toolframe-core 0.6.3__tar.gz → 0.6.4__tar.gz

toolframe_core-0.6.4/.github/dependabot.yml

@@ -0,0 +1,50 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:23'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 4
+    commit-message:
+      prefix: fix(container)
+    pull-request-branch-name:
+      prefix: chore
+      template: '{prefix}/{name}'
+    groups:
+      # Catch every version and security update, including major versions.
+      # To split a dependency out, add a named group before these catch-alls;
+      # exclusions would fall back to noncompliant solo dependency/version names.
+      container-dependencies:
+        applies-to: version-updates
+        patterns: ['*']
+      container-security:
+        applies-to: security-updates
+        patterns: ['*']
+    ignore:
+      # The 0.6.3 launcher accepts uv >=0.12.2,<0.13.0.
+      # Widen this only alongside a compatible launcher release.
+      - dependency-name: astral-sh/uv
+        versions: ['>=0.13.0']
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '04:23'
+      timezone: Etc/UTC
+    open-pull-requests-limit: 4
+    commit-message:
+      prefix: chore(ci)
+    pull-request-branch-name:
+      prefix: chore
+      template: '{prefix}/{name}'
+    groups:
+      actions-dependencies:
+        applies-to: version-updates
+        patterns: ['*']
+      actions-security:
+        applies-to: security-updates
+        patterns: ['*']

toolframe_core-0.6.4/.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    # Publication independently verifies/promotes the selected release tag.
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      rebuild:
+        description: Run all checks and builds even if validated artifacts exist
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  pull-requests: read
+  actions: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    uses: ./.github/workflows/quality.yml
+
+  validate:
+    needs: quality
+    uses: ./.github/workflows/validate.yml
+    with:
+      reuse-stage: ${{ github.ref == 'refs/heads/main' && 'main' || 'none' }}
+      rebuild: ${{ inputs.rebuild || false }}
+    secrets: inherit
+
+  result:
+    name: CI result
+    if: always()
+    needs: [quality, validate]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 2
+    steps:
+      # Require this check when configuring branch protection. A skipped
+      # validation job must not turn a failed prerequisite into a green check.
+      - name: Require successful checks and validation
+        env:
+          QUALITY_RESULT: ${{ needs.quality.result }}
+          VALIDATE_RESULT: ${{ needs.validate.result }}
+        run: |
+          echo "Quality: $QUALITY_RESULT; validation: $VALIDATE_RESULT"
+          test "$QUALITY_RESULT" = success
+          test "$VALIDATE_RESULT" = success

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/.github/workflows/container.yml

@@ -79,8 +79,16 @@ jobs:
         if: inputs.release_artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: launcher-release-${{ matrix.target }}
-          path: build/container-release/
+          name: validated-release
+          path: build/candidate/
+      - name: Verify the bundle and stage this platform's release
+        if: inputs.release_artifacts
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+          TOOLFRAME_TARGET: ${{ matrix.target }}
+        run: >-
+          python scripts/ci/artifacts.py export --bundle build/candidate
+          --kind release --target "$TOOLFRAME_TARGET" --output build/container-release
       - name: Stage the verified executable
         env:
           USE_ARTIFACTS: ${{ inputs.release_artifacts }}

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/.github/workflows/launcher.yml

@@ -76,6 +76,7 @@ jobs:
           name: launcher-wheel-${{ matrix.target }}
           path: build/launcher-dist/wheels/*.whl
           if-no-files-found: error
+          overwrite: true
           retention-days: 14
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -86,6 +87,7 @@ jobs:
             build/launcher-dist/release/*.json
             build/launcher-dist/release/SHA256SUMS-*.txt
           if-no-files-found: error
+          overwrite: true
           retention-days: 14
       - name: Retain acceptance evidence
         if: always()
@@ -94,3 +96,4 @@ jobs:
           name: launcher-evidence-${{ matrix.target }}
           path: build/launcher-dist/*.json
           if-no-files-found: warn
+          overwrite: true

toolframe_core-0.6.4/.github/workflows/pr-policy.yml

@@ -0,0 +1,31 @@
+name: Pull request policy
+
+on:
+  workflow_call:
+  # Keep a stable required check for title edits without repeating native CI.
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  commit-policy:
+    name: PR policy
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: commit-check/commit-check-action@a61779784a953fd9047c001c102cfeac5cf26964 # commit-check 2.18.3
+        with:
+          message: true
+          branch: false
+          pr-title: true
+          pr-comments: false

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/.github/workflows/publish.yml

