v0.4.0#

Wreath 0.4.0 makes recent HTTP standards first-class application primitives, moves repeated native execution work into operation-owned compiled plans, and removes several regex and parser paths whose cost grew badly on malformed input. It also includes the PostgreSQL, ORM and framework-wide runtime improvements landed after 0.3.4.

Upgrade notes#

• Field(pattern=...) and ORM Pattern(...) now reject regex constructs that cannot be shown to stay linear-safe. The refusal happens at declaration time. Anchor open-ended searches, keep at most one unbounded repeat on a match path, use finite bounds where possible, or move grammar-shaped validation into a dedicated parser.
• StreamingResponse and SSEResponse now emit Incremental: ?1 by default. Pass incremental=False when an intermediary may buffer the complete response.
• The native edge proxy refuses an upstream Incremental: ?1 response with a named 501 and Proxy-Status instead of silently buffering a representation it cannot forward incrementally.
• No documented public class, function or method was intentionally removed or renamed. The removed raw template-tape executor was an internal native entry point; public templates already compile before rendering.

Standards-native HTTP#

• RFC 10008 QUERY is supported across routing, the test and HTTP clients, redirects and retries, native policy, edge forwarding, OpenAPI and generated TypeScript. A QUERY body is typed like any other request body while retaining safe, idempotent and cacheable semantics. Cache keys include the body and its representation metadata.
• RFC 9727 API Catalog discovery publishes the API, OpenAPI description and docs through /.well-known/api-catalog. RFC 9652 Link-Template response fields validate the complete RFC 6570 template at construction and use RFC 9651 Structured Fields, including Display Strings for Unicode attributes.
• RFC 9530 Content-Digest, Repr-Digest, Want-Content-Digest and Want-Repr-Digest support covers bounded parsing, SHA-256/SHA-512 verification, weighted algorithm selection and response generation. Compression leaves a representation unchanged once an integrity field describes its bytes.
• RFC 9470 OAuth step-up requirements evaluate auth_time and acr, compile the Bearer challenge at startup, and preserve the existing browser-session second-factor contract. RFC 10017 BFF primitives keep OAuth tokens in a revocable server-side session behind fixed-origin resource routes, strict credential filtering and a preflight-forcing CSRF header.
• Route declarations can emit RFC 9745 Deprecation, RFC 8594 Sunset and the corresponding migration link from the same lifecycle declaration that marks OpenAPI. RFC 10036 Incremental identifies streaming responses explicitly.
• Cache policy now covers RFC 9213 targeted CDN-Cache-Control, RFC 9211 Cache-Status and RFC 9875 cache groups alongside Wreath's existing signed invalidation. RFC 9209 Proxy-Status, including RFC 9532 next-hop aliases, carries DNS, connection, TLS, protocol and upstream failure context across the proxy boundary.

Native runtime and data paths#

• Cedar expressions, SCIM predicates, HTTP signature inputs, validation trees, XML representations and ORM hydration constants compile into operation-owned native plans. Execution reads direct fields instead of repeatedly walking Python tuples, dictionaries or dataclass trees. Plans own their references and allocate no process-global mutable cache.
• Templates now have one execution path: construction lowers the tape once and every render executes the compiled native program. The obsolete raw tuple-tape executor and its duplicate benchmark are gone.
• PostgreSQL query execution crosses fewer task and protocol boundaries. Cold description decoding, completion publication, grouped mapping, array encoding, compact records and model hydration move more work into the native driver.
• ORM writes batch compatible inserts, equal-shape updates and deletes within PostgreSQL's parameter budget. Returned-key checks detect stale rows, dependency order is preserved, and model plus audit state is published only after a successful statement.
• Native codecs, JSON validation, HTTP/2 and HTTP/3 header processing, SigV4, series construction, compression and response preparation remove repeated allocations, scans and Python crossings while preserving portable ASGI use.

Regex and parser hardening#

• Caller-supplied field and ORM regexes pass through a conservative declaration- time validator. Lookarounds, backreferences, nested or branched repeats, multiple unbounded repeats on one path and unanchored open-ended searches are refused before request handling.
• Duration, Markdown heading, heading-id, table and frontmatter parsing now use deterministic scans for the shapes that previously backtracked or rescanned. Complexity probes retain same-size controls for each contract.
• Cedar comment removal and PostgreSQL replay SQL inspection now use quote-aware state machines. The SQL scanner understands line and nested block comments, standard and escape strings, quoted identifiers and dollar-quoted bodies before placeholder or cast inspection.

Performance#

The operation-owned native-plan comparisons used nine interleaved runs per arm, retired userspace instructions as the primary metric and exact-output checks:

The mandatory compile-once template path reduced its retained workload from 1,112,848,188 to 976,027,594 median instructions (12.29% fewer) over nine interleaved exact-output runs.

Adversarial fixed-workload parser probes recorded these median reductions:

The earlier framework-wide optimisation survey retained 40 exact-output comparisons with nine interleaved samples per arm. Reductions ranged from 1.003% to 97.587% across different workloads; 42 A/A controls had a maximum absolute delta of 0.745%, and three candidates that regressed were removed. Separately, seven-run driver measurements recorded 26.56% fewer instructions for task-free grouped Connection.map() and 11.36% fewer for a 250,000-row, five-column Record lifecycle.

These are instruction-count results for the named workloads, not latency, throughput, energy or cumulative whole-application speedup claims.

Compatibility#

• Wreath remains dependency-free at runtime and usable on any conforming ASGI server. Native edge features still refuse unsupported configurations rather than selecting a Python request path.
• The base, Linux reactor and HTTP/3 distributions remain version-locked and target regular CPython 3.14 on the published wheel platforms.