Changelog

View Source

All notable changes to Erlang ADK are documented here. The project follows Semantic Versioning.

Versions 0.3.0 through 0.7.0 below are frozen delivery milestones in the development history; their presence does not claim that a package was published for each milestone. Version 0.9.0 is the current released version. The detailed evidence and remaining limitations are in the corresponding documents under docs/.

Unreleased

The following expanded v0.10.0 implementation is IN DEVELOPMENT. It is not a release record: merged-candidate validation is recorded below, while release approval, tagging, and publication remain pending.

Added

  • Strict ephemeral_local and durable_local runtime-service profiles plus adk_runtime_service_bundle, which owns session, sharded artifact, and sharded memory selection as one supervised, fail-stop generation and exposes validated service references and a Runner-ready option split. The ephemeral profile uses one shared ETS adapter per component with global quotas; the durable profile uses exact-scope filesystem/Mnesia workers with per-shard quotas and lease-protected, LRU-on-capacity idle reclamation. durable_local also atomically owns and health-checks a private Mnesia ingestion outbox, exposes its redacted service/status surface, and injects validated durable memory ingestion into the standard Runner path. Pending jobs survive bundle process restarts; stale or unhealthy service references fail closed. Deterministic registry hydration gates bounded rotating claims by exact adapter identity; a constant-row four-table sentinel provides health, and due/lease/erasure/terminal work is indexed and bounded. Majority mode requires at least two shared nodes. Epoch-bound job IDs preserve same-epoch idempotency while allowing post-erasure resubmission, and a hard active-plus-terminal reservation supports explicit migration/pruning. Nested options and adapter capabilities are strict, status is redacted, and legacy named APIs resolve the one durable bundle owner without a duplicate processor. Disabled and ephemeral_local configurations preserve the standalone-outbox path without creating a profile-owned outbox.
  • Reusable schema-v2 adk_agent_config compilation/loading for JSON and a strict YAML subset, with schema-1 compatibility, normalized cross-format snapshot-stable fingerprints and opaque registry lineage/revision provenance. Immutable-generation adk_config_registry snapshots now cover provider, MCP, OpenAPI, tool-pack, credential-profile, runtime-policy, workflow, and agent-template descriptors. adk_agent_composition resolves data-only references against the exact sealed snapshot and materializes bounded sub-agent trees, workflows, Runner policy, and opaque credential profile IDs. Agent names use the runtime identifier grammar, reserve user, and are limited to 256 bytes. Toolset references are capped at 64, duplicates are rejected, and one authenticated bulk lookup resolves the accepted list. Independently created non-empty registries have distinct instance IDs; every non-empty snapshot has a fresh revision. Neither ID is a descriptor-content digest, and the internal keyed content seal is never exposed.
  • Registry-only connector descriptors and strict manifests for permissions, side-effect class, confirmation policy, and concurrency safety, plus in-tree Google, GitHub, Slack, and Postgres connector packages. The packages require application-owned backends/credentials and are prepared for a future publication; they are not claimed as published packages. Their local Hex workflow includes a required post-build normalizer because rebar3_hex 7.1.0 omits the _checkouts/erlang_adk dependency from generated requirements. Only the normalized tarball, with non-optional erlang_adk ~> 0.10.0, is eligible for offline inspection or clean-extracted tests. It is not a publish input: rebar3_hex 7.1.0 rebuilds on hex publish. packages/build_connector_packages.sh is the sole offline all-connector release gate. Its package suites execute every advertised operation through the real registry, Agent Config, and adk_toolset path and assert the projected permission/side-effect/confirmation/concurrency policy metadata. All four connectors remain explicitly unpublished.
  • A GCS-compatible, exactly scoped immutable artifact adapter with bounded ranges and credit/ack upload/download; a durable metadata-only artifact effect journal; and a bounded lease-fenced orphan reconciler. Reconciliation deliberately requires an operator/backend-specific handler to decide whether an external effect committed, was compensated, or was not applied.
  • A bounded, killable embedding-provider boundary; a local volatile cosine and weighted lexical/vector ETS reference adapter; an opt-in fail-closed memory governance hook with a static consent/TTL/retention/legal-hold policy; durable erasure epochs shared by Mnesia memory and the ingestion outbox; and bounded terminal-outbox retention/pruning.
