v0.5.0#

Wreath 0.5.0 adds provider-neutral billing, workplace ChatOps and governed model agents; implements recent OAuth, JSONPath, Linkset and SCIM standards; and turns mutation replay into a coverage-guided fuzzing system. It also closes a broad set of security-boundary gaps and moves more route, validation, storage and tooling work into bounded, operation-owned state.

Upgrade notes#

• Security-sensitive declarations are stricter. Non-finite or otherwise unbounded authentication, delegation, replay, quota, rate-limit, timeout, lease and lifecycle values now fail at declaration or startup instead of weakening the runtime boundary.
• Ambiguous request inputs are rejected earlier. Duplicate scalar security fields, conflicting framing, unsafe raw targets, invalid continuation state and several protocol-limit bypasses no longer reach application activation or body handling.
• Replay and pending-capability stores fail closed at capacity rather than evicting live credentials or deliveries. Applications that relied on eviction must size these stores for the admitted workload and handle the documented capacity refusal.
• Existing OAuth clients keep bearer-token behaviour unless DPoP, rich authorization details or signed introspection are explicitly configured. New registration-time checks reject unsupported introspection encryption and incompatible signing choices.
• Native fuzz campaigns require Clang. Python fuzzing remains available without it, and native build time has a separate bounded timeout outside the campaign's execution budget.
• No documented public class, function or method was intentionally removed or renamed. Wreath remains dependency-free at runtime and works as an ordinary application on any conforming ASGI server.

Billing, ChatOps and governed agents#

• A provider-neutral billing control plane now covers hosted Stripe Checkout, Connect and Managed Payments, durable webhook projection, reconciliation, refunds, customer portals, support approvals and subscription read models. app.billing(...) connects the declaration to Wreath's existing PostgreSQL, webhook, organization, audit and policy owners.
• Subscription access resolves plan and entitlement state from one durable snapshot before Cedar evaluates policy. Reconciliation applies each provider page and advances its cursor in the same transaction.
• One typed ChatOps declaration targets Slack, Microsoft Teams and Discord while retaining provider-native acknowledgements, manifests and delivery limits. Ingress is verified, identities resolve only through explicit links to existing Wreath users, and commands reuse Cedar, second-factor, rate-limit, durable-job, stream, notification and audit boundaries.
• Governed agents support OpenAI, Anthropic, Gemini, Azure and compatible model backplanes behind one compiled profile. Profiles bound model choice, budgets, tools, delegation, memory, artifacts, routing, fallbacks, approvals and observation before execution.
• Agent tools can call Wreath MCP operations directly or use remote MCP sessions. Durable effects retain stable identities and checkpoints, while unknown remote outcomes are refused rather than retried as though they were safe. ChatOps can carry provider-native approval and resumable-output flows.

OAuth, JSONPath, Linkset and SCIM#

• OAuth authorization responses can include the RFC 9207 issuer parameter. Authorization servers can validate RFC 9396 rich authorization details against registered dataclass shapes, bind access and refresh tokens to RFC 9449 DPoP keys, and return audience-bound RFC 9701 signed introspection JWTs.
• wreath.auth publishes RFC 7638 JWK thumbprints and RFC 9278 thumbprint URIs. DPoP validation covers method and URI binding, access-token hashes, nonces, proof age, public-key-only JWKs, single-use proofs and refresh-token key continuity.
• The RFC 9535 JSONPath compiler supports child and descendant segments, unions, slices, filters, comparisons, boolean expressions and the standard functions. Evaluation uses an immutable native instruction program with an explicit node-visit ceiling and is checked against an independent Python implementation plus the 703-case compliance corpus.
• RFC 9264 JSON Linksets round-trip through application/linkset+json, and API Catalog discovery now uses that representation with the RFC 9727 profile.
• SCIM gains POST .search, filtering, ordering, groups, batch user lookup, corrected resource metadata and RFC 9865 cursors. Cursors are signed, expire, and remain bound to the original query and page size.

Security and adversarial hardening#

• Routing, proxying, caches, idempotency, signed capabilities and mounts now bind to the exact raw request target. Redirect and SSRF containment covers encoded traversal and address-normalization cases.
• HTTP/1.1, HTTP/2, HTTP/3, WebSocket, multipart, DNS, GraphQL, gRPC, response emission and the HTTP client enforce tighter size, framing, continuation and type boundaries. Native and Python validation agree on malformed and oversized inputs.
• OAuth, OIDC, JWKS, JWT, SAML, SCIM, sessions, Cedar and permissions strengthen issuer, audience, origin, token-class, replay, revocation, credential and claim checks. Duplicate security fields and ambiguous identity keys fail closed.
• Tenant, account, issuer, namespace and fencing identities survive jobs, billing, organizations, messaging, subscriptions, progress, approvals and workflow state. Stale workers cannot publish after losing a fence.
• Upload completion and expiry are fenced against racing writers and sweepers. Storage, recording, webhook, migration, signature, logging, MCP and agent paths now bound names, metadata, collections and lifetimes before accepting work.
• The security regression corpus is organized beside the domains it protects. The work closed 26 confirmed defects found during mutation-guided campaigns; targeted campaigns killed 10/10 native protocol, 124/124 identity, 98/98 data and 9/9 messaging-envelope mutants selected from the changed lines.