@@ -11,9 +11,15 @@ on:
           - pypi
         default: testpypi
         required: true
+      rebuild:
+        description: Validate and rebuild at the tag instead of promoting main artifacts
+        type: boolean
+        default: false
 
 permissions:
   contents: read
+  actions: read
+  pull-requests: read
 
 concurrency:
   group: publish-${{ github.ref }}-${{ inputs.index }}
@@ -33,9 +39,19 @@ jobs:
       - name: Require the exact project version tag
         run: python scripts/ci/check-release.py --ref "$GITHUB_REF"
 
-  validate:
+  quality:
     needs: release-tag
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: ./.github/workflows/quality.yml
+
+  validate:
+    needs: [release-tag, quality]
     uses: ./.github/workflows/validate.yml
+    with:
+      reuse-stage: release
+      rebuild: ${{ inputs.rebuild }}
     secrets: inherit
 
   publish-core:
@@ -45,22 +61,24 @@ jobs:
     environment:
       name: ${{ inputs.index }}
     permissions:
+      contents: read
       id-token: write
     steps:
-      - name: Download the distributions validated in this run
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Download the bundle validated in this run
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: python-dist
-          path: dist/
-      - name: Require the complete Core release set
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-          files = list(Path('dist').iterdir())
-          assert len(list(Path('dist').glob('toolframe_core-*.whl'))) == 1
-          assert len(list(Path('dist').glob('toolframe_core-*.tar.gz'))) == 1
-          assert len(files) == 2
-          PY
+          name: validated-release
+          path: build/candidate/
+      - name: Verify and stage the exact Core distributions
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: python scripts/ci/artifacts.py export --bundle build/candidate --kind core --output dist
       - name: Publish Core using its Trusted Publisher
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
@@ -74,22 +92,24 @@ jobs:
     environment:
       name: ${{ inputs.index }}-launcher
     permissions:
+      contents: read
       id-token: write
     steps:
-      - name: Download all four validated native wheels
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Download the bundle validated in this run
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: launcher-wheel-*
-          merge-multiple: true
-          path: dist/
-      - name: Require the complete launcher release set
-        run: |
-          python - <<'PY'
-          from pathlib import Path
-          files = list(Path('dist').iterdir())
-          assert len(list(Path('dist').glob('toolframe-*.whl'))) == 4
-          assert len(files) == 4
-          PY
+          name: validated-release
+          path: build/candidate/
+      - name: Verify and stage all four exact native wheels
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: python scripts/ci/artifacts.py export --bundle build/candidate --kind wheel --output dist
       - name: Publish the launcher using its Trusted Publisher
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
@@ -104,11 +124,20 @@ jobs:
     permissions:
       contents: write
     steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: launcher-release-*
-          merge-multiple: true
-          path: releases/
+          name: validated-release
+          path: build/candidate/
+      - name: Verify and stage the exact release archives
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: python scripts/ci/artifacts.py export --bundle build/candidate --kind release --output releases
       - name: Publish verified executables and checksums
         env:
           GH_TOKEN: ${{ github.token }}

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/.github/workflows/quality.yml

@@ -1,11 +1,7 @@
 name: Code quality
 
 on:
-  push:
-    branches: ['**']
-  pull_request:
-    types: [opened, synchronize, reopened, edited]
-  workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
@@ -21,10 +17,15 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14.7'
-      - name: Check the actual source branch
+      - name: Check the source branch or selected release tag
         env:
           BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
-        run: python scripts/check_branch_name.py "$BRANCH_NAME"
+        run: |
+          if [ "$GITHUB_REF_TYPE" = tag ]; then
+            python scripts/ci/check-release.py --ref "$GITHUB_REF"
+          else
+            python scripts/check_branch_name.py "$BRANCH_NAME"
+          fi
 
   code-quality:
     runs-on: ubuntu-24.04
@@ -42,22 +43,7 @@ jobs:
 
   commit-policy:
     if: github.event_name == 'pull_request'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: '3.14.7'
-      - uses: commit-check/commit-check-action@a61779784a953fd9047c001c102cfeac5cf26964 # commit-check 2.18.3
-        with:
-          message: true
-          branch: false
-          pr-title: true
-          pr-comments: false
+    uses: ./.github/workflows/pr-policy.yml

