From 403e0e4acbd6487ecf0c5d5faec43e52d205960a Mon Sep 17 00:00:00 2001 From: TramAI Test Date: Sat, 3 Oct 2026 12:27:14 +0200 Subject: [PATCH] 0.7.1i: bind API migrations to the release lineage The api-architecture gate was red on the 0.7.1 -> release/0.7.0 promotion (#440) with 13 failure-severity diagnostics: 6 modules changed without an exact hash-bound migration entry, and 7 entries from a branch-only lineage that is no longer authoritative. Keep the 6 real 0.7.0 -> 0.7.1 transitions as ACTIVE entries (fromSha256 = release/0.7.0's committed dump, toSha256 = this line's dump, targetVersion 0.7.0) and remove the 7 non-authoritative entries. Git preserves their history; no registry redesign, no retire-with-record mechanism, no DAG. ApiCompatibilityVerifier accepts an entry only when it is ACTIVE or its toSha256 reaches the module's base dump by following entries as a sequence. The removed targets are intermediate states of the epic lineage that never landed in release/0.7.0, so no chain can reach that base: a linear successor chain cannot express a merge of two divergent API lineages, and the release lineage is authoritative. Nothing else changes: no module architecture, no catalog reclassification, no production code, no gate, no baseline. The 5 pre-existing stability inversions need no exemption -- verifyStabilityInversions already reports them as WARNING when the descriptor is present in the base dump. Verified: verify060Architecture PASS 10/10 against release/0.7.0 and against the PR base; spotlessCheck + verifyStaticAnalysis + verifyStaticSafetyGuards green; verifyChangePolicy PASSED. --- config/quality/api-migrations.yml | 72 ++++++++++++++----------------- 1 file changed, 33 insertions(+), 39 deletions(-) diff --git a/config/quality/api-migrations.yml b/config/quality/api-migrations.yml index a6d18700d..9b82f8eec 100644 --- a/config/quality/api-migrations.yml +++ b/config/quality/api-migrations.yml @@ -52,13 +52,6 @@ migrations: rationale: "Intentional additive API: JdbcStepAttemptRecordStore.createTableSql() is restored to a single executable DDL statement; multi-statement provisioning is exposed explicitly via createSchemaSql()/createSequenceTableSql() (one statement per entry, generic-JDBC safe). No signature changed; binary compatibility preserved. toSha256 reconciled to the post-BCV-surface (#352) canonical dump: 39 sanctioned-marked (@ExperimentalTramaiInternalApi) declarations removed from the surface, authorization unchanged." migration: "Applications executing createTableSql() alone must additionally execute createSequenceTableSql() (or createSchemaSql()) so the sequence counter table exists; source-compatible callers require no other change." - - module: ":tramai-engine" - fromSha256: "34fa48078a3f2f978b8edd9ce014d91fd4726f9c48b5206b87caff008c0f6913" - toSha256: "97449797943f051f255c0f96d69746f9145059fb577c8927d7443e9958da435f" - targetVersion: "0.7.0" - rationale: "Epic 0.7.1d run attribution: adds GovernedSuspendedInvocation, the suspension record that carries the durable whole-run identity alongside the invocation metadata." - migration: "No consumer action: the governed suspension type is opt-in, and existing SuspendedInvocationStore paths are unchanged." - - module: ":tramai-orchestration" fromSha256: "64c1ff59baae3a49faa0f1d1c8a617ab7cc7773413c302203b230e1ac2c8a733" toSha256: "beefaf0846ba9d94964e0303b20a1014e415fb96150096502fb61e4ab2e07c34" @@ -66,50 +59,51 @@ migrations: rationale: "Epic 0.7.1d run attribution: adds GovernedRun, the run handle that binds a workflow context to its canonical governed identity." migration: "No consumer action: GovernedRun is additive; ungoverned workflow execution is unchanged." + - module: ":tramai-scheduler" + fromSha256: "5e1ae0be11be0b3d00edb1ff02cf49409603bb4ea32e49a9dbc47ae71187f795" + toSha256: "18656b08156f0cef13589468dcdb7b9d0b7ac6e1bdbeb8eef37fc789d2e25b5e" + targetVersion: "0.7.0" + rationale: "Epic 0.7.1d run attribution: adds the governed schedule-binding surface (CompositeWorkflowSchedulerStore and the governed binding store/timer pair) so a scheduled wake-up recovers the bound deployment identity." + migration: "No consumer action: governed scheduling is opt-in; the existing scheduler store contract is unchanged." + + - module: ":tramai-control-plane" + fromSha256: "b73b76dea59ef5dbd27bebfaf83260479164d7baa02d229423772b0897bf69cd" + toSha256: "71acccdcab31390b76032fc1979384dea72cce7dca8f6a5156254c2fb319e675" + targetVersion: "0.7.0" + rationale: "Epic 0.7.1e/0.7.1f control-plane authority contract and safe exposure model: adds ClassifiedRead (WorkloadExposure + QueryConsistency + WorkloadStateVersion) as the classified read shape, and narrows the generic outcome payloads from RegisteredWorkload to WorkloadExposure so the CAS/rebinding witness is no longer reachable from a generic read." + migration: "Binary-incompatible for preview consumers: LifecycleTransitionOutcome.Applied and the non-stale outcome payloads change descriptor (RegisteredWorkload -> WorkloadExposure) and ClassifiedRead.registration/outcome.registration are renamed to exposure, so constructors, copy(...), componentN() and getters must be updated and recompiled. The exposed payload is strictly narrower: the configuration fingerprint is returned on no generic surface. WorkloadRegistrationAuthority command signatures are unchanged." + + - module: ":tramai-engine" + fromSha256: "2be18464bc69a5c9c0b387d7a88cf6701066f5f4bf31c4e93ec8d9a82aa45dfc" + toSha256: "97449797943f051f255c0f96d69746f9145059fb577c8927d7443e9958da435f" + targetVersion: "0.7.0" + rationale: "Epic 0.7.1d1 governed approval identity carriage: adds GovernedSuspendedInvocation, binding SuspendedInvocationMetadata to the framework-owned GovernedRunIdentity so a resumed suspension recovers the exact workload/configuration attribution." + migration: "Additive. GovernedSuspendedInvocation is a new public type; existing suspension and resume signatures are unchanged, so no recompilation is required." + - module: ":tramai-persistence-file" - fromSha256: "41dcb6ad3f7dd35a316d9f317d3711b0eeb932961c58d87be4d975015de338dc" + fromSha256: "2c116948a04c020d41bb3e8af5339b542f1398f8ddfc706b5b0ecfde0f6e583d" toSha256: "f4f21c7cb3a6185994706adf4340ad734c8072520363e03faf75b097900c450e" targetVersion: "0.7.0" - rationale: "Epic 0.7.1d run attribution: adds GovernedFileSuspendedInvocationStore and the governed outbox/audit types (V2 provenance) for file persistence." - migration: "No consumer action: the governed store is a new type; legacy V1 records keep their released shape." + rationale: "Epic 0.7.1d1 governed approval identity carriage on the file-backed store: adds GovernedFileApprovalStore and its factory, implementing ApprovalStore plus the governed approval surface (createGovernedApproval, attributionOf) so the file backend carries the same governed attribution contract as the JDBC backend." + migration: "Additive. GovernedFileApprovalStore is a new public type and the existing file store contract is unchanged; file-backed consumers gain the governed surface without recompiling." - module: ":tramai-persistence-jdbc" - fromSha256: "48e004581e5929bfe3610c0372a33c776951ffe72f455166676b19cbd6590597" + fromSha256: "820477f11b52fdadb78157ed9d7b45404c9f54f642cfe5b51d1efe87fe9c3815" toSha256: "0b04daf0a52a32e5467840089ba305dbe0979f2875b81ca02be8cd063025f4fa" targetVersion: "0.7.0" - rationale: "Epic 0.7.1d run attribution: adds GovernedJdbcSuspendedInvocationStore, wrapping the JDBC suspension store so run identity survives the JDBC boundary." - migration: "No consumer action: the governed store is a new type composed around the existing JDBC store." - - - module: ":tramai-scheduler" - fromSha256: "5e1ae0be11be0b3d00edb1ff02cf49409603bb4ea32e49a9dbc47ae71187f795" - toSha256: "18656b08156f0cef13589468dcdb7b9d0b7ac6e1bdbeb8eef37fc789d2e25b5e" - targetVersion: "0.7.0" - rationale: "Epic 0.7.1d run attribution: adds the governed schedule-binding surface (CompositeWorkflowSchedulerStore and the governed binding store/timer pair) so a scheduled wake-up recovers the bound deployment identity." - migration: "No consumer action: governed scheduling is opt-in; the existing scheduler store contract is unchanged." + rationale: "Epic 0.7.1d/0.7.1e persistence work on the JDBC backend: the governed approval mutation store and the governed suspension surfaces change the committed dump relative to release/0.7.0." + migration: "Source-compatible for existing callers; the governed surfaces are additive. Java/Spring consumers must recompile against this version where a