monoid-agent-kernel 0.22.0__tar.gz → 0.24.0__tar.gz

{monoid_agent_kernel-0.22.0 → monoid_agent_kernel-0.24.0}/.gitattributes

@@ -1,4 +1,5 @@
 *.py text eol=lf
+src/monoid_agent_kernel/adapters/postgres/sql/*.sql text eol=lf
 .nvmrc text eol=lf
 # `vite build` copies studio-ui/index.html verbatim and injects the hashed asset tags with LF.
 # With core.autocrlf=true the template checks out CRLF on Windows, so the generated file comes out
@@ -18,3 +19,6 @@ src/monoid_agent_kernel/reference/studio/web/dist/assets/*.js whitespace=-traili
 # inline-only today, so nothing is broken yet; pinning the tree closes it before the first
 # offloaded fixture rather than after someone spends a day on it.
 tests/fixtures/** -text
+# Temporal history manifests are semantic JSON. Keep them reviewable and cross-platform while
+# leaving any future content-addressed payload chunks under the binary fixture rule above.
+tests/fixtures/temporal_replay_v1/*.json text eol=lf

{monoid_agent_kernel-0.22.0 → monoid_agent_kernel-0.24.0}/.github/workflows/ci.yml

@@ -2,16 +2,18 @@ name: CI
 
 on:
   push:
-    branches: [main, develop]
-  pull_request:
+    branches: [main, develop, codex/v0.23-production-adapters]
+
+permissions:
+  contents: read
 
 jobs:
   studio-ui:
     name: Studio UI build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: npm
@@ -31,8 +33,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install lint tooling
@@ -42,7 +44,7 @@ jobs:
         # that also fixes the new findings, so the migration is reviewable on its own.
         run: python -m pip install ruff==0.15.6
       - name: Lint
-        run: ruff check src tests
+        run: ruff check src tests tools/v023_ci.py
 
   fast-contract:
     name: Fast + contract (Python ${{ matrix.python-version }})
@@ -52,8 +54,8 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install
@@ -69,21 +71,24 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install
         run: python -m pip install -e ".[dev,openai]"
       - name: Run bounded serial shard
-        run: python -m pytest -q -m "(integration or serial) and not live" --durations=25
+        run: >
+          python -m pytest -q
+          -m "(integration or serial) and not live and not service"
+          --durations=25
 
