v0.9.5

Fixed

• A caller's datasource is bounded before it reaches the audit row (#370). The name is caller-written text and arrives at _record_execution before anything establishes that it names a datasource we serve, so an arbitrarily long value was stored once per call. The statement beside it has always been capped; this column was missed. It now shares LOG_DATASOURCE_MAX_CHARS with the refusal log line, so the line and the row cannot disagree about what was sent.

Internal

• The wheel's contents are asserted (#122). Every test runs against an editable install, where migrations/ and static/ resolve into the source tree whatever the packaging config says — so that config was the one part of the repo the suite could not see, and it has shipped broken once. A test now builds a wheel and looks inside it.
• The test suite no longer reads or writes the developer's own machine (#293). artifacts_dir() resolved a pointer at ~/.config/agami/path and then ~/agami-artifacts, one level earlier than the fixtures isolating files inside that directory, so a real org_id leaked into tests asserting local — 41 failures on a maintainer's machine and none in CI. The legacy-home migration was worse than a leak: it moves ~/.agami, and a subprocess re-resolved it from the real home regardless of what this process had patched.

Full changelog: https://github.com/AgamiAI/agami-core/blob/main/CHANGELOG.md

v0.9.4

Reconcile now asks agami the way a person does, and says plainly what happened.

run_golden_eval.py --via mcp serves the cold client agami's own MCP tools, so a row's answer comes from the surface a person uses rather than from a client with one pasted schema. The first query that does not run ends the question, because that failure is the finding, and the run writes agami's result itself, through execute_sql's guard, from the server's own record of the statement (#363).

A statement a person hands to reconcile now reaches the database only through that same guard: Phase 1.5 runs in check_statement.py instead of on a command-line tier, every execution and refusal is written down, and a crash reports its type without the database's own words (#374).

On the report: a card shows what agami answered, which a run read from a dashboard screenshot did not (#381); a row whose query never ran says so instead of reading an empty file as a result (#368); equal columns pair by name first and a column that mostly repeats one value no longer pairs with a different column like it (#369); and a table that matched only through one repeated value is marked unverified rather than kept (#375).

See CHANGELOG.md for the full list.

v0.9.3

A hosted execute_sql now requires proof the client looked at the datasource's examples: the call names an id get_prompt_examples returned and says whether it followed it or it was shown_only, or it is refused as example_required (#376, #377). Both are recorded on the tool call and shown in the activity view. Every refused statement also writes one line to the server log — rule, datasource, organization and audit id, never the statement or the caller (#371). Plus: a served deployment names only a datasource its organization has (#348), and a blank thread_id no longer satisfies the requirement (#349).

Anything calling execute_sql directly on a hosted server must send model_version (since 0.9.1) and, where the datasource stores examples, example. See CHANGELOG.md.

v0.9.2

An executor that connects as the person asking can now report a missing or unrenewable personal credential as its own failure kind, sign_in_required (exit code 11). The caller is told to sign in again and start a new conversation, instead of being told the database rejected the connection's credentials, and the execute_sql description tells the agent not to retry (#366). Additive: the built-in executor never raises it. See CHANGELOG.md.

v0.9.1

A hosted server now refuses a query written against a model that has since changed: execute_sql takes the model_version that get_datasource_schema returns, and a missing or out-of-date one is refused as stale_model. The live version itself is now reliable, with one dated row per datasource (#364, #365). Also: clearer rules on which columns may be queried (#360), and two reconcile/examples fixes (#359, #361). Anything that calls execute_sql directly on a hosted server must now pass model_version. See CHANGELOG.md.

v0.9.0

Reconcile takes the evidence a person brings and grades it part by part: four new sm verbs, a batch executor, and a comparator that pairs a column by agreement instead of calling it missing (#288 to #353). See CHANGELOG.md.

v0.8.8

Table and column scope identify a table by schema and name, and CTE names resolve against the WITH that encloses them (#332, #345). See CHANGELOG.md.

v0.8.7

Datasource routing and descriptions (#336, #343), per-organisation row cap and statement time limit (#334, #338, #342), and table schemas in the summary tier (#333). See CHANGELOG.md.

v0.8.6

Redshift dialect rules on the schema response (#325), execute_sql states the row cap and statement deadline (#326), and the activity log records the datasource a call ran against (#328). See CHANGELOG.md.

0.8.5 — golden runs get cheaper, and read a workbook

Golden runs get much cheaper, and a question bank can come straight from an Excel workbook.

• A golden run pays for the model's description once, not once per question (#308): the part of the context every question shares is sent as a cached system prompt, so a run no longer re-sends the whole model for each question. --effort low|medium|high|xhigh|max sets how hard the generator reasons, and the level is recorded with the run.
• The import door reads an Excel workbook (#312, closes #261): golden_author.py parse --file bank.xlsx --sheet <name> reads one sheet with the standard library alone. A title block above the header is fine, and a column that looks like SQL but isn't read is asked about rather than dropped — --column sql="<header>" reads it.
• A schema response says when a datasource has stored examples (#313), so clients stop skipping get_prompt_examples.
• A chain of joins is no longer reported as a chasm trap (#306).

See CHANGELOG.md.