a2a-rails 0.2.0.rc2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d25d68c2d162e0c74bd0290796deb21e67a25dbb5173a8aeb7c0157a4386e449
-  data.tar.gz: 179763f0e9367cb693984ff21965a1e6b274bad535623eabce480f56c08e210c
+  metadata.gz: 447c947dcb0231daa7d00a4c0de158ca737795fcae5f529d71a0ed8d87f9ee3f
+  data.tar.gz: bc9fa7e1884a169d45857a9febea788630d9917022e8919819357b4e57914d35
 SHA512:
-  metadata.gz: 52b61f85459067a908b296f30b54085d0b13e4dce84b1e3cd67753d851b0c2cc124716f6ac9ac9c76785cb962285886c8570ea185fb10940249c67ada17e99f2
-  data.tar.gz: 67f88e735d6a54ccf1e858b2bbaf3b775e522a4cb4eab064892bf052eddb396f3f883b3c786c2159d87408e4f61f7bf4df6ccc4afb17b63fea5d6d88a405b37e
+  metadata.gz: 6209ff98b146525320999d3d44e086053e6d767e1a20328436ff34908af222c87912c2e1b78745ce3b646499f1eb33c4e245d4b883fcc169870a1233604e4c10
+  data.tar.gz: b0b74efa6e45bf7fe84ac63e1d5b2e68cc27386177f1fab728f0ea0582186adb55c7c3c379504b66b05997cc7600cb9e30056143df7311b8af2c591a8b73957d

data/CHANGELOG.md

@@ -4,9 +4,33 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.2.0.rc2] - 2026-10-07 (release candidate source; not published)
+## [0.2.0] - 2026-10-08 (stable candidate source; NOT published)
 
-> Fresh candidate after Steps 21–22 runtime changes. Verification is tracked in [Issue #54](https://github.com/cuichangquan/a2a-rails/issues/54). No tag, GitHub Release, or RubyGems publication is authorized by this version change.
+> **Step 26-4 release preparation only.** Version `0.2.0` has been selected for an exact, source-built candidate. No `v0.2.0` Git tag, GitHub Release, or RubyGems push has been authorized. The published `0.2.0.rc2` pre-release is immutable and **does not include the subsequent fixes** below.
+
+### Added
+
+- A2A v1.0 **Task and optional direct Message** responses; explicit output File Parts through `FileArtifact.bytes` and `.url`.
+- **Opt-in ActiveRecordStore** with owner-scoped persistent Tasks, PostgreSQL locking, signed pagination cursors, generated migration, retention, bounded pruning, resource guards and maintenance statistics. **MemoryStore remains the default**.
+- **Opt-in ActiveJob async Task execution** with global / Agent / Skill configuration; durable Store + operated durable queue required for reliable multi-process use. Default processing stays synchronous; direct Message execution stays synchronous.
+- Host-owned HTTP Bearer authentication and corresponding Agent Card advertisement, fail-closed production endpoint behavior, principal-scoped Task operations, bounded request parsing and safer error handling. **The Gem does not implement the host's identity provider or business authorization.**
+- Source-built **installed-artifact** Rails 8.0/8.1 + PostgreSQL 16 production-host checks, realistic signed-token **test fixture** for negative authentication/tenant isolation, and Solid Queue/Sidekiq worker SIGKILL and duplicate delivery smoke. See [Step 26 release gates](docs/release/v0.2.0-stable-readiness.md).
+
+### Fixed
+
+- **Issue #65:** configure the Rails/Zeitwerk `a2a` basename as `A2A` in the Engine without mutating global ActiveSupport inflections, preventing production eager-load errors in clean Rails 8.0/8.1 applications.
+- Generate the ActiveRecord Task Store migration class from the host's ActiveSupport inflections, so both standard `CreateA2aRailsTasks` and host-configured acronym `CreateA2ARailsTasks` cases migrate without fixture patches.
+
+### Changed / upgrade notes
+
+- **Potential v0.1.0 breaking change:** non-development/test environments fail closed without a configured trusted `authenticate_request` hook and matching Bearer Agent Card metadata; tasks are isolated by authenticated principal. See [upgrade guide](docs/release/upgrading-v0.1.0-to-v0.2.md).
+- Reject oversized/malformed/unsupported HTTP input earlier; only verified non-secret principal IDs may drive Task ownership.
+- No general-purpose automatic Handler retries, forceful in-flight cancellation, or exactly-once external side effects. A Task committed just before enqueue can remain SUBMITTED; a crashed worker can leave an ambiguous WORKING Task. Business idempotency and reconciliation are **host responsibilities**.
+- Ruby **>= 3.3**, Rails **>= 8.0, < 8.2**, A2A protocol **v1.0**, `agent2agent ~> 2.0.0`. No universal production certification; per-deployment security [Issue #11](https://github.com/cuichangquan/a2a-rails/issues/11) remains open.
+
+## [0.2.0.rc2] - 2026-10-08 (published pre-release; historical artifact)
+
+> Published as the **rc2 pre-release** on RubyGems after separate approval in Step 25. Verified published artifact SHA256: `d65fdd65003987ece96f0a90a4cf28563929be99d26658deeb275fca30c5d694`. Later Step 26 fixes (including #65) are **not** in that immutable rc2 Gem.
 