  • Explicit MCP 2025-11-25 legacy and 2026-07-28 modern protocol eras, including stateless per-request metadata, discovery/cache metadata, deterministic catalogs, modern input-required and subscription flows, credit-driven incremental SSE, RFC 9728/RFC 8414 discovery with S256 PKCE, a bounded owner-leased connection pool, and immutable atomic tool/resource/prompt catalog generations. Legacy GET/SSE remains opt-in compatibility behavior; the modern era does not reintroduce removed GET/replay semantics.
  • A supervised bounded adk_eval_service and adk_eval_store contract with immutable eval-set revisions, atomic set-plus-job creation, atomic job transitions, exact application scopes, named baselines, byte quotas, bounded default-safe pruning with explicit baseline cleanup, restart recovery, terminal-record quota headroom, and bounded ETS or local durable Mnesia adapters with strict schema/config checks and batched accounting repair. Backend-canonical store ownership, including across wrapper modules, prevents concurrent schedulers/recovery on one backend; ETS and Mnesia recovery are batched. Raw submissions are prepared in a hard-capped set of monitored timeout/heap-bounded workers outside the service mailbox.
  • First-party bounded evaluation metrics for latency, token cost, safety, and deterministic semantic similarity; persisted-score ensembles and threshold calibration; operator-selected user/environment simulators; confidence and longitudinal-regression helpers; a revision-safe human-review state machine; one canonical adk_eval_export renderer for JSON, Markdown, JUnit, SARIF, and annotations; a stored-result adk_eval_dev_api:report/5 API; an authenticated HTTP report route; adk eval report; a safe Developer UI authoring facade; and optional explicit-node RPC evaluation workers with owner-bound cancellation and no replay. Direct, API, HTTP, CLI, and existing eval-run report paths return the same canonical bytes under one 16 MiB default/hard report ceiling. dev_evaluation_report_max_bytes can lower the report-route ceiling; unrelated CLI responses stay at 1 MiB and Developer request bodies at 64 KiB.
  • A supervised bounded adk_trace_store for principal-isolated metadata-only observability and workflow lifecycle retention, cursor paging, explicit replay gaps, content rejection/pruning, and global/per-principal quotas, plus a fixed-principal observability exporter and an opaque best-effort workflow lifecycle receiver that preserves PID-receiver compatibility.
  • A bounded server-owned Developer UI graph catalog, metadata-only trace timelines and graph overlays, and evaluation authoring/history routes. A separate provider payload inspector is disabled by default and requires an explicit local-development opt-in; it is redacted, normalized, bounded, and short-lived rather than a production trace/audit store.
  • Runner-backed A2A 1.0 execution, callback-driven incremental client streams, extended Agent Cards, bounded ETS or local Mnesia task-snapshot stores, and push-notification configuration CRUD plus SSRF/DNS/HTTPS-bounded delivery. Push secrets and the drop-new delivery queue remain process-local.
  • Render/review-first deployment assets: an OTP/relx release, non-root read-only-root container contract, dependency-aware health and draining, Cloud Run and Helm/GKE manifests, explicit-apply CLI/scripts, and SBOM, scanning, signing, and provenance helpers. A bundled health-only HTTP profile serves /livez and /readyz on the platform-selected PORT while leaving agent/A2A/developer routes disabled. The container bounds inherited open-file limits before ERTS startup, and PID 1 owns one drain/forward/reap sequence with target-specific shutdown budgets.
  • A strict deployment OTLP environment bridge. ERLANG_ADK_OTLP_ENDPOINT explicitly activates a bounded metadata-only OTLP/HTTP JSON exporter; optional OTEL_EXPORTER_OTLP_HEADERS are ignored without that activation, parsed as bounded W3C-Baggage-style headers with optional-whitespace trimming and one strict value percent-decoding pass. Raw semicolons, malformed escapes, decoded invalid UTF-8, and case-insensitive duplicate names fail closed without reflecting values; headers are never accepted from agent data. The bridge forces batch size one; the HTTP/exporter bounds are 3/4 seconds, and the bus timeout must exceed the sum of all final exporter descriptor timeouts plus 250 ms. It includes the trace-store exporter before validating/auto-sizing an absent timeout and rejects an explicit undersized value. Standard configured Runner paths emit through the asynchronous observability bus even when local trace retention is disabled.
  • docs/VERSION_0_10_0.md, the in-development 0.10 contract and merged-candidate evidence ledger.

