cloacina 0.9.0

cloacina 0.9.0 brings a complete server authentication & authorization model, declared/typed workflow inputs, operator inject-and-fire surfaces, a unified trigger fan-out, and the Aurora Dark web-UI redesign.

Highlights

Server authentication & authorization (CLOACI-I-0118) — server-only; the embedded library and daemon are untouched

• ABAC route-table authorization — every /v1/* route is classified once at startup into a declarative (method, path) → {scope, level} table and evaluated by a small total matcher. Fail-closed: a route absent from the table is denied, never allowed by default.
• Local accounts — tenant-admin-provisioned username/password accounts (argon2id) under /v1/tenants/{t}/accounts; POST /v1/auth/local/login mints a short-TTL, tenant-scoped key.
• OIDC single sign-on — configure an issuer with CLOACINA_OIDC_*; spec-compliant discovery + PKCE + JWKS + ID-token validation (openidconnect). A god-owned allowlist (CLOACINA_OIDC_MAP: group / email-domain / subject → tenant+role) maps the validated identity to tenant memberships; unmapped identities are denied.
• Multi-tenant SSO — one login resolves to the set of {tenant, role} memberships, minting a scoped key per tenant; the UI shows a tenant picker. Bearer keys always stay scoped to one tenant.
• Sessions — TTL + issued_via provenance; POST /v1/auth/refresh (silent UI refresh) and POST /v1/auth/logout.
• Web UI — username/password + SSO sign-in, tenant-admin account management, tenant switcher, and role-gated controls (write/admin actions hidden for read-only keys, via GET /v1/auth/whoami).

Other additions

• Declared, typed workflow inputs (I-0128) — #[workflow(params(name: Type [= default], …))] / @cloaca.workflow_params(...), validated at execute time.
• Operator inject / fire surfaces — reactor force_fire/fire_with, accumulator inject, typed-slot interface discovery, plus cloacinactl reactor fire / accumulator inject. Every manual fire/inject is audit-logged.
• Manual trigger fire + universal pause/resume for triggers and workflows.
• Multi-architecture execution-agent fleet (T-0780) — per-target cdylibs dispatched by target_triple; interpreted (Python) packages run on any agent arch.
• Opinionated task docs (what:/why:), workflow source retrieval, Aurora Dark UI redesign, and an SDK coverage gate (TypeScript/Rust/Python parity).

⚠️ Breaking changes

• Plugin ABI CloacinaPlugin v2 → v3 — adds optional get_input_interface. Old packages still load (empty interface), but recompile against 0.9.0 to declare params / expose typed interfaces.
• Authorization moved to the fail-closed ABAC route table, which fixes a cross-tenant key-management leak: the global /v1/auth/keys surface is now god-only. A tenant key managing keys must use /v1/tenants/{t}/keys; a tenant key hitting the global surface now gets 403. Repoint any tooling accordingly.
• Trigger fan-out now fires all workflows subscribed via #[workflow(triggers=[…])], across packages, on manual and auto-poll firing (previously only the primary on workflow ran).
• Declared-param workflows are validated at execute time (400 workflow_input_invalid); executing a paused workflow is refused (409 workflow_paused).

Security

• Cross-tenant key-management leak fixed (see breaking changes). Local-account passwords hashed with argon2id; OIDC refresh material stored server-side AES-256-GCM, never returned to the browser; OIDC in-flight login state is Postgres-backed (multi-replica safe).

Migrations

• New Postgres-only auth tables (api_keys TTL/provenance, oidc_sessions, local_accounts, oidc_login_flows; 032–035), package_artifacts (PG 031 / SQLite 027), and paused columns (PG 029 / SQLite 025). All applied automatically on server boot.

See CHANGELOG.md for the full list.

cloacina 0.8.0

cloacina 0.8.0

Scheduler throughput & responsiveness

• Timer-driven cron — scheduled workflows now fire within ~10ms of their slot (was up to 30s). The cron scheduler sleeps until the next due instant and wakes immediately on schedule changes; co-due schedules dispatch concurrently. (CLOACI-T-0743)
• Scheduler dispatch rework — per-tick work no longer scales with backlog depth (batched state resolution), and task dispatch is backend-aware: fire-and-forget concurrent on PostgreSQL (the fleet now actually saturates — throughput ~0.3 → 18+ tasks/s under load), serial on SQLite (single-writer safe). The loop no longer stalls under hundreds of concurrent workflows. (CLOACI-T-0745)

Rust ↔ Python parity

• @cloaca.state_accumulator(capacity=N) and packaged cron @cloaca.trigger(on=, cron=) are now authorable from Python, closing the last authoring-surface gaps. (CLOACI-T-0688)

Web UI / observability

• Reactors are first-class in the Computation Graphs view — new GET /v1/health/reactors endpoint plus a Reactors card showing each reactor's criteria (any/all) and the accumulators it consumes (including reactors with no graph bound). (CLOACI-T-0742)

Demo

• Fleet concurrency raised 4 → 16 per agent; new demo-py-state and demo-py-cron fixtures exercising the new Python authoring surfaces.

v0.7.0

Release 0.7.0 — execution-agent fleet + server-level default executor