now it is checked (#62)
tooling: A rebase could push a tree nothing had compiled (#55)
dev: Ship-check could not run, because cargo nextest has no -q (#57)
tooling: A green just check was read as a green tree (#52)
Main did not compile after seven parallel merges (#40)
xtask: A test appended to an existing test module is not a production change (#36)
docs: Publish a version per release, so the dropdown has versions

Refactoring¶

serve: Split catalog opening out of main to hold the line limit
ci: Share the workflow lint sequence, and gate its references
test-infra: Hoist Pulumi tasks into the top-level justfile as infra-*

Documentation¶

justfile: Describe BigQuery acceptance accurately (#164)
plan: Reconcile the stack, hand the backlog to the tracker (#157)
adr: Untrusted content, and what marks it
contributing: Restack with stax, never hand-rebase a branch in a stack
test-infra: Fix stale just gl citation to infra-gl in setup
adr: Settle where each identity claim is proven, per issue 81 (#103)
The exact-order comparison is measured now, not predicted (#100)
adr: DataHub carries part of a model, and declares the rest (#53)
agents: The dev shell follows cargo into other repos and breaks builds there (#46)
plan: The table says which steps shipped, because six of them did not (#44)
plan: BigQuery leads the stack, and cheap-first is a tiebreak (#43)
The records catch up with what the merges actually shipped (#41)
adr: The metrics endpoint, the pool policy, and a finding withdrawn (#29)
adr: Two false claims and seven stale cross-references from the final review (#27)
The architecture of record for federation and impersonation, and the plan (#26)

Tests¶

mcp: Share the single-cell answer fixture between the two forgery tests
google: Pulumi-only bootstrapping - enable APIs and RLS in-program
google: Configure the stack from the machine env automatically
google: Make pulumi preview actually run against the pinned SDK
google: Local file backend, no pulumi cloud, CI stack postfix
google: Workload identity pool (jwt), env-driven config, e2e-gcp workflow
bigquery: The corpus acceptance leg, and the importer it needed (#90)
sql: Prove and cover the week grain's Monday semantics (#67) (#75)
golden: A value in double quotes was stripped before we looked (#51)
startup: The source refusals both binaries make and neither proved (#31)

Build¶

licence: Ship a committed, signed attribution document (#161) (#170)
release: Publish sutura-serve as a second artefact (#167)
licence: An attribution document, and a signed licence report
Refresh dependencies (#65)
tooling: The Google Cloud CLI, as a container not a package (#54)
xtask: One Arrow major per lock file, or an explained exception (#30)
nix: Stax 0.108.0, pinned upstream because nixpkgs has 0.102.2 (#25)

CI¶

Answer the merge_group event, and gate cross on the event (#109)
Run required checks for merge queue
secrets: Allowlist the KEY_ALG_RSA_2048 GCP enum in the test-infra pulumi program
e2e-gcp: Install pulumi at the pixi-locked version, no third-party action (address review r3897537270)
e2e-gcp: Take the pulumi CLI version from pixi.lock, not a float
A dev trunk, and a release on every promotion to main (#104)
release: Sign and attest every published artefact (#97)
Run all workflows on the rust-mcp larger runner (#96)
docs: A text-only citation gate, so a prose-only PR stops paying 15m45s (#32)

Infra¶

google: Add infra-down and infra-set operator recipes
google: Move provisioning out of CI; CI consumes the bq-test environment
google: Export a CI service account key and CI dataset/table for the bq-test environment
google: Make up run as the developer ADC and fix three resource validations
google: Give the GCP provider a concrete region+zone so it stops enumerating compute regions
google: Bootstrap the Service Usage API itself, first, from pulumi
google: Env-driven stack name and a pulumi CLI/SDK version-parity gate
google: Pin the pixi pulumi SDK to the nix CLI version (both 3.255.0)
google: Pin the pulumi CLI via nix (devenv + flake), drop the web installer

Merge¶

Bring main's direct merges back into dev, keeping one licence implementation

0.2.4 - 2026-08-25¶

Fixes¶

ci: The prune's own display line failed the workflow

Performance¶

ci: A profile for the link check, tuned for compile speed

CI¶

Delete the caches of closed pull requests, weekly
release: Cut releases on request, not on every push

0.2.3 - 2026-08-25¶

Documentation¶

The end-user pages stop routing contributors
release: The notes are tables, and nothing else

0.2.2 - 2026-08-25¶

Documentation¶

release: Notes are the changelog, the binaries and the images

0.2.1 - 2026-08-25¶

Fixes¶

api-docs: Drop the version, and wire the writer through nix

Documentation¶

Compress the prose, and make "Where to start" end-user only

0.2.0 - 2026-08-25¶

Features¶

Mimalloc 3.5.0 via nix, generated API docs, new identity mark

Fixes¶

release: Take the image digest from the push, not from RepoDigests

Refactoring¶

Move repo-only config into devco/

Documentation¶

One mark on the front page, not two
agents: Cite a just task, never a raw command
agents: Let CONTRIBUTING.md own the procedure
agents: Cut what the file already says elsewhere

CI¶

Check every arch on the pull request, as a matrix
Build the shipped artifacts on main, not on every branch
hooks: Run the tests at commit, not at push
release: Cache the release path, and split it into a matrix

0.1.0 - 2026-08-25¶

Features¶

Musl artifacts with mimalloc, plus a contributing guide
Mkdocs-material docs, FHS dev container, one pin per tool
Typed newtypes, structured errors, and an honest hexagon
Secrets gate, dev CLI, justfile, changelog automation
gates: Check-guidance, skills lock, and one dispatch table
skills: Import 20 library-tier skills, enforce provenance
agents: Cross-agent skill wiring, ponytail, PR and issue templates
Stacked-branches skill, repo-local stax config, generated-file exemption
skills: Add ms-rust, regenerated from current upstream
agents: Skills tree, causality gate, and the checks that keep them honest
gates: Max-lines 1000, unused-deps, and a stricter lint table
M0 walking skeleton — toolchain, gates, and a binary that runs
Initial

Fixes¶

xtask: A check that could not run must not report a finding
xtask: A pointer file is not a newline violation
dev: Clear build-users-group so the container can build derivations
ci: Catch a missing flake output and a vendored leak locally
dev: Pass a token through only when it exists, and keep nix on PATH
Unbreak CI on main, and make the hooks work outside the dev shell
dev: Doctor catches uninstalled hooks - they were never installed
ci: A moved file no longer skips its own area
Ship one binary, one hygiene list, CRLF for every text file
Nextest everywhere, doctests in CI, and three things I got wrong
ci: Compare against the whole branch, and stop passing on a base that never built
deny: Allow only the licences in use, and fail if that stops being true
security: Act on the review - publish paths, supply chain, betterleaks
gates: Skip crane's .cargo-home, drop four lint allows, ASCII output
ci: Make the Nix path actually work, and stop rebuilding Rust four times

Documentation¶

The brand slots are filled, not empty
skills: St sync does not restack, st refresh does
Trim getting-started and enterprise-mirrors

Build¶

Bump sha2 from 0.10.9 to 0.11.0

CI¶

Remove every third-party action, add the weekly security audit
Classify changes, inline the remote hooks, --all-features everywhere
Drop devenv from CI, add the opt-in performance release

Review¶

1.98, rustfmt 130, drop the hook, cross-built releases, cranelift dev-only