   coverage:
     name: Coverage floor
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install
@@ -96,14 +101,14 @@ jobs:
           --cov-report=
       - name: Append serial integration coverage and enforce floor
         run: >
-          python -m pytest -q -m "(integration or serial) and not live"
+          python -m pytest -q -m "(integration or serial) and not live and not service"
           --cov=monoid_agent_kernel
           --cov=native_agent_runner
           --cov-append
           --cov-report=term-missing:skip-covered
           --cov-report=xml
           --cov-fail-under=80
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: coverage-xml
           path: coverage.xml
@@ -116,8 +121,8 @@ jobs:
       matrix:
         os: [windows-latest, macos-latest]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
       - name: Install
@@ -140,8 +145,8 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install experimental DBOS profile
@@ -168,21 +173,23 @@ jobs:
       matrix:
         include:
           - install: minimal
-            requirement: "."
+            extras: ""
           - install: all-extras
-            requirement: ".[openai,http-async,otel-export,mcp,reference-dbos]"
+            extras: "[openai,http-async,otel-export,mcp,reference-dbos,durable-host]"
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
-      - name: Build and audit release wheel
-        if: matrix.install == 'minimal'
+      - name: Build and audit exact release wheel
         run: |
           python -m pip wheel --no-deps --wheel-dir dist .
           python tools/release_wheel_audit.py dist
-      - name: Install package
-        run: python -m pip install "${{ matrix.requirement }}"
+      - name: Install exact release wheel
+        run: |
+          wheel_path="$(find dist -maxdepth 1 -name '*.whl' -print -quit)"
+          test -n "$wheel_path"
+          python -m pip install "${wheel_path}${{ matrix.extras }}"
       - name: Import public and optional surfaces
         run: >
           python -c "import monoid_agent_kernel;
@@ -192,10 +199,13 @@ jobs:
           import monoid_agent_kernel.providers.gateway;
           import monoid_agent_kernel.observability.otel;
           import monoid_agent_kernel.mcp;
-          import monoid_agent_kernel.reference.dbos"
+          import monoid_agent_kernel.reference.dbos;
+          import monoid_agent_kernel.adapters.postgres;
+          import monoid_agent_kernel.adapters.object_store;
+          import monoid_agent_kernel.adapters.temporal"
       - name: Verify optional dependencies
         if: matrix.install == 'all-extras'
-        run: python -c "import dbos, openai, httpx, opentelemetry.sdk"
+        run: python -c "import boto3, dbos, openai, httpx, opentelemetry.sdk, psycopg, psycopg_pool, temporalio"
       - name: Run installed conformance evidence smoke
         if: matrix.install == 'minimal'
         working-directory: ${{ runner.temp }}
@@ -214,3 +224,46 @@ jobs:
           monoid studio accept \
             --workspace "${{ runner.temp }}/studio-workspace" \
             --run-root "${{ runner.temp }}/studio-runs"
+
+  combined-services:
+    name: V0.23 combined actual services
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      MONOID_SERVICE_PROFILE: combined
+      MONOID_POSTGRES16_DSN: postgresql://monoid:monoid-local-only@127.0.0.1:55416/monoid_kernel_test
+      MONOID_POSTGRES18_DSN: postgresql://monoid:monoid-local-only@127.0.0.1:55418/monoid_kernel_test
+      MONOID_MINIO_ENDPOINT: http://127.0.0.1:59000
+      MONOID_MINIO_ACCESS_KEY: monoid-test-access
+      MONOID_MINIO_SECRET_KEY: monoid-test-secret-only
+      MONOID_TEMPORAL_CLI_VERSION: v1.8.2
+      COMPOSE_PROFILES: combined
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install exact campaign SDKs
+        run: |
+          python -m pip install -e ".[dev,durable-host]"
+          python tools/v023_ci.py exact-requirements | xargs python -m pip install
+          python tools/v023_ci.py verify-installed
+      - name: Start PostgreSQL and MinIO
+        run: docker compose -f tests/service/compose.yml up -d --wait
+      - name: Run combined service integration
+        run: python -m pytest -q tests/service -m service --durations=10
+      - name: Record integration evidence
+        run: >
+          python tools/v023_ci.py write-evidence
+          --head-sha "$GITHUB_SHA"
+          --merge-sha "$GITHUB_SHA"
+          --profile combined
+          --output .tmp/v023-ci-evidence.json
+      - uses: actions/upload-artifact@v7
+        with:
+          name: v023-combined-evidence
+          path: .tmp/v023-ci-evidence.json
+      - name: Stop PostgreSQL and MinIO
+        if: always()
+        run: docker compose -f tests/service/compose.yml down --volumes

monoid_agent_kernel-0.24.0/.github/workflows/pr-fast.yml

@@ -0,0 +1,34 @@
+name: V0.23 PR fast
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, converted_to_draft]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fast-pr-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fast:
+    name: Python 3.12 fast contracts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install fast gate dependencies
+        run: python -m pip install -e ".[dev]" ruff==0.15.6
+      - name: Validate campaign lock
+        run: python tools/v023_ci.py validate-lock
+      - name: Lint Python sources
+        run: ruff check src tests tools/v023_ci.py
+      - name: Run deterministic unit and contract gate
+        run: >
+          python -m pytest -q -n 4
+          -m "(unit or contract) and not serial and not service"
+          --durations=25

monoid_agent_kernel-0.24.0/.github/workflows/pr-full-cancel.yml

@@ -0,0 +1,18 @@
+name: V0.23 PR full cancel sentinel
+
+on:
+  pull_request:
+    types: [converted_to_draft]
+
+permissions: {}
+
+concurrency:
+  group: full-pr-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  cancel:
+    name: Cancel stale L2 run
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Draft transition invalidated the previous L2 merge candidate."

