Skip to content

id_effect 0.13.0 — Breadth - #121

Merged
Industrial merged 88 commits into
mainfrom
release/0.13.0
Oct 25, 2026
Merged

Industrial merged 88 commits into
mainfrom
release/0.13.0

Conversation

@Industrial

@Industrial Industrial commented Oct 24, 2026 •

Copy link
Copy Markdown
Owner

id_effect 0.13.0 "Breadth"

This PR implements every leaf of .maestro/specs/releases/0.13.0.md, which is ADR 0015's breadth batteries. Each leaf's commit names its slug.

Also included:

  • the KPI leaf and the migration guide;
  • fixes for follow-ups F63, F64 and F65;
  • the blind re-score: E 86.8 against a target of 85.2. sec.supply reaches 88 and is carried over to 0.14 until the 0.10.1 advisories are published;
  • the release prep: version 0.13.0, ADR 0015 Accepted (D16), CHANGELOG dated 2026-10-25, and S3/S6 accepted under the owner decision on ci(release): publish from a pushed tag with the registry token, as in 0.10.1 #118;
  • a fix for an rpc_duplex_frame fuzz crash: decoded JSON payloads now refuse serde_json's raw-value key.

Highlights

  • New crates: id_effect_admin (generated admin: list, detail and edit pages, bulk actions, audit trail) and id_effect_i18n (Accept-Language negotiation, an axum locale layer, maud messages, translated Schema errors).
  • id_effect_ai moves to integration tier: provider-neutral chat, typed tools and structured output, embeddings, and an MCP server and client pinned to the 2026-07-28 spec revision.
  • SQL: relations and eager loading, keyset pagination, lifecycle hooks inside the write's transaction, and one database per tenant.
  • Web: server-rendered maud/htmx views, a Leptos SSR recipe, WebTransport in the host, WebSockets over HTTP/2 (RFC 8441), HTTP/3 0-RTT and congestion settings.
  • RPC and mesh: client batching, a wss:// client, a separate WebSocket control-frame cap, a mesh session pump, and rpc check --allow-retired.
  • Reference apps: the Pipeline app (multi-tenant intake, AI stages, back office) and the relay running on the host.
  • Quality: benches with D15 gates; the eager-loading pair limit is 0.45 by owner decision of 2026-10-24, with follow-up F66. Also fuzz and compile-fail security cases.

Merged from main

Release

After merge, the plan is to push the annotated tag v0.13.0 on the merge commit, and publish.yml publishes it.

🤖 Generated with Claude Code

Industrial and others added 30 commits October 21, 2026 02:43
…rignore

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…y (r13-kickoff)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…estatement (r13-t0-adr0015)

ADR 0015 (Proposed) records 0.13 D1-D15 and the Security table as rules B1-B23 with their
enforcement points, and pins MCP to specification revision 2026-07-28. PLAN-OF-PLANS gains the
Pipeline definition (§5 T9), restates §6 0.13.0 on the measured 0.12.0 baseline (E 85.2, RT 87.8,
red <= 3) and a §11 row. The release spec scorecard block is restated and carries sec.supply over
from 0.12.0. scorecard.json is not edited (D13).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…d kit (r13-f-rcgen)

F5: move the six crates from rcgen 0.13 to 0.14.10 (the version instant-acme already brings), so cargo tree -d lists rcgen once. Port the call sites: CertifiedKey.key_pair -> signing_key, signed_by(key, &Issuer) with the CA's params and key, id-effect dev keeps ECDSA P-256 and the 13-day leaf. No public signature exposes rcgen types.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Run an env-free effect (R = HNil) under any environment R, HList or not
(F52 / D14). A ready effect is returned as is; a fused step is rewrapped
once; a program gets one Provide frame over the shared static HNil env.
Tests any_env_runs_under_unit_and_dyn_env,
any_env_preserves_interruption_and_finalizers, local_any_env_round_trip;
book section in part2 ch04-03.

Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…eletons (r13-t0-skeletons)

Move labs/id_effect_ai to crates/id_effect_ai (manifest paths only, transitional merge tier,
PENDING_PROMOTION until r13-e9-1-promote); add the id_effect_admin and id_effect_i18n
tier-integration crates and the Pipeline reference app (tier example, kit only); publish order
for the three crates; CI job breadth; examples/recipes excluded from the root workspace; delete
crates/id_effect_cli/templates/admin-stub; MIGRATION-0.13 headings; crates.io names checked.

Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
id-effect rpc check gains --allow-retired Service:N (repeatable, 0.12
follow-up F46): the removal of that service version passes and is printed
as retired; every other breaking change still exits 1, and naming a
version that was not removed exits 2 (typo guard). Library:
rpc::RetiredVersion, rpc::check::retire. Book ch33-12, CHANGELOG,
MIGRATION-0.13 (CheckArgs gains allow_retired).

Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ility (r13-e9-4-i18n-core)

id_effect_i18n core over Project Fluent (D5; eco.i18n #1 #2 #7): Catalog of Fluent resources per locale, embedded or loaded once from allowlisted directories (parse errors fail startup), fallback chain requested -> language -> default, Catalog::check for missing keys, CLDR plural categories through Fluent selectors, and the fiber-local CurrentLocale capability with with_locale / current_locale / translate. Declares the axum, maud and schema features for r13-e9-4-i18n-web. Book chapter 30.9.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…d of stalling (r13-f-stream-chunking)

F57: a Stream::unfold_effect pull waits for its first element only, then keeps the steps that complete without waiting (ready values, synchronous steps, futures ready on their first poll) and stops at the first step that would wait, which the next pull resumes. run_for_each on a live client stream sees each element as it arrives; pure and bounded sources keep full chunks. Pull path only, no signature change. Tests: crates/id_effect/tests/stream_live_chunks.rs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ders and bearer (r13-f-client-batching)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ventlog-head)

F21: EventLog gains a provided head() (the position of the last event
appended; the default reads the log to its end), overridden in one step by
MemoryEventStore and SqlEventJournal (MAX(position)). id_effect_rpc's
EventSubscription::from_now() starts a call without a cursor after the head,
read when its stream is first pulled; no cursor still means after
starting_after (default 0). Tests head_is_last_global_position (memory and
pg, own container), head_default_impl_matches_override,
subscription_from_now_skips_history; book ch33-08 paragraph.

Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… streaming, safe defaults (r13-e9-1-promote)

Tier integration; publish = false and the PENDING_PROMOTION entry removed; every 0.13
feature and optional dependency declared once (openai, anthropic, ollama, cursor, tools,
embeddings, mcp, mcp-http, test-util; rmcp =3.4.0 as the dev-only MCP interop peer).

Module layout for the wave 2-3 leaves: chat, stream, vendors/{openai,anthropic,ollama}/
{mod,chat,embed}.rs, tools/, embeddings/, mcp/, and testing::ScriptedModel (replies, tool
calls, streams and failures in order, requests recorded).

Secure by default (ADR 0013, ADR 0015 B13 B14): all HTTP through the platform client (SSRF
policy on provider base URLs, request timeout, response cap), API keys as Secret, prompts and
completions never on spans unless AiConfig::dangerous_log_prompts (recorded), max_tokens 1024
by default, SSE decoded incrementally under byte, event and per-event caps
(stream::decode_sse_event public for the fuzz target). ai.llm #1 #2 #7 re-evidenced by the
wiremock, streaming, telemetry and cursor fixture tests. Book chapter 35 rewritten; CHANGELOG
and MIGRATION-0.13 entries.

Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…itch (r13-f-h3-settings)

F25: the platform QUIC endpoint gains a per-route early-data setting,
Route::dangerous_allow_early_data (recorded; refused on idm/1 and on routes that require a
verified client). The TLS server offers early data only once a route takes it; such a route
receives connections before the handshake completes (AlpnRoute::accept_early with a Handshake),
and a connection that sends 0-RTT data on any other route is closed with
CLOSE_EARLY_DATA_REFUSED before its handler sees it. Http3Options::
dangerous_allow_zero_rtt_for_queries stops being a no-op: early GET/HEAD requests are served
before the handshake completes, everything else is answered 425 Too Early.

F36: Http3Options::congestion(CongestionControl::{Bbr, Cubic}) over the route's congestion
control (default BBR; the mesh stays CUBIC), read from server.http3.congestion by
Http3Options::config(); CongestionControl implements FromStr.

