orxtra v0.13.0 /Changelog
On this page

#Changelog

#Unreleased

#Features

  • [scheduler, services, session] Custom model pricing. Declare per-model token rates in the run config ([pricing."provider/model"]) to price custom or self-hosted models; config rates override the built-in table, and unknown models still error.

#Fixes

  • [., cli] CLI no longer crashes on startup. The orxtra command resolved its version from an unpublished distribution name, raising PackageNotFoundError at import and breaking every invocation of the installed package. It now resolves from the published orxtra distribution.
  • [.] Missing runtime dependencies declared. The published package omitted strictspec and pydantic-monty from its dependencies, so importing agent category generation or the Monty data tool failed with ModuleNotFoundError. Both are now declared and installed automatically.
  • [., cli, services, trace] orxtra db init and orxtra db verify now work from an installed package (previously crashed with ModuleNotFoundError); db verify no longer reports spurious missing objects on a fully-initialized schema

#0.13.0

PostgreSQL 18 is now the minimum and every command declares its effect under strictcli 0.36.0.

Context

Two breaking changes land together in this release.

strictcli 0.36.0 makes effect classification mandatory, so every orxtra command now declares whether it is read-only or mutating. The visible consequence is orxtra db migrate apply, which is classified consequential and prompts for confirmation before it runs; pass --approve-consequential to skip the prompt. --dry-run, --quiet and --verbose became framework flags and are accepted anywhere in the command line, and orxtra db init --use-extension-stub is gone along with the stub it enabled.

PostgreSQL 18 becomes the minimum server version. Primary keys now use the server's built-in uuidv7(), which retires the pg_uuidv7 extension and its development stub entirely. orxtra db init against a pre-18 server fails loudly rather than silently degrading. Two regressions surfaced by that bump are fixed here: PG 18 changed the SQLSTATE for an ON DELETE RESTRICT violation, which had been leaking a raw driver exception instead of PrincipalInUseError when deleting a principal that anchors history, and dispatch and trace writes that still named the old extension function now work again. Separately, orxtra validate and orxtra event fire no longer crash while reading the quiet setting.

The published wheel now declares strictcli>=0.36.0 so the effect-classification requirement is enforced at install time rather than discovered at runtime.

#Breaking

  • [api, cli, worker] strictcli 0.36.0. Every orxtra command now declares its effect (read-only or mutating). orxtra db migrate apply asks for confirmation before it runs; pass --approve-consequential to skip the prompt. --dry-run, --quiet and --verbose are framework flags now and work anywhere in the command line, and orxtra db init --use-extension-stub is gone.
  • [., services] PostgreSQL 18 is now the minimum. Primary keys use the server's built-in uuidv7(); the pg_uuidv7 extension and its development stub are gone. Running orxtra db init against a pre-18 server fails loudly instead of degrading.

#Fixes

  • [., dispatch, identity, trace] Deleting a principal that anchors history reports the right error again on PostgreSQL 18. PG 18 changed the SQLSTATE for an ON DELETE RESTRICT violation, which leaked a raw driver exception instead of PrincipalInUseError. Dispatch and trace writes that named the old extension function also work again.
  • [., cli, identity] **orxtra validate and orxtra event fire no longer crash reading the quiet setting.**

#0.12.0

Unified delivery and notifications, live worker WebSocket endpoint, AG-UI live streaming, strictspec validation gate, and a published documentation site.

Context

This release carries the content originally cut as v0.11.0 together with the strictspec validation gate and the documentation build-out.

v0.11.0 was cut under the pre-CI-gate release flow and could never pass the modern publish gate: CI cannot run retroactively on a stale release commit, so that version had no path to publication. Rather than attempt to resurrect it, its content ships here as 0.12.0 under the modern flow, which pushes the branch, verifies CI, and only then finalizes and tags.

v0.11.0 remains a sealed, never-published version: its tag and its finalized changelog stay as historical record and are not reused.

