@creatornader/agent-bridge 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -6,6 +6,225 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-07-20
+
+### Added
+
+- Add migration 020 to converge databases released through migration 019 on the managed-authority
+  function and attestation contract. Migration readiness accepts only the exact
+  released checksums or the current checksums for changed migrations, so existing
+  databases can advance without allowing arbitrary ledger drift.
+
+- Add migration 021 with an attested, database-derived backup-reader role. The role is
+  `NOLOGIN`, receives read-only access to Agent Bridge tables and sequences, and is
+  granted only to the schema owner so managed PostgreSQL can produce complete native
+  backups without exposing backup access to runtime or control principals. Migrations
+  accept `CREATEROLE`, while source native backups require a true superuser or
+  `BYPASSRLS`. A restore target superuser can validate a suspended restored schema owner.
+
+- Add a PostgreSQL 15 through 18 integration path that applies every migration as a
+  non-superuser with `CREATEROLE` and `BYPASSRLS`, matching the authority available on
+  managed providers such as Supabase.
+
+- Add a read-only production PostgreSQL preflight. It rejects unsupported server
+  majors, insufficient migration authority, migration-ledger drift, derived-role
+  collisions, and incompatible legacy import tables before any schema change runs.
+  It reports migration authority separately from native DR authority. Reports omit
+  connection URLs and database identities.
+
+- Add a manual production proof workflow for an existing Agent Bridge gateway. It
+  uses separate sender, receiver, Fly machine-cycle, and verifier jobs behind the
+  `agent-bridge-production-proof` environment. A versioned, phase-specific receipt
+  contract records offline queue replay, exact idempotency, cross-host claim and
+  acknowledgment, a changed Fly runtime instance ID, and fresh-edge verification without
+  storing credentials, message content, database URLs, or SQLite files.
+- Add an optional `messageId` filter to HTTP 2.1, MCP, and CLI delivery claims. It
+  atomically selects and maintains only that eligible recipient delivery. Omitting the
+  filter preserves claim-next behavior, and HTTP 2.0 rejects the new field.
+
+- Add a maintained Fly.io reference config with one always-running shared VM, HTTPS
+  ingress, `/readyz` checks, and a 30-second SIGTERM budget. Add a read-only preflight
+  that checks the local contract and, when an app is supplied, reports value-safe Fly
+  account and app observations. The deployment docs keep migration, restricted-runtime
+  bootstrap, secret changes, deployment, and cross-machine proof behind operator gates.
+
+### Fixed
+
+- Support managed PostgreSQL role administration without restating protected role
+  attributes. PostgreSQL 16 and newer may split one schema-owner membership across an
+  administrator grant and a separate inherit-and-set grant. Readiness and native DR
+  now validate and preserve the effective authority while rejecting unexpected grant
+  shapes. Ownership transfers receive schema `CREATE` only for the transaction that
+  needs it, and runtime bootstrap verifies an existing login before changing its
+  password or membership.
+
+- Make runtime bootstrap transactional and reject derived authority names, object
+  owners, unexpected memberships, and reverse membership edges before changing an
+  existing login.
+
+- Suspend restored runtime, control, and archive principals as `NOLOGIN` roles without
+  authority memberships. Control and archive registration histories receive explicit
+  revocation events. Restore may reuse one preexisting role only when it is the source
+  schema owner, the target session user, and a true superuser.
+
+- Resolve the Fly Dockerfile from the deployment config directory and reject missing
+  configured build files during the production preflight.
+
+- Check the client TLS socket during the production PostgreSQL preflight when a
+  session pooler terminates TLS before opening its database connection.
+
+- Fix the legacy Supabase setup script's column comment so PostgreSQL accepts the
+  checked-in schema without manual editing. The PostgreSQL integration suite now runs
+  that script before testing the v2 legacy import.
+
+## [0.4.0] - 2026-07-19
+
+### Added
+
+- Add v6 managed-client endpoint cutover and finalization commands. A
+  committed v5 stage authorizes a credential-free v6 journal only after both live
+  gateways negotiate HTTP 2.1, bind the recorded principal and credential IDs, report
+  one immutable authority ID, and complete a route challenge. Cutover drains the
+  source edge under an exclusive lease before changing a host registration. The initial
+  proof uses the predecessor and successor. Once a journal exists, every proof and
+  replay uses the successor credential at both URLs, then drains the source edge
+  through the target gateway. Finalization retires the source only after the
+  predecessor grace cutoff. Dry runs inspect edge state without opening SQLite for
+  write access or contacting a gateway. Resume classifies durable before and after
+  proofs and cannot take over a live lease.
