Make role catalogue expansion resilient (#26)

Co-authored-by: Toby Martin <toby@another.com.au>

Author: first-assist

CHANGELOG.md

@@ -14,6 +14,21 @@ This file is the authoritative user-facing release chronology. The former
 [release-notes ledger](docs/archive/2026/graphql-orm-release-notes.md) is retained
 for historical context.
 
+## 0.26.0 - 2026-08-22
+
+Companion macros crate: `graphql-orm-macros` **0.26.0**. Generated ORM and
+database behavior are unchanged.
+
+- Aligned the optional `auth-agql` bridge to generic `agql-auth` 0.18.0 at
+  merged full revision `527d15d28e3c295a6f6b5e6d74559a7aecdc1322`, retaining
+  one public auth type universe for direct consumers.
+- The upstream release adds a typed authorization-role claim and issuer hook,
+  explicit unknown-role expansion errors, and independent catalogue lifetime
+  validation. The ORM bridge remains a projection of an accepted principal;
+  database policy and generated resolver behavior are unchanged.
+
+No database, GraphQL SDL, generated-code, or stored-data migration is required.
+
 ## 0.25.1 - 2026-08-22
 
 Companion macros crate: `graphql-orm-macros` **0.25.1**. Generated ORM and

Cargo.lock

@@ -27,7 +27,7 @@ license = "MIT"
 repository = "https://github.com/Dastari/graphql-orm"
 
 [workspace.dependencies]
-agql-auth = { git = "https://github.com/Dastari/agql-auth.git", rev = "b792241b7d9bb46bad81dde4534ae5b39857f614", version = "0.17.1" }
+agql-auth = { git = "https://github.com/Dastari/agql-auth.git", rev = "527d15d28e3c295a6f6b5e6d74559a7aecdc1322", version = "0.18.0" }
 arc-swap = "1.7"
 async-graphql = { version = "7", features = ["dataloader", "uuid"] }
 async-graphql-parser = "7"
@@ -37,7 +37,7 @@ cynic-parser = { version = "=0.11.2", features = ["pretty"] }
 futures = "0.3"
 getrandom = "0.3"
 graphql-composition = "=0.12.2"
-graphql-orm = { path = "crates/graphql-orm", version = "0.25.1", default-features = false }
+graphql-orm = { path = "crates/graphql-orm", version = "0.26.0", default-features = false }
 graphql-orm-ai-tool-profiles = { path = "crates/graphql-orm-ai-tool-profiles", version = "0.9.0" }
 graphql-orm-backup = { path = "crates/graphql-orm-backup", version = "0.7.1", default-features = false }
 graphql-orm-operation-catalog = { path = "crates/graphql-orm-operation-catalog", version = "0.3.0" }
@@ -62,5 +62,6 @@ thiserror = "2"
 tokio = { version = "1" }
 tokio-stream = { version = "0.1", features = ["sync"] }
 tokio-util = { version = "0.7", features = ["compat"] }
+tracing = "0.1"
 uuid = { version = "1", features = ["v4"] }
 url = "2"

Cargo.toml

@@ -13,6 +13,16 @@ supersedes: []
 `graphql-orm` is distributed from GitHub only. Use a reviewed full 40-character commit in `rev`;
 neither the runtime nor macros crate is published to crates.io.
 
+## 0.25.1 to 0.26.0: agql-auth 0.18.0 alignment
+
+Git consumers using `auth-agql` must align direct `agql-auth` dependencies to
+0.18.0 at merged revision `527d15d28e3c295a6f6b5e6d74559a7aecdc1322`.
+Adopt aligned `graphql-orm` and `graphql-orm-macros` 0.26.0 from the same
+reviewed monorepo revision. The bridge remains projection-only. Hosts adopting
+typed authorization-role grants follow the upstream issuer/resource-server
+rollout; no ORM schema, migration, generated-code, database-policy, or
+stored-data change is required.
+
 ## 0.25.0 to 0.25.1: agql-auth 0.17.1 alignment
 
 Git consumers using `auth-agql` must align direct `agql-auth` dependencies to

MIGRATION.md

@@ -42,12 +42,12 @@ schema changes explicitly.
 