Changed

  • adk config validate now uses the reusable Agent Config compiler and reports schema version, registry generation, opaque registry instance/revision IDs, and configuration fingerprint. Direct module names in the tools field are disabled by default; trusted API callers must explicitly opt into that legacy path. Arbitrary adk_llm_* provider module names have a separate trusted opt-in and are also disabled by default; normal declarative configs use fixed/registry-backed provider IDs and registry-backed toolsets IDs.
  • adk_agent_config:current_schema_version/0 now returns 2. .yaml and .yml files use the strict YAML decoder; anchors, aliases, tags, directives, merge keys, multi-document input, non-JSON scalar behavior, and unbounded input are rejected instead of being interpreted.
  • adk serve --config now compiles before application startup and merges the agent's bounded Runner options into developer configuration. Trusted operator options win conflicts, while profile-owned service references stay authoritative.
  • erlang_adk:runtime_runner_spec/0, CLI run/console, the evaluation agent adapter, and developer HTTP setup now resolve an enabled application runtime profile. Its service references are authoritative, missing/mismatched enabled bundles fail closed, and console/evaluation cleanup uses the selected session backend.
  • Enabling the trace store now strictly configures and starts its observability bus/exporter, injects asynchronous metadata-only observability into the configured Runner paths, and supplies store-minted lifecycle receivers to the public start/run workflow facade. Direct Runner/workflow constructors remain explicit. Lifecycle delivery has atomic pending admission and drop accounting; paging and expiry pruning use ordered indexes and bounded batches. Receiver TTL now follows monitored local workflow owners, retaining authority for a quiet live workflow and returning to normal expiry after every owner exits.
  • Durable scope routers now carry one absolute deadline across admission, resolution, and handoff, and bind exactly-once operation leases to the caller and worker generation. Killed/timed-out callers cannot pin capacity or create a stale shard. Existing durable invocation-ledger Mnesia tables also fail closed unless their record schema, set type, majority, and local disc_copies durability match the configured contract.
  • Development application, OTLP instrumentation, package-verifier, and Phoenix path-dependency version surfaces now identify 0.10.0; this metadata bump does not mark the version as released.
  • The Cloud Run manifest now selects the built-in health-only relx config at /opt/erlang_adk/etc/health-http.sys.config and relies on Cloud Run to inject its reserved PORT. Helm selects the same profile only when its Service is enabled and no custom runtime config is present. A custom runtime ConfigMap must provide the exact sys.config key mounted at /opt/erlang_adk/etc/runtime/sys.config; it replaces, rather than augments, the built-in profile. These form three explicit modes: a closed base release, the packaged health-only release, and an application-owned runtime config.
  • The Cloud Run renderer now emits maxScale: "1" at both Service and revision scopes and accepts no other maximum. This is an autoscaling envelope, not a hard singleton lease or a promise that revisions cannot overlap during rollout.
  • The container entrypoint now validates ERLANG_ADK_NOFILE_CAP from 1024 through 1048576 (default 65536) and only lowers inherited soft/hard limits. Helm no longer adds a duplicate preStop drain; PID 1 performs the single drain and stays alive until BEAM exits. The default/Helm drain budget is 30 seconds within a 60-second grace period, while Cloud Run uses 3 seconds.
  • The read-only managed Agent Runtime feasibility probe now retrieves the bearer token exactly from a named environment variable, bounds and validates the RFC 6750 token shape, and passes its curl header through standard-input config rather than exposing the token as a process argument. This remains a feasibility boundary, not managed-runtime support or staging evidence.
  • Feature documentation now describes the 0.9 release as the existing base: artifacts and Runner-integrated memory, evaluation v2, stdio and Streamable HTTP MCP, Developer UI/Phoenix, A2A 1.0, and partial Agent Config were already present before the expanded 0.10 work.

