# Changelog

All notable changes to this crate are documented in this file.

The format is based on
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
this crate adheres to
[Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [0.1.10] - 2026-05-14

### Changed
- Internal Cargo.toml audit: `default-features = false` set on
  direct dependencies with explicit feature lists for what the
  crate actually uses. No behaviour change. (D24)

## [0.1.9] - 2026-05-13

- Dev: migrate integration-test fixtures from `testcontainers` /
  `testcontainers-modules` to `dockerlet 0.1`. No public-API
  change; runtime behaviour unchanged.

## [0.1.8] - 2026-05-11

- Extended `WhoamiResponse` with `permissions: Vec<String>`
  — the effective permission-atom set the route-protector
  enforces against for the authenticated caller. WebUI uses
  this to hide unreadable pages from the sidebar and to
  disable non-actionable buttons. Additive field; older
  clients ignore it.

## [0.1.7] - 2026-05-10

- Added `max_mechanics_response_bytes` cap to `EmbedDatasetCaps`
  (default 2 GiB). Bounds transient JSON-in-memory pressure
  during the embed-job parse before the corpus item-count and
  vector-dimension caps from 0.1.6 take effect. Addresses
  Gate-2 pre-review Finding 1.5 (deferred from 0.1.6, prioritised
  per Yuka's "do these sooner" note on the approval).

## [0.1.6] - 2026-05-10

- Added three corpus-side caps to `EmbedDatasetCaps`:
  `max_corpus_items`, `max_corpus_vector_dimension`, and
  `max_corpus_blob_bytes`. Bounds parse-time + post-encode
  allocation in the embed-job dispatcher against an unbounded
  mechanics worker / upstream-provider response. Addresses
  Gate-2 security pre-review 2026-05-10 Finding 1 (blocking).
- Default values: 10,000 items, 4,096 dimensions, 1 GiB blob
  size. Matches `docs/design/16-embedding-datasets.md` §"Hard
  limits enforced by the API".

## [0.1.5] - 2026-05-10

- Added the `ApiError::Conflict` variant and standard 409 error envelope.
- Wired embedding-dataset caps through `EmbedDatasetState` with the
  `EmbedDatasetCaps` struct.
- Integrated embed-job dispatch in `create_dataset` and `update_dataset`
  handlers.

## [0.1.4] - 2026-05-10

- Added `/v1/embed-datasets` CRUD/read routes with tenant scoping,
  permission atoms, source-item caps, corpus reads, and retirement.
- Added `data_config` validation, storage, carry-forward, and response
  round-tripping on workflow template create/read/update routes.

## [0.1.3]

- Added `/v1/whoami` endpoint.
- Added `/v1/_meta/branding` endpoint with `BrandingState`.
- Added `pub mod whoami` route module.

## [0.1.2]

## [0.1.0]

Initial functional release. Implements Phase 8 of the Philharmonic
roadmap: the complete public HTTP API.

- **Skeleton (A)**: axum builder, `RequestScopeResolver` trait +
  middleware, request context, structured error envelope, correlation
  ID propagation, structured request logging, meta smoke endpoints
  (`/v1/_meta/version`, `/v1/_meta/health`).
- **Authentication (B)**: long-lived `pht_` token lookup via substrate
  `find_by_content`, ephemeral COSE_Sign1 verification via
  `philharmonic-policy` B0 primitives, `AuthContext` enum (Principal |
  Ephemeral), authority-tenant binding, authority-epoch enforcement,
  generic external 401 collapsing.
- **Authorization (C)**: `RequiredPermission` per-route extension,
  role-based permission evaluation for Principal (via
  `evaluate_permission`), claim-list check for Ephemeral, tenant-scope
  enforcement, instance-scope enforcement infrastructure.
- **Workflow endpoints (D)**: 13 handlers — template CRUD (create, list,
  read, update, retire) + instance lifecycle (create, list, read,
  history, steps, execute, complete, cancel). Cursor-based pagination.
  `WorkflowEngine` integration with pluggable executor + lowerer.
- **Endpoint-config management (E)**: 6 handlers — create (SCK
  encrypt), list, read metadata, read decrypted (SCK decrypt), rotate,
  retire. No plaintext/ciphertext in logs or metadata reads.
- **Identity CRUD (F)**: 16 handlers — principal (create + list +
  rotate + retire), role (create + list + modify + retire), membership
  (assign + remove), minting authority (create + list + rotate +
  bump-epoch + retire + modify). `pht_` token returned once via
  `Zeroizing` borrow.
- **Token minting (G)**: `POST /v1/tokens/mint` — permission clipping
  against authority envelope, 4 KiB injected-claims cap, lifetime
  validation, instance-scope validation, builder validates kid+issuer
  against verifying-key registry, post-serialization `MAX_TOKEN_BYTES`
  guard.
- **Audit + rate limit + admin (H)**: tenant settings read/update,
  audit-event list (paginated + filterable), in-memory token-bucket
  rate limiting per tenant per endpoint family (429 + Retry-After),
  operator tenant create/suspend/unsuspend.

## [0.0.0]

Name reservation on crates.io. No functional content yet.
