diff --git a/.github/workflows/release-v071-trigger.yml b/.github/workflows/release-v071-trigger.yml new file mode 100644 index 0000000..2f2ebb3 --- /dev/null +++ b/.github/workflows/release-v071-trigger.yml @@ -0,0 +1,39 @@ +name: Release v0.7.1 trigger + +on: + push: + branches: + - main + paths: + - '.github/workflows/release-v071-trigger.yml' + +permissions: + actions: write + contents: write + +jobs: + trigger-release: + if: github.repository == 'sauravsingla/agentweave' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 + with: + python-version: '3.11' + - name: Verify release metadata + run: python scripts/check_release_metadata.py --tag v0.7.1 + - name: Create immutable release tag ref + env: + GH_TOKEN: ${{ github.token }} + run: | + if gh api "repos/${{ github.repository }}/git/ref/tags/v0.7.1" >/dev/null 2>&1; then + echo "::error::Tag v0.7.1 already exists; refusing to retarget it." + exit 1 + fi + gh api --method POST "repos/${{ github.repository }}/git/refs" \ + -f ref='refs/tags/v0.7.1' \ + -f sha="$GITHUB_SHA" + - name: Dispatch canonical release workflow on the tag + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run release.yml --ref v0.7.1 -f publish_pypi=true diff --git a/.release/v0.7.1 b/.release/v0.7.1 new file mode 100644 index 0000000..f5589a7 --- /dev/null +++ b/.release/v0.7.1 @@ -0,0 +1 @@ +AgentWeave v0.7.1 release prepared 2026-09-25. diff --git a/CHANGELOG.md b/CHANGELOG.md index ec18e79..4b6c701 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,16 +4,33 @@ All notable changes to AgentWeave are documented here. The project follows Seman ## [Unreleased] +### Planned +- Additional independently hosted A2A endpoints and physical edge-hardware evidence as environments become available. +- Additional external provider/model reproductions using the credentialed Issue #38 live protocol. + +## [0.7.1] - 2026-09-25 + ### Added +- Per-run replay/idempotency protection with explicit `ToolSpec.idempotency` modes and stronger argument-signature deduplication for high/critical-risk tools. +- Replay telemetry and provenance so reused successful tool executions are visible in runtime audit output. - Runnable in-process multi-MCP example demonstrating duplicate `search` names, model-visible aliases, and verified dispatch to both providers. - A provider-neutral local runtime example with three tools, routing visibility, and callable execution, requiring no model service or optional integration packages. +- Release metadata validation that separates the stable Zenodo Concept DOI from version-specific software archive DOIs. + +### Changed +- Runtime-resolved tool identity is authoritative after authorization; conflicting executor-returned identity is retained only as audit metadata. +- Structured tool results are serialized to deterministic canonical JSON for model continuation and provider interoperability. +- Central quality/security gates now include targeted Ruff bug-pattern checks, broader mypy coverage, Bandit scanning, and replay/provenance regression coverage. +- Packaging and integration smoke coverage was expanded across supported Python and optional-integration lanes. ### Fixed - Close file-backed reputation database connections after each operation, including failures, so Windows can release database files without waiting for garbage collection. In-memory stores retain their shared connection. +- Preserve existing positional `ToolSpec` construction compatibility while adding idempotency configuration. -### Planned -- Additional independently hosted A2A endpoints and physical edge-hardware evidence as environments become available. -- Additional external provider/model reproductions using the credentialed Issue #38 live protocol. +### Security +- Successful side-effectful calls can no longer be silently re-executed during bounded recovery when replay protection applies. +- Executor-supplied provenance cannot replace the canonical tool identity that passed runtime validation and authorization. +- Security-sensitive runtime surfaces are now included in static bug-pattern, typed-surface, and Bandit CI gates. ## [0.7.0] - 2026-09-23 diff --git a/CITATION.cff b/CITATION.cff index 0b2cfb1..42b80ec 100644 --- a/CITATION.cff +++ b/CITATION.cff @@ -8,15 +8,10 @@ authors: orcid: https://orcid.org/0000-0002-6404-3988 abstract: AgentWeave is an open-source pre-inference routing and reliability layer for tool-rich LLM and multi-agent systems, with support for MCP, A2A interoperability, policy-aware routing, recovery, and reproducible evaluation. repository-code: https://github.com/sauravsingla/agentweave -repository-artifact: https://zenodo.org/records/22913460 url: https://sauravsingla.github.io/agentweave/ license: Apache-2.0 -version: 0.7.0 -date-released: 2026-09-23 -doi: 10.5281/zenodo.22913460 -identifiers: - - type: doi - value: 10.5281/zenodo.22913460 +version: 0.7.1 +date-released: 2026-09-25 keywords: - pre-inference routing - LLM routing diff --git a/agentweave/__init__.py b/agentweave/__init__.py index 2b3697f..272fdc4 100644 --- a/agentweave/__init__.py +++ b/agentweave/__init__.py @@ -53,7 +53,7 @@ ) from .safe_http import SafeHttpTransport -__version__ = "0.7.0" +__version__ = "0.7.1" __all__ = [ "AgentWeave", diff --git a/codemeta.json b/codemeta.json index 64740a5..62e236b 100644 --- a/codemeta.json +++ b/codemeta.json @@ -3,21 +3,17 @@ "@type": "SoftwareSourceCode", "name": "AgentWeave", "description": "Open-source pre-inference routing and reliability layer for tool-rich LLM and multi-agent systems, with support for MCP, A2A interoperability, policy-aware routing, recovery, and reproducible evaluation.", - "version": "0.7.0", - "datePublished": "2026-09-23", + "version": "0.7.1", + "datePublished": "2026-09-25", "codeRepository": "https://github.com/sauravsingla/agentweave", "issueTracker": "https://github.com/sauravsingla/agentweave/issues", "url": "https://sauravsingla.github.io/agentweave/", - "downloadUrl": "https://pypi.org/project/agentweave-router/0.7.0/", + "downloadUrl": "https://pypi.org/project/agentweave-router/0.7.1/", "license": "https://spdx.org/licenses/Apache-2.0", "programmingLanguage": "Python", "runtimePlatform": "Python >=3.11", "developmentStatus": "active", "identifier": "https://doi.org/10.5281/zenodo.22913459", - "sameAs": [ - "https://doi.org/10.5281/zenodo.22913460", - "https://zenodo.org/records/22913460" - ], "referencePublication": "https://arxiv.org/abs/2608.23078", "author": { "@id": "https://orcid.org/0000-0002-6404-3988", diff --git a/pyproject.toml b/pyproject.toml index 44a4fac..8859852 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "agentweave-router" -version = "0.7.0" +version = "0.7.1" description = "Pre-inference routing for tool-rich LLMs and multi-agent systems with MCP, A2A, LangGraph, AutoGen, policy-aware routing, recovery, and reproducible evaluation." readme = "README.md" requires-python = ">=3.11" @@ -54,8 +54,6 @@ Repository = "https://github.com/sauravsingla/agentweave" Documentation = "https://sauravsingla.github.io/agentweave/" "Research Paper" = "https://arxiv.org/abs/2608.23078" "Concept DOI" = "https://doi.org/10.5281/zenodo.22913459" -"Version DOI" = "https://doi.org/10.5281/zenodo.22913460" -"Software Archive" = "https://zenodo.org/records/22913460" Issues = "https://github.com/sauravsingla/agentweave/issues" Changelog = "https://github.com/sauravsingla/agentweave/blob/main/CHANGELOG.md"