Validation

  • Evidence refers to the named codex/version_0.10.0 working-tree candidate. Its HEAD, 78f31fd6b72295ebeb37cecbd7c11a6c5a666b34, is the v0.9 baseline; the v0.10 work remains uncommitted and is not a reproducible commit or tag. The changed-candidate aggregate passed 1,826/1,826 non-coverage EUnit and an independent 1,826/1,826 coverage EUnit run, 6 deterministic Common Test cases with 22 expected paid-provider skips, clean compile/xref, Dialyzer over 309 project files with 0 warnings, and 36,574/49,312 = 74.17% line coverage (12,738 missed; 83 covered lines over the exact floor). Escript, doctor, and checked config validation passed. README checks passed 30/30 plus 4/4, all three checked example modules compiled with -Werror, and ExDoc, local link/anchor/fence, root Hex/verifier/extracted compile, and diff gates passed. Root artifact hashes/freshness remain out of packaged documentation to avoid self-reference.
  • Focused durable-runtime validation passed 46/46 EUnit with compile, xref, and Dialyzer clean. Focused canonical evaluation-report parity and size-boundary validation passed 56 tests across direct, stored-result API, authenticated HTTP, existing eval-run, stdout, and file paths, including an approximately 1.4 MiB exact-parity report.
  • The sole offline connector wrapper passed all four packages: 12/12 source and 12/12 clean-extracted EUnit, including real registry/Agent Config/toolset execution for every advertised operation and policy projection. Warning- strict compilation, four normalized Hex archives with the exact non-optional erlang_adk ~> 0.10.0 requirement and no checkout leakage, and four docs archives passed. These are inspection artifacts, not publication inputs; all connectors remain unpublished.
  • The pinned official MCP Python/TypeScript 2.0.0 matrix passed modern 2026-07-28 and legacy-auto-fallback 2025-11-25 in all four cells. The pinned official A2A 1.0 JSON-RPC TCK passed 100 tests with 165 expected transport/capability skips and no failures/errors/xfail; its selected JSON-RPC surface was 94 passed plus seven inapplicable skips.
  • The Phoenix companion passed 107 ExUnit and 40 Node/browser-audio tests, production assets/release, and trusted-proxy plus CA-verified direct-TLS health smokes. The exact advisory verifier accepted only the two documented Cowlib advisories and Gun's duplicate response-splitting advisory. Live Hex registry access still failed with Unknown CA, so cached locked dependency success is not represented as a live-registry result.
  • The final local image erlang-adk:0.10.0-final built with fresh locked dependencies at OCI/index digest sha256:d74eb0a349d45692b5bb59e5ac7f1bbbe3710a59cd2e0be5301a179ce28f92d7. A constrained non-root/read-only-root 1 GiB direct smoke passed health-only routing, nofile 65536 for PID 1/BEAM, memory/OOM/restart checks, and graceful SIGTERM. A disposable Kind cluster passed closed/headless and service-enabled Helm rollouts, nondefault PORT=18081, health/404 routing, drain readiness/liveness behavior, and graceful pod recovery, then was deleted.
  • Complete aggregate Erlang, documentation/package, protocol, Phoenix, and deployment evidence is recorded in the in-development candidate ledger; these passing gates do not release 0.10.0.

Compatibility and known limitations

  • The 0.10 additions remain opt-in development APIs. They do not add a managed cloud product, visual/no-code builder, hosted evaluation control plane, durable/distributed trace backend, automatic instruction optimizer, or complete external MCP/A2A ecosystem.
  • The pinned external protocol gates are recorded narrowly. Official MCP Python 2.0.0 (6f69a3758ebf2ee55ce050f58b470ce11af71133) and TypeScript client 2.0.0 (cc4b41617ce3601b1290d67216ea0b194a3cd9ac) passed both modern 2026-07-28 and legacy-auto-fallback 2025-11-25 modes without waivers. The official A2A 1.0 TCK at 5996b79f9cefa6fc390980e383e358a66fb9e49e passed 100 tests with 165 expected transport/capability skips and no failures, errors, or expected failures; the selected JSON-RPC surface was 94 passed plus 7 inapplicable skips. These loopback fixtures do not prove arbitrary peers, HTTPS/IAM, or unselected A2A transports. No multi-node node-loss Common Test proves Mnesia/task/outbox recovery. Cloud Run/GKE staging, registry push, generated SBOM/Grype scan, Cosign sign/attest, verified provenance, and managed Agent Runtime gates remain separate and unclaimed.
  • The built-in deployment listener is health-only. A callable agent endpoint still requires a deployment-owned listener, authentication, TLS/proxy, ingress, and network policy. The Cloud Run template requests a one-instance maximum at both annotation scopes, but that is not a hard singleton guarantee; its writable storage is ephemeral, and no successful Cloud Run staging deployment is claimed.
  • Artifact effect recovery is not automatic inference: an operator-owned backend handler must provide idempotency, observation, and compensation policy. Memory governance hooks are opt-in and must be invoked by the owning application/adapter path; the local vector implementation is not a managed or distributed vector database.
  • Developer payload inspection is explicit development-only capture. Redaction is bounded defense in depth, not a general PII classifier. A2A push secrets and delivery jobs are process-local; queue saturation drops the new delivery, and restart does not guarantee webhook delivery.
  • This section must remain unreleased until the complete candidate gates in docs/RELEASING.md pass and the evidence ledger is populated from one reviewed revision.

