Changelog

View Source

All notable changes to Erlang ADK are documented here. The project follows Semantic Versioning.

Versions 0.3.0 through 0.6.0 below are frozen delivery milestones in the development history; their presence does not claim that a package was published for each milestone. Version 0.7.0 is the cumulative release line. The detailed evidence and remaining limitations are in the corresponding documents under docs/.

The 0.7.0 and Unreleased references at the end of this file intentionally target the prospective v0.7.0 tag. They become usable only after the release checklist is approved and that tag is created; this candidate does not claim the tag or Hex package already exists.

Unreleased

No changes have been assigned to the next release.

0.7.0 - 2026-07-15

Added

  • A separately supervised Gemini Live runtime for gemini-3.1-flash-live-preview, with text, PCM audio, image input, audio output, transcription, interruption, resumption, bounded credit, and explicitly allowlisted tool execution.
  • A transport-neutral, owner-bound browser voice protocol and one lightweight bridge process per connection. The protocol provides bounded ingress, binary framing, exact audio-event acknowledgement, interruption cleanup, reconnect fences, and ambiguous-outcome protection.
  • Runner-global plugins with ordered observation, amendment, explicit early return, bounded callbacks, supervised stateful instances, and reusable instruction, context-filter, logging, and reflect/retry plugins.
  • Evaluation schema v2 with full-case response and trajectory criteria, repeated samples, aggregate thresholds, baseline comparison, stable JSON/Markdown reports, an explicit bounded Gemini rubric judge, and adk eval run CI exit semantics.
  • Strict W3C Trace Context, metadata-first GenAI spans, bounded low-cardinality metrics, a supervised asynchronous export bus, Live telemetry, and an SDK-independent OTLP/HTTP JSON exporter.
  • Authenticated developer projections for Live sessions, evaluation reports, and observability snapshots.
  • A Phoenix Live operations view with server-owned session discovery, future-only Live delivery, realtime text, and a same-origin binary full-duplex voice socket backed by the Erlang bridge.
  • An explicit loopback-only Phoenix development identity, allowing local use without an external OIDC provider. It is available only in MIX_ENV=dev, binds to 127.0.0.1, and uses a CSRF-protected login POST.
  • A complete Phoenix presentation layer, AudioWorklet capture/resampling, bounded Web Audio playback, static asset checks, and a favicon route.
  • A reproducible EUnit plus Common Test coverage gate that discards stale exports, writes an HTML/per-module report, and enforces a 73% deterministic Erlang line-coverage floor in release validation.
  • Deterministic boundary coverage for OIDCC authorization/OAuth adapters, OpenAPI compilation and execution, Live transport/voice leases, evaluation agents and limits, JSON/OpenAPI schemas, trace context, and secret-safe failure classification.

Changed

  • REST generation continues to default to gemini-3.1-flash-lite; Live is a distinct protocol and requires the explicit gemini-3.1-flash-live-preview model.
  • A2A Agent Cards now derive their application version from the loaded erlang_adk application rather than retaining a hard-coded earlier release value. The A2A protocol version remains 1.0.
  • Phoenix local authentication no longer evaluates or requires OIDC_* configuration. Production configuration rejects local authentication.
  • Phoenix voice playback uses continuous bounded scheduling and defers each ADK audio acknowledgement until its corresponding browser audio has been admitted, preventing credit from outrunning playback.
  • Release validation now pins Node 24-native actions/checkout and actions/setup-node releases, eliminating the GitHub Actions Node 20 deprecation fallback while retaining immutable commit-SHA references.
  • Reorganized the production source tree into explicit agent, tool, workflow, Live, runtime, state, protocol, integration, auth, model, plugin, telemetry, and evaluation ownership directories. The src root now contains only the public facade and OTP application shell; Erlang module names, public APIs, and BEAM names are unchanged.
  • Reorganized Erlang tests and their dedicated helpers to mirror production ownership under a test-profile-only recursive test root. Explicit Common Test paths and documentation now follow the same hierarchy, while default builds and packages continue to contain production modules only.
  • Extracted canonical safety-setting validation into the provider-neutral model contract; Gemini retains provider-specific REST encoding.

Fixed

  • Corrected the local-login form's CSRF token handling and session rotation.
  • Corrected Live audio framing and multi-chunk byte preservation across the Erlang bridge, Phoenix socket, AudioWorklet, and playback path.
  • Added explicit interruption teardown so already scheduled browser audio is purged instead of playing stale model output.
  • Added a /favicon.ico redirect and packaged SVG favicon so a normal browser request no longer produces a router error.
  • Corrected stdio MCP initialization to use initialize_timeout rather than the shorter per-operation request_timeout, removing a startup race on loaded hosts while preserving bounded operation timeouts.

