signalwire-sdk 3.4.3.dev119__tar.gz → 3.5.0.dev120__tar.gz

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## [Unreleased]
+## [3.5.0] - 2026-09-24
 
 Webhook signatures and SWAIG tokens are now enforced on every path, including
 serverless. Skills that fetch URLs no longer reach internal addresses through

{signalwire_sdk-3.4.3.dev119/signalwire/signalwire_sdk.egg-info → signalwire_sdk-3.5.0.dev120}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: signalwire-sdk
-Version: 3.4.3.dev119
+Version: 3.5.0.dev120
 Summary: SignalWire SDK for AI voice agents, live call control (RELAY) and REST. Run sw-pydocs for its documentation.
 Author-email: SignalWire Team <info@signalwire.com>
 License: MIT

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/docs/developer_pain_points.md

@@ -2,7 +2,7 @@
 
 This guide starts from problems developers recognize when they build voice agents. Each entry names the symptom, the mechanism that addresses it, and the responsibility that still belongs to the application. It's a map of capabilities, not a claim that every safeguard is enabled automatically.
 
-It was checked against the `signalwire-sdk` source at commit `63aed86`: version 3.4.3 in `pyproject.toml`, plus the changes listed under Unreleased in `CHANGELOG.md`. It describes the SDK's contract. It doesn't verify the platform's server-side behavior, and no live call was tested. The [PGI implementation guide](pgi_agent_guide.md) labels its capabilities with these entries' `Pxx` numbers. Source identifiers such as [S03] resolve in [Sources](#sources).
+It was checked against the `signalwire-sdk` source at commit `63aed86`: version 3.4.3 in `pyproject.toml`, plus changes that were released in 3.5.0 (see `CHANGELOG.md`). It describes the SDK's contract. It doesn't verify the platform's server-side behavior, and no live call was tested. The [PGI implementation guide](pgi_agent_guide.md) labels its capabilities with these entries' `Pxx` numbers. Source identifiers such as [S03] resolve in [Sources](#sources).
 
 A working voice demo is not the same as a dependable application. The difficult work often lives around the model: reaching users, managing live media, preserving state, enforcing prerequisites, executing real actions, and recovering when something fails.
 
@@ -322,7 +322,7 @@ Sources: [S04], [S05].
 
 A hidden tool is not a replacement for authenticated HTTP endpoints and application authorization.
 
-**How SignalWire addresses it:** The SDK supports Basic Auth, function tokens, and inbound webhook signature validation. Configure the relevant mechanisms, then validate identity, tenant, state, and permissions in handlers. With a signing key set, the agent refuses any POST without a valid SignalWire signature, on a web server or a serverless platform. A `secure=True` tool runs only with the token minted for that function and call. Releases up to 3.4.3 don't enforce these checks on every path; the Unreleased section of `CHANGELOG.md` lists the fixes.
+**How SignalWire addresses it:** The SDK supports Basic Auth, function tokens, and inbound webhook signature validation. Configure the relevant mechanisms, then validate identity, tenant, state, and permissions in handlers. With a signing key set, the agent refuses any POST without a valid SignalWire signature, on a web server or a serverless platform. A `secure=True` tool runs only with the token minted for that function and call. Releases up to 3.4.3 don't enforce these checks on every path; 3.5.0 does, and its section of `CHANGELOG.md` lists the fixes.
 
 **You still own:** Enable signature checking, protect proxy trust, manage secrets, and reject unauthorized business operations. Caller ID alone is not verified customer identity.
 
@@ -545,4 +545,4 @@ The identifiers in the entries resolve to these documents and source files in th
 
 - [S26] [SWAIG request/result contract](swaig_reference.md) - `docs/swaig_reference.md`.
 
-- [S27] [Release notes, including the Unreleased changes](../CHANGELOG.md) - `CHANGELOG.md`.
+- [S27] [Release notes, including 3.5.0](../CHANGELOG.md) - `CHANGELOG.md`.

