v0.4.0 — The Safety Net Update#77

Merged

michaelmcnees merged 24 commits into

mainfrom

feature/v040-safety-net

Mar 27, 2026

Commits on Mar 27, 2026

feat(config): add version field with validation (#52)

michaelmcnees
and
claude
committed
feat(config): rename tmp section to storage with deprecation fallback (#75)

michaelmcnees
and
claude
committed
feat(secrets): global key rotation with caller-managed transaction (#51)

michaelmcnees
and
claude
committed
feat(db): add migration 016 for v0.4.0 safety net features
michaelmcnees
committed
feat(workflow): add concurrency fields, hooks schema, and validation (#49, #30)

michaelmcnees
and
claude
committed
feat(engine): concurrency controls with advisory locks and queue promotion (#49)

michaelmcnees
and
claude
committed
feat(cel): add hooks and execution variables to CEL environment (#30)

michaelmcnees
and
claude
committed
feat(engine): lifecycle hooks — on_success, on_failure, on_finish (#30)

michaelmcnees
and
claude
committed
feat(engine): promote queued executions after hooks complete (#49, #30)
michaelmcnees
committed
feat(cli): mantle retry — resume from failed step (#48)

michaelmcnees
and
claude
committed
feat(cli): mantle rollback — revert workflow to previous version (#50)

michaelmcnees
and
claude
committed
docs: document v0.4.0 features — hooks, concurrency, retry, rollback

michaelmcnees
and
claude
committed
fix: address code review findings — transactions, validation, indexes

michaelmcnees
and
claude
committed
fix: use fresh context for queue promotion after timeout (security review)
michaelmcnees
committed
fix: wire concurrency limits into execution path (architecture review)
michaelmcnees
committed
fix: store unprefixed hook step names with proper unique constraint

michaelmcnees
and
claude
committed
test: add unit tests for concurrency, hooks, and retry engine logic

michaelmcnees
and
claude
committed
fix: add stderr warning before printing sensitive key material
michaelmcnees
committed
fix: secure key rotation — no argv exposure, tx-backed audit, advisory lock (PR review)

michaelmcnees
and
claude
committed
fix: atomic concurrency check+insert, audit on promotion (PR review)

michaelmcnees
and
claude
committed
fix: hooks hardening, migration fixes, validation, security improvements (PR review)

michaelmcnees
and
claude
committed
fix: PR review round 2 — config semantics, exit codes, audit, security, validation

michaelmcnees
and
claude
committed
fix: JSON encode errors, encrypt under lock, docs accuracy (PR review round 3)
michaelmcnees
committed
fix: match rollback error example to actual code output
michaelmcnees
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

v0.4.0 — The Safety Net Update#77

v0.4.0 — The Safety Net Update#77
michaelmcnees merged 24 commits into
mainfrom
feature/v040-safety-net

Commits on Mar 27, 2026

feat(config): add version field with validation (#52)

feat(config): rename tmp section to storage with deprecation fallback (#75)

feat(secrets): global key rotation with caller-managed transaction (#51)

feat(db): add migration 016 for v0.4.0 safety net features

feat(workflow): add concurrency fields, hooks schema, and validation (#49, #30)

feat(engine): concurrency controls with advisory locks and queue promotion (#49)

feat(cel): add hooks and execution variables to CEL environment (#30)

feat(engine): lifecycle hooks — on_success, on_failure, on_finish (#30)

feat(engine): promote queued executions after hooks complete (#49, #30)

feat(cli): mantle retry — resume from failed step (#48)

feat(cli): mantle rollback — revert workflow to previous version (#50)

docs: document v0.4.0 features — hooks, concurrency, retry, rollback

fix: address code review findings — transactions, validation, indexes

fix: use fresh context for queue promotion after timeout (security review)

fix: wire concurrency limits into execution path (architecture review)

fix: store unprefixed hook step names with proper unique constraint

test: add unit tests for concurrency, hooks, and retry engine logic

fix: add stderr warning before printing sensitive key material

fix: secure key rotation — no argv exposure, tx-backed audit, advisory lock (PR review)

fix: atomic concurrency check+insert, audit on promotion (PR review)

fix: hooks hardening, migration fixes, validation, security improvements (PR review)

fix: PR review round 2 — config semantics, exit codes, audit, security, validation

fix: JSON encode errors, encrypt under lock, docs accuracy (PR review round 3)

fix: match rollback error example to actual code output