monoid_agent_kernel-0.24.0/.github/workflows/pr-full.yml

@@ -0,0 +1,186 @@
+name: V0.23 PR full
+
+on:
+  pull_request:
+    types: [opened, reopened, ready_for_review, labeled, unlabeled]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: PR number used by the cross-workflow concurrency key
+        required: true
+        type: string
+      ref:
+        description: Exact merge ref or commit to qualify
+        required: true
+        type: string
+      profile:
+        description: Explicit diagnostic service profile
+        required: true
+        type: choice
+        options: [core, postgres, objectstore, temporal, combined]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: full-${{ ((github.event.action == 'labeled' || github.event.action == 'unlabeled') && contains(fromJSON('["ci:core","ci:postgres","ci:objectstore","ci:temporal","ci:combined"]'), github.event.label.name) == false) && 'dormant-' || '' }}pr-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  trigger:
+    name: Classify L2 trigger
+    runs-on: ubuntu-latest
+    outputs:
+      mode: ${{ steps.classify.outputs.mode }}
+    steps:
+      - name: Classify required, diagnostic, or dormant execution
+        id: classify
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_DRAFT: ${{ github.event.pull_request.draft }}
+          LABEL_EVENT: ${{ github.event.action == 'labeled' || github.event.action == 'unlabeled' }}
+          RELEVANT_LABEL: ${{ contains(fromJSON('["ci:core","ci:postgres","ci:objectstore","ci:temporal","ci:combined"]'), github.event.label.name) }}
+        run: |
+          mode=dormant
+          if test "$EVENT_NAME" = workflow_dispatch; then
+            mode=diagnostic
+          elif test "$PR_DRAFT" = false; then
+            if test "$LABEL_EVENT" != true || test "$RELEVANT_LABEL" = true; then
+              mode=required
+            fi
+          fi
+          echo "mode=$mode" >> "$GITHUB_OUTPUT"
+
+  profile:
+    name: Validate L2 profile
+    needs: trigger
+    if: needs.trigger.outputs.mode != 'dormant'
+    runs-on: ubuntu-latest
+    outputs:
+      profile: ${{ steps.resolve.outputs.profile }}
+      lock_sha256: ${{ steps.resolve.outputs.lock_sha256 }}
+      run_postgres: ${{ steps.resolve.outputs.run_postgres }}
+      run_postgres18: ${{ steps.resolve.outputs.run_postgres18 }}
+      run_objectstore: ${{ steps.resolve.outputs.run_objectstore }}
+      run_temporal: ${{ steps.resolve.outputs.run_temporal }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Resolve plan-owned service profile
+        id: resolve
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref || inputs.ref }}
+          LABELS_JSON: ${{ toJSON(github.event.pull_request.labels.*.name) }}
+          REQUESTED_PROFILE: ${{ inputs.profile }}
+        run: >
+          python tools/v023_ci.py resolve-profile
+          --head-ref "$HEAD_REF"
+          --labels-json "$LABELS_JSON"
+          ${REQUESTED_PROFILE:+--requested-profile "$REQUESTED_PROFILE"}
+          --github-output "$GITHUB_OUTPUT"
+
+  core:
+    name: L2 core (Python ${{ matrix.python-version }})
+    needs: profile
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Install
+        run: python -m pip install -e ".[dev,openai,reference-dbos]"
+      - name: Run complete unit and contract gate
+        run: >
+          python -m pytest -q -n 4
+          -m "(unit or contract) and not serial and not service"
+          --durations=25
+      - name: Run serial unit and contract gate
+        run: >
+          python -m pytest -q
+          -m "(unit or contract) and serial and not service"
+          --durations=25
+
+  service:
+    name: L2 ${{ needs.profile.outputs.profile }} services
+    needs: [profile, core]
+    if: needs.profile.outputs.profile != 'core'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      MONOID_SERVICE_PROFILE: ${{ needs.profile.outputs.profile }}
+      MONOID_POSTGRES16_DSN: postgresql://monoid:monoid-local-only@127.0.0.1:55416/monoid_kernel_test
+      MONOID_POSTGRES18_DSN: postgresql://monoid:monoid-local-only@127.0.0.1:55418/monoid_kernel_test
+      MONOID_MINIO_ENDPOINT: http://127.0.0.1:59000
+      MONOID_MINIO_ACCESS_KEY: monoid-test-access
+      MONOID_MINIO_SECRET_KEY: monoid-test-secret-only
+      MONOID_TEMPORAL_CLI_VERSION: v1.8.2
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install exact campaign SDKs
+        run: |
+          python -m pip install -e ".[dev,durable-host]"
+          python tools/v023_ci.py exact-requirements | xargs python -m pip install
+          python tools/v023_ci.py verify-installed
+      - name: Start selected repository services
+        if: needs.profile.outputs.run_postgres == 'true'
+        env:
+          COMPOSE_PROFILES: ${{ needs.profile.outputs.profile }}
+        run: docker compose -f tests/service/compose.yml up -d --wait
+      - name: Run actual service integration
+        run: python -m pytest -q tests/service -m service --durations=10
+      - name: Record qualified merge candidate
+        env:
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: >
+          python tools/v023_ci.py write-evidence
+          --head-sha "${PR_HEAD_SHA:-$(git rev-parse HEAD)}"
+          --merge-sha "$(git rev-parse HEAD)"
+          --profile "$MONOID_SERVICE_PROFILE"
+          --output .tmp/v023-ci-evidence.json
+      - uses: actions/upload-artifact@v7
+        with:
+          name: v023-${{ needs.profile.outputs.profile }}-evidence
+          path: .tmp/v023-ci-evidence.json
+      - name: Stop repository services
+        if: always() && needs.profile.outputs.run_postgres == 'true'
+        run: docker compose -f tests/service/compose.yml down --volumes
+
+  gate:
+    name: L2 ${{ needs.trigger.outputs.mode || 'dormant' }} gate
+    needs: [trigger, profile, core, service]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Record dormant trigger without qualification authority
+        if: needs.trigger.outputs.mode == 'dormant'
+        run: echo "This event does not create L2 merge evidence."
+      - name: Require profile, core, and selected service success
+        if: >-
+          needs.trigger.outputs.mode == 'required' ||
+          needs.trigger.outputs.mode == 'diagnostic'
+        env:
+          PROFILE_RESULT: ${{ needs.profile.result }}
+          CORE_RESULT: ${{ needs.core.result }}
+          SERVICE_RESULT: ${{ needs.service.result }}
+        run: |
+          test "$PROFILE_RESULT" = success
+          test "$CORE_RESULT" = success
+          test "$SERVICE_RESULT" = success -o "$SERVICE_RESULT" = skipped

