Release 0.7.0

Added

Approval System (PROTOCOL_SPEC §7)

• ApprovalHandler Protocol - Async protocol for pluggable approval handlers with request_approval() and check_approval() methods
• ApprovalRequest / ApprovalResult - Frozen dataclasses carrying invocation context and handler decisions with Literal status typing
• Phase A (synchronous) - Handler blocks until approval decision; denied/timeout raise immediately
• Phase B (asynchronous) - pending status returns _approval_token for async resume via check_approval()
• Built-in handlers - AlwaysDenyHandler (safe default), AutoApproveHandler (testing), CallbackApprovalHandler (custom logic)
• Approval errors - ApprovalError, ApprovalDeniedError, ApprovalTimeoutError, ApprovalPendingError with result, module_id, and reason properties
• Audit events (Level 3) - Dual-channel emission: logging.info() always + span events when tracing is active
• Extension point - approval_handler registered as a built-in extension point in ExtensionManager
• ErrorCodes - Added APPROVAL_DENIED, APPROVAL_TIMEOUT, APPROVAL_PENDING constants

Executor Integration

• Step 4.5 approval gate - Inserted between ACL (Step 4) and input validation (Step 5) in call(), call_async(), and stream()
• Executor.set_approval_handler() - Runtime handler configuration
• Executor.from_registry() - Added approval_handler parameter
• Dict and dataclass annotations - Both ModuleAnnotations and dict-style requires_approval supported
• Unknown status fail-closed - Unrecognized approval statuses treated as denied with warning log

Changed

Structural Alignment

• Approval errors re-exported from apcore.approval for multi-language SDK consistency; canonical definitions remain in errors.py
• ApprovalResult.status typed as Literal["approved", "rejected", "timeout", "pending"] per PROTOCOL_SPEC §7.3.2

Release 0.6.0

Added

Extension System

• ExtensionManager / ExtensionPoint - Added a unified extension-point framework for discoverer, middleware, acl, span_exporter, and module_validator
• Extension wiring - Added apply() support to connect registered extensions into Registry and Executor

Async Task & Cancellation

• AsyncTaskManager - Added background task orchestration with status tracking, cancellation, concurrency limits, shutdown, and cleanup
• TaskStatus / TaskInfo - Added task lifecycle enum and metadata dataclass for async task management
• CancelToken / ExecutionCancelledError - Added cooperative cancellation primitives and integrated cancellation checks into executor flows

Trace Context & Observability

• TraceContext / TraceParent - Added W3C Trace Context utilities for inject(), extract(), and strict parsing via from_traceparent()
• Context.create(trace_parent=...) - Added distributed-tracing entry support by accepting inbound trace context
• OTLPExporter top-level export - Added OTLP exporter re-exports in observability and top-level public API

Registry Enhancements

• Custom discoverer/validator hooks - Added set_discoverer() and set_validator() integration paths
• Module describe support - Added Registry.describe() for human-readable module descriptions
• Hot-reload APIs - Added watch(), unwatch(), and file-change handling helpers for extension directories
• Validation constants/protocols - Added MAX_MODULE_ID_LENGTH, RESERVED_WORDS, Discoverer, and ModuleValidator exports

Changed

Public API Surface

• Expanded top-level apcore exports to include cancellation, extensions, async task types, trace context types, additional registry protocols/constants, and new error classes

Error System

• Added ModuleExecuteError and InternalError to the framework error hierarchy and exports
• Extended ErrorCodes with additional constants used by newer execution/extension paths

Fixed

Execution & Redaction

• executor - Added recursive _secret_ key redaction for nested dictionaries
• executor - Preserved explicit cancellation semantics by re-raising ExecutionCancelledError

Import Graph Robustness

• Reduced import-coupling risk across middleware/observability/trace typing paths while preserving existing runtime behavior and public interfaces

Release 0.5.0

Changed

API Naming

• decorator - Renamed _generate_input_model / _generate_output_model to generate_input_model / generate_output_model as public API
• context_logger - Renamed format parameter to output_format to avoid shadowing Python builtin
• registry - Renamed _write_lock to _lock for clearer intent

Type Annotations

• decorator - Replaced bare dict with dict[str, Any] in _normalize_result, annotations, metadata, _async_execute, _sync_execute
• bindings - Fixed _build_model_from_json_schema parameter type from dict to dict[str, Any]
• scanner - Fixed roots parameter type from list[dict] to list[dict[str, Any]]
• metrics - Fixed snapshot return type from dict to dict[str, Any]
• executor - Removed redundant string-quoted forward references in from_registry; fixed middlewares parameter type to list[Middleware] | None

Code Quality

• executor - Extracted _convert_validation_errors() helper to eliminate 6 duplicated validation error conversion patterns
• executor - Refactored call_async() and stream() to use new async middleware manager methods
• executor - Removed internal _execute_on_error_async method (replaced by MiddlewareManager.execute_on_error_async)
• loader - Use self._resolver.clear_cache() instead of accessing private _file_cache directly
• tracing - Replaced print() with sys.stdout.write() in StdoutExporter
• acl / loader - Changed hardcoded logger names to logging.getLogger(__name__)

Added

Async Middleware

• MiddlewareManager - Added execute_before_async(), execute_after_async(), execute_on_error_async() for proper async middleware dispatch with inspect.iscoroutinefunction detection
• RefResolver - Added clear_cache() public method for cache management
• Executor - Added clear_async_cache() public method

Schema Export

• SchemaExporter - Added streaming hint to export_mcp() annotations from ModuleAnnotations

Fixed

Memory Safety

• context - Changed Identity.roles from mutable list[str] to immutable tuple[str, ...] in frozen dataclass

Observability

• context_logger / metrics - Handle cases where before() was never called in ObsLoggingMiddleware and MetricsMiddleware

Security

• acl - Added explicit encoding="utf-8" to YAML file open

Release 0.4.0

Added

Streaming Support

• Executor.stream() - New async generator method for streaming module execution
• Implements same 6-step pipeline as call_async() (context, safety, lookup, ACL, input validation, middleware before)
• Falls back to call_async() yielding single chunk for non-streaming modules
• For streaming modules, iterates module.stream() and yields each chunk
• Accumulates chunks via shallow merge for output validation and after-middleware
• Full error handling with middleware recovery
• ModuleAnnotations.streaming - New streaming: bool = False field to indicate if a module supports streaming execution
• Test coverage - Added 5 comprehensive tests in test_executor_stream.py:
• Fallback behavior for non-streaming modules
• Multi-chunk streaming
• Module not found error handling
• Before/after middleware integration
• Disjoint key accumulation via shallow merge

Release 0.3.0

Release version 0.3.0

See CHANGELOG.md for details.