Release v0.7.0

Merged
LC
2mo ago
+1052-99

Release v0.7.0

Bumps version from 0.6.0 to 0.7.0. This release carries breaking changes, so the minor moves per the repo's pre-1.0 rule.

Closes L-260827-4cf826

Changelog

Added

  • Automation: New Claude skill (bump-mthds) and companion script (upstream_notes.py) to automate bumping the mthds dependency, regenerating locks, and adapting the codebase to upstream protocol changes.

Changed

  • Dependency: Pinned mthds to an exact version (mthds==0.11.1) instead of a floor (>=0.8.2), ensuring the SDK and its strict extra="forbid" protocol models are always tested against the exact upstream version and preventing runtime parse failures from uncoordinated resolutions. pipelex pins the same version, so the two co-install; the two pins must now move in step, because two exact pins on different versions do not resolve at all. (Breaking)
  • Typing: PipelexValidationReport.input_form and pipe_io_contracts are now strictly typed via the standard's own client models (mthds.protocol.input_form.InputForm and mthds.protocol.pipe_io_contracts.PipeIOContracts) rather than opaque dictionaries. As a result, reports with older contracts (e.g. boolean optional instead of presence, or missing multiplicity/item_count) no longer parse; the hosted API emits the reshaped contracts and there is intentionally no compatibility shim for older runners. The types are used, never re-exported — mthds.protocol stays the one import path for the vocabulary — and bundle_blueprint / graph_spec stay opaque, since nothing published declares them. (Breaking)
  • Parsing: List items in input forms now parse into nameless unions (e.g. DocumentItem instead of DocumentField), so code narrowing a list's item must target the item layer (the named layer silently fails isinstance checks). Input-form parsing is also tightened to reject contradictory required/presence combinations, gating on optional slots, and explicit nulls on wire slots (except default_value). (Breaking)
  • Strictness: The imported artifacts are closed shapes, but the report envelope around them stays extension-open — an unrelated field a future server adds to the report still parses and still rides model_extra. The two regimes nest rather than spread, and a test pins both halves.
  • Linting: Updated Ruff to include mthds models (ValidationReport, InvalidValidationReport, ValidationDiagnostic) in runtime-evaluated-base-classes, preventing Pydantic resolution errors from annotations mistakenly moved into TYPE_CHECKING blocks.
  • Documentation: Updated README.md and docs/architecture.md to reflect the move from opaque dictionaries to typed MTHDS imports, detailing strictness boundaries and narrowing strategies, and docs/ci-cd.md to record that third-party actions are allowlisted at the enterprise level by exact commit SHA.

Fixed

  • Serialization: Generating a serialization-mode JSON Schema from PipelexValidationReport now outputs the real input-form field shapes instead of an opaque object (resolved via the bump to mthds 0.11.1).
  • CI/CD: Fixed the GitHub Actions publish workflow by pinning sigstore/gh-action-sigstore-python to an enterprise-allowlisted SHA for v3.5.0 (790bc6befb9d733738f18d8f895854b453640ec9), resolving a deterministic UnsignedMetadataError caused by a Sigstore TUF trust-root rotation that broke the previous v3.0.0 tag.

Summary by cubic

Releases v0.7.0 with two breaking changes: mthds moves to an exact pin, and PipelexValidationReport's input-form and pipe-I/O fields are typed by the standard's own models instead of opaque dicts. Payloads from runners predating the contract reshape now fail to parse, so the minor rolls per the pre-1.0 rule.

Breaking changes

  • mthds is pinned at ==0.11.1 (was >=0.8.2); pipelex pins the same version, so the two pins must move in step or a co-install fails to resolve.
  • input_form is now InputForm | None and pipe_io_contracts is now PipeIOContracts, so input slots read presence and multiplicity as enums.
  • List items parse into nameless item models (DocumentItem, not DocumentField); narrow a list's item at the item layer, since the named layer silently fails isinstance.
  • Input-form parsing rejects contradictory required/presence, gating on optional slots, and explicit nulls on wire slots (except default_value).
  • The imported artifacts are closed shapes, but the report envelope stays extension-open; unrelated future report fields still parse and ride model_extra.

Also in this release

  • Serialization-mode JSON Schema now emits the real input-form field shapes instead of an opaque object.
  • Publish workflow pins sigstore/gh-action-sigstore-python to an allowlisted SHA (v3.5.0), fixing the TUF root-rotation UnsignedMetadataError from the v3.0.0 tag.
  • Ruff now treats the three mthds models as runtime-evaluated base classes, preventing pydantic resolution errors from annotations moved into TYPE_CHECKING.
  • Adds the bump-mthds Claude skill and upstream_notes.py script to automate future mthds bumps, and updates README.md, docs/architecture.md, and docs/ci-cd.md.

Closes L-260827-4cf826.