#Breaking

  • [api, cli, worker] Breaking: strictcli v0.29.0 migration. All CLI command handlers now receive ctx as first parameter. App constructor includes explicit version=.
  • [., a2a, agent, overseer, scheduler, services, tool] **Breaking: spec documents now require an integer format_version and are hard-error validated by strictspec.** Workflow, agent, categories, skill, data-tool, knowledge, and run-config TOML files are validated against generated strictspec schemas at their load boundary; unknown keys, wrong types, missing required fields, bad enum arms, and invalid execution-mode/routing/discriminator combinations are now hard errors at load. Every such document must carry format_version = 1 at the top level -- stamp existing files (e.g. strictspec migrate --to 1 <paths>, or add the key by hand) to upgrade.

#Features

  • [.] Documentation site build-out. New long-form guides: getting started, concepts, architecture, configuration reference, deployment, and security model. Generated API reference pages are now published for the protocols, transport, trace, tool, scheduler, services, dispatch, overseer, auth, cli, and worker packages.
  • [api, cli, worker] Clearer CLI help text. Command groups, commands, flags, and positional arguments across the orxtra, orxtra-api, and orxtra-worker CLIs now carry descriptive help text explaining what each does, replacing terse one-liners.

#0.11.0

#Breaking

  • [protocols] Breaking. TaskSpec.remote: bool replaced by execution_target: str | None -- workflow specs using remote = true must switch to execution_target.
  • [api, auth, worker] Breaking. WebSocket connections now require authentication (code 4001 on failure). WorkerInfo.consumer_id changed from str to UUID | None.
  • [dispatch, protocols] Breaking. FilterPredicate gains principal_id field (AND-combined with other predicates). Existing serialized subscriptions gain null default.
  • [services] Breaking. create_principal gains required notification_event_types parameter for consumer kinds -- callers must pass event type lists.
  • [protocols, scheduler, worker] Breaking. WorkerRegistration.capabilities typed as ToolCapability enum -- string capabilities no longer accepted.

#Features

  • [cli, dispatch, protocols, services] NotifyAction. Fifth dispatch action type; subscriptions can deliver notifications to target principals.
  • [services] Self-subscriptions. Consumer principals created with notification_event_types get automatic notification subscriptions (preferences as subscription filters).
  • [api, notification] Principal notification SSE endpoint (GET /notifications/stream) with catch-up replay, LISTEN/NOTIFY push, SYSTEM-tier override.
  • [api, services] Notification CRUD capabilities (list_deliveries, acknowledge_delivery) behind notifications:read/notifications:manage scopes.
  • [api, protocols, scheduler, services, worker] ToolLocation routing. LOCAL/ANYWHERE traits on tools, ToolCapability enum, should_route_to_worker composition function, execution_target on TaskSpec.
  • [api, worker] Worker WebSocket endpoint live. Authenticated connection, WorkerRegistry, BrainWorkerBridge, tool routing for remote execution.
  • [agui, api, scheduler, services, session] AG-UI live streaming. RunManager, runtime sink injection via subscribe_run, enriched StateSnapshotEvent for late-joiners and completed runs.
  • [., api, auth, notification, protocols, services] Notification module (Foundation layer) with PG and in-memory backends implementing NotificationPort.
  • [., api, mcp] Explicit MCP transport security via mcp_allowed_hosts configuration.
  • [., identity, protocols, services] Orphan principal sweep. Automatic cleanup of run principals from crashed creations, invoked during start_run.
  • [., dispatch, overseer, trace] Inbox expiry. Bulk expire_due_inbox_items operation, sweep tick in dispatch worker poll loop, deadline wired through create_inbox_item tool.
  • [dispatch, scheduler] Dispatch worker consolidation. Deleted DualPhaseEventDelivery, wired accumulator buffering into DispatchWorker poll loop.

#0.10.1

Restore the Root Tests lint job to green by fixing ruff violations in scheduler and overseer.

Context

Infrastructure-only release (no user-facing changes), hence the hotfix bump.