0.9.0 - 2026-08-06

Added

  • Definition-bound workflow checkpoint schema v2 with a stable execution ID, ordered lineage, durable attempt/node/runnable/waiting/join/cycle/interruption state, optional portable definition revisions, and one-step v1 migration.
  • Ordered schema-v1 workflow lifecycle delivery through the opt-in lifecycle_receiver, separate from the legacy event receiver.
  • Checkpoint-resumable nested workflow pauses in parallel, loop, transfer, graph, and graph-fork execution, plus typed tool-confirmation pauses in every typed workflow shape.
  • Canonical graph validation and non-executable JSON inspection, deterministic DOT/Mermaid rendering, public inspection APIs, and adk graph validate, describe, and render commands.
  • Fork all, any, first_success, and quorum join policies; per-node input and output JSON Schemas; and per-key overwrite, append, sum, or conflict-rejecting state reducers.
  • A constrained keyless loopback policy for local OpenAI-compatible servers, with model-support recipes and explicit evidence tiers.
  • Native Vertex AI publisher-model GenerateContent/SSE with fixed authority derivation and bounded OAuth/Google ADC token acquisition.
  • docs/VERSION_0_9_0.md, the 0.9 release contract.

Changed

  • Agent generation features are checked against adapter capability declarations, and profile-selected Live capabilities cannot exceed the selected adapter's implementation ceiling.
  • Workflow retry attempt numbers survive checkpoints. An ambiguous in-flight attempt repeats at the same number after recovery rather than receiving a fresh retry budget.
  • Root and Phoenix locks now resolve Cowboy 2.18.0, Cowlib 2.19.0, Ranch 2.2.1, and Gun 2.4.1; the companion additionally resolves Bandit 1.12.4 and Plug.Crypto 2.2.0.
  • The application and OTLP instrumentation versions are now 0.9.0.

Security

  • Graph inspection omits executable callbacks, captures, tool arguments, nested options, credentials, and provider configuration.
  • Graph factory CLI lookup is limited to already available modules and exported zero-arity functions, avoiding unbounded atom creation from command input.
  • Keyless cleartext compatible endpoints are restricted to numeric IPv4/IPv6 loopback with auth none; existing HTTPS, verified-TLS, redirect, and private-address policy remains in force elsewhere.
  • Vertex profiles cannot expose OAuth tokens, ADC handles, arbitrary origins, headers, executables, or command arguments to public configuration.
  • Dependency upgrades remove Bandit EEF-CVE-2026-65623, Cowboy EEF-CVE-2026-65624, and Cowlib EEF-CVE-2026-59248 from the Phoenix audit. The exact-exception verifier now matches package/advisory pairs, so a new GHSA-only finding cannot hide behind the two documented unresolved Cowlib advisories.

Validation

  • Release validation compiled 242 production modules and 271 test modules with warnings treated as errors. All 1,495 EUnit tests and all 6 deterministic Common Test cases passed.
  • A fresh Dialyzer run completed with 0 warnings, and ./rebar3 xref reported 0 undefined or deprecated calls or functions. The passing aggregate includes the focused graph, durability, provider, model, and CLI regression suites.
  • The Phoenix companion passed 103 ExUnit and 40 browser/audio tests, production asset and release assembly, locked-dependency validation, and trusted-proxy plus verified direct-TLS health smokes.

Compatibility and known limitations

  • Checkpoint recovery and lifecycle delivery remain at least once, never exactly once for external effects. A v1 checkpoint is readable for migration and is rewritten as definition-bound v2 at its next commit.
  • There is no visual graph editor, arbitrary multi-node branch-region scheduler, automatic cross-vendor router, blanket 100+ model guarantee, or Agent Skills implementation.
  • Coverage, package, and optional paid-provider results were not recorded for this release; deterministic fixtures do not prove arbitrary Vertex or OpenAI-compatible deployments.

0.8.0 - 2026-07-17

Added

  • Operator-owned model provider profiles with bounded binary profile/model aliases, adapter and endpoint validation, structured HTTPS endpoints, secret-free capabilities, and credential sources resolved only at the trusted runtime boundary.
  • Generation-consistent profile/credential resolution using an opaque keyed snapshot, so a concurrent profile replacement cannot mix old authority with a new credential source.
  • A native OpenAI Responses adapter with bounded one-shot and incremental SSE generation, canonical multimodal content, function call IDs and parallel calls, structured output, and operator-owned organization/project/storage settings.
  • A native Anthropic Messages adapter with bounded one-shot and incremental SSE generation, canonical image/tool content, parallel tool blocks, operator-owned API versioning, and GA structured-output encoding.
  • A deliberately narrow OpenAI-compatible Chat Completions adapter with a trusted HTTPS endpoint, fixed operation path, bearer/x-api-key/keyless auth modes, bounded content/tool/SSE handling, and an explicit structured-output capability switch.
  • Shared model HTTP, Gun, header, and incremental SSE contracts with exact origin policy, verified TLS, deadline-bounded DNS, redirects disabled, private-address rejection by default, response limits, 64 KiB aggregate header/trailer block caps in both synchronous and streaming paths, and streaming flow control.
  • An OpenAI Realtime Live adapter, GA event codec, and fixed-origin verified- TLS Gun WebSocket transport for bidirectional text/audio/image, audio/text output, transcription, function calls/results, interruption, usage, and rate-limit events.
  • Provider-neutral ordered multi-frame Live actions and an explicit no-op action outcome, allowing one logical text/tool/manual-turn operation to be admitted atomically without interleaving or duplicate audio-buffer commits; once sending begins, a later priority action cannot splice into that batch.
  • Trusted Live input-rate status and voice format negotiation: Gemini uses 16 kHz PCM input and OpenAI Realtime uses 24 kHz, while the browser bridge continues to receive native 24 kHz PCM output.
  • docs/PROVIDER_PROFILES.md and the 0.8.0 release contract.

