From 878b265ff570a1b950dd248810772b14959d341e Mon Sep 17 00:00:00 2001 From: yia-mw-agent Date: Sun, 13 Sep 2026 19:02:22 +0000 Subject: [PATCH] chore: prepare authorized 0.7.0 release candidate Identify the tree as 0.7.0, superseding the unpublished 0.6.1 candidate. PyPI and GitHub Releases remain 0.6.0 until an authorized tag-driven publication. Closes #117 --- AGENTS_SETUP_INSTRUCTIONS.md | 4 +-- CHANGELOG.md | 61 +++++++++++++++++++++++--------- README.md | 8 ++--- docs/fava_trails_faq.md | 4 +-- docs/fava_trails_onepager.html | 2 +- docs/mcp-context-overhead.md | 2 +- docs/retrieval-baseline.md | 4 +-- docs/runtime-and-upgrade.md | 17 ++++----- pyproject.toml | 2 +- src/fava_trails/__init__.py | 2 +- tests/test_packaged_mcp.py | 8 ++--- tests/test_retrieval_baseline.py | 4 +-- uv.lock | 2 +- 13 files changed, 74 insertions(+), 46 deletions(-) diff --git a/AGENTS_SETUP_INSTRUCTIONS.md b/AGENTS_SETUP_INSTRUCTIONS.md index 1b56ab5..11f03f9 100644 --- a/AGENTS_SETUP_INSTRUCTIONS.md +++ b/AGENTS_SETUP_INSTRUCTIONS.md @@ -19,13 +19,13 @@ pip install fava-trails # Confirm the loaded runtime (package + module + MCP product version): fava-trails version -# Or from source (for development / unreleased 0.6.1 RC on main) +# Or from source (for development / unreleased 0.7.0 RC on main) git clone https://github.com/MachineWisdomAI/fava-trails.git && cd fava-trails && uv sync ``` **Version boundary:** PyPI and GitHub Releases still list **0.6.0** as latest. Governed identity, `mode="authoring"`, and related isolation behavior described in -this guide and the usage guide are the **unreleased 0.6.1 release candidate** on +this guide and the usage guide are the **unreleased 0.7.0 release candidate** on `main` (this tree). Published **0.6.0** does **not** match that model. After any install or upgrade, run `fava-trails version` and restart the MCP client so the process loads the intended entrypoint. See diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ef1230..782b08c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,11 +4,41 @@ All notable changes to FAVA Trails are documented here. ## Unreleased +## [0.7.0] — merged on main, not published (candidate) + +> **Publication status:** GitHub/PyPI latest remain **0.6.0**. This tree identifies +> as **0.7.0**. The unpublished **0.6.1** candidate identity is superseded and was +> never tagged. A normal `pip install fava-trails` still resolves **0.6.0** until +> an authorized tag-driven release. See +> [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md). + +### Compatibility and migration + +- **Identity:** Governed read/draft isolation is process-scoped. Set + `FAVA_TRAILS_AGENT_ID` on each ordinary authoring MCP process; caller + `agent_id` must match. A shared endpoint or shared data filesystem is one + identity boundary, not per-caller crypto isolation. Enable + `FAVA_TRAILS_OPERATOR=1` only on a separate operator-controlled endpoint. + Published **0.6.0** does not implement this model — confirm the loaded runtime + with `fava-trails version` after install or upgrade. +- **MCP:** Runtime requires MCP SDK 2.2.x (`mcp>=2.2.0,<3.0`). Handshake + `serverInfo.version` is the FAVA product version, not the SDK version. +- **JJ:** `install-jj` reuses any JJ `>= 0.28.0` and does not silently downgrade + or overwrite a user-managed binary. +- **Not claimed:** Trust Gate is rubric process control, not independent truth + verification. Secret preflight is not complete DLP and does not erase stored + records. `recall` is lexical whitespace-token substring AND, not semantic + search. This release does not report measured user adoption. Local Rich Views + remain a local reader; five real-session acceptance was waived and is not + claimed. + ### Added -- `FAVA_TRAILS_MCP_SURFACE=compact` advertises shorter