The v0.10.0 Root Tests CI lint job was red on four ruff violations: three PLC0414 re-export aliases (scheduler/overseer importing protocol types via the import X as X idiom) and one N806 uppercase local. The re-exports were rewired to import shared types from their canonical home (orxtra.protocols), eliminating the alias idiom without any per-file lint suppression and keeping mypy --strict clean; the local was renamed. Root Tests now passes repo-wide.

Two further CI issues investigated during this release are upstream rlsbl template defects, not orxtra-fixable, and are reported separately for the tool maintainers: (1) the CI Router per-package jobs fail because members are not independently testable under pytest rootdir confinement, and (2) the monorepo publish workflow has no CI gate because rlsbl's inline publish-router generator self-excludes the single root publisher, so no gated router is emitted.

#Infrastructure

  • Restore the Root Tests lint job to green by fixing ruff violations in scheduler and overseer.

#0.10.0

Unified identity model: every actor gets a durable principal, every action names its actor, and dispatch enforces authentication structurally.

Context

Identity used to be computed at the edge and thrown away: an authenticated request produced an ephemeral auth context that never became a persisted, referenceable actor. Mutations could happen anonymously, ownership was tied to orchestration runs alone, and events recorded a free-text source that no foreign key could vouch for -- actions were fundamentally unattributable.

This release makes identity first-class. A new principals table gives every actor -- runs, consumers, sources, the system, and app-registered kinds -- a durable identity minted at birth. Every event names its acting principal via a NOT NULL foreign key, subscriptions are owned by principals (cascading on deletion), and the ephemeral Principal auth type is renamed AuthContext to end the overload. Enforcement is structural, not advisory: every capability declares a required scope, and the single dispatch choke point rejects any call whose authenticated context lacks it -- MCP and A2A now sit behind the auth wall, and an API served without an authenticator exposes public surfaces only.

#Breaking

  • [auth, protocols] **Principal renamed to AuthContext.** The ephemeral per-request auth type is now AuthContext; consumer_id is widened to UUID | None. Update imports and type references.
  • [a2a, api, auth, cli, incoming, mcp, protocols, services] MCP and A2A endpoints now require authentication. Every capability dispatch requires an authenticated context carrying the capability declared scope, drawn from a new scope vocabulary covering all namespaces. An API served without an authenticator exposes public surfaces only (such as agent-card discovery).
  • [., api, cli, dispatch, incoming, overseer, scheduler, services, trace] **events.source replaced by events.principal_id.** Every event names its acting principal via a NOT NULL foreign key; the NOTIFY payload and event query filters use principal_id instead of the free-text source. The idempotent-write dedup path on PostgreSQL now returns the existing persisted event id instead of a non-existent one.
  • [., dispatch, protocols, services] Subscriptions are owned by principals. subscriptions.owner_run_id is removed; ownership is a principal_id FK that cascades on owner deletion. SubscribeParams drops owner_run_id, and list_subscriptions gains a principal filter.
  • [., overseer, scheduler, services, trace] Attribution parameters added to write paths. write_event, create_run, and the inbox writers changed signatures to carry principal attribution, and create_run now takes a caller-supplied run_id.
  • [., agui, api, incoming, worker] CORS wildcard-with-credentials is rejected. The API compositor requires an explicit origin allowlist or no CORS; a * origin combined with credentials is refused.
  • [mcp] Legacy MCP stdio transport removed. The MCP server is served over HTTP with per-request identity; the stdio path is gone.

#Features

  • [., api, auth, cli, dispatch, identity, incoming, protocols, services, trace] Unified identity model. A new principals table gives every actor -- runs, consumers, sources, the system, and app-registered kinds -- a durable identity minted at birth. Runs, sources, and consumers record their creator (runs.created_by, sources.created_by, consumers.principal_id, inbox resolved_by); principal CRUD is exposed as capabilities gated by principals:read/principals:manage; and deletion pins historical actors, raising PrincipalInUseError when references remain.
  • [agui, api] AG-UI per-run access control. The AG-UI SSE stream is restricted to the run creator or an operator.