Changed

  • Binary provider IDs now select configured profiles; direct atom-module provider maps remain a trusted-code compatibility path.
  • New native OpenAI and Anthropic environment keys are accepted only at their exact official origins. A custom HTTPS origin requires a profile-resolved explicit credential, and an authenticated compatible endpoint never reads a process-wide ambient compatible key.
  • Profile callers may set only adapter-specific inference/runtime options. Model IDs, endpoints, credentials, arbitrary headers, auth/storage/billing settings, HTTP/Live transports, and audio rates remain operator-owned.
  • Anthropic max_tokens validation now enforces the provider-compatible minimum of one for both direct and profile-selected requests.
  • Phoenix browser capture waits for the server's input-format frame and resamples to the negotiated 16 or 24 kHz rate instead of assuming Gemini's 16 kHz input contract.
  • Source and test layout documentation now identifies the provider profile, shared transport, native OpenAI/Anthropic, compatible, and Realtime ownership directories.

Security

  • Credentials are absent from normalized profiles, public configuration, errors, transport state diagnostics, model-visible content, and browser frames. Literal profile sources project only their source type.
  • Custom endpoints are structured HTTPS configuration, not caller-provided URL strings; fixed adapter paths, host/scheme allowlists, DNS address policy, no redirects, and verified hostname/peer checks constrain credential delivery.
  • Live binary profiles cannot select a transport module, endpoint, model ID, credential handle, CA file, billing headers, or input sample rate.
  • Gun rejects an aggregate response-header or trailer block above 64 KiB in both synchronous and streaming paths, and Live preserves an in-flight multi-frame batch as one contiguous side-effect sequence even when a later priority action arrives.

Verification and known limitations

  • The 2026-07-17 deterministic release gates passed 1,414 EUnit tests, six Common Test cases, Dialyzer over 235 source modules with no warnings, 74.17% line coverage, 244/244 focused provider/profile/Realtime tests, 34/34 README and workflow tests, all three warning-as-error example compilations, and the xref/escript/doctor/configuration/documentation/package checks. Common Test intentionally skipped 22 opt-in paid cases in the deterministic command.
  • The seven-module post-audit repair regression set passed 67/67.
  • The Phoenix gate passed 103 ExUnit and 40 Node tests, production assets and release assembly, and both trusted-proxy and direct-TLS smokes. Raw Hex audit remained non-zero only for the two documented Cowlib advisories; the exact- exception verifier passed.
  • The paid Gemini REST attempt reached Google but did not produce a pass: the configured credential was rejected with HTTP 401 UNAUTHENTICATED / ACCESS_TOKEN_TYPE_UNSUPPORTED. No v0.8 paid Gemini Live pass is recorded. Focused REST header tests passed 29/29 and Live broker/transport tests passed 19/19; that deterministic evidence does not turn the remote credential failure into a pass, skip, or product regression.
  • No paid OpenAI Responses, OpenAI Realtime, Anthropic, or compatible-vendor result is claimed by deterministic fixtures.
  • Automatic routing/fallback, custom Live origins, OpenAI Realtime resumption, blanket compatible-vendor parity, browser WebRTC/direct-provider tokens, and distributed provider-profile rollout remain outside this release.

