@plumbus/core 0.8.0-beta.6 → 0.8.0-beta.8

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @plumbus/core changelog
 
+## 0.8.0-beta.8 — 2026-10-01
+
+### Fixed
+
+- **Connections made from `config.database` honour `ssl`.** The server and worker pool's connection (`connectPostgresDatabase`), `plumbus seed`, `plumbus run`, and `plumbus migrate`'s create-database and reset connections built their postgres.js options without `ssl`, so they connected in plain text even when the configuration asked for TLS — which production always does. A Postgres that requires TLS refused them: Amazon RDS for PostgreSQL 15+ (`rds.force_ssl=1`) answered `28000 … no encryption`, and the worker's startup preflight surfaced it as `Failed query: SELECT lease_owner, lease_expires_at FROM flow_executions LIMIT 0`. All five now take their options from one `postgresConnectionOptions(config.database)`; `ssl: true` negotiates TLS and verifies the server certificate (supply a private CA, e.g. the RDS bundle, with `NODE_EXTRA_CA_CERTS`). Tenant data-plane connections and `migrate apply` already passed `ssl`.
+
+### Changed
+
+- **`DATABASE_SSL=false` now turns TLS off in production.** Production still defaults to TLS; an explicit `false` is for a production Postgres without TLS, which the fix above would otherwise stop connecting to (`validateConfig` keeps its `database.ssl should be enabled in production` warning).
+
+## 0.8.0-beta.7 — 2026-09-27
+
+Carries core 0.7.5 and 0.7.6 from `main` into the beta family.
+
+### Fixed
+
+- **GPT-6 OpenAI requests.** Chat Completions send `max_completion_tokens` for `gpt-6*`; active or default reasoning omits the unsupported sampling `temperature` (explicitly disabled reasoning keeps it); tool calls under GPT-6 default reasoning use the Responses API.
+- **Event pipeline audit is best-effort.** Dispatch and delivery audit entries (`event.dispatch.*`, `event.consumer.*`, including the 0.8 `event.consumer.skipped`) are written through `recordPipelineAudit`: a failed audit write is logged and no longer skips the publish, the consumer handler or the dead-letter write. Beta.2 had already made the outcomes valid, but a failing audit write still counted as a failed publish or a failed consumer attempt, so the row was retried or dead-lettered instead of delivered. `createOutboxDispatcher` and `createEventWorker` take an optional `logger`, which the worker pool passes.
+- **Stranded outbox claims are released.** On every plane it polls, the dispatcher returns `event_outbox` rows left in `processing` for longer than `claimTimeoutMs` (default 5 minutes) to `pending` before selecting, so rows claimed by a dispatcher that stopped before publishing are delivered.
+- **Timer polls cannot reject.** Per-plane failures were already contained; the timer now also catches the poll itself, and every outbox-poll failure goes to the logger when one is configured.
+
 ## 0.8.0-beta.6 — 2026-09-23
 
 Carries core 0.7.2 and 0.7.4 from `main` into the beta family (0.7.4 absorbed the unpublished 0.7.3).
@@ -100,7 +121,18 @@ Repository tag `v0.8.0-beta.3` already pointed at the format-only commit and no
 - `WorkerPoolConfig.schedulePlanes` and `app/server.ts` `export const schedulePlanes`: tenant planes for the scheduler alone, for hosts that route tenant data themselves; flows, events and the outbox keep the pool plane.
 - The scheduler syncs and polls the pool only when a registered flow is scheduled on the spine, tolerates a plane it cannot resolve or read, and reports the driver's cause.
 
-## 0.7.4 — Unreleased
+## 0.7.6 — 2026-09-27
+
+- Fix the event pipeline stalling whenever audit is wired, which the worker pool does by default (#65). Since 0.7.0 `createAuditService` refuses outcomes outside `success | failure | denied`, but the outbox dispatcher and event worker still wrote `pending`, `retry` and `dead_lettered`. Every dispatch left its outbox row in `processing` and no consumer handler ran. Attempts now record no outcome (stored as `success`), `event.dispatch.failed` and `event.consumer.dead_lettered` record `failure`, and a failed dispatch keeps `retry` / `dead_lettered` in a `disposition` metadata field. Apps that rewrote these literals in `dist/` can remove that patch.
+- Make dispatch and delivery audit entries best-effort: a failed audit write is logged (worker pool logger, else console) and no longer skips the consumer handler, the publish, or the dead-letter write. Capabilities running inside a consumer still record their own audit.
+- Return outbox rows claimed more than five minutes ago (`claimTimeoutMs`) to `pending`, so rows left in `processing` by a stopped dispatcher, including those stranded by this bug, are published after upgrading.
+- Log a failed timer-driven outbox poll instead of leaving an unhandled promise rejection.
+
+## 0.7.5 — 2026-09-24
+
+- Fix GPT-6 OpenAI request compatibility: Chat Completions use `max_completion_tokens`, active/default reasoning omits unsupported sampling temperature, and tool calls with GPT-6 default reasoning use the Responses API. Explicitly disabled reasoning stays on Chat Completions and retains configured temperature.
+
+## 0.7.4 — 2026-09-23
 
 - Bump agent wiring to v17 and add a packaged classification recipe covering explicit provider/model selection, defaults, thresholds, and cost recording. All agent formats link the recipe and decision provider instruction indexes; refresh existing apps with `plumbus init --patch --agent all`.