#Fixes

  • [mcp] MCP tools expose real parameter schemas. FastMCP-served tools previously advertised a broken kwargs-envelope schema; they now serve each capability actual parameter schema and validate input strictly.
  • [mcp] MCP tools with tuple returns no longer crash. Tool results that return a tuple (such as fire_event) now serialize correctly instead of crashing after the side effect ran.
  • [trace] Inbox reads work against PostgreSQL. Inbox item options and tags are decoded via a jsonb codec, fixing reads that failed against a real PostgreSQL backend.
  • [., trace] Crash-recovery events are attributed to the system principal. Recovery-generated events no longer violate the new NOT NULL event attribution.
  • [., api] Mounted sub-app session managers initialize on startup. The composited application lifespan now forwards through to mounted sub-apps (requires fastware >= 0.5.0), so their session managers start correctly.
  • [transport] Streaming token usage is reported for Anthropic and OpenAI providers. Streamed responses now surface input and output token usage instead of dropping it.

#0.9.0

Data-defined tools, compose engine, event-bus dispatcher, and database provisioning CLI.

Context

Six new sub-projects (auth, compose, dispatch, incoming, a2ui, agui) and major rework of existing ones. Exec/shell tool configs replaced by declarative [[tools.define]] with three execution engines (http, monty, command). Prompt composition unified under the compose engine with template-based fragment providers. Event-bus connected end-to-end with a dispatcher worker, webhook receiver, and capability-keyed HMAC auth. The db command group provides init, verify, and migrate subcommands. Schema generation adopted from pgdesign with faceted codegen output.

#Breaking

  • [agent] Breaking. Replace ExecToolConfig/ShellConfig with InlineToolDefinition and [[tools.define]] TOML parsing.
  • [., scheduler, tool, worker] Breaking. Delete make_exec_tool/make_shell_tool constructors and CONSULT_STRIP_TOOLS/FILE_MUTATION_TOOLS name-sets. Consult stripping and mutation tracking now use tag-based logic. Agent [[exec]]/[shell] sections replaced by [[tools.define]] inline definitions.

#Features

  • [cli] New command group. orxtra db with init, verify, and migrate (plan/apply/status) subcommands for database provisioning and migration.

#0.8.0

Five new sub-projects (worker, api, auth, a2a, a2ui), AG-UI protocol support, MCP SDK adoption, a capability registry unifying the MCP/CLI surfaces, and an EventSink backbone across session, scheduler, and trace.

Context

This release ships the interface and remote-execution layers built since 0.7.0. The protocol surfaces (MCP, A2A, AG-UI) are composed by the new api sub-project into a single ASGI app served via orxtra serve, backed by the new auth sub-project. The worker sub-project adds sandboxed remote tool execution (native and Docker). Internally, ad-hoc event callbacks were replaced by a typed EventSink backbone, which required renaming transport's Event union to TransportEvent and removing event_callback. It is also the first release resolving fastware from PyPI (0.2.0) instead of a machine-local path, unblocking installs and CI outside the author's machine.

#Breaking

  • [., scheduler, session, trace, transport] Transport's Event union is renamed to TransportEvent, and the event_callback hook is removed in favor of TraceSink implementing EventSink.

