@plumbus/core 0.8.0-beta.1 → 0.8.0-beta.4

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @plumbus/core changelog
 
+## 0.8.0-beta.4 — 2026-09-17
+
+Repository tag `v0.8.0-beta.3` already pointed at the format-only commit and no `0.8.0-beta.3` package was published, so this increment is `beta.4`.
+
+### Added
+
+- **Approval request cancellation.** `ApprovalService.cancel({ requestId, auth, reason })` withdraws a still-pending request after human-actor and host-authorization revalidation, records cancellation actor/reason evidence, and atomically cancels linked open/claimed human tasks without creating an approval decision. Durable tenant migration `0002_approval_cancellation.sql` adds the evidence columns. Docs: [Approvals](../../docs/core-concepts/approvals.md).
+
+### Fixed
+
+- **Tenant flow heartbeats extend the authoritative spine hint.** A long-running tenant-placed step now extends its guarded `opaque_dispatch` lease before extending the tenant `flow_executions` lease. A stale worker cannot extend or acknowledge a hint owned by a peer, so a healthy step is not re-dispatched when the original spine lease duration elapses.
+- **Flow retry policies now schedule their declared backoff.** A failed step with retries remaining moves to `waiting`, releases its lease, and is claimable only at its computed fixed/exponential `wakeAt`. Tenant-placed flows persist `retry-scheduled` execution state, a retry wait, and a future-dated dispatch outbox row in one tenant transaction before acknowledging the inbound spine hint.
+- **Dispatch outbox and execution state use the framework schema.** The event pump and durable writers resolve `dispatch_outbox` / `execution_state` as `frameworkSchema ?? PLUMBUS_FRAMEWORK_SCHEMA ?? FRAMEWORK_SCHEMA` and no longer qualify those tables by the plane handle's `coreSchema` (that name is for tenant entity tables). Server and worker bootstraps pass `frameworkSchema` through to the engine and pump. Audit metadata with NUL bytes is named instead of rejected by jsonb.
+
+## 0.8.0-beta.2 — 2026-09-16
+
+### Added
+
+- **Host data-plane resolver exports.** `app/server.ts` may export `dataPlaneResolver`, `listTenantRefs`, `untenantedDataPlane`, `requestDataPlane`, `workerDataPlane` and `resolveTenantRef`; `plumbus dev` / `start` / `worker` pass them to `createServer` and the worker pool. Request-side flow engines then carry `spineDispatch`, so a flow started by a request is written to the tenant plane with an opaque hint on the control plane. `untenantedDataPlane: 'control-plane'` (`FlowSpineDispatchConfig.untenanted`) lets flows with no tenant stay classic spine rows claimed beside the tenant hints (default `'refuse'`); `requestDataPlane: 'control-plane'` keeps request repositories on the boot connection and `workerDataPlane: 'control-plane'` does the same for claimed units (`WorkerPoolConfig.unitDataPlane`; both default to `'resolved'`). Under `'resolved'`, a `tenantScoped: false` capability reads the control plane even for a tenant-bound request. A host that supplies a resolver must not also supply `createDataService`. `retryDeadLetteredFlow` takes an optional `placement` (`{ spineDb, coreSchema? }`) that reopens a tenant-placed execution and publishes a fresh spine hint (`republished` on the result). A host enabling spine dispatch needs the framework's `opaque_dispatch` table on its control plane (`migrations/spine/0000_opaque_dispatch.sql`) and the `core_plumbus` durable tables on each tenant plane. Docs: [Tenant data planes](../../docs/sdk-reference/tenant-data-planes.md).
+- **AI provider admission and trace propagation.** `ServerConfig` (and `app/server.ts` exports, honoured by `dev` / `start` / `worker`) accept `aiProviderConcurrency`, `resolveAIProviderHeaders` and `onAIProviderSpan`; `createAIService` takes the same as `providerConcurrency`, `resolveProviderHeaders` and `onProviderSpan`. The concurrency ceiling is an immediate per-scope admission shared by every identity-bound service — default scope provider + tenant + `costContext.serviceArea`, `resolveScope` overrides it — and saturation throws a `PlumbusError('conflict')` with `failureCode` / `reason` `ai-provider-concurrency-exhausted` and `retryAfterSeconds: 1` instead of queueing. `resolveAIProviderHeaders` runs before every real provider attempt (validation retries and streams included) and its result reaches the adapter as `ProviderRequest.transportHeaders`; `authorization`, `proxy-authorization`, `x-api-key`, `api-key` and `content-type` are reserved and refused. `onAIProviderSpan` receives the completed client span (`AIProviderSpan`: provider, operation, tenant, actor, correlation id, cost context, `startedAt`, `durationMs`, `status`, `traceparent`, `errorType`) and is best effort — hook failures never change the model-call result. `AIService.withContext` accepts `correlationId`, and flow workers bind the persisted flow correlation id so one trace spans request → flow → provider. New exports: `AIProviderCallContext`, `AIProviderConcurrencyConfig`, `AIProviderOperation`, `AIProviderSpan`. Docs: [AI integration](../../docs/ai/ai-integration.md).
+- **`ctx.flows.terminate(executionId)`.** `FlowService` now exposes the engine's `terminate`: it aborts the active step and closes the execution as `cancelled` without running compensations, where `cancel` runs every declared compensation for completed steps. Docs: [Flows — cancellation](../../docs/core-concepts/flows.md).
+
+### Fixed
+
+- **Event dispatch audit outcomes are valid.** The dispatcher and the event worker recorded `pending` / `retry` / `dead_lettered` / `skipped` as audit outcomes, which `createAuditService` refuses, so with a real audit service every dispatch attempt threw and one plane's rejected poll escaped the timer and ended the worker process. `event.dispatch.attempt`, `event.consumer.attempt` and `event.consumer.skipped` now carry no outcome; `event.dispatch.failed` and `event.consumer.dead_lettered` are `failure` (the former adds `disposition: retry | dead_lettered`). A failing plane's outbox poll is contained and the other planes keep being polled.
+- **Spine hint lifecycle under a data-plane resolver.** The outbox pump publishes only never-published rows (it re-readied every unacknowledged row on each poll, clearing live leases); acknowledged hints close their outbox rows; the follow-up hint between drained steps is published under the running worker's lease; a claim drops the hint of a terminal row instead of reviving it; `engine.cancel` and the runner's failure finaliser close the durable state of a tenant-placed execution; and a hint whose plane fails to resolve is dead-lettered after `FlowSpineDispatchConfig.maxClaimAttempts` (default 10) claims with `privacy_safe_failure_category_id = 'plane-unresolved'` instead of being re-leased forever.
+
 ## 0.8.0-beta.1 — 2026-09-11
 
 ### Changed