TraceWeft v0.3.5

TraceWeft 0.3.5 is a documentation release. There are no code or behavior
changes — it exists to publish the corrected README to crates.io so the registry
pages match reality.

Documentation

• The README now documents crates.io installation (trace-weft = "0.3") in place of the old git-dependency instructions, and installs the (unpublished) CLI from the repository with cargo install --git. Publishing this release makes the corrected README render on the crates.io pages
• DEVELOPMENT.md points at the OpenAPI contract's relocated in-crate path (crates/trace-weft-server/openapi/trace-weft.openapi.json)

Known limitations

• The CLI ships dev only; import / export / replay are planned
• Blob reads are authenticated but not yet project-scoped

Full Changelog: v0.3.4...v0.3.5

TraceWeft v0.3.4

TraceWeft 0.3.4 is a security-maintenance release. There are no API or
behavior changes — it pins a patched transitive dependency so the supply-chain
gate stays green.

Security

• Updated anyhow to 1.0.103 to clear RUSTSEC-2026-0190, an unsoundness in Error::downcast_mut() (a use-after-context borrow violation, undefined behavior) present in 1.0.102. The cargo-deny supply-chain gate denies the advisory, so the workspace now builds on the patched release

Known limitations

• The CLI ships dev only; import / export / replay are planned
• Blob reads are authenticated but not yet project-scoped

Full Changelog: v0.3.3...v0.3.4

TraceWeft v0.3.3

TraceWeft 0.3.3 is a packaging release. It does not change any runtime
behavior — it fixes how the crates are published to crates.io so the registry
pages are complete and every published crate builds from its own tarball.

Fixed

• Published crates now render a README on crates.io. Every published crate declares readme = "../../README.md", so the project overview shows on each crate's registry page instead of "no README"
• trace-weft-server now packages cleanly. The embedded OpenAPI contract moved from the repo-root schemas/api/ into the crate at openapi/trace-weft.openapi.json, so include_str! resolves inside the published tarball rather than reaching outside the package. The web API-type generator reads the contract from its new location

Known limitations

• The CLI ships dev only; import / export / replay are planned
• Blob reads are authenticated but not yet project-scoped

Full Changelog: v0.3.2...v0.3.3

TraceWeft v0.3.2

TraceWeft 0.3.2 is a maintenance release that tightens the build and
supply-chain tooling on top of 0.3.0/0.3.1. There are no API or behavior
changes — the libraries, server, CLI, and apps are functionally identical to
0.3.1.

Changed

• Trimmed unused dependencies flagged by cargo-machete across the desktop app and the CLI, core, ingest, MCP, OpenInference, OTel, and recorder crates
• Hardened the supply-chain gate: cargo-deny now ignores advisories with no available fix and recognizes the workspace's private crates

Fixed

• The Rust CI job now installs the Tauri system dependencies so the desktop crate builds on a clean runner

Known limitations

• The CLI ships dev only; import / export / replay are planned
• Blob reads are authenticated but not yet project-scoped

Full Changelog: v0.3.1...v0.3.2

TraceWeft v0.3.1

TraceWeft 0.3.1 is a small follow-up to 0.3.0 that closes two of its known
limitations: OTLP ingestion is now actually served by the dev server, and the
web workbench can authenticate against a project-scoped server.

Features

• OTLP/HTTP JSON ingestion is now served at POST /v1/traces — payloads are decoded by trace-weft-ingest (original trace/span/parent IDs preserved, 400 for malformed bodies) and, like /api/v1/batch, the authenticated project is stamped onto every span before it is persisted. Resolves the 0.3.0 "OTLP is library-only" limitation
• The web UI accepts an API key — a header field stores an Authorization: Bearer token (leave it empty to keep the local dev bypass) that is sent on every request, so the workbench can talk to an authenticated, project-scoped server. Resolves the 0.3.0 "web UI has no API-key entry" limitation

Known limitations

• The CLI ships dev only; import / export / replay are planned
• Blob reads are authenticated but not yet project-scoped

Full Changelog: v0.3.0...v0.3.1

TraceWeft v0.3.0

TraceWeft 0.3.0 brings a full Graphite-styled web workbench on a typed API
contract, replay/diff tooling, and a Postgres backend that now actually works.
TraceWeft remains local-first by default.