 ### Added
 

data/README.md

@@ -5,14 +5,15 @@
 
 Rails-native integration for exposing Rails applications as A2A v1.0 agents.
 
-> **Status:** v0.1.0 is the published RubyGems release. Current `main` is being prepared as **`0.2.0.rc2`** after Steps 21–22 added the optional durable ActiveRecord Task Store and opt-in ActiveJob Task execution. The historical `0.2.0.rc1` artifact remains historical-only evidence. `rc2` is a verification candidate, **not published** and not authorization for a tag/GitHub Release/RubyGems push.
+> **Release status (2026-10-08):** RubyGems has published **`0.1.0`** and the **`0.2.0.rc2` pre-release**. The current source is being verified as an **unpublished `0.2.0` stable candidate** (Step 26-4). In particular, the Rails/Zeitwerk and migration-generator fixes after rc2 are only in the newer source-built candidate. **No stable `0.2.0` tag, GitHub Release, or RubyGems publication has been authorized.**
 
 - RubyGems: https://rubygems.org/gems/a2a-rails
-- GitHub Release: https://github.com/cuichangquan/a2a-rails/releases/tag/v0.1.0
+- Published pre-release: https://github.com/cuichangquan/a2a-rails/releases/tag/v0.2.0-rc.2 (stable `0.2.0` not yet released)
+- Previous stable release: https://github.com/cuichangquan/a2a-rails/releases/tag/v0.1.0
 - Changelog: [CHANGELOG.md](CHANGELOG.md)
 - Release record: [docs/release/v0.1.0-record.md](docs/release/v0.1.0-record.md)
 - **Release readiness:** [current release/deployment checklist](docs/release/security-hardening-release-checklist.md) · [v0.1.0 → proposed v0.2 upgrade guide](docs/release/upgrading-v0.1.0-to-v0.2.md). The old rc1 record is historical evidence only.
-- **Roadmap / 次にやること:** [ROADMAP.md](ROADMAP.md) — Step 23 / [Issue #54](https://github.com/cuichangquan/a2a-rails/issues/54) prepares and verifies `0.2.0.rc2` without publishing. Deployment security [#11](https://github.com/cuichangquan/a2a-rails/issues/11) remains open.
+- **Roadmap / 次にやること:** [ROADMAP.md](ROADMAP.md) — [Step 26 / Issue #62](https://github.com/cuichangquan/a2a-rails/issues/62) tracks the `0.2.0` stable candidate and release gates; [production Issue #11](https://github.com/cuichangquan/a2a-rails/issues/11) remains open. See [stable-readiness record](docs/release/v0.2.0-stable-readiness.md).
 - **Official A2A TCK results:** [Pinned JSON-RPC MUST report and reproduction](docs/testing/official-a2a-tck.md) — after Step 17-4: **63 passed / 1 failed / 171 skipped / 30 deselected** (pytest). The remaining `CORE-SEND-003` mismatch is tracked [upstream in #202](https://github.com/a2aproject/a2a-tck/issues/202). The TCK workflow is informational, **not** an A2A conformance certificate.
 
 - [A2Aの全体像（日本語・A4 1枚PDF）](docs/guides/a2a-protocol-overview-ja.pdf) — 登場人物・依頼の流れ・主要用語・MCPとの違いをまとめた学習資料。
@@ -67,7 +68,7 @@ v0.1 is intentionally **server-first** and **non-streaming**.
 - A2A protocol version `1.0`
 - `agent2agent ~> 2.0.0`
 
-The v0.1.0 release is verified against:
+The original v0.1.0 baseline was verified against:
 
 - Ruby 3.3 / 3.4 / 4.0
 - Rails 8.0 / 8.1
@@ -273,13 +274,13 @@ The Rails Engine is mounted automatically.
 