Mutation-guided fuzzing and assurance#

• wreath mutant can now drive generated, coverage-guided Python campaigns with persistent content-addressed corpora, deterministic seeds, shrinking, replay and retained reproduction artifacts. Pristine and mutant observations run from identical fork snapshots so mutable target state cannot manufacture a kill.
• Six compiler-native libFuzzer harnesses cover HTTP/1, HTTP/2, HTTP replay, GraphQL, multipart and XML with ASan, UBSan and SanitizerCoverage. Build caches are tied to the Python ABI, platform, Clang identity, target and schema, and the exact imported extension is verified before execution.
• Daily sharded CI campaigns merge corpora, publish manifests and retain stable finding artifacts. Campaign budgets account for harness execution separately from native compilation.
• Pull-request CI now builds the strict documentation site, preventing a docs failure from reaching the default branch and Pages deployment.

Bounded runtime and static sites#

• Repeated lookup work moved into application images, reverse indexes, deadline trackers and operation-owned plans. This covers routes, headers, JOSE audiences, second-factor credentials, notification recipients, invitations, PostgreSQL workloads, response schemas, resolvers, exports, signatures and recordings.
• Concurrent tasks, subscriber sets, queues, retries, GraphQL resolution, MCP and WebSocket sessions, SCIM paging, notification fan-out, edge input and object streaming now have explicit ownership and bounds. The audit taint rule uses a dependency worklist instead of silently stopping after eight hops.
• Validation plans, PostgreSQL records, route masks, series projections, queues, KV tables, gzip workspaces, request and response capture, replay output and object-store ranges retain or copy less data without adding process-global mutable state.
• The public wreath.docs surface exposes Wreath's static-site builder with custom templates, general-page layouts, additional head, CSS and JavaScript content, copied assets and renderer-provided asset manifests. Browser bundlers and rendering engines remain external tools rather than runtime dependencies.
• Public facades defer heavy imports until an export is used while preserving __all__, star imports, dir(), runtime annotations, exact-type checks and missing-attribute behaviour.

Performance#

Measurements below are retained results from the merged changes. CPU figures use interleaved equivalent-output runs and retired userspace instructions or fixed-work CPU time; memory figures name the retained workload. They are not additive and do not establish production latency, throughput or energy changes.

• A representative typed ASGI text request fell from 11.987 billion to 10.781 billion median instructions over 21 interleaved runs, 10.06% fewer. The request-boundary baseline fell from 100 to 94 native crossings, including 39 to 36 before handler activation.
• Building an 8,000-route application image fell from 820.158 ms to 172.126 ms median CPU time, 79.01% less, over seven alternating measured pairs.
• A warm two-field projection from a 1,024-column ORM model fell from 25.751 to 1.110 microseconds, 95.69% less; whole-process instructions fell 87.66% and traced peak allocation fell from 42,064 to 1,494 bytes.
• Retained PSS growth for the first 64 KiB of a 64 MiB object-store range fell from 33.67 MiB to 0.16 MiB, 99.53% less. A 100,000-row four-cell PostgreSQL RecordBatch fell from 13.77 MiB to 9.58 MiB, 30.46% less.
• Idle ORM sessions retain 872 fewer bytes each, decoded path-parameter mappings retain 184 fewer bytes each, and direct flight-recorder draining reduced the measured workload's peak PSS from 64.376 MiB to 50.884 MiB, 20.96% less.
• Planning 64 selected captured-default mutations fell from 393.231 ms to 136.296 ms, 65.34% less, while pass retry batching fell from 10.214 billion to 0.780 billion instructions, 92.37% fewer.

Some trade-offs remain visible: first materialization of an 8 MiB response capture cost 4.81% more CPU while retained PSS fell 23.73%; point-read and transaction workloads cost 1.91% and 1.39% more CPU. The refreshed whole-stack README artifact records Wreath at 49.92 MiB median peak PSS, 35.6% below the previous retained artifact, but those two artifacts were recorded three days apart rather than interleaved, so this is not a controlled whole-framework comparison.

Compatibility#

• The framework core still has no mandatory third-party runtime dependencies.
• The base, Linux reactor and HTTP/3 distributions remain exactly version-locked and target regular CPython 3.14 on the published wheel platforms.
• wreath.edge remains native-only and refuses an unsupported build or configuration rather than selecting a slower Python request path.
• The new billing, ChatOps, agent, DPoP, JSONPath, Linkset, SCIM and static-site capabilities are opt-in; existing generic ASGI applications do not activate them unless declared.