Features

• Reworked web workbench — the Graphite design system, a structured span-metadata inspector, a waterfall time axis, a trace graph, transcript and content/blob views, and trace-list search with root-span/model/error summaries, all driven by a typed API client backed by React Query
• First-class API contract — an OpenAPI document (schemas/api/trace-weft.openapi.json) and generated TypeScript types consumed by the web client
• New query/server endpoints — replay-plan, trace-diff, replay-config, and the OpenAPI document, alongside full span detail, trace events, and blob content
• Builder input/output capture by label under the active capture policy
• Richer redaction — error-message redaction with real error type names, redacted previews for full-content policies, a fallback redactor, and secret-assignment, phone, and credit-card patterns

Security

• Desktop hardening — the Tauri webview now ships a content security policy and an explicit window capability instead of an open CSP

Fixes

• Postgres backend now functions — the schema DDL runs unprepared and is created via the server's own pool, and retry_count is stored/decoded as BIGINT; the backend previously failed on connect and was effectively unusable
• HITL approvals persist their resolved state — a span recorded twice with the same span_id (PendingApproval, then Ok) now upserts instead of failing the primary key or being discarded, so resolved breakpoints no longer stay stuck pending
• Trace-graph layout is rebuilt per trace, fixing cross-trace position drift
• The evaluations and trace-diff screens surface fetch errors instead of showing misleading empty states
• README CLI and OTLP descriptions corrected to match what the server actually serves

Other

• CI workflow — fmt, clippy -D warnings, nextest, doc tests, cargo-deny, cargo-machete, plus web lint/test/build and Playwright
• Workspace lints, Vitest + Playwright harnesses, a docker compose Postgres, and a just test-pg recipe
• A DEVELOPMENT.md development guide
• MSRV raised to 1.96, dependencies updated, and all manifests aligned to 0.3.0

Known limitations

• OTLP /v1/traces is library-only (trace-weft-ingest); the dev server ingests via POST /api/v1/batch
• The CLI ships dev only; import / export / replay are planned
• The web UI targets the local dev bypass — an authenticated server has no API-key entry yet
• Blob reads are authenticated but not yet project-scoped

Full Changelog: v0.2.0...v0.3.0

TraceWeft v0.2.0

Features

• OpenTelemetry export preserves original trace and span IDs - a custom IdGenerator maps TraceWeft UUIDs onto OTel 128/64-bit IDs and rebuilds parent context, so exported spans keep their place in the trace tree
• Postgres query endpoints - list traces, get trace by id, and list evals now serve Postgres as well as SQLite through shared dialect-agnostic mappers
• API-key authentication with per-project multi-tenancy - SHA-256 hashed keys, constant-time comparison, project-scoped queries, and server-side project stamping so tenants only see their own traces
• Robust OTLP ingest on opentelemetry-proto types - original trace/span/parent IDs are preserved instead of regenerated
• Desktop app lifecycle - the Tauri shell embeds the server, exposes server_info/server_start/server_stop IPC commands, and drains the server gracefully on exit

Security

• The local API is no longer readable from arbitrary browser origins - permissive CORS is replaced by an origin allowlist (loopback + Tauri webview), blocking cross-origin reads and preflighted CSRF
• HITL approval endpoints now require authentication
• start_server defaults to secure auth (reject unless keys or dev mode are configured); trace-weft dev and the desktop opt into local-first
• Vite updated to 8.0.16 and the Babel advisory patched - npm audit is clean at high severity

Fixes

• MCP traceparent span-id reduction aligned with the OTel exporter (low 8 bytes), so a span maps to the same 64-bit id on every wire
• OTLP ingest returns 400 for malformed payloads instead of silently minting new UUIDs
• Query handlers surface corrupt JSON as 500 instead of masking it as {}
• MSRV metadata corrected - every crate inherits rust-version = 1.94.1

Other

• 100+ unit and integration tests across propagation, MCP, SQLite/Postgres parity, tenant isolation, ingest, and graceful shutdown
• All publishable crates carry crates.io metadata (description, license, repository) with versioned path dependencies; cargo package --workspace passes
• Web API base centralized via VITE_API_BASE so the dev proxy and the desktop bundle both work
• README screenshots and badges; all manifests aligned to 0.2.0

Full Changelog: https://github.com/kidoz/trace-weft/commits/v0.2.0