 The unreleased `main` branch includes a host-provided `config.authenticate_request` callback for `POST /a2a`, plus per-principal Task ownership checks. Without an authenticator, production and other non-development/test environments fail closed; the local development/test Quick Start remains available. See [Authentication guide](docs/guides/authentication.md).
 
-> **Important:** These protections are **not yet shipped in RubyGems 0.1.0** and do not make an endpoint production-secure by themselves. Distributed rate limits, business authorization and the deployment review remain tracked in [Issue #11](https://github.com/cuichangquan/a2a-rails/issues/11).
+> **Important:** These protections are **absent from RubyGems 0.1.0** but included in the published `0.2.0.rc2` pre-release; the stable candidate has additional fixes. Neither pre-release nor stable source automatically makes a deployed endpoint production-secure. Distributed rate limits, business authorization and the deployment review remain tracked in [Issue #11](https://github.com/cuichangquan/a2a-rails/issues/11).
 
 ### Step 16-4 request hardening (merged on main; unreleased)
 
 The unreleased main branch adds a bounded JSON-RPC body (`config.max_request_bytes`, default 1 MiB), Content-Type validation, stricter parameter checks, a pagination snapshot cap, and reduced exception logging. See [Request Hardening Guide](docs/guides/request-hardening.md).
 
-Rate limiting, application-specific authorization and production deployment safeguards remain the host's responsibility or future work. Step 16-5 adds explicit A2A Agent Card Bearer authentication advertisement on unreleased `main`; it must match the host verifier. **These improvements are not included in the published v0.1.0 Gem.**
+Rate limiting, application-specific authorization and production deployment safeguards remain the host's responsibility or future work. Step 16-5 adds explicit A2A Agent Card Bearer authentication advertisement on unreleased `main`; it must match the host verifier. **These improvements are not included in the published v0.1.0 Gem; see the later rc2 pre-release and current stable candidate.**
 
 ### Production deployment review (Step 16-6)
 
@@ -492,7 +493,7 @@ See [docs/release/v0.1.0-record.md](docs/release/v0.1.0-record.md) for the compl
 - [Final Ruby/Rails regression CI](https://github.com/cuichangquan/a2a-rails/actions/runs/37576849516) — **13/13 PASS**.
 - [Interop test code, reproduction and limitations](docs/testing/cross-language-interop.md).
 
-This is **unreleased source**, not RubyGems v0.1.0; these tests do not certify full A2A interoperability or public-production safety.
+This evidence applies to the later source/pre-release line, not RubyGems v0.1.0; these tests do not certify full A2A interoperability or public-production safety.
 
 ## Test Strategy
 

data/lib/a2a/rails/engine.rb

@@ -14,6 +14,15 @@ module A2A
     class Engine < ::Rails::Engine
       isolate_namespace A2A::Rails
 
+      # The Gem's app/controllers/a2a/... files define A2A, not A2a.
+      # Override only the exact Zeitwerk basename, rather than mutating the
+      # host's global ActiveSupport inflections (used by migrations).
+      initializer "a2a-rails.zeitwerk_inflection" do
+        ::Rails.autoloaders.each do |loader|
+          loader.inflector.inflect("a2a" => "A2A")
+        end
+      end
+
       initializer "a2a-rails.mount_engine" do |app|
         app.routes.append do
           mount A2A::Rails::Engine => "/"

data/lib/a2a/rails/version.rb

@@ -2,6 +2,6 @@
 
 module A2A
   module Rails
-    VERSION = "0.2.0.rc2"
+    VERSION = "0.2.0"
   end
 end

data/lib/generators/a2a/rails/templates/create_a2a_rails_tasks.rb.tt

@@ -1,4 +1,4 @@
-class CreateA2aRailsTasks < ActiveRecord::Migration[8.0]
+class <%= ::ActiveSupport::Inflector.camelize("create_a2a_rails_tasks") %> < ActiveRecord::Migration[8.0]
   def change
     create_table :a2a_rails_tasks do |t|
       t.string :task_id, null: false

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: a2a-rails
 version: !ruby/object:Gem::Version
-  version: 0.2.0.rc2
+  version: 0.2.0
 platform: ruby
 authors:
 - cuichangquan