toolframe_core-0.6.4/.github/workflows/validate.yml

@@ -0,0 +1,214 @@
+name: Validate distributions and launchers
+
+on:
+  workflow_call:
+    inputs:
+      reuse-stage:
+        type: string
+        default: none
+      rebuild:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
+
+# Concurrency belongs to the caller: a reusable workflow must not cancel it.
+jobs:
+  reuse:
+    name: Resolve validated artifacts
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    outputs:
+      reused: ${{ steps.resolve.outputs.reused }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - name: Verify the source run, complete bundle and checksums
+        id: resolve
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REUSE_STAGE: ${{ inputs.reuse-stage }}
+          REBUILD: ${{ inputs.rebuild }}
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: |
+          options=()
+          if [ "$REBUILD" = true ]; then options+=(--rebuild); fi
+          python scripts/ci/artifacts.py resolve --stage "$REUSE_STAGE" \
+            --output build/candidate "${options[@]}"
+      - name: Retain the promoted bytes and their provenance
+        if: steps.resolve.outputs.reused == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: validated-release
+          path: build/candidate/
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 30
+
+  postgres:
+    needs: reuse
+    if: needs.reuse.outputs.reused == 'false'
+    name: PostgreSQL journal and mixed SQL storage
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: postgres:16.14-alpine
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s --health-timeout 5s --health-retries 10
+    env:
+      TOOLFRAME_CORE_TEST_ADMIN_DSN: postgresql://postgres:postgres@127.0.0.1:5432/postgres
+      TOOLFRAME_POSTGRES_PG_DUMP: /usr/lib/postgresql/16/bin/pg_dump
+      TOOLFRAME_POSTGRES_PG_RESTORE: /usr/lib/postgresql/16/bin/pg_restore
+      TOOLFRAME_REPOSITORY_TOKEN: ${{ secrets.TOOLFRAME_READ_TOKEN }}
+      TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Install matching PostgreSQL backup tools
+        run: sudo apt-get update && sudo apt-get install -y postgresql-client-16
+      - name: Verify journals, mixed storage and failure recovery
+        run: >-
+          python scripts/ci/validate.py --checks postgres --output build/ci-postgres
+          --repository-owner "$TOOLFRAME_REPOSITORY_OWNER"
+      - name: Save PostgreSQL validation evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: postgres-validation
+          path: |
+            build/ci-postgres/*.json
+            build/ci-postgres/workspace.txt
+          if-no-files-found: warn
+          overwrite: true
+  python:
+    needs: reuse
+    if: needs.reuse.outputs.reused == 'false'
+    name: Python integration and distribution
+    runs-on: macos-15
+    timeout-minutes: 40
+    env:
+      # github.repository_owner is the base repository owner, including fork PRs.
+      TOOLFRAME_REPOSITORY_TOKEN: ${{ secrets.TOOLFRAME_READ_TOKEN }}
+      TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: '0.12.8'
+          enable-cache: false
+      - name: Validate in a fresh pinned workspace
+        run: >-
+          python scripts/ci/validate.py --checks python --output build/ci-python
+          --repository-owner "$TOOLFRAME_REPOSITORY_OWNER"
+      - name: Save validated Python distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-dist
+          path: build/ci-python/python-dist/
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 14
+      - name: Save Python validation evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: python-validation
+          path: |
+            build/ci-python/*.json
+            build/ci-python/*.xml
+            build/ci-python/workspace.txt
+          if-no-files-found: warn
+          overwrite: true
+          retention-days: 14
+
+  launcher:
+    needs: reuse
+    if: needs.reuse.outputs.reused == 'false'
+    uses: ./.github/workflows/launcher.yml
+    secrets: inherit
+
+  bundle:
+    name: Seal complete validation
+    needs: [reuse, python, postgres, launcher]
+    if: >-
+      always() && needs.reuse.result == 'success' &&
+      needs.reuse.outputs.reused == 'false' &&
+      needs.python.result == 'success' && needs.postgres.result == 'success' &&
+      needs.launcher.result == 'success'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14.7'
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: '{python-dist,python-validation,postgres-validation,launcher-*}'
+          path: build/candidate/
+      - name: Seal distributions and installed-application evidence
+        env:
+          TOOLFRAME_REPOSITORY_OWNER: ${{ vars.TOOLFRAME_REPOSITORY_OWNER || github.repository_owner }}
+        run: python scripts/ci/artifacts.py seal --bundle build/candidate
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: validated-release
+          path: build/candidate/
+          if-no-files-found: error
+          overwrite: true
+          retention-days: 30
+
+  result:
+    name: Validated artifacts
+    if: always()
+    needs: [reuse, python, postgres, launcher, bundle]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 2
+    steps:
+      - name: Require verified reuse or complete fresh validation
+        env:
+          REUSE_RESULT: ${{ needs.reuse.result }}
+          REUSED: ${{ needs.reuse.outputs.reused }}
+          PYTHON_RESULT: ${{ needs.python.result }}
+          POSTGRES_RESULT: ${{ needs.postgres.result }}
+          LAUNCHER_RESULT: ${{ needs.launcher.result }}
+          BUNDLE_RESULT: ${{ needs.bundle.result }}
+        run: |
+          test "$REUSE_RESULT" = success
+          case "$REUSED" in
+            true) expected=skipped ;;
+            false) expected=success ;;
+            *) exit 1 ;;
+          esac
+          for result in "$PYTHON_RESULT" "$POSTGRES_RESULT" "$LAUNCHER_RESULT" "$BUNDLE_RESULT"; do
+            test "$result" = "$expected"
+          done

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/CHANGELOG.md

@@ -5,6 +5,13 @@ imply that its distributions have been published or every target is qualified.
 