#Features

  • [., cli, protocols, worker] Worker sub-project. Sandboxed remote tool execution: a brain-worker protocol, a native worker with build_worker_tools and a CLI entry point (new worker connect/worker docker commands), a Docker worker for containerized execution, a worker registry with one-per-root enforcement, and a pipeline split so tools can execute remotely (TaskSpec gains a remote field).
  • [., api, cli] HTTP compositor. New api sub-project that mounts MCP, A2A, AG-UI, and native routes on a single ASGI app with graceful startup/shutdown, plus a new orxtra serve CLI command to run it.
  • [., agui] AG-UI protocol support. New agui sub-project: event translation sinks, an SSE endpoint, and state snapshots with RFC 6902 deltas.
  • [a2a] A2A protocol support. New a2a sub-project: Agent Card generation from the capability registry, a skill registry with TOML loading and auto-generation, a task state bridge, and a JSON-RPC server with an ASGI app factory.
  • [., a2ui] A2UI support. New a2ui sub-project: surface registry, engine, and fragments; standard surface templates with a default registry; and overseer surface tools (render_surface, compose_surface).
  • [., auth, dispatch, protocols, services] Auth sub-project. Authentication and authorization: backend protocol with in-memory implementation, authenticator and authorizer, and ASGI auth middleware. Dispatch Source now references a credential_id instead of carrying auth_method/auth_config.
  • [mcp] MCP server upgrade. The MCP server now builds on the official MCP SDK, registers tools with annotations and resources, offers a streamable HTTP transport factory, and emits notifications via McpNotificationSink.
  • [cli, mcp, services] Capability registry. Service functions are described once as capabilities with Pydantic params models; the MCP and CLI surfaces are now projections of that single registry through a generic dispatcher.
  • [protocols] New shared protocol types. EventSink[T] generic protocol, TrustTier enum and Principal dataclass, A2UI surface types, Capability frozen dataclass, and SurfaceGenerator/CardContributor contracts.
  • [., scheduler, session, trace, transport] Event sink backbone. Session emits transport events and the scheduler emits overseer events through EventSink; ToolExecuting and ToolUse events now carry a tool_use_id.

#Fixes

  • [., worker] Dependency installation no longer requires a machine-local checkout: uv.lock previously carried a local path for fastware, breaking installs and CI outside the author's machine. It now resolves from PyPI (fastware 0.1.0, strictcli upgraded to 0.24.0).
  • [services] db_url redaction now also redacts passwords passed as query parameters and preserves the netloc verbatim.
  • [services] Credentials are now redacted from the run config snapshot before it is persisted.
  • [scheduler] The scheduler now closes the LLM session after orchestrator tasks, fixing a connection leak.
  • [cli] The CLI's --quiet flag is now optional and defaults to off, instead of being required on every invocation.
  • [.] Bundled example TOML files are updated to the current agent/workflow loader formats (they previously failed to load), with a loading regression test.

#0.7.0

PgDispatchBackend, source CRUD, sync wrapper hardening, protocol consolidation

#Breaking

  • [mcp] MCP no longer depends on orxtra-trace. MCPServer now requires EventBus injection instead of importing trace directly.
  • [dispatch, protocols, services, trace] ActionExecutor, DispatchBackend, and EventBus protocols moved to orxtra-protocols. Import paths changed from orxtra.dispatch and orxtra.scheduler to orxtra.protocols.

#Features

  • [dispatch] PgDispatchBackend. Full asyncpg-backed dispatch storage with subscription, source, and accumulator persistence.
  • [dispatch, protocols, services] Source CRUD. Register, query, and delete event sources with SourceStorage protocol and InMemoryDispatchBackend implementation.
  • [protocols, services, session] run_sync utility. Event-loop-aware sync wrappers that safely handle nested event loops, replacing raw asyncio.run() calls.
  • [dispatch, protocols] EventDelivery.fire() gains source parameter for tracking event origin.

#0.6.0

Dispatch module, event bus enhancements, protocols reorganization

Context

Major architectural changes: new dispatch module for event delivery with subscriptions, action dispatch, and accumulator flush. Event bus enhanced with nullable run_id, source column, replay(), fire_blocking(), and event_stream(). Protocols reorganized into internal _types/ package. Scheduler migrated from EventRegistry to dispatch's TransientEventDelivery. Services promoted to composition layer owning dispatch integration.

#Breaking

  • [scheduler] Scheduler migrated to dispatch. EventRegistry removed from public API, replaced by dispatch module's TransientEventDelivery. Bridge-to-events pattern removed in favor of direct dispatch subscriptions.
  • [services] Services promoted to composition layer. Services now owns dispatch integration (subscribe, unsubscribe, list_subscriptions), AsyncioFlushScheduler, and ServicesActionExecutor.