initialize instructions and tool descriptions and omits list-time `outputSchema`, with `get_usage_guide` as on-demand protocol. Default remains `full`. `fava-trails measure-mcp-context` records tokenizer-labeled session-init size, loads a frozen issue #104 tested-release artifact (not relabeled from the current SDK), and the same-task comparison runs through `mcp.Client` sessions. Prompt-coverage gaps are instruction scans, not observed client skips, and the comparison payload does not label those scans as `called`/`skipped`; missing-scope recovery selects an exact returned path and retries recall with the original arguments except `trail_name`, requiring a non-empty result. Full initialize instructions are a maintained subset of `AGENTS_USAGE_INSTRUCTIONS.md`, not a verbatim inject. See [docs/mcp-context-overhead.md](docs/mcp-context-overhead.md). Addresses #104. +- **Governed read / draft isolation (#72, #93; [PR #93](https://github.com/MachineWisdomAI/fava-trails/pull/93)):** default `recall` / `get_thought` expose approved current records only. Explicit `mode="authoring"` retrieves only the server-configured agent's draft/proposed records; operator-only `mode="history"` selects lifecycle statuses and superseded records. Neither a namespace nor a supplied `agent_id` grants access. +- **Local Rich Views after 0.6.0 ([PR #92](https://github.com/MachineWisdomAI/fava-trails/pull/92), [PR #97](https://github.com/MachineWisdomAI/fava-trails/pull/97)):** reader generate/serve lifecycle and Astro managed-background startup for the existing local loopback reader. This is not a claim of five real production sessions. +- `FAVA_TRAILS_MCP_SURFACE=compact` advertises shorter initialize instructions and tool descriptions and omits list-time `outputSchema`, with `get_usage_guide` as on-demand protocol. Default remains `full`. `fava-trails measure-mcp-context` records tokenizer-labeled session-init size, loads a frozen issue #104 tested-release artifact (not relabeled from the current SDK), and the same-task comparison runs through `mcp.Client` sessions. Prompt-coverage gaps are instruction scans, not observed client skips, and the comparison payload does not label those scans as `called`/`skipped`; missing-scope recovery selects an exact returned path and retries recall with the original arguments except `trail_name`, requiring a non-empty result. Full initialize instructions are a maintained subset of `AGENTS_USAGE_INSTRUCTIONS.md`, not a verbatim inject. See [docs/mcp-context-overhead.md](docs/mcp-context-overhead.md). Addresses #104 ([PR #115](https://github.com/MachineWisdomAI/fava-trails/pull/115)). - `fava-trails register` prints native MCP registration using an ordinary `FAVA_TRAILS_AGENT_ID`, the resolved executable, and the intended data repository. Unresolved executables fail unless `--executable` names an existing executable file. `--write` is an explicit client-config opt-in (atomic write, `.bak` backup, files opened with the final mode before content is written, modes capped at `0600` while stricter existing modes are kept, new files `0600`, non-writable existing configs refused). `--verify` labels a direct MCP smoke test, client-config inspection, and MCP Inspector config-load (`inspector_config_load`). It does not claim Claude Code/Desktop loaded the registration. Failures stay distinct (`inspector_unavailable`, `inspector_invocation_failed`, `config_load_failed`, `server_spawn_failed`, `server_initialize_failed`, `inspector_failed`, stale runtime path, registration not loaded). Native-session evidence that a client loaded Claude-shaped `mcpServers` config is `test_native_client_registration_loads_and_initializes`. -- Bounded obvious-secret preflight before save, update, supersede, and promotion persist or transmit. Supported high-confidence