constructor descriptor changed." - module: ":tramai-spring-boot-starter-sovereign-ops" - fromSha256: "5b5bad9d52b8e711dfd109c696956dbb216447cfd56e7366fc607c28abbdcbc6" + fromSha256: "7100484d4ea3e5a5e84b19abce1b1046de4aceab5c01722186f9450d2d24e416" toSha256: "5e773044a6ae45de22fa3f983ebc192b4f2c3ee7df530d5e2cf74b92f71a6dda" targetVersion: "0.7.0" - rationale: "Epic 0.7.1d run attribution: adds the ApprovalRunAttribution.Governed variant so suspended approvals carry the complete governed identity through the sovereign ops outbox." - migration: "No consumer action: the existing attribution surface is preserved; governed attribution is an additional variant." + rationale: "Epic 0.7.1d run attribution: the sovereign ops autoconfiguration carries the governed ApprovalRunAttribution variant through the outbox, changing the committed dump relative to release/0.7.0." + migration: "Source-compatible for existing callers: the governed attribution variant is additional. Recompile against this version if you construct the attribution types directly." - module: ":tramai-spring-boot-starter-sovereign-persistence-jdbc" - fromSha256: "6546de47ac3d62a97f87eca8916e71de7f702026028ebf3f60778a28797605d6" + fromSha256: "c12710086064ec051631dfef7fdadf268daf9ae1f43aedb1f7e00d90ed2d1da7" toSha256: "2f12c7776fc64c59b1cf128038db52bbdb400f4c2c928e87dcabf3459b81557b" targetVersion: "0.7.0" - rationale: "Epic 0.7.1d run attribution: the JDBC approval mutation store and its autoconfiguration bean method each gained a governed-suspension-store parameter (with a default) so the mutation transaction can carry provenance." - migration: "Source-compatible for existing callers, but the JVM constructor descriptor changed: Spring/Java consumers must recompile against this version. Binary-compatibility was not preserved for these constructor signatures, which is acceptable for a preview module." - - module: ":tramai-control-plane" - fromSha256: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" - toSha256: "0c656c8654f45c0d8fc33b25c8e8935e3bcc6bf1d6ff6d1f395b4a19725db7e8" - targetVersion: "0.7.0" - rationale: "0.7.1e control-plane authority contract: adds the public preview command and read ports (WorkloadControlPlaneCommands, WorkloadControlPlaneQueries) plus the read classification types (QueryConsistency, ClassifiedRead), and declares both ports on WorkloadRegistrationAuthority. The authority keeps its three command methods with unchanged signatures; its dump entry is re-rendered only because the class header now names the implemented interfaces." - migration: "No consumer action: the contract is additive. Existing call sites are unaffected; a consumer that wants the framework-neutral port binds WorkloadRegistrationAuthority to WorkloadControlPlaneCommands or WorkloadControlPlaneQueries. No existing signature changed, so no recompilation is required." - - - module: ":tramai-control-plane" - fromSha256: "0c656c8654f45c0d8fc33b25c8e8935e3bcc6bf1d6ff6d1f395b4a19725db7e8" - toSha256: "71acccdcab31390b76032fc1979384dea72cce7dca8f6a5156254c2fb319e675" - targetVersion: "0.7.0" - rationale: "0.7.1f invariant: the generic control-plane payload becomes the explicit safe exposure model, so the CAS/rebinding witness stops being reachable from WorkloadControlPlaneQueries and every non-stale command outcome." - migration: "Binary-incompatible for preview consumers: ClassifiedRead.registration and the outcome payload property registration are renamed to exposure, so constructors, copy(...), componentN() and the getters change descriptor — update those accesses and recompile. RegisterOutcome.Rejected.existing keeps its NAME; only its type changes (RegisteredWorkload -> WorkloadExposure). The payload is strictly narrower: the configuration fingerprint is no longer returned on any generic surface. WorkloadRegistrationStore / CreateResult and every command signature are unchanged." + rationale: "Epic 0.7.1d run attribution on the sovereign JDBC starter: the approval mutation store bean method gained a governed-suspension-store parameter, changing the committed dump relative to release/0.7.0." + migration: "The bean method keeps a default parameter, so Spring wiring is unaffected, but the JVM descriptor changed: Spring/Java consumers must recompile against this version."