Changelog: harnessweaver-sidecar

All notable changes to harnessd. The format follows Keep a Changelog, and this package uses Semantic Versioning on its own (RULES V1). Versions before 0.2.1 were never published; their Git tags (harnessweaver-sidecar@<version>) mark the commit where each one landed.

[Unreleased]

0.2.1 - 2026-11-01

The first version published to PyPI.

Added

• The package ships the Apache-2.0 LICENSE in its wheel and sdist.

0.2.0 - 2026-11-01

Security

• harnessd read and JSON-parsed a request body of any size before it checked the bearer token, so a peer without the token could grow its memory (RULES S6). The token is now checked in ASGI middleware before any of the body is read. Everything except GET /v1/health answers 401 without it, which now includes unknown paths and FastAPI's /docs, /redoc and /openapi.json. Bodies are capped too: --max-body-bytes on harnessd (max_body_bytes on create_app), 10 MiB by default, answers 413 with an ErrorInfo, counting the bytes that arrive so chunked uploads count. The OpenAPI document gains the 413.

0.1.0 - 2026-10-20

Added

• harnessd (ADR-0038) serves one effective spec over /v1: health, spec, hooks, guards/{stage} (input, context, output), guards/providers/{name}:check, decisions/{router}, policy/evaluate, tools/{name}/authorize, tools/{name}/sanitize, validate, runs, runs/{run_id}, runs/{run_id}/approvals/{approval_id} and evals/run. Checks run as one-step sessions answered with their RunResult. Every route except health needs the bearer token; harnessd refuses to start without one and binds 127.0.0.1 (S6). Errors are ErrorInfo bodies, and invalid requests never echo their values (R9).
• contracts/openapi/harnessd.openapi.json, generated by make schemas and drift-tested, and contracts/proto/harnessweaver/v1/harnessd.proto, which mirrors its routes for gRPC later.