{monoid_agent_kernel-0.22.0 → monoid_agent_kernel-0.24.0}/.github/workflows/publish.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 
@@ -49,7 +49,7 @@ jobs:
       - name: Check distributions
         run: python -m twine check dist/*
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: python-package-distributions
           path: dist/
@@ -67,7 +67,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: python-package-distributions
           path: dist/

{monoid_agent_kernel-0.22.0 → monoid_agent_kernel-0.24.0}/CHANGELOG.md

@@ -7,6 +7,116 @@ out in commit messages and here.
 
 ## [Unreleased]
 
+## [0.24.0] - 2026-09-27
+
+### Added — stopped-stream drain
+
+- Added `ModelCallRunner.abort_drain_s` and `current_abort_drain_s` (keyword-only) and
+  `AgentLoop.async_model_abort_drain_s` (keyword-only, read live). With a positive budget, a
+  streamed call's cooperative stop — `should_abort`/`interrupt_turn`, or the run token's
+  `user_cancel` — keeps reading the same provider stream, undelivered, until it ends or
+  `min(stop + budget, deadline)` passes, then closes it within the cancel grace. The stop still
+  raises `ModelCallAborted` or `RunCancelled(user_cancel)`, now stamped with the drained
+  `TurnComplete` usage, which reaches the failed receipt, the attempt log and the run's totals and
+  token budget. `graceful_drain`, `deadline`, `host_shutdown` and lease loss still end the call at
+  once, unless a `user_cancel` already turned the stop into a drain (the token keeps its first
+  cause); then, of these, only lease loss cuts it short, and the run deadline still closes its
+  window. A deadline that closes the window never reclassifies the stop as a timeout. The default
+  of `0` keeps closing the stream at the stop. No receipt, ledger, codec, schema or fixture changes.
+- With the drain on, `AgentLoop.astream`'s early-exit wait before it hard-cancels the drive grows
+  from 8 s to `8 s + async_model_abort_drain_s + async_model_cancel_grace_s`, so a drain started by
+  leaving the block early is not cut. Both knobs are read when that wait starts, not when
+  `astream()` is called, and the drain term is never less than the budget the in-flight streamed
+  call opened with: a knob raised inside the `async with` before the first call, or lowered after
+  the call opened, still leaves the wait covering the drain the runner actually runs.
+  `RunStream` takes an optional `current_extra_grace_s` callable for this. Unchanged with the drain
+  off.
+- Known limit: the drain applies to the loop's own model calls. Subagent child and fork loops keep
+  their default `async_model_abort_drain_s` of `0`, so a token `cancel()` during a child's
+  streamed call still cuts it at once and reports no usage for that call. `interrupt_turn()` never
+  reaches a child, which streams its call to completion and bills it in full, as before.
+
+### Fixed
+
+- A streamed call stopped by `should_abort` after the provider's terminal chunk had already been
+  delivered now carries that chunk's usage on `ModelCallAborted` and its receipt; it was discarded.
+  This applies with the drain off too — the one deliberate change to the default path in this
+  release.
+
+### Changed — CI service pin
+
+- Re-pinned the actual-service MinIO image to `docker.io/bitnamilegacy/minio:2025.7.23-debian-12-r5`
+  (the same upstream commit as `RELEASE.2025-07-23T15-54-02Z`) because upstream MinIO archived its
+  image distribution; CI and the campaign lock only, no package change.
+
+## [0.23.0] - 2026-08-25
+
+### Added — PostgreSQL and ObjectStore production persistence
+
+- Added the optional PostgreSQL production adapter with explicit migrations, pooled transaction
+  boundaries, DB-clock writer leases, monotonic generations, and full fenced checkpoint,
+  invocation, event, evidence, terminal, admission, activation, stream, and outbox storage. Every
+  authoritative mutation checks the writer generation inside the same database transaction.
+- Added migration status, plan, apply, doctor, checksum, advisory-lock, reader-floor, and
+  writer-floor controls. PostgreSQL 16 and 18 qualification covers fresh and idempotent migration,