Tests: zero_rtt_off_by_default, zero_rtt_admits_only_safe_methods, zero_rtt_mutation_gets_425,
mesh_route_never_accepts_early_data, http3_congestion_switch_to_cubic (a UDP relay holds the
server's handshake flight so early data is deterministic).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…-3-relations)

belongs_to / has_many / many_to_many(through) on #[derive(Entity)]; Repository::with loads each relation in one IN query per level (max 3), re-scoping children by their tenant and soft-delete filters (ADR 0013 R1); Entity::FIELDS / RELATIONS / LABEL with defaults. repository.rs split into repository/{mod,relations,page,hooks}.rs with every public path kept. Book chapter 28.6.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…x, forms (r13-e9-5-views)

Feature `ui` in id_effect_axum (ADR 0015 D3; web.ui #1 #2 #6, margin #5): maud =0.27.0 Markup as a typed-route response; Component + Slots; Page + LayoutLayer / BasicLayout (full page to browsers, fragment to htmx by HX-Request, Vary: HX-Request); HxRequest, HxTarget, HxTrigger, HxRedirect (same-origin only), HxReswap, HxRetarget; htmx 2.0.11 vendored (0BSD, sha384 in assets/README.md), served by ui::htmx::asset_route() and loaded with integrity and htmx-config allowEval=false, selfRequestsOnly=true under script-src 'self'; the layout sends the masked CSRF token on every htmx request; HtmlForm / FormState bind Schema decode errors to fields with translatable message keys; raw HTML only through ui::trusted_html (grep test over the axum and admin sources). Example 095_htmx_todo (--self-test), book chapter 29.10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…13-e9-5-views)

maud's html! expands to `extern crate maud;`, so the ui::maud re-export cannot stand in for the dependency: the module docs and book chapter 29.10 now say to add maud = "=0.27.0", book-snippets depends on it, and the htmx/form/layout doc examples compile (reserved-prefix ul#id, state type, shadowed fn).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ure (r13-f-h3-settings)

The h3 builder settings, the hand-off channel and next_handoff move into small helpers whose
WebTransport parts compile only with feature `webtransport`, so an `http3`-only build carries no
unreachable branches (id_effect_axum --features http3: 96.05 % regions).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…s (r13-f-eventlog-head)

Covers the global-position retry after a unique violation, a race on the
stream's own version (VersionConflict), giving up after POSITION_RETRIES,
other insert failures, bad journal state inside the transaction,
unserializable events, and failed or undecodable read_all and head queries,
keeping id_effect_events at >= 96 % regions.

Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…able branch (r13-f-stream-chunking)

flat_map_go takes the rest of the outer stream directly (it was always Some). New tests in stream_live_chunks: oversized chunks split across pulls (channel, group_by), empty chunks skipped by folds and pumps, stage edges, large-chunk map/filter order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ages, translated Schema errors (r13-e9-4-i18n-web)

Bounded Accept-Language parse (<= 256 bytes, <= 32 ranges) and allowlist negotiation with preference and cookie overrides; feature axum LocaleLayer puts Localizer and CurrentLocale in the request; feature maud renders messages escaped; feature schema ships en/de catalogs for Schema validation messages. Example i18n_web --self-test; book chapter 30.9 web sections.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…3-3-pagination)

Repository::find_after / find_before (also BoundRepository, EagerRepository) return Paged<T> { items, next, prev } in a Keyset order (declared mapped sort columns, then the primary key), stable under concurrent inserts; the offset Page is kept. D11 cursor: base64url of the sort-key tuple and a fingerprint of the request filter, sort and filter mode, at most 1 KiB, decoded through a bounded Schema (PageCursor::decode is public for the sql_page_cursor fuzz target), unsigned because every page re-applies tenant and global filters. ADR 0013 R4/R1: oversize cursors refused, fingerprint mismatch refused, page size default 50, capped at 500 (PageLimits). Book chapter 28.7.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
… dimension checks (r13-e9-1-embeddings)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…5-5-tenancy)

TenantResolver (principal by default, Host allowlist, recorded dangerous_tenant_from_header) with an axum layer and TenantId extractors; TenantRouter, a fail-closed SqlClient mapping tenants to their own clients with a bounded LRU of pools that composes with RoutingSqlClient replicas; book chapter 30.7 sections.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…box adapter (r13-e3-3-hooks)

EntityHooks (before/after insert, update, delete) registered per repository run inside the
write's transaction (or a savepoint of the caller's); a failing hook rolls the write back and a
before hook rejects with the caller's typed error. Hooks get the repository bound to the
transaction with its tenant and filters. Feature outbox: repository::outbox stages events in
id_effect_outbox (id_effect_messaging's row format) in the same transaction; no dependency on
id_effect_messaging, which depends on this crate (Cargo rejects the cycle). Book chapter 28.8.

Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…3-e9-1-tools)

Tool<I, O> with HasSchema input/output (parameters exported through json_schema_export), ToolSet, ToolPolicy and decode_arguments; both vendors' tool-call formats; structured output decoded through Schema with one bounded repair retry; ToolLoop with the D9 budgets (8 steps, 32 tool calls, 60 s, 64 KiB per tool output). Book chapter 35.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…dError (r13-e9-1-tools)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…er-action permissions (r13-e9-3-admin-core)

AdminSite::new().register::<E>(EntityAdmin::default()...) is checked against Entity::FIELDS
and mounts only through .guard(g) (H8 typestate: an unguarded site has no router). List pages
with text search, typed filters, sortable columns and keyset pages, and detail pages, render with
the axum ui maud views and htmx; labels go through id_effect_i18n (feature i18n). Every page
checks admin.<entity>.<action> through id_effect_authz before any query and reads through a
repository bound to CurrentTenant. Book chapter 30.8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…-e-benches)

Benches orm/eager_100x10, orm/n_plus_one_100x10 and orm/flat_100x10 (id_effect_sql, SQLite in memory), i18n/format_plural (id_effect_i18n) and ui/render_list_50 (id_effect_axum, feature ui), all in scripts/bench-run.sh. gates.toml: pair orm/eager_100x10 / orm/n_plus_one_100x10 <= 0.25 (measured 0.374: sqlx-sqlite's per-row cost puts even two plain reads at 0.29, see docs/benchmarks/README.md). D15 budgets (median x 1.5) in gates-0.13.toml against the stored v0.13.json. Every 0.12 budget, delta and pair gate passes against v0.12.json.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial and others added 8 commits October 24, 2026 18:16
…ished advisories (r13-w8-kpis)

The 0.13 carry-over sec.supply#7: every Security releases row of SECURITY.md names a known finding and a GHSA id, pending or not a published crate; online, every listed GHSA is a published advisory and every published advisory is listed. Rows still pending with a consistent history report pending (publication is a release-automation or owner step). Self-test cases kpi_security_releases.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…follow-up F66 (r13-e-benches)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…0.13 Security, Scorecard and owner steps (r13-t0-migration-guide)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…387 with its unreachable-path reason

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
SysinfoTelemetry primes sysinfo on a background thread and reports TelemetrySnapshot::NEUTRAL until the sample lands, so ComputeFabric::tick no longer blocks ~350 ms on Windows. Restores the 50 ms non-blocking bound on every platform.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ng it (F65)

After KILL QUERY the feeder closes the pooled connection (PoolConnection::close: COM_QUIT, no drain) instead of returning it, so the pool no longer reads the rest of a large result before reuse. The conformance test streams 100 000 rows again, drops the bounded NotConnected retry and requires the release within 20 s (also settles F63).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
… links)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial and others added 9 commits October 24, 2026 18:33
…overlay

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ient, live stream chunks (r13-t0-migration-guide)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…essages never print secret-derived values (CodeQL rust/cleartext-logging)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…w8-kpis)

docs/security/kpis-0.13.json regenerated by bash scripts/security-kpis.sh 0.13.0 (online, live tests): security_table green, security_releases pending (12 of 13 0.10.1 rows await a published GHSA, 0 published). Fails on fuzz_open_crashes (rpc_duplex_frame, owner id_effect_rpc), openssf_scorecard 6.6, and two KPIs the merged 0.12.0 release fix (#118) brings back: registry_token (CARGO_REGISTRY_TOKEN under .github, S3) and open_highs (the S6 test s6_release_requires_signed_tag no longer exists); the notes name the owner decision. CHANGELOG entry updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…its section; ai Eq and UnwindSafe rows (r13-t0-migration-guide)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…cision (r13-w8-kpis)

kpis-0.13.json notes: registry_token and the open_highs register problem follow from the owner's #118 release flow (merged at 432ac57), not reverted; findings.json and SECURITY.md still describe the 0.11 flow. CHANGELOG entry reworded.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…owner decision (r13-w8-kpis)

scripts/security-kpis.sh: registry_token passes with accepted and the register note when docs/security/findings.json records S3 as accepted (self-test cases). kpis-0.13.json: registry_token and the S6 open_highs register problem carry the owner decision of 2026-10-24 (keep the #118 release flow; accepted, not a regression); release prep updates findings.json and SECURITY.md. fuzz_open_crashes keeps pointing at the rpc_duplex_frame fix in id_effect_rpc.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…(rpc_duplex_frame fuzz crash)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ace and check-dangerous

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Industrial and others added 8 commits October 25, 2026 19:51
…sec.supply carried to 0.14 (r13-x-rescore)