patterns are refused with a safe explanation, including nested caller-controlled metadata and relationships after hook mutation, and the complete MCP request (tool name plus arguments) before schema validation, logging, lookup, auto-initialization, or JJ operations. Assembled Trust Gate result metadata is scanned before governance persist. Nested walks deeper than 32 fail closed. Block logs use a fixed message without pattern ids. Legacy matching drafts are left unchanged and are not sent for review. Documents data flow and detection limits; does not claim complete DLP. Fixes #102. -- **Trust Gate data-egress disclosure (issue #101):** `describe_trust_gate_egress` +- Bounded obvious-secret preflight before save, update, supersede, and promotion persist or transmit. Supported high-confidence patterns are refused with a safe explanation, including nested caller-controlled metadata and relationships after hook mutation, and the complete MCP request (tool name plus arguments) before schema validation, logging, lookup, auto-initialization, or JJ operations. Assembled Trust Gate result metadata is scanned before governance persist. Nested walks deeper than 32 fail closed. Block logs use a fixed message without pattern ids. Legacy matching drafts are left unchanged and are not sent for review. Documents data flow and detection limits; does not claim complete DLP. Fixes #102 ([PR #112](https://github.com/MachineWisdomAI/fava-trails/pull/112)). +- **Trust Gate data-egress disclosure (issue #101; [PR #111](https://github.com/MachineWisdomAI/fava-trails/pull/111)):** `describe_trust_gate_egress` + `fava-trails doctor` **Data egress** section and MCP startup log show the effective review destination/model and which candidate fields are sent before promotion. Successful LLM or operator `propose_truth` paths (and credential / @@ -27,8 +57,9 @@ All notable changes to FAVA Trails are documented here. configuration, local runtime selectors that can keep an old checkout active, and release-candidate install/upgrade verification. Wheel/sdist packaging tests cover fresh install, upgrade from published 0.6.0, installed-entrypoint - MCP protocol (#83), and governed recall isolation (#72). Prepares #99; **0.6.1 - remains merged but unreleased on PyPI until an authorized tag is published.** + MCP protocol (#83), and governed recall isolation (#72). Prepares #99 + ([PR #109](https://github.com/MachineWisdomAI/fava-trails/pull/109)); **0.7.0 + remains unreleased on PyPI until an authorized tag is published.** - Issue #99 verification depth: real native MCP client registration via `@modelcontextprotocol/inspector` loading Claude-shaped `mcpServers` config (distinct from direct stdio probes); two separately configured ordinary server @@ -44,23 +75,19 @@ All notable changes to FAVA Trails are documented here. **draft** GitHub Release (title/notes/target bound to the candidate), publishes the same `dist/` to PyPI, requires published PyPI SHA-256 to match `candidate-SHA256SUMS` before undraft (still owner-gated; no automatic - publication from this PR). + publication from this changelog). +- **Local-only sync (#105; [PR #116](https://github.com/MachineWisdomAI/fava-trails/pull/116)):** `sync` distinguishes a repo with no remotes (local-only) from a configured remote that is broken. It does not invent hosted remotes or treat missing-remote as a fetch failure. ### Changed -- `fava-trails init` and `fava-trails scope set` persist scope in `.fava-trails.yaml` and no longer write application `.env` files unless `--write-env` is passed. Existing `FAVA_TRAILS_SCOPE` reads are unchanged. Generated agent guidance (`AGENTS_USAGE_INSTRUCTIONS.md`, server instructions, data-repo `agents-guide.md`) and root `AGENTS.md` no longer tell agents to edit application-owned `.env` files. `fava-trails