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/docs/pgi_agent_guide.md

@@ -1,7 +1,7 @@
 # SignalWire PGI and Python SDK
 ## Build natural interfaces on top of software-controlled interactions
 
-This implementation guide is written for AI coding agents, technical assistants, and application developers. It was checked against the `signalwire-sdk` source at commit `67db6f32f7a1dce911f7a9e88ac58cee51151989`. That commit is version 3.4.3 in `pyproject.toml`, plus the changes listed under Unreleased in `CHANGELOG.md`. The SDK requires Python 3.10 or later. The guide also draws on [Programmatically Governed Inference](programmatically_governed_inference.md), the PGI concept document in this directory.
+This implementation guide is written for AI coding agents, technical assistants, and application developers. It was checked against the `signalwire-sdk` source at commit `67db6f32f7a1dce911f7a9e88ac58cee51151989`. That commit is version 3.4.3 in `pyproject.toml`, plus changes that were released in 3.5.0 (see `CHANGELOG.md`). The SDK requires Python 3.10 or later. The guide also draws on [Programmatically Governed Inference](programmatically_governed_inference.md), the PGI concept document in this directory.
 
 Its claims were checked against the source. The reference implementation in [section 6](#6-reference-implementation) and the recipes in sections 5 and 7 were run against that commit, except the RELAY examples in 7.8, which need a live connection. No live call was tested.
 
@@ -53,7 +53,7 @@ This is an implementation and explanation reference, not a marketing prompt. Use
 
 ### Version and evidence discipline
 
-The authoritative implementation baseline for this file is the `signalwire-sdk` source at commit `67db6f3`: version 3.4.3 plus the changes listed under Unreleased in `CHANGELOG.md`. Examples use `from signalwire import AgentBase`, not an assumed older distribution or import path. `SwaigFunctionResult` is a compatibility alias for `FunctionResult` in this snapshot. [S01, S04, S23, S27]
+The authoritative implementation baseline for this file is the `signalwire-sdk` source at commit `67db6f3`: version 3.4.3 plus changes that were released in 3.5.0 (see `CHANGELOG.md`). Examples use `from signalwire import AgentBase`, not an assumed older distribution or import path. `SwaigFunctionResult` is a compatibility alias for `FunctionResult` in this snapshot. [S01, S04, S23, S27]
 
 When building against another version, check its package metadata, method signatures, emitted SWML, and tests. Current docs may move faster or slower than the installed package. Distinguish:
 
