Break to strict authorization and declared-target contract for Python 0.1.0

[terjekv]

Python 0.1.0 adopts one strict REST 0.1.0 contract and the declared label-target configuration. Early releases prioritize correctness over compatibility. Remove the single-result check wrappers, legacy health methods, misspelled decision alias, tagged decisions, scalar policy responses, and omitted-field defaults.

Authorization now requires canonical decision strings, consistent permit IDs/arrays, complete policy versions, ordered batch indices, accurate counts, and matching versions. All four synchronous/asynchronous authorization methods require exactly one response with the matching ID for every submitted request. Empty batches and batches with failed items never satisfy all_allowed(). A separate SchemaVersion represents schema revisions without manufacturing policy generation fields.

Policy versions are immutable and interned in a bounded typed cache keyed by all four required fields. Invalid values cannot enter the cache, boolean generations cannot alias integers, and subclasses remain uncached. Current status metadata and permit Cedar IDs are required. The dated changelog and MIGRATION.md document every breaking API, the exact target syntax, format 2 manifests, and archive rebuilding/re-signing.

CI runs the full live suite against the published REST 0.1.0 container, pinned by immutable digest; the old server matrix is removed. Compose uses a pinned HTTP fixture image, checks both served configuration files before starting REST, and requires loaded policy/label metadata before tests run. Startup failures fail the suite and cleanup remains bounded. CodSpeed retains the existing benchmark suite and performance checks. Package version/lockfile are 0.1.0, and the wheel/source package are inspected to exclude test, editor, and agent artifacts.

Validation: 94 unit/model cases, 33 benchmark cases, and 29 live server integration cases pass. Pyright and BasedPyright report zero errors or warnings. Wheel and source distribution build successfully. CodSpeed reports no regressions on final head 71b7880: one improved, 31 untouched, and one new benchmark replacing the removed check wrapper. CodSpeed marks the retired wrapper benchmark as skipped. Earlier comparisons warned about different runtime environments, so the reported improvement is not treated as a controlled measurement. The final Compose suite also passes locally; this host requires invoking the configured fixture health check manually because its rootless Podman scheduler does not run it.

[codspeed]

Merging this PR will improve performance by 52.76%

⚡ 1 improved benchmark
✅ 31 untouched benchmarks
🆕 1 new benchmark
⏩ 1 skipped benchmark¹

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_policy_version_with_label_metadata	49.5 µs	32.4 µs	+52.76%
🆕	test_authorize_single	N/A	2.4 ms	N/A

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing agent/declared-label-targets (71b7880) with main (f6908ed)}

Footnotes

1. 1 benchmark was skipped, so the baseline result was used instead. If it was deleted from the codebase, click here and archive it to remove it from the performance reports. ↩