register --write` and `--verify` fail unless a real data-repository path is resolved; print-only guidance may still show a placeholder. +- Safer onboarding (#103; [PR #113](https://github.com/MachineWisdomAI/fava-trails/pull/113), [PR #114](https://github.com/MachineWisdomAI/fava-trails/pull/114)): `fava-trails init` and `fava-trails scope set` persist scope in `.fava-trails.yaml` and no longer write application `.env` files unless `--write-env` is passed. Existing `FAVA_TRAILS_SCOPE` reads are unchanged. Generated agent guidance (`AGENTS_USAGE_INSTRUCTIONS.md`, server instructions, data-repo `agents-guide.md`) and root `AGENTS.md` no longer tell agents to edit application-owned `.env` files. `fava-trails register --write` and `--verify` fail unless a real data-repository path is resolved; print-only guidance may still show a placeholder. +- Honest substring recall (#100; [PR #110](https://github.com/MachineWisdomAI/fava-trails/pull/110)): public docs and the retrieval baseline state that `recall` is lexical whitespace-token substring AND across content and selected metadata. They do not promise semantic search, hallucination prevention, or truth verification. - Public Trust Gate wording no longer implies that a review verdict prevents secret persistence or egress. -- Support MCP SDK 2.2 with explicit low-level handlers, preserving tool schemas, annotations, input/output validation, structured results, and Markdown usage guidance over stdio and Streamable HTTP. Adds installed-wheel protocol tests for legacy initialization and current SDK clients. Resolves #83. -- **JJ installer policy (issue #98):** `fava-trails install-jj` (canonical `jj_install.py`; `scripts/install-jj.sh` is a thin Bash 3.2-safe delegate) reuses any installed JJ `>= 0.28.0` before platform checks, never silently downgrades or overwrites a user-managed binary, resolves current GitHub stable when install is needed (explicit `--version` / `JJ_VERSION` override retained), verifies GitHub asset SHA-256 digests when published, requires exactly one safe regular `jj` archive member, installs atomically with restore of the prior managed binary after any post-replacement failure, and PATH-hints the selected install directory. CI matrix covers JJ **0.28.0** and **0.45.1**. See `docs/jj-compatibility.md`. - -## [0.6.1] — merged on main, not published (candidate) - -> **Publication status:** GitHub/PyPI latest remain **0.6.0**. Main identifies as -> **0.6.1** and includes governed-read and MCP registration fixes. A normal -> `pip install fava-trails` does **not** receive those fixes until an authorized -> release. See [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md). +- Support MCP SDK 2.2 with explicit low-level handlers, preserving tool schemas, annotations, input/output validation, structured results, and Markdown usage guidance over stdio and Streamable HTTP. Adds installed-wheel protocol tests for legacy initialization and current SDK clients. Resolves #83 ([PR #94](https://github.com/MachineWisdomAI/fava-trails/pull/94)). +- **JJ installer / current-stable policy (issue #98; [PR #108](https://github.com/MachineWisdomAI/fava-trails/pull/108)):** `fava-trails install-jj` (canonical `jj_install.py`; `scripts/install-jj.sh` is a thin Bash 3.2-safe delegate) reuses any installed JJ `>= 0.28.0` before platform checks, never silently downgrades or overwrites a user-managed binary, resolves current GitHub stable when install is needed (explicit `--version` / `JJ_VERSION` override retained), verifies GitHub asset SHA-256 digests when published, requires exactly one safe regular `jj` archive member, installs atomically with restore of the prior managed binary after any post-replacement failure, and PATH-hints the selected install directory. CI matrix covers JJ **0.28.0** and **0.45.1**. See `docs/jj-compatibility.md`. ### Fixed -- Raised direct MCP (`>=1.28.1`) and Starlette (`>=1.3.1`) floors and refreshed the lockfile to clear open Dependabot advisories (including high-severity transitive updates such as NLTK and Transformers). Supersedes #81. +- Raised direct MCP (`>=1.28.1`, later `>=2.2.0`) and Starlette (`>=1.3.1`) floors and refreshed the lockfile to clear open Dependabot advisories (including high-severity transitive updates such as NLTK and Transformers). Supersedes #81 ([PR #91](https://github.com/MachineWisdomAI/fava-trails/pull/91)). +- Duplicate-recovery receipts stay private and durable before retry ([PR #95](https://github.com/MachineWisdomAI/fava-trails/pull/95)). ## [0.6.0] — 2026-07-31 diff --git a/README.md b/README.md index 48fa2a6..eb64d0b 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ Every thought, decision, and observation is stored as a markdown file with YAML ## Governed recall > **Release status:** The governed visibility model below describes the **current -> unreleased 0.6.1 tree** (release candidate on `main`). PyPI and GitHub Releases +> unreleased 0.7.0 tree** (release candidate on `main`). PyPI and GitHub Releases > still list **0.6.0** as latest; that published build does **not** include the > later governed-read isolation / MCP registration fixes. Confirm what you loaded > with `fava-trails version` — see [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md). @@ -36,7 +36,7 @@ For a long-lived private ChatGPT connection, follow the deployment-neutral ## Why - **Supersession tracking** — a proposed correction leaves the original current; approved replacements make predecessors historical in default recall. Lineage is recorded; supersession does **not** prove the replacement is true. -- **Draft isolation (0.6.1 RC)** — working thoughts stay in `drafts/`. Default governed `recall`/`get_thought` expose approved current records only; own drafts need explicit `mode="authoring"` on a configured identity. A shared MCP endpoint or shared data filesystem is one boundary, not per-caller crypto isolation. Published **0.6.0** does not match this isolation model — upgrade/check the loaded version before relying on it. +- **Draft isolation (0.7.0 RC)** — working thoughts stay in `drafts/`. Default governed `recall`/`get_thought` expose approved current records only; own drafts need explicit `mode="authoring"` on a configured identity. A shared MCP endpoint or shared data filesystem is one boundary, not per-caller crypto isolation. Published **0.6.0** does not match this isolation model — upgrade/check the loaded version before relying on it. - **Trust Gate** — default policy is `llm-oneshot` (synchronous single-record rubric review). Non-LLM promotion is **not** a config toggle: on an operator endpoint use `propose_truth(..., approval="human")`. Rubric review is process control with limited context — **not** independent verification of project facts, and not a guarantee that hallucinations never enter shared truth. A reject does not mean the draft was never stored or sent for review. A separate [bounded obvious-secret preflight](docs/secret-preflight.md) refuses a small set of high-confidence credential shapes before normal write and promotion paths persist or transmit them. It is not complete DLP and does not erase already-stored records. - **Lexical recall** — `recall` matches lowercased whitespace-separated query tokens as substrings across content and selected metadata (AND). It is not semantic similarity search. See [docs/retrieval-baseline.md](docs/retrieval-baseline.md). - **Full lineage** — every thought carries who wrote it, when, and why it changed. @@ -62,8 +62,8 @@ pip install fava-trails ``` **Publication note:** PyPI and GitHub Releases still list **0.6.0** as latest. -Main