0.7.0 - 2026-07-15

Added

  • A separately supervised Gemini Live runtime for gemini-3.1-flash-live-preview, with text, PCM audio, image input, audio output, transcription, interruption, resumption, bounded credit, and explicitly allowlisted tool execution.
  • A transport-neutral, owner-bound browser voice protocol and one lightweight bridge process per connection. The protocol provides bounded ingress, binary framing, exact audio-event acknowledgement, interruption cleanup, reconnect fences, and ambiguous-outcome protection.
  • Runner-global plugins with ordered observation, amendment, explicit early return, bounded callbacks, supervised stateful instances, and reusable instruction, context-filter, logging, and reflect/retry plugins.
  • Evaluation schema v2 with full-case response and trajectory criteria, repeated samples, aggregate thresholds, baseline comparison, stable JSON/Markdown reports, an explicit bounded Gemini rubric judge, and adk eval run CI exit semantics.
  • Strict W3C Trace Context, metadata-first GenAI spans, bounded low-cardinality metrics, a supervised asynchronous export bus, Live telemetry, and an SDK-independent OTLP/HTTP JSON exporter.
  • Authenticated developer projections for Live sessions, evaluation reports, and observability snapshots.
  • A Phoenix Live operations view with server-owned session discovery, future-only Live delivery, realtime text, and a same-origin binary full-duplex voice socket backed by the Erlang bridge.
  • An explicit loopback-only Phoenix development identity, allowing local use without an external OIDC provider. It is available only in MIX_ENV=dev, binds to 127.0.0.1, and uses a CSRF-protected login POST.
  • A complete Phoenix presentation layer, AudioWorklet capture/resampling, bounded Web Audio playback, static asset checks, and a favicon route.
  • A reproducible EUnit plus Common Test coverage gate that discards stale exports, writes an HTML/per-module report, and enforces a 73% deterministic Erlang line-coverage floor in release validation.
  • Deterministic boundary coverage for OIDCC authorization/OAuth adapters, OpenAPI compilation and execution, Live transport/voice leases, evaluation agents and limits, JSON/OpenAPI schemas, trace context, and secret-safe failure classification.

Changed

  • REST generation continues to default to gemini-3.1-flash-lite; Live is a distinct protocol and requires the explicit gemini-3.1-flash-live-preview model.
  • A2A Agent Cards now derive their application version from the loaded erlang_adk application rather than retaining a hard-coded earlier release value. The A2A protocol version remains 1.0.
  • Phoenix local authentication no longer evaluates or requires OIDC_* configuration. Production configuration rejects local authentication.
  • Phoenix voice playback uses continuous bounded scheduling and defers each ADK audio acknowledgement until its corresponding browser audio has been admitted, preventing credit from outrunning playback.
  • Release validation now pins Node 24-native actions/checkout and actions/setup-node releases, eliminating the GitHub Actions Node 20 deprecation fallback while retaining immutable commit-SHA references.
  • Reorganized the production source tree into explicit agent, tool, workflow, Live, runtime, state, protocol, integration, auth, model, plugin, telemetry, and evaluation ownership directories. The src root now contains only the public facade and OTP application shell; Erlang module names, public APIs, and BEAM names are unchanged.
  • Reorganized Erlang tests and their dedicated helpers to mirror production ownership under a test-profile-only recursive test root. Explicit Common Test paths and documentation now follow the same hierarchy, while default builds and packages continue to contain production modules only.
  • Extracted canonical safety-setting validation into the provider-neutral model contract; Gemini retains provider-specific REST encoding.

Fixed

  • Corrected the local-login form's CSRF token handling and session rotation.
  • Corrected Live audio framing and multi-chunk byte preservation across the Erlang bridge, Phoenix socket, AudioWorklet, and playback path.
  • Added explicit interruption teardown so already scheduled browser audio is purged instead of playing stale model output.
  • Added a /favicon.ico redirect and packaged SVG favicon so a normal browser request no longer produces a router error.
  • Corrected stdio MCP initialization to use initialize_timeout rather than the shorter per-operation request_timeout, removing a startup race on loaded hosts while preserving bounded operation timeouts.

Security

  • Raised the production runtime baseline to OTP 27.3.4.14 / SSL 11.2.12.10 so outbound TLS clients include the fix for CVE-2026-54891.
  • Enforced IPv4/IPv6 loopback binding for the unauthenticated legacy /a2a/prompt listener; A2A v1 public-listener flags cannot weaken it.
  • Voice WebSocket handshakes are same-origin and authenticated; every frame revalidates the opaque server session, exact principal, scopes, and server-owned Live session.
  • Media, transcripts, credentials, provider handles, tool payloads, and thought signatures remain out of LiveView assigns and observability projections.
  • Phoenix LiveView is pinned to the official upstream fix commit for CVE-2026-58228 until a fixed Hex release at or above 1.2.7 is available.