+
+- Add migration 019 for successor-only endpoint-migration challenges. A challenge now
+  accepts either a direct predecessor-to-successor pair or the same active successor
+  credential on both endpoints. The migration preserves the migration 018 challenge
+  records and readiness controls, adds v2 endpoint and v6 owner attestations, and does
+  not grant cutover authority. Authenticated HTTP 2.1 capabilities now return the
+  credential's `grantedScopes`.
+
+- Add migration 017 with an immutable PostgreSQL gateway authority UUID. Production
+  request authority now uses a bound opener without changing the released opener's
+  return shape. Authenticated gateway status adds optional `gatewayAuthorityId` and
+  `credentialId` fields under HTTP 2.1. Native DR preserves the UUID as logical
+  authority continuity, not live-clone fencing. Deployments must drain old gateway
+  instances before the migration.
+
+- Add `clients migrate stage <runtime>` for inert gateway-client migration
+  preparation. The command probes the active and successor bearer credentials, records
+  enrollment credential IDs and credential-free source and target bindings, and
+  prepares a private successor backend without changing the active registration or
+  backend. It does not authorize cutover. The source SQLite edge gate prevents new
+  outbox inserts once a later drain starts, including from a client that opened the
+  database before the gate changed. Staging requires an absolute, normalized source
+  edge database path and rejects in-memory edge state.
+
+- Add explicit, plan-first `clients rollback <update-operation-id> --identity <name>`
+  for committed same-host v4 updates. `--apply` creates a separate reverse journal.
+  It verifies the source inverse contract and current forward metadata and
+  registration before it removes the forward native entry, restores the prior entry,
+  and writes prior metadata last. Claude Desktop replaces only its Agent Bridge entry.
+  Generic `clients resume` also resumes a reverse journal. The v4 source completion
+  keeps only a bounded credential-free inverse contract. Repair remains monotonic and
+  uninstall stays forward-only. Managed operation summaries preserve the durable
+  manifest version and include the `rollback` kind.
+
+- Add forward-only `clients uninstall` for metadata-owned Codex, Claude Code, and
+  Claude Desktop registrations. Uninstall proves and removes the managed
+  registration, deletes an already private backend file, then deletes management
+  metadata. It never snapshots backend bytes or reverses a completed step. POSIX
+  deletion syncs the private parent directory. Windows verifies deletion and records
+  unavailable directory durability. Native and Desktop writes retain their documented
+  same-user advisory race boundaries.
+  Add `clients resume <operation-id> [--recover-lock]`, which derives repair and
+  uninstall authority from recorded v3 requests, and update or rollback authority
+  from recorded v4 requests. It also accepts pre-v4 update journals. It accepts no
+  replacement identity, runtime, instance, launch, or file locator. Version 2
+  journals remain inspectable only. Generic resume also completes an uninstall
+  interrupted after its final metadata deletion.
+
+- Add plan-first `clients repair` and `clients update` for metadata-owned Codex,
+  Claude Code, and Claude Desktop registrations. Runtime and stable instance locate
+  strict owner-private metadata. Identity binds the record and immutable repair or
+  update request. Repair restores the stored launch contract, while update journals a
+  normalized credential-free launch request.
+  Applied native changes prove remove, absence, add, and exact target before a
+  metadata-last launch update. Desktop replaces only the Agent Bridge entry and
+  preserves unrelated JSON values. Backend privacy repair records only policy proofs
+  and tightens permissions without reading or snapshotting backend content. Full
+  metadata and bounded registration proofs prevent drifted state from advancing a
+  prior journal. Unknown environment keys and unsafe registration fields stop before
+  journal creation. Native update commands reject argument, credential, and URL-like
+  surfaces. Desktop publication uses a private operation-scoped temporary file and
+  detects the checked races that Node can observe, but it cannot provide an OS
+  transaction with Claude Desktop. Same-action same-host resume and stale-lock recovery
+  use the existing operation substrate.
+  New journals use operation format version 3. Version 2 journals remain inspectable,
+  but incomplete records cannot resume without an identity-bound request.
+
+- Give local and edge SQLite initialization a 15-second minimum busy-retry window
+  for concurrent first-start schema work. Normal database operations retain their
+  configured timeout. Concurrency tests also terminate hung child processes before
+  temporary-directory cleanup.