identifies as **0.6.1** with governed-recall and MCP registration fixes -**merged but unreleased**. Confirm what you actually loaded with +Main identifies as **0.7.0** with governed-recall, MCP registration, and later +fixes **merged but unreleased**. Confirm what you actually loaded with `fava-trails version` (see [docs/runtime-and-upgrade.md](docs/runtime-and-upgrade.md)). Local `uv run --directory …` or vendor checkout selectors can keep an older tree active after a package upgrade — restart the MCP client registration after diff --git a/docs/fava_trails_faq.md b/docs/fava_trails_faq.md index 27516a8..eb3037c 100755 --- a/docs/fava_trails_faq.md +++ b/docs/fava_trails_faq.md @@ -281,9 +281,9 @@ Thoughts are **not** globally immutable. Lifecycle behavior: ### What's on the roadmap? -**Current unreleased tree (0.6.1 release candidate on `main` / this docs branch):** Versioned thought store with durable persistence before successful return (interruptions can still leave recoverable dirty/incomplete state), governed/authoring/history visibility (process-configured identity; #72/#93), Trust Gate LLM review plus per-call operator `approval="human"` provenance, supersession lineage, MCP integration, lexical `recall`, 1-hop relationship expansion, local Rich Views reader. **Not on PyPI yet** — GitHub/PyPI latest remain **0.6.0**. Confirm the loaded runtime with `fava-trails version` (see [runtime-and-upgrade.md](runtime-and-upgrade.md)). +**Current unreleased tree (0.7.0 release candidate on `main` / this docs branch):** Versioned thought store with durable persistence before successful return (interruptions can still leave recoverable dirty/incomplete state), governed/authoring/history visibility (process-configured identity; #72/#93), Trust Gate LLM review plus per-call operator `approval="human"` provenance, supersession lineage, MCP integration, lexical `recall`, 1-hop relationship expansion, local Rich Views reader. **Not on PyPI yet** — GitHub/PyPI latest remain **0.6.0**. Confirm the loaded runtime with `fava-trails version` (see [runtime-and-upgrade.md](runtime-and-upgrade.md)). -**Published 0.6.0 (what `pip install fava-trails` still resolves):** Trust Gate provider-neutral LLM config and related runtime fields shipped; **does not** include the later governed-read isolation / MCP registration fixes that identify as 0.6.1 on `main`. Do not assume 0.6.0 draft/authoring behavior matches this FAQ’s governed visibility model. +**Published 0.6.0 (what `pip install fava-trails` still resolves):** Trust Gate provider-neutral LLM config and related runtime fields shipped; **does not** include the later governed-read isolation / MCP registration fixes that identify as 0.7.0 on this tree. Do not assume 0.6.0 draft/authoring behavior matches this FAQ’s governed visibility model. **In design / discovery (not shipped by this FAQ):** Continuous Pull Daemon automation; a dedicated search/retrieval layer after Lima Discovery ([issue #59](https://github.com/MachineWisdomAI/fava-trails/issues/59)) — candidates may include full-text indexes or, only if discovery proves need, derived semantic indexes. **No embeddings product, vector database, or retrieval architecture is selected in #59's discovery gate.** diff --git a/docs/fava_trails_onepager.html b/docs/fava_trails_onepager.html index b848d02..5660e83 100755 --- a/docs/fava_trails_onepager.html +++ b/docs/fava_trails_onepager.html @@ -1031,7 +1031,7 @@

Stop building memory from scratch.