 Packages are distributed from this repository, not crates.io. Pin the reviewed
 release revision, not a moving branch or tag. The current coordinated
-`graphql-orm` version is 0.25.1. Replace the placeholder below with the final
+`graphql-orm` version is 0.26.0. Replace the placeholder below with the final
 reviewed full SHA for the release:
 
 ```toml
 [dependencies]
-graphql-orm = { git = "https://github.com/Dastari/graphql-orm.git", rev = "<reviewed-full-40-character-commit-sha>", version = "0.25.1", default-features = false, features = ["sqlite"] }
+graphql-orm = { git = "https://github.com/Dastari/graphql-orm.git", rev = "<reviewed-full-40-character-commit-sha>", version = "0.26.0", default-features = false, features = ["sqlite"] }
 ```
 
 Choose exactly the backend support needed by each service. Cargo can unify

README.md

@@ -18,6 +18,19 @@ checkpoint facts. For the current workspace baseline and active gates, use the
 [implementation status](docs/implementation-status.md) and the central
 [AI production-readiness plan](../../docs/plans/active/ai-production-readiness/README.md).
 
+## [0.91.0] - 2026-08-22
+
+Persistent schema module: **0.63.0** (unchanged from 0.90.1).
+
+### Changed
+
+- Aligned the public `agql-auth` type universe to 0.18.0 at merged revision
+  `527d15d28e3c295a6f6b5e6d74559a7aecdc1322`. Consumers using re-exported
+  principal types must resolve the same full revision.
+- The additive typed authorization-role metadata is available through the
+  shared principal type. AI authorization, principal rehydration, providers,
+  persistence, GraphQL SDL, backup, and restore behavior are unchanged.
+
 ## [0.90.1] - 2026-08-22
 
 Persistent schema module: **0.63.0** (unchanged from 0.90.0).

crates/graphql-orm-ai/CHANGELOG.md

@@ -1,6 +1,6 @@
 [package]
 name = "graphql-orm-ai"
-version = "0.90.1"
+version = "0.91.0"
 edition = "2024"
 authors = ["Toby Martin <toby@dastari.net>"]
 description = "Project-agnostic AI agent runtime for graphql-orm applications"

crates/graphql-orm-ai/Cargo.toml

@@ -19,6 +19,15 @@ they describe. For the current workspace baseline and active delivery gates,
 use [implementation status](docs/implementation-status.md) and the central
 [AI production-readiness plan](../../docs/plans/active/ai-production-readiness/README.md).
 
+## 0.90.1 to 0.91.0: agql-auth 0.18.0 type-universe alignment
+
+Adopt `graphql-orm-ai` 0.91.0 from one reviewed full monorepo revision and
+align every direct `agql-auth` dependency to version 0.18.0 at merged revision
+`527d15d28e3c295a6f6b5e6d74559a7aecdc1322`. The new typed authorization-role
+metadata is additive to the public principal type. The schema module remains
+**0.63.0**; no database, data, provider, GraphQL SDL, protected-payload,
+backup, restore, or runtime migration is required.
+
 ## 0.90.0 to 0.90.1: agql-auth 0.17.1 type-universe alignment
 
 Adopt `graphql-orm-ai` 0.90.1 from one reviewed full monorepo revision and

crates/graphql-orm-ai/MIGRATION.md

@@ -28,7 +28,7 @@ for AI, ORM, storage, backup, and tool-profile packages:
 
 ```toml
 [dependencies]
-graphql-orm-ai = { git = "https://github.com/Dastari/graphql-orm.git", rev = "<reviewed-full-40-character-commit-sha>", version = "0.90.1", default-features = false, features = ["sqlite"] }
+graphql-orm-ai = { git = "https://github.com/Dastari/graphql-orm.git", rev = "<reviewed-full-40-character-commit-sha>", version = "0.91.0", default-features = false, features = ["sqlite"] }
 ```
 
 Exactly one persistence backend is required: `sqlite` (default), `postgres`,

crates/graphql-orm-ai/README.md

@@ -10,10 +10,10 @@ supersedes: []
 
 # Implementation Status
 
-`graphql-orm-ai` is at crate version `0.90.1` with AI schema module
-`0.63.0`. It uses workspace `graphql-orm` `0.25.1`, backend-neutral
+`graphql-orm-ai` is at crate version `0.91.0` with AI schema module
+`0.63.0`. It uses workspace `graphql-orm` `0.26.0`, backend-neutral
 `graphql-orm-ai-tool-profiles` `0.9.0`, and external `agql-auth`
-`0.17.1` at `b792241b7d9bb46bad81dde4534ae5b39857f614`.
+`0.18.0` at `527d15d28e3c295a6f6b5e6d74559a7aecdc1322`.
 
 Completed stateless local-provider turns can carry a proof-bearing contained
 native-item refusal after authoritative usage settlement. Those runs close as