#Features

  • [protocols, scheduler] EventDelivery protocol. Clean abstraction for event delivery, injected into Scheduler.
  • [overseer, scheduler, services, trace] Event bus enhancements. Nullable run_id for system-level events, source column for event provenance, replay() for cursor-based pagination, fire_blocking() for synchronous delivery, event_stream() async generator.
  • [protocols] Action type hierarchy and FlushScheduler protocol. Typed Action union (CreateTask, CreateWorkflow, AddConstraint, etc.) and FlushScheduler protocol for accumulator-driven dispatch.
  • [dispatch] Dispatch module. New event delivery system with subscriptions, action dispatch, and accumulator flush. Includes TransientEventDelivery (in-memory), InMemoryDispatchBackend, dual-phase delivery, persistent subscriptions, and action executor with typed Action dispatch.

#0.5.0

Tool namespaces, capability tags, registry-based construction, deferred loading, and prepare_event protocol.

Context

Tools gain hierarchical namespaces (fs.read, fs.write, git, task.lifecycle, etc.) and capability tags (readonly, mutation, lifecycle, suspending). Allow lists support wildcards (fs.*) and tag filters (#readonly). ToolRegistry replaces the 207-line if/elif chain with data-driven construction. load_tools meta-tool enables on-demand schema loading with provider-aware deferred specs (Anthropic defer_loading, OpenAI empty params, Gemini parameterless). All 26 tools now use the @tool decorator. OverseerProtocol gains prepare_event replacing handle_event for clean message formatting. Session.update_tools() enables dynamic tool sets.

#Features

  • [overseer, protocols, scheduler] New feature. prepare_event(event) -> str replaces handle_event on OverseerProtocol. Separates message formatting from session interaction.
  • [scheduler, tool] New feature. All 26 tools now use the @tool decorator. Shell, consult, http (two modes), and exec converted. validate_args and jsonschema removed from tool module.
  • [protocols, tool] New feature. namespace and tags fields on Tool. All 26 tools tagged with hierarchical namespaces (fs.read, fs.write, git, task.lifecycle, etc.) and capability tags (readonly, mutation, lifecycle, suspending).
  • [scheduler] New feature. ToolRegistry for data-driven tool construction. Allow lists support namespace wildcards (fs.*) and tag filters (#readonly). Replaces 207-line if/elif chain.
  • [protocols, session, tool, transport] New feature. load_tools meta-tool for on-demand schema loading. Provider-aware deferred tools: Anthropic defer_loading, OpenAI empty params, Gemini parameterless. Session.update_tools() for dynamic tool sets.

#Fixes

  • [scheduler, tool] Bug fix. multi_edit tool now reachable via allow lists and correctly tracked as file mutation.

#0.4.0

@tool decorator, layer violation fix, knowledge hash persistence, CI fixes, and type cleanup.

Context

Introduced @tool decorator with ToolTemplate[T].bind() for typed tool definitions. All 22 decorator-eligible tools migrated, 4 factory tools updated with Pydantic input schemas. OverseerProtocol and HealthMonitorProtocol added to protocols, removing the scheduler->overseer layer violation. Knowledge file hashes persisted via StorageBackend. StatResult and GlobResult replace union types and DirListing misuse. Pipeline suspending flag bug fixed. Dead escalation handler removed. CI fixes for transport, overseer prompts, schema, and pytest.

#Features

  • [overseer, protocols, scheduler] New feature. OverseerProtocol and HealthMonitorProtocol in protocols. Scheduler no longer depends on the overseer module.
  • [protocols, tool] New feature. StatResult and GlobResult types replace union returns and misused DirListing.
  • [overseer, trace] New feature. Knowledge file hashes persisted via StorageBackend. Eliminates redundant re-loading on restart.
  • [tool] New feature. @tool decorator with ToolTemplate[T].bind() for typed tool definitions. 22 tools migrated. Pydantic input models for all tools.
  • [tool] New feature. Remaining tools migrated to Pydantic input schemas. Factory tools (exec, shell, http, consult) use model_json_schema().