diff --git a/docs/mcp-context-overhead.md b/docs/mcp-context-overhead.md index 01b4db4..981e97e 100644 --- a/docs/mcp-context-overhead.md +++ b/docs/mcp-context-overhead.md @@ -33,7 +33,7 @@ figure is a client invoice. | Checkout | Role | FAVA version | Git commit | Client | | --- | --- | --- | --- | --- | | Issue #104 source review baseline | tested release (frozen artifact) | 0.6.1 | `6c5278a40a86246014901a88417f3455a46cdfcc` | `mcp.Client` 2.2.0 (frozen) | -| This branch | candidate | 0.6.1 | current `git rev-parse HEAD` | live `mcp.Client` (currently 2.2.0) | +| This branch | candidate | 0.7.0 | current `git rev-parse HEAD` | live `mcp.Client` (currently 2.2.0) | The tested release had no compact surface. Its full-surface payload, enabled tool names, lazy-loading flag, recurrence, tokenizer, and client version are stored in diff --git a/docs/retrieval-baseline.md b/docs/retrieval-baseline.md index 1b3ed45..5a02ff0 100644 --- a/docs/retrieval-baseline.md +++ b/docs/retrieval-baseline.md @@ -47,7 +47,7 @@ See [governed-recall.md](governed-recall.md). | Field | Value | | --- | --- | -| Product version | `0.6.1` (`pyproject.toml`) — **unreleased** release candidate on this tree / `main`; PyPI and GitHub Releases latest remain **0.6.0** | +| Product version | `0.7.0` (`pyproject.toml`) — **unreleased** release candidate on this tree / `main`; PyPI and GitHub Releases latest remain **0.6.0** | | Git baseline (matrix authoring) | `54692dbaae7ca4fdcc80a4a8e26018411541207f` (PR #110 repair for review `5161963110` on `automation/fava-trails-100`). Prior SHA rows (`36d6bbb`, `10b937d`, `32b5b82`, `187f523`) are historical only. | | Runner | `uv run pytest tests/test_retrieval_baseline.py -v` | | Issue | [#100](https://github.com/MachineWisdomAI/fava-trails/issues/100) | @@ -83,7 +83,7 @@ Legend: **hit** = listed fixture ids present; **miss** = empty fixture-id set; "Expected" is the behavior of the current matcher, not a wishlist. Cells list **complete** fixture-id sets under the stated mode. -| Case | Query | Mode / filters | Expected (complete fixture ids) | Actual (0.6.1 matcher) | Notes | +| Case | Query | Mode / filters | Expected (complete fixture ids) | Actual (0.7.0 matcher) | Notes | | --- | --- | --- | --- | --- | --- | | Exact token | `colocated` | governed | `{exact-jj}` | `{exact-jj}` | Baseline true positive | | Multi-token AND | `JJ Git` | governed | `{exact-jj}` | `{exact-jj}` | Non-contiguous tokens OK | diff --git a/docs/runtime-and-upgrade.md b/docs/runtime-and-upgrade.md index 83073d3..4bc338a 100644 --- a/docs/runtime-and-upgrade.md +++ b/docs/runtime-and-upgrade.md @@ -1,10 +1,11 @@ # Runtime versions, identity, and upgrade behavior -FAVA Trails 0.6.1 fixes (governed recall isolation from #72 / #93 and MCP -registration compatibility from #83 / #94) are **merged on `main` but not yet +FAVA Trails 0.7.0 (governed recall isolation from #72 / #93, MCP registration +compatibility from #83 / #94, and later merged work on `main`) is **not yet published** to PyPI or a GitHub Release. Live `pip install fava-trails` still resolves **0.6.0** until an authorized tag-driven release runs. Treat anything -newer on `main` as a release candidate until publication is verified. +newer on `main` as a release candidate until publication is verified. The +unpublished 0.6.1 candidate identity is superseded by 0.7.0. ## Report the loaded runtime @@ -22,12 +23,12 @@ Example (values vary by install): ```text FAVA Trails product: fava-trails -Package version: 0.6.1 -Module version: 0.6.1 +Package version: 0.7.0 +Module version: 0.7.0 Module path: /…/site-packages/fava_trails/__init__.py Source: installed MCP SDK version: 2.2.0 -Handshake product version (serverInfo.version): 0.6.1 +Handshake product version (serverInfo.version): 0.7.0 ``` | Field | Meaning | @@ -45,7 +46,7 @@ Handshake product version (serverInfo.version): 0.6.1 On stdio `initialize`, FAVA advertises: - `serverInfo.name`: `fava-trails` -- `serverInfo.version`: **FAVA product version** (for example `0.6.1`) +- `serverInfo.version`: **FAVA product version** (for example `0.7.0`) The MCP Python SDK has its