 ## Unreleased
 
+## 0.6.4
+
+- Refresh the container runtime packages to include Debian
+  `libexpat1 2.9.0-1~deb13u1`, fixing six Expat security advisories in
+  the standard image. Both image variants retain the existing vulnerability
+  publication policy.
+
 ## 0.6.3
 
 - Apply container security updates, remove unused pip bootstrap dependencies and

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/CONTRIBUTING.md

@@ -25,8 +25,8 @@ prek run --all-files
 The Ruff version and checked paths are pinned in
 [the hook configuration](.pre-commit-config.yaml); the Python rules remain in
 [pyproject.toml](pyproject.toml). CI uses these same hooks on all tracked files
-within their configured paths. Existing package, integration, and release checks
-run independently.
+within their configured paths. Package, integration, and release validation starts
+after the quality checks pass; see [CI checks](docs/ci.md).
 
 ## Branches and commits
 
@@ -42,6 +42,6 @@ Commits with its default subject length of 5–80 characters. Pull requests chec
 their commits and title so the title can be used for a Conventional Commit when
 squash merging.
 
-Local hooks can be bypassed. CI reports `branch-policy`, `code-quality`, and
-`commit-policy`; maintainers must configure required status checks separately to
-make passing checks a merge requirement.
+Local hooks can be bypassed. Configure `CI result` and the standalone `PR policy`
+as required status checks to enforce source validation and PR title/commit policy.
+The [CI guide](docs/ci.md) describes their triggers and gating behavior.

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/Cargo.lock

@@ -1186,7 +1186,7 @@ dependencies = [
 
 [[package]]
 name = "toolframe"
-version = "0.6.3"
+version = "0.6.4"
 dependencies = [
  "anyhow",
  "flate2",

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "toolframe"
-version = "0.6.3"
+version = "0.6.4"
 edition = "2024"
 rust-version = "1.88"
 description = "A local-first runtime for agent-built internal apps"

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/Dockerfile

@@ -3,7 +3,7 @@ FROM ghcr.io/astral-sh/uv:0.12.24@sha256:3af4716e991d6956a41e573eab705d0ee08500c
 
 FROM debian:trixie-slim@sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11f AS runtime
 ARG TARGETARCH
-ARG TOOLFRAME_VERSION=0.6.3
+ARG TOOLFRAME_VERSION=0.6.4
 ARG TOOLFRAME_REVISION
 LABEL org.opencontainers.image.source="https://github.com/toolframe/toolframe-core" \
       org.opencontainers.image.title="Toolframe" \
@@ -68,7 +68,7 @@ RUN mkdir -p /opt/ps-libs/var/lib/dpkg/status.d \
     && dpkg-query -s tini > /opt/ps-libs/var/lib/dpkg/status.d/tini
 
 FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 AS distroless
-ARG TOOLFRAME_VERSION=0.6.3
+ARG TOOLFRAME_VERSION=0.6.4
 ARG TOOLFRAME_REVISION
 LABEL org.opencontainers.image.source="https://github.com/toolframe/toolframe-core" \
       org.opencontainers.image.title="Toolframe (Distroless)" \

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: toolframe-core
-Version: 0.6.3
+Version: 0.6.4
 Summary: Persistent control host for isolated Toolframe plugins
 Project-URL: Homepage, https://github.com/toolframe/toolframe-core
 Project-URL: Repository, https://github.com/toolframe/toolframe-core

{toolframe_core-0.6.3 → toolframe_core-0.6.4}/docs/architecture.md

@@ -155,6 +155,9 @@ Plugins declare owned pages, tools and documents. Providers prepare a complete
 catalog, then acknowledge the selected epoch before Core makes their entrance
 available. A failed acknowledgement remains a visible unavailable entrance;
 publication is not presented as a distributed atomic transaction.
+Each publication consumes health changes already included in its snapshot, so a
+completed reload does not trigger another cutover for the same failure. Health
+changes observed while that snapshot is being published schedule another update.
 
 Native Streamlit pages call business services through the SDK page bridge. MCP
 tools declare schemas and target business methods; the provider does not import