+
+- Add the crash-safe managed-client operation substrate and read-only `clients
+  operations [<operation-id>]` inspection. Owner-private revisioned manifests,
+  immutable ordered step plans, snapshot artifacts, pinned directory identities,
+  per-client locks, and same-host stale-lock proof keep private contents out of JSON
+  and errors. Restart classification distinguishes exact before-state retries,
+  verified after-state advancement, and blocked ambiguity. Snapshot publication never
+  replaces residue, every step requires a verified before-state snapshot, and bounded
+  manifests reject contradictory state. Typed credential-agnostic requests,
+  no-replace before/after artifacts, lock-covered begin, and same-host resume now feed
+  distinct resumable, classification-required, blocked, and complete inspection.
+  Crash-restartable per-artifact cleanup advances `applied` through `cleaning` to a
+  `committed` manifest after verified unlink and POSIX directory sync, or an explicit
+  Windows unavailable-durability result. Exact after-publication and post-intent unlink
+  residue can resume; every other missing or extra artifact blocks. Terminal manifests
+  retain a bounded credential-free completion record. Windows mutations reuse native
+  ACL results only within one held lock and for the same verified directory path
+  identity. File checks, new or resumed locks, and passive inspection recheck the
+  policy. POSIX checks remain per-access. Repair, update, and uninstall use this substrate.
+
+- Add read-only `clients inspect` and plan-first `clients adopt` for Codex, Claude
+  Code, and Claude Desktop. Exact unmanaged registrations can be adopted only with
+  `--apply`, which writes owner-only credential-free management metadata. Inspection
+  reports absent, unmanaged, managed, or drifted state without reading backend values
+  or contacting a gateway. Registration comparison is structural and health-neutral,
+  backend paths enforce the owner-only no-link policy, Desktop inspection shares the
+  installer launch resolver, and apply re-inspects its postcondition. Enrollment-based
+  provision collision behavior is unchanged. Managed metadata also binds Desktop to
+  its normalized config path, Codex to its active profile config, and Claude Code
+  local or project scope to its invocation directory so later operations cannot guess
+  at a registration target.
+
+- Add a pinned, non-root gateway image and a loopback-only Compose development stack.
+  The stack runs migrations separately, creates a restricted runtime login, reads
+  database passwords from private secret files, and retains PostgreSQL data in a named
+  volume.
+- Add a Linux Compose acceptance test for credential-bound identity, targeted delivery,
+  lease settlement, denied runtime access to credential hashes, and PostgreSQL
+  persistence across a full stack restart.
+- Add a deployment guide for production TLS, network isolation, secret handling,
+  backup, upgrade order, and rollback.
+
+### Fixed
+
+- Defer Windows SQLite sidecar ACL application until the opened connection establishes
+  WAL and completes its serialized schema transaction. Concurrent first-open processes
+  no longer race a transient sidecar before their own connection holds it. Replacement
+  during one ACL validation still fails.
+- Treat a Windows SQLite sidecar that disappears during ACL validation as an expected
+  race only when the path remains absent. A replacement or reparse object still fails
+  validation.
+- Handle `-h` and `--help` before command parsing and dispatch so help never opens a
+  backend or performs a command side effect.
+
+### Changed
+
+- Require the exact release commit to pass the full `test.yml` matrix on `main` before
+  release packaging begins. Pin GitHub Actions and reusable workflows to verified
+  commit SHAs.
+- Keep Dependabot's grouped npm updates to patch and minor versions. Major updates now
+  require separate review.
+
 ## [0.3.1] - 2026-07-15
 
 ### Added
@@ -136,7 +355,9 @@ First tagged release. Marks the point where agent-bridge has shipped its initial
 - Narrative-leak detection in CI + on commit via `creatornader/textleaks@v0.2.0` (renamed from leakguard).
 
 [0.1.0]: https://github.com/creatornader/agent-bridge/releases/tag/v0.1.0
-[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.3.1...HEAD
+[Unreleased]: https://github.com/creatornader/agent-bridge/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/creatornader/agent-bridge/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/creatornader/agent-bridge/compare/v0.3.1...v0.4.0
 [0.3.1]: https://github.com/creatornader/agent-bridge/compare/v0.3.0...v0.3.1
 [0.3.0]: https://github.com/creatornader/agent-bridge/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/creatornader/agent-bridge/compare/v0.1.0...v0.2.0