own distribution version (for example `2.2.0`). A client UI that shows a single "server version" may be reading either product @@ -178,6 +179,6 @@ unreleased**. After publication, confirm PyPI and GitHub release metadata match the tested candidate, then install with: ```bash -pip install -U 'fava-trails>=0.6.1' +pip install -U 'fava-trails>=0.7.0' fava-trails version ``` diff --git a/pyproject.toml b/pyproject.toml index 362199b..67b1c8e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "fava-trails" -version = "0.6.1" +version = "0.7.0" description = "FAVA Trails 🫛👣 — Federated Agents Versioned Audit Trail. VCS-backed memory for AI agents via MCP." readme = "README.md" requires-python = ">=3.11" diff --git a/src/fava_trails/__init__.py b/src/fava_trails/__init__.py index 3a05a72..c3fc6fc 100644 --- a/src/fava_trails/__init__.py +++ b/src/fava_trails/__init__.py @@ -10,4 +10,4 @@ try: __version__ = version("fava-trails") except PackageNotFoundError: # pragma: no cover - source tree without install metadata - __version__ = "0.6.1" + __version__ = "0.7.0" diff --git a/tests/test_packaged_mcp.py b/tests/test_packaged_mcp.py index 090edfb..c6cd9da 100644 --- a/tests/test_packaged_mcp.py +++ b/tests/test_packaged_mcp.py @@ -161,7 +161,7 @@ def test_candidate_artifacts_support_fresh_install_and_upgrade_from_0_6_0(tmp_pa fresh_py = fresh / ".venv" / "bin" / "python" _install_into_venv(uv, fresh_py, wheel) fresh_probe = _probe_runtime(fresh_py) - assert fresh_probe.split()[0] == "0.6.1" + assert fresh_probe.split()[0] == "0.7.0" version_cmd = subprocess.run( [str(fresh / ".venv" / "bin" / "fava-trails"), "version"], capture_output=True, @@ -170,7 +170,7 @@ def test_candidate_artifacts_support_fresh_install_and_upgrade_from_0_6_0(tmp_pa ) assert version_cmd.returncode == 0, version_cmd.stdout + version_cmd.stderr assert "Package version:" in version_cmd.stdout - assert "0.6.1" in version_cmd.stdout + assert "0.7.0" in version_cmd.stdout assert "MCP SDK version:" in version_cmd.stdout assert "Source: installed" in version_cmd.stdout @@ -193,7 +193,7 @@ def test_candidate_artifacts_support_fresh_install_and_upgrade_from_0_6_0(tmp_pa assert before == "0.6.0" _install_into_venv(uv, upgrade_py, wheel, upgrade=True) after = _probe_runtime(upgrade_py) - assert after.split()[0] == "0.6.1" + assert after.split()[0] == "0.7.0" # Fresh sdist install of the same candidate sdist bytes sdist_env = tmp_path / "fresh-sdist" @@ -202,4 +202,4 @@ def test_candidate_artifacts_support_fresh_install_and_upgrade_from_0_6_0(tmp_pa sdist_py = sdist_env / ".venv" / "bin" / "python" _install_into_venv(uv, sdist_py, sdist) sdist_probe = _probe_runtime(sdist_py) - assert sdist_probe.split()[0] == "0.6.1" + assert sdist_probe.split()[0] == "0.7.0" diff --git a/tests/test_retrieval_baseline.py b/tests/test_retrieval_baseline.py index b95d81a..b98cc98 100644 --- a/tests/test_retrieval_baseline.py +++ b/tests/test_retrieval_baseline.py @@ -16,7 +16,7 @@ from fava_trails.models import SourceType from fava_trails.trust_gate import TrustResult -PRODUCT_VERSION = "0.6.1" +PRODUCT_VERSION = "0.7.0" # Stable fixture ids for matrix rows. Stored only in metadata.extra (not searchable). FIXTURE_EXACT = "exact-jj" @@ -145,7 +145,7 @@ async def save( def test_documented_product_version_matches_package(): - """Baseline doc pins 0.6.1; fail if package metadata drifts without doc update.""" + """Baseline doc pins 0.7.0; fail if package metadata drifts without doc update.""" try: installed = version("fava-trails") except PackageNotFoundError: diff --git a/uv.lock b/uv.lock index d5b167d..2de385d 100644 --- a/uv.lock +++ b/uv.lock @@ -495,7 +495,7 @@ wheels = [ [[package]] name = "fava-trails" -version = "0.6.1" +version = "0.7.0" source = { editable = "." } dependencies = [ { name = "any-llm-sdk" },