+  rolling readers, concurrent migration runners, generation handoff, canonical readback after
+  ambiguous commits, and complete fenced-sink conformance.
+- Added the optional S3-compatible content-addressed blob adapter with conditional single-part and
+  multipart creation, checked reads, digest and size verification, bounded response-loss
+  reconciliation, and run-scoped PostgreSQL associations. Pinned MinIO qualification covers
+  conditional races, multipart behavior, corrupt or missing objects, PostgreSQL rollback orphans,
+  inventory, and fenced garbage collection.
+
+### Added — durable admission, activation, and Temporal orchestration
+
+- Added strict v1 admission request, admitted command, admission receipt, activation command, and
+  activation receipt records. Stable command identity, per-run PostgreSQL ordering, transactional
+  dispatch outbox, duplicate delivery, terminal convergence, and canonical checkpoint receipts now
+  survive process replacement.
+- Added the optional Temporal per-run Workflow, Signal-With-Start dispatcher, Continue-As-New state,
+  versioned Workflow policy/status/result records, saved-history replay, and finite threaded
+  activation Activity. PostgreSQL remains the writer and terminal authority while Temporal owns
+  orchestration order, timers, retry, signals, and history rollover.
+- Added bounded Activity supervision for lease renewal, copied-context heartbeat and cancellation,
+  graceful drain, host shutdown, database timeouts, and worker takeover. Crash qualification proves
+  stale-generation rejection and preserves the paid-call journal across reserved, started,
+  unknown, and settled boundaries.
+- Added Workflow-owned redrive after a retryable Activity exhausts its bounded attempt batch. The
+  same admitted command remains live, uses a distinct Activity ID on each redrive, and transfers
+  through Continue-As-New during a long infrastructure outage.
+
+### Added — durable private model streams
+
+- Added the durable stream v1 contract and PostgreSQL/ObjectStore implementation for batched private
+  model output and reasoning. Generation, UTF-8 byte cursor, chunk metadata, reset receipt, seal,
+  and terminal coordination are fenced with the same run authority used by the canonical sink.
+- Added reconnect, reset, gap, takeover, seal, late-delta, response-loss, and garbage-collection race
+  qualification. Prepared stream settlement preserves the full accepted generation across a crash;
+  an ambiguous paid dispatch remains ineligible for automatic provider retry.
+
+### Added — production operations and release qualification
+
+- Added aggregate-only PostgreSQL operational snapshots, read-only migration and S3 doctor checks,
+  OpenTelemetry operational gauges, and production runbooks for startup, rolling migration,
+  rollback, drain, takeover, backup/restore, corruption, and dry-run-first garbage collection.
+- Added the versioned v0.23 qualification manifest and campaign lock. CI pins PostgreSQL 16/18,
+  MinIO, Temporal local server, Python SDK versions, profile-specific required tests, and evidence
+  digests for every merge candidate.
+- Added actual-service integration for PostgreSQL, MinIO, and Temporal together, including private
+  payload scans across Temporal history, PostgreSQL receipts, public operations snapshots, and
+  streamed content boundaries.
+
+### Changed — package and compatibility boundary
+
+- Added independent `postgres`, `object-store-s3`, and `temporal` extras plus the explicit
+  `durable-host` composition. The default installation retains the v0.22 base dependency set and
+  imports root, hosting, and conformance surfaces without loading platform SDKs.
+- Registered the v0.23 admission, activation, Temporal, and live-stream record versions in the
+  compatibility ledger. Packaged fixtures exercise every new strict portable record alongside the
+  retained v0.21 and v0.22 checkpoint, terminal-outcome, and model-invocation fixtures.
+- Expanded wheel and install audits to require every production adapter module, PostgreSQL
+  migration, compatibility fixture, minimal import boundary, and all-adapter extra.
+
 ## [0.22.0] - 2026-08-23
 
 ### Added — portable production-boundary records