Verification and known limitations

  • The 2026-07-16 deterministic gate on OTP 27.3.4.14 passed 1,176 EUnit tests, six Common Test cases, 73.88% aggregate Erlang line coverage against an enforced 73% floor, Dialyzer over 210 project files, escript packaging, adk doctor, checked configuration validation, 29 README tests, four workflow tests, 193 focused v0.7 tests, and both 1,000-operation stress suites.
  • The Phoenix gate on OTP 27.3.4.14 passed 101 ExUnit tests and 31 dependency-free browser audio tests, warnings-as-errors compilation, production assets, release assembly, and loopback health checks for trusted-proxy and verified direct TLS configurations.
  • The paid Live suite passed all five cases against gemini-3.1-flash-live-preview.
  • The paid REST suite passed 15 of 17 cases against gemini-3.1-flash-lite. Search grounding and context-cache creation each failed explicitly with HTTP 429 after one bounded retry; these are quota failures, not passing evidence.
  • mix hex.audit remains non-zero for two unresolved Cowlib 2.18.0 advisories. Reachability is reduced but the vulnerable routines remain in the dependency tree. See SECURITY.md.
  • Live subscribers receive future events only; a local CA-controlled Live WebSocket lifecycle harness remains open. A2A tasks, Phoenix web sessions, run lookup, and the reference Live gateway remain node-local.

0.6.0 - 2026-07-14

Added

  • Immutable provider profiles, strict OIDC/JWT validation, default-deny operation/resource authorization, opaque credential references, bounded single-flight token refresh, and supervised authorization-code flows with S256 PKCE.
  • Principal-bound MCP 2025-11-25 and A2A 1.0 protocol paths with bounded parsers, discovery, SSRF/redirect/token-forwarding policy, TLS policy, and canonical structural errors.
  • Issuer-bound run ownership and a same-BEAM Phoenix 1.8/LiveView companion with opaque server-side sessions, OIDC code+PKCE login, CSRF/origin/header policy, bounded rendering, typed human approval, production assets, and release assembly.

Limitations

  • The local /dev bearer remains single-operator developer administration, not production end-user identity.
  • A2A tasks and web/run state are node-local; A2A push notifications, distributed task storage, client streaming decode, and compound multi-credential requirements remain incomplete or adapter-owned.
  • The Cowlib advisories described for 0.7 were already visible in the Phoenix dependency tree and remain unresolved upstream.

0.5.0 - 2026-07-14

Added

  • Strictly scoped, immutable artifact versions with ETS and filesystem adapters, quotas, metadata pagination, repair, bounded inspection, and least-authority tool access.
  • App/user-scoped long-term memory contracts with lexical ETS and local Mnesia adapters, provenance, idempotency, retrieval, erasure, and a durable bounded outbox path.
  • Mandatory model-boundary context sanitation, complete-request budgets, exchange-aware selection, owner-bound compaction, fingerprints, and a provider-prefix-cache lifecycle.
  • Optional exact-scope sharded services so unrelated artifact, memory, and cache scopes can overlap in lightweight processes while preserving same-scope ordering.

Limitations

  • Durable object-store/vector-store/KMS integrations remain adapters.
  • Credit-based blob streaming, complete durable artifact orphan recovery, managed vector search, schema migration, and global cross-shard quota are not claimed.
  • Provider context caching is prefix reuse, not model-response caching.

0.4.0 - 2026-07-14

Added

  • Invocation-scoped delegated history, exact-session invocation lanes, bounded agent topology, and private cycle/depth ancestry checks.
  • Compiled tool catalogs, strict JSON Schema argument validation, explicit catalog drift, AgentTool isolation, confirmation, and bounded tool workers.
  • Supervised sequential, parallel, loop, collaborative, and graph workflows with deterministic state merge, budgets, checkpoints, and explicit failure behavior.

Limitations

  • Legacy direct prompts intentionally remain a stateful FIFO compatibility path.
  • Running agents do not receive automatic live tool-catalog swaps, and some nested workflow pause/resume shapes remain unsupported.

0.3.0 - 2026-07-14

Added

  • The OTP-native execution foundation: reusable agent admission processes, one supervised process per invocation, stable run IDs, deadlines, budgets, cancellation, event sequencing, replay, and exactly one terminal result.
  • Bounded concurrency and admission control for agents, sessions, workflows, tools, model calls, and ambient invocations.
  • Versioned JSON-safe events, ETS/Mnesia session services, state, pause/resume, callbacks, telemetry, plugins, evaluation, MCP, A2A, authenticated local developer tooling, CLI packaging, and an Erlang-hosted development UI.
  • Explicit process ownership and secret-isolation rules used by later releases.