@@ -148,7 +148,7 @@ python -m pip install .
 python -c "from importlib.metadata import version; print(version('signalwire-sdk'))"
 ```
 
-Pin the version you actually validate; this is a reproducible baseline, not a statement that it remains the newest code. Installed from commit `67db6f3`, the package reports version 3.4.3. The 3.4.3 release doesn't include the Unreleased changes this guide relies on. For example, on 3.4.3 an agent served with `run()` accepts unsigned requests even with a signing key set, and runs a secure tool without its token. When a release includes those changes, pin that release instead. Optional search extras are installed only when the application uses that functionality. [S23, S27]
+Pin the version you actually validate; this is a reproducible baseline, not a statement that it remains the newest code. Installed from commit `67db6f3`, the package reports version 3.4.3, but the 3.4.3 release doesn't include the changes this guide relies on; they were released in 3.5.0. For example, on 3.4.3 an agent served with `run()` accepts unsigned requests even with a signing key set, and runs a secure tool without its token. Pin 3.5.0 or later. Optional search extras are installed only when the application uses that functionality. [S23, S27]
 
 ## 4. Design before coding
 
@@ -1474,7 +1474,7 @@ A positive answer is evidence that consequential correctness is not merely a pro
 
 ### 12.1. Authority of this reference
 
-This document draws on the PGI concept document and on the SDK source in this repository. The baseline is `signalwire-sdk` at commit `67db6f32f7a1dce911f7a9e88ac58cee51151989`: version 3.4.3 plus the changes listed under Unreleased in `CHANGELOG.md`.
+This document draws on the PGI concept document and on the SDK source in this repository. The baseline is `signalwire-sdk` at commit `67db6f32f7a1dce911f7a9e88ac58cee51151989`: version 3.4.3 plus changes that were released in 3.5.0 (see `CHANGELOG.md`).
 
 [PGI] [Programmatically Governed Inference](programmatically_governed_inference.md) - `docs/programmatically_governed_inference.md`. It describes the intended discipline; the [PGI section of the SDK features guide](sdk_features.md#programmatically-governed-inference-pgi) summarizes it. Where broad rhetoric could imply infallible speech or external transaction guarantees, this guide uses the narrower, implementable claim.
 
@@ -1540,7 +1540,7 @@ The implementation sources in [12.2](#122-implementation-sources) link to files
 
 - [S26] [SWAIG request/result contract](swaig_reference.md) - `docs/swaig_reference.md`.
 
-- [S27] [Release notes, including the Unreleased changes](../CHANGELOG.md) - `CHANGELOG.md`.
+- [S27] [Release notes, including 3.5.0](../CHANGELOG.md) - `CHANGELOG.md`.
 
 ### 12.3. Key symbols to inspect first
 

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "signalwire-sdk"
-version = "3.4.3.dev119"
+version = "3.5.0.dev120"
 description = "SignalWire SDK for AI voice agents, live call control (RELAY) and REST. Run sw-pydocs for its documentation."
 authors = [
     {name = "SignalWire Team", email = "info@signalwire.com"}

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/signalwire/signalwire/__init__.py

@@ -58,7 +58,7 @@ if TYPE_CHECKING:
     from signalwire.utils.schema_utils import SchemaValidationError
     from signalwire.web import WebService
 
-__version__ = "3.4.3.dev119"
+__version__ = "3.5.0.dev120"
 
 # §6.2-python (owner decision: NO packaging split — one package, all deps required;
 # IMPORT-TIME behavior only): the agent/web symbols are lazy-imported via module

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/signalwire/signalwire/agent_server.py

@@ -68,7 +68,7 @@ class AgentServer:
         self.app = FastAPI(
             title="SignalWire AI Agents",
             description="Hosted SignalWire AI Agents",
-            version="3.4.3.dev119",
+            version="3.5.0.dev120",
             redirect_slashes=False,
             docs_url=None,
             redoc_url=None,

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120/signalwire/signalwire_sdk.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: signalwire-sdk
-Version: 3.4.3.dev119
+Version: 3.5.0.dev120
 Summary: SignalWire SDK for AI voice agents, live call control (RELAY) and REST. Run sw-pydocs for its documentation.
 Author-email: SignalWire Team <info@signalwire.com>
 License: MIT

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/tutorial/full-guardrails-agent/requirements.txt

@@ -1,5 +1,5 @@
-# 3.4.4 is the first release that enforces webhook signatures and tool tokens
+# 3.5.0 is the first release that enforces webhook signatures and tool tokens
 # on every path, which Penny's security tests check.
-signalwire-sdk>=3.4.4
+signalwire-sdk>=3.5.0
 # Time zone data for slim containers that ship without /usr/share/zoneinfo
 tzdata>=2024.1

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/tutorial/full-guardrails-agent/tutorial/03-rules-first.md

@@ -26,7 +26,7 @@ source .venv/bin/activate
 pip install -r requirements.txt
 ```
 
-`requirements.txt` asks for `signalwire-sdk>=3.4.4`, the first release that enforces webhook signatures and tool tokens on every path, and `tzdata`. `tzdata` supplies time zone data to containers that don't ship it, since Penny works in the restaurant's time zone.
+`requirements.txt` asks for `signalwire-sdk>=3.5.0`, the first release that enforces webhook signatures and tool tokens on every path, and `tzdata`. `tzdata` supplies time zone data to containers that don't ship it, since Penny works in the restaurant's time zone.
 
 ## The House Policy
 

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/tutorial/full-guardrails-agent/tutorial/README.md

@@ -99,4 +99,4 @@ Start with [Lesson 1: Why Guardrails](01-why-guardrails.md).
 
 ---
 
-*This tutorial was created for SignalWire SDK v3.4.4*
+*This tutorial was created for SignalWire SDK v3.5.0*

{signalwire_sdk-3.4.3.dev119 → signalwire_sdk-3.5.0.dev120}/tutorial/full-guardrails-agent/tutorial/appendix-complete-code.md

@@ -1488,9 +1488,9 @@ Penny needs the SDK and time zone data:
 
 <!-- source: requirements.txt -->
 ```
-# 3.4.4 is the first release that enforces webhook signatures and tool tokens
+# 3.5.0 is the first release that enforces webhook signatures and tool tokens
 # on every path, which Penny's security tests check.
-signalwire-sdk>=3.4.4
+signalwire-sdk>=3.5.0
 # Time zone data for slim containers that ship without /usr/share/zoneinfo
 tzdata>=2024.1
 ```