#Fixes

  • [tool] Bug fix. Pipeline wrapping now preserves the suspending flag on tools.
  • [scheduler] Bug fix. Removed dead _fixed_escalation_ladder fallback handler.
  • [overseer, services, verify] Bug fix. Fixed conftest imports for pytest importlib mode compatibility across overseer, services, and verify tests.

#0.3.0

Typed tool returns, storage abstraction, headless mode, streaming always-on, and 15 new features.

Context

Major architectural overhaul spanning 15 phases. Tool.execute returns ToolOutput[T] with semantic result types. StorageBackend abstraction enables workflows without PostgreSQL. Streaming is always-on with stuck detection. Headless mode has deterministic fallbacks instead of silent degradation. Autonomy gating enforced at runtime. One-shot ask() API for simple LLM calls. GoogleProvider for Gemini. 3 breaking changes (knowledge-module removed, stream_deltas removed, autonomy_level required).

#Breaking

  • Breaking. Removed knowledge-module (cognee enrichment). The flat file knowledge loader is preserved.
  • Breaking. Streaming is always-on. Removed stream_deltas flag from TaskSpec.
  • Breaking. autonomy_level required on Scheduler (no implicit max). Headless mode with deterministic fallbacks replaces silent degradation.

#Features

  • New feature. All tools return typed ToolOutput[T] with semantic result types (FileContent, ExecResult, HttpResponse, etc.). Pipeline and transport handle typed returns.
  • New feature. Scheduler accepts custom_tools for consumer-injected domain-specific tools.
  • New feature. collect_tools(module) scans a module for Tool instances.
  • New feature. Stuck detection and liveness monitoring with graduated thresholds.
  • New feature. Explicit provider + model routing on Agent. Transport registry buildable from config.
  • New feature. StorageBackend abstraction with PgBackend and InMemoryBackend. Workflows can run without PostgreSQL.
  • New feature. ask(), ask_structured(), and sync_ask() one-shot API for simple LLM calls without PG or scheduler.
  • New feature. Transport hardening: UnknownEvent fallback, RateLimit event surfacing, history compaction, ToolExecuting progress events.
  • New feature. Session resume restores conversation history from storage.
  • New feature. Per-event-type callbacks via session.on(event_type, handler).
  • New feature. Agent context window awareness with automatic handoff at 90% capacity.
  • New feature. GoogleProvider for Gemini API.
  • New feature. Multi-edit tool for batched file edits.
  • New feature. Exec tool argument safety with path containment and metacharacter rejection.
  • New feature. Agent model supports budget, write_paths, timeout defaults.
  • New feature. SyncSession for synchronous consumers.
  • New feature. All modules expose __version__.

#Fixes

  • Bug fix. FileLockRegistry detects nested scope overlaps.
  • Bug fix. Autonomy gating now enforced on Overseer tools. RunStarted event emitted.

#0.2.0

Renamed from orxt to orxtra.

Context

Full rename: PyPI package, Python imports, npm package, GitHub repo. All orxt. imports are now orxtra..

#Breaking

  • Breaking. Renamed from orxt to orxtra across all packages, imports, and distribution.

#0.1.3

#Fixes

  • Fix. Package build includes overseer prompt files.

#0.1.2

#Breaking

  • [agent, cli, knowledge-module, mcp, notepad, overseer, protocols, scheduler, secrets, services, session, tool, trace, transport, verify, write-safety] Single-package distribution. orxtra is now published as a single orxtra package on PyPI instead of 16 separate orxtra-* packages. All sub-modules are included in one wheel.

#0.1.1

#Fixes

  • [agent, cli, knowledge-module, mcp, notepad, overseer, protocols, scheduler, secrets, services, session, tool, trace, transport, verify, write-safety] Fix. CI publish workflow uses --out-dir dist for correct dist placement in workspace builds.

#0.1.0

#Breaking

  • Breaking. Standardized all package names to orxtra-* prefix for PyPI publication.

#Features

  • New. BSL 1.1 license and updated documentation.
  • New. npm CLI wrapper package for installing the Python CLI via uv.
Search