Measured column 0.13.0 in scorecard.json (no target edits), results/v0.13.0.json, REPORT-0.13.0.md with adjudications (web.ui 83, web.admin 88, ai.llm 100, eco.tenancy 88, web.validation 100, sec.web 100) and Security/DX sections, index.html, PLAN-OF-PLANS 11 exit row, CHANGELOG 0.13.0 Scorecard measured values. METHOD 5.2 and the scorecard.sh self-test copy restated for the measured version; REPORT-0.7.0..0.10.0 regenerated (planned path).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
Every manifest 0.12.0 -> 0.13.0: the workspace version, every intra-workspace dependency pin, examples (book-snippets, cli-minimal, http-showcase, reference ledger/pipeline/relay), lints/id_effect_lints and the tracked labs manifests (kept in lockstep, README step 1); Cargo.lock, fuzz/, the Leptos recipe and the lints lockfiles updated with cargo update -w. check-version-drift: 62 pins at 0.13.0. Book, README and kit snippets pin "0.13"; the dylint tag, the tutorial doctor output and the release tag examples name v0.13.0 (annotated, not signed).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ision; KPIs re-measured

docs/security/findings.json: S3 (long-lived CARGO_REGISTRY_TOKEN) and S6 (unsigned tags) accepted, reason owner decision 2026-10-24 (#118, 3e9104e); S6 drops the removed s6_release_requires_signed_tag and keeps the DCO test. THREAT-MODEL.md: B8 rows, an Accepted risks section and the register rows. SECURITY.md: 0.13.x supported, 0.12.x security fixes until 2027-01-23; Supply chain describes the actual flow (pushed v* tag, registry token, new crates created on first publish, SLSA provenance and digest checks kept). docs/RELEASING.md: no signed-tag check, the 0.11 owner steps kept only as a record. docs/security/kpis-0.13.json: open_highs and registry_token re-measured offline (both pass: 0 register problems, S3 accepted); fuzz_open_crashes pending: the rpc_duplex_frame crash is fixed by e9032b4, main's batch run (40173339047) still runs the pre-fix code until the merge.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…corecard CI for 0.13.0

CHANGELOG: "## 0.13.0 — 2026-10-25 — Breadth" with an intro; the KPI and Security bullets record the rpc_duplex_frame crash as fixed (e9032b4) and S3/S6 as accepted; owner steps: publish the 0.10.1 advisories (sec.supply#7), push v0.13.0. ADR 0015 Accepted (D16, 2026-10-21, D1-D15 as written; §15 notes the 0.45 pair limit). PLAN-OF-PLANS §11 and the release spec record D16, the eager pair limit 0.45 (F66) and keeping the #118 release flow (D17 superseded); scorecard block no longer provisional. ci.yml diffs the stored 0.13.0 result and runs --diff 0.12.0 0.13.0 --compare-targets 0.13.0. docs/benchmarks/README.md: eager pair <= 0.45.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…no stub marker in a test comment

tier-conformance failed on id_effect_proc_macro (N:tests=85<need=95) and id_effect_events (S:stub-markers=1). id_effect_proc_macro: 19 unit tests for the #[derive(Entity)] code that grew in 0.13 (41f7fcb): relation kinds, default names and keys (belongs_to from the target path, has_many plural, many_to_many local/foreign keys), belongs_to against renamed columns, has_many keys never marking a field relation, declared order, generics and visibility of the constructors, duplicate and keyword relation names, extra relation arguments, field labels (defaults, unraw, overrides), soft-delete/tenant editability, type rendering and Option unwrapping (105 tests for 4098 lines; tier-conformance all PASS). id_effect_events: the only marker was the word "stub" in a comment describing the scripted test client in sql_journal.rs tests (no unfinished code); reworded.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
The publish workflow no longer checks a tag signature (owner decision 2026-10-24, #118; S6 accepted), so CONTRIBUTING no longer says it refuses unsigned tags.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
…ere it is deterministic

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: Tom Wieland <tom.wieland@gmail.com>
@codecov

codecov Bot commented Oct 25, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.09%. Comparing base (cec5c04) to head (014bcab).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #121      +/-   ##
==========================================
+ Coverage   97.87%   98.09%   +0.22%     
==========================================
  Files         552      616      +64     
  Lines      117984   136258   +18274     
==========================================
+ Hits       115472   133665   +18193     
- Misses       2512     2593      +81     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Industrial
Industrial marked this pull request as ready for review October 25, 2026 21:47
@Industrial
Industrial merged commit 0ae051c into main Oct 25, 2026
40 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants