@aiaiai-pt/frankctl 0.7.2 → 0.8.1

package/CHANGELOG.md

@@ -3,6 +3,29 @@
 All notable changes to `@aiaiai-pt/frankctl` are documented here. This project
 adheres to [Semantic Versioning](https://semver.org/).
 
+## 0.8.1
+
+- Document the explicit Source credential runtime boundary in the bundled
+  agent skill: the current base Compose deployment uses `legacy_inline`, while
+  credential lifecycle commands and opaque references require `vault` mode.
+
+## 0.8.0
+
+- Add declarative `IdentityPolicy` reconciliation, exact symbolic reference
+  resolution, typed field-mapping persistence, dry-run version planning, and
+  portable Pipeline export through the existing `pipelines apply` path.
+- Preserve identity-policy history with monotonic first-use freezing: unchanged
+  recipes no-op, unused recipes patch in place, and changed frozen recipes
+  advance exactly one version.
+- Serialize first binding with recipe writers and carry an internal complete
+  recipe-hash precondition across declarative resource requests. Concurrent
+  drift now returns a structured 409 and full-file replay guidance instead of
+  silently binding a changed in-place recipe.
+- Add the CIRA regional `stop_time` identity-backed pipeline as an explicit
+  `declared_pending` template component. The default remains the seven
+  live-proven components (50 documents); `--all` renders all eight components
+  (53 documents) until current-box ontology proof promotes it.
+
 ## 0.7.2
 
 - Make the CIRA regional-transport integration self-contained by declaring the

package/README.md

@@ -42,7 +42,7 @@ frankctl --help
 - `frankctl templates list|show|render`
 - `frankctl pipelines list|get|validate|apply|export`
 - `frankctl sources list|get|create|update|delete|discover|sync|logs|history`
-- `frankctl sources credentials set|rotate`
+- `frankctl sources credentials set|rotate` (Vault mode only)
 - `frankctl backing-datasets list|get|create|update|delete|sync|entities` (alias: `frankctl bd`; `sync --force` replays unchanged data/spec)
 - `frankctl sources streams list|set|refresh-schema`
 - `frankctl transforms list|get|runs|logs|trigger`
@@ -65,17 +65,24 @@ when force replay is unsupported or unadvertised.
 
 `frankctl pipelines apply -f vertical.yaml` can provision a complete Source +
 Pipeline + BackingDataset triple from a single multi-doc YAML file when the
-Source contains no credential value.
+tracked Source contains no credential value.
 Docs use the kubectl-style envelope (`apiVersion: frank.platform/v1`,
 `kind:`, `metadata.name:`, `spec:`). The CLI sorts by kind (Source →
 Pipeline → BackingDataset), resolves cross-doc name references to UUIDs,
 and POSTs each doc with `?if-not-exists=true`. `frankctl pipelines export
 <id> -o yaml` round-trips an existing pipeline back to a multi-doc YAML
-file for review. Declared credential values are written separately with
-`frankctl sources credentials set|rotate --values-file -` and stored in Vault;
-they are never accepted in ordinary `source_config` or returned by export.
-Git-owned Sources contain only ordinary configuration and the tenant-owned
-opaque `credential_ref`. See `../docs/guides/cli.md` for the full reference.
+file for review.
+
+Credential handling follows the server's explicit `SOURCE_CREDENTIAL_MODE`.
+Current mutable/base Compose uses `legacy_inline`: Source create/update accepts
+write-only `credential_values` and persists them in `Source.source_config`;
+read/export stay redacted, and credential references plus the `sources
+credentials` commands are unavailable.
+The immutable release uses `vault`: values are written separately with
+`sources credentials set|rotate --values-file -`, and Git-owned Sources may
+carry the tenant-owned opaque `credential_ref`. Export never returns values; it
+strips inline credential fields and preserves only a Vault-mode reference when
+one exists. See `../docs/guides/cli.md` for the full reference.
 
 Relationship-bearing BackingDatasets declare their prerequisites in
 `metadata.dependsOn` and explicitly use `spec.sync_mode: manual`. The graph is