Security

  • Raised the production runtime baseline to OTP 27.3.4.14 / SSL 11.2.12.10 so outbound TLS clients include the fix for CVE-2026-54891.
  • Enforced IPv4/IPv6 loopback binding for the unauthenticated legacy /a2a/prompt listener; A2A v1 public-listener flags cannot weaken it.
  • Voice WebSocket handshakes are same-origin and authenticated; every frame revalidates the opaque server session, exact principal, scopes, and server-owned Live session.
  • Media, transcripts, credentials, provider handles, tool payloads, and thought signatures remain out of LiveView assigns and observability projections.
  • Phoenix LiveView is pinned to the official upstream fix commit for CVE-2026-58228 until a fixed Hex release at or above 1.2.7 is available.

Verification and known limitations

  • The 2026-07-16 deterministic gate on OTP 27.3.4.14 passed 1,176 EUnit tests, six Common Test cases, 73.88% aggregate Erlang line coverage against an enforced 73% floor, Dialyzer over 210 project files, escript packaging, adk doctor, checked configuration validation, 29 README tests, four workflow tests, 193 focused v0.7 tests, and both 1,000-operation stress suites.
  • The Phoenix gate on OTP 27.3.4.14 passed 101 ExUnit tests and 31 dependency-free browser audio tests, warnings-as-errors compilation, production assets, release assembly, and loopback health checks for trusted-proxy and verified direct TLS configurations.
  • The paid Live suite passed all five cases against gemini-3.1-flash-live-preview.
  • The paid REST suite passed 15 of 17 cases against gemini-3.1-flash-lite. Search grounding and context-cache creation each failed explicitly with HTTP 429 after one bounded retry; these are quota failures, not passing evidence.
  • mix hex.audit remains non-zero for two unresolved Cowlib 2.18.0 advisories. Reachability is reduced but the vulnerable routines remain in the dependency tree. See SECURITY.md.
  • Live subscribers receive future events only; a local CA-controlled Live WebSocket lifecycle harness remains open. A2A tasks, Phoenix web sessions, run lookup, and the reference Live gateway remain node-local.

0.6.0 - 2026-07-14

Added

  • Immutable provider profiles, strict OIDC/JWT validation, default-deny operation/resource authorization, opaque credential references, bounded single-flight token refresh, and supervised authorization-code flows with S256 PKCE.
  • Principal-bound MCP 2025-11-25 and A2A 1.0 protocol paths with bounded parsers, discovery, SSRF/redirect/token-forwarding policy, TLS policy, and canonical structural errors.
  • Issuer-bound run ownership and a same-BEAM Phoenix 1.8/LiveView companion with opaque server-side sessions, OIDC code+PKCE login, CSRF/origin/header policy, bounded rendering, typed human approval, production assets, and release assembly.

Limitations

  • The local /dev bearer remains single-operator developer administration, not production end-user identity.
  • A2A tasks and web/run state are node-local; A2A push notifications, distributed task storage, client streaming decode, and compound multi-credential requirements remain incomplete or adapter-owned.
  • The Cowlib advisories described for 0.7 were already visible in the Phoenix dependency tree and remain unresolved upstream.

0.5.0 - 2026-07-14

Added

  • Strictly scoped, immutable artifact versions with ETS and filesystem adapters, quotas, metadata pagination, repair, bounded inspection, and least-authority tool access.
  • App/user-scoped long-term memory contracts with lexical ETS and local Mnesia adapters, provenance, idempotency, retrieval, erasure, and a durable bounded outbox path.
  • Mandatory model-boundary context sanitation, complete-request budgets, exchange-aware selection, owner-bound compaction, fingerprints, and a provider-prefix-cache lifecycle.
  • Optional exact-scope sharded services so unrelated artifact, memory, and cache scopes can overlap in lightweight processes while preserving same-scope ordering.

Limitations

  • Durable object-store/vector-store/KMS integrations remain adapters.
  • Credit-based blob streaming, complete durable artifact orphan recovery, managed vector search, schema migration, and global cross-shard quota are not claimed.
  • Provider context caching is prefix reuse, not model-response caching.

0.4.0 - 2026-07-14

Added

  • Invocation-scoped delegated history, exact-session invocation lanes, bounded agent topology, and private cycle/depth ancestry checks.
  • Compiled tool catalogs, strict JSON Schema argument validation, explicit catalog drift, AgentTool isolation, confirmation, and bounded tool workers.
  • Supervised sequential, parallel, loop, collaborative, and graph workflows with deterministic state merge, budgets, checkpoints, and explicit failure behavior.

Limitations

  • Legacy direct prompts intentionally remain a stateful FIFO compatibility path.
  • Running agents do not receive automatic live tool-catalog swaps, and some nested workflow pause/resume shapes remain unsupported.

0.3.0 - 2026-07-14

Added

  • The OTP-native execution foundation: reusable agent admission processes, one supervised process per invocation, stable run IDs, deadlines, budgets, cancellation, event sequencing, replay, and exactly one terminal result.
  • Bounded concurrency and admission control for agents, sessions, workflows, tools, model calls, and ambient invocations.
  • Versioned JSON-safe events, ETS/Mnesia session services, state, pause/resume, callbacks, telemetry, plugins, evaluation, MCP, A2A, authenticated local developer tooling, CLI packaging, and an Erlang-hosted development UI.
  • Explicit process ownership and secret-isolation rules used by later releases.