From c0ed8d8a406f3df53942fe54513ad32db67812e0 Mon Sep 17 00:00:00 2001 From: Jake Fineman Date: Wed, 2 Sep 2026 19:02:32 -0400 Subject: [PATCH] docs(changelog): sync CHANGELOG.md with tagged and current versions Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01K9mRh8G2ugbUt2kaXvFvF6 --- CHANGELOG.md | 158 ++++++++++++++++++++++++++++----------------------- 1 file changed, 86 insertions(+), 72 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ec73469..4c6a3d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,83 +6,97 @@ All notable changes to this project are documented here. The format is based on ## [Unreleased] -### Fixed - -- `pr-agent` lane: fork-triggered `/` commands are now refused, and the AI - call's budget fits inside its step. Three defects, one of them only visible - once the first was fixed. +### Added - The job-level `if:` refused forks on the `pull_request` arm and could not on - `issue_comment` — fork status is absent from that payload, so there was never - an expression to write. A `fork gate` step now asks the pulls endpoint and - fails closed: only a literal `false` proceeds, so a 404, a rate limit or a - deleted fork all skip. The lane runs no `actions/checkout`, so fork code was - never executed and no exfiltration path existed; what this closes is the - comment claiming forks were already skipped, which was true of one arm only. +- **Console-management operations** (`openapi.yaml`) — six new operations across four paths + give the derived MCP tool plane coverage of the console-management surfaces: `GET`/`POST` + `/pricing/manifests` (org-scoped list and validated upsert), `POST /custody/{op}` with a + four-value enum (`grant`/`revoke`/`inspect`/`exercise`), `GET /engine/capabilities`, and + `GET`/`POST` `/gpu/infer`. Adds the `PricingManifest` component schema and the `Pricing`, + `Custody`, `Engine`, and `Gpu` tags. (#72) +- **Agent-auth device authorization ceremony** (`openapi.yaml`) — two new paths under the + `Agent Auth` tag: `POST /agent/auth/device` (the RFC 8628 bootstrap, deliberately + unauthenticated) and its poll counterpart, modelling the device-code grant shape and the + honest `403` while the user has not yet approved. (#66) +- **Registered RFC 8628 grant type URN** (`openapi.yaml`) — the device-authorization poll's + `grant_type` enum now requires the registered URN + `urn:ietf:params:oauth:grant-type:device_code` instead of the bare `device_code` shorthand. + **Breaking:** removes the bare-shorthand enum value from the spec (the live gateway still + accepts both forms on the wire, so no client is broken by this alone). (#68) +- **`POST /batch` endpoint** (`openapi.yaml`) — documents the batch operation contract: an + `operations` array of method, enforced `/v1` path, and optional body, capped at 25 items + per call. (#64) +- **`/search` reconciled to the shipped contract** (`openapi.yaml`) — replaces four stale + search paths that described an archived contract with the four the gateway actually + serves: `POST /search` (hybrid dense+sparse query), `POST /search/index` (upsert one + document or a batch), `DELETE /search/index/{id}`, and the shipped suggest/semantic + variants. (#56) +- **Async render job lifecycle** (`openapi.yaml`) — documents `GET /render/{jobId}` and + `GET /render/{jobId}/events` (server-sent events) so a render started through `POST + /render` can be polled and streamed to completion. Also fixes a YAML structural bug that + had corrupted an adjacent schema. (#34) +- **`AV Mux/Demux` surface** (`openapi.yaml`) — documents `POST /v1/av/remux` (combine + separate RTP H.264 video and Dante/AES67 audio into one MPEG-TS/fMP4 stream) and `POST + /v1/av/demux` (the inverse), with the `AvRemuxRequest`, `AvDemuxRequest`, and + `AvTransformResult` schemas. (#23) +- **Braided Audio publish/stop** (`openapi.yaml`) — documents `POST /v1/braid/publish` and + `DELETE /v1/braid/publish/{ns}` under a new `Braided Audio` tag, with the + `BraidPublishRequest`, `BraidPublishResult`, and `BraidStopResult` schemas. (#19) +- **WAVE Render in the OpenAPI source of truth** (`openapi.yaml`) — adds the `Render` tag and + `POST /render`, payable via the x402 challenge flow, so render gets a generated client + instead of a hand-written one. (#12) +- **Error responses carry suggestions** (`openapi.yaml`) — the shared `Error` envelope gains + optional `suggestions[]`, `did_you_mean[]`, and `doc_url` fields, matching the gateway's + error layer. Additive only. (#10) +- **Word-level timestamps on the Voice API** (`openapi.yaml`) — `VoiceGenerateRequest` gains + a `timestamps` boolean (default `false`); when set, `VoiceGeneration.alignment` returns the + new `VoiceAlignment` schema with parallel `characters[]` and start/end time arrays. (#9) +- **Realtime control/event plane** (`openapi.yaml`) — adds the `Realtime` tag and + `/realtime/connect`, `/realtime/channels/{channel}/publish`, `/presence`, and `/history` + paths, each with a per-operation `servers` override pointing at + `https://realtime.wave.online`. (#4) +- **Fleet agent directory resolve** (`GET /identity/resolve`) — adds the `Identity` tag, the + `identityResolve` operation (`agent` query parameter, optional `org` self-assertion), and + the `IdentityResolveResponse` oneOf (`AgentIdentity` | `TelephonyIdentity`). Directory data + is public only: `key`/`keys` fields are key names, never values. Gated by the + `directory:read` scope. (#57) +- **SDK types generated from the spec** (`generated/api-types.d.ts`) — `openapi-typescript` + now emits typed paths, operations, and schemas from `openapi.yaml`, and a CI gate + regenerates them on every pull request and fails if the committed artifact has drifted. + (#49) +- **Breaking-change gate** — pull requests are diffed against the base branch with `oasdiff`; + an unacknowledged breaking change fails the build unless the PR body carries an explicit + `Breaking: yes` marker. (#49) +- **MoQ join-token mint surface** (`openapi.yaml`) — adds the `MoQ` tag and both mint + operations: `POST /moq/publish/{ns}/{track}` and `GET /moq/subscribe/{ns}/{track}`, the + `MoqJoinToken` response schema, path parameters constrained to `^[a-z0-9-]{1,64}$`, the + `X402PaymentRequired`/`X402Accepts` schemas and the reusable `PaymentRequired` response + (the 402 body is not the standard `Error` envelope). The media session itself is not + modelled, since it is not an HTTP surface; the spec pins the direct-to-relay flow to + `draft-ietf-moq-transport-18`. (#30) +- **WAVE Attestation Standard v1** (`attestation/` directory) — a frozen v1 specification + covering the wire envelope shape, canonicalization algorithm, Ed25519 signature scheme, + and verification procedure, plus a standalone verifier reference and the + `/.well-known/wave-attestation-keys.json` key-rotation contract (30-day overlap window, up + to 5 keys at once). (#14) +- **Attestation component schemas** (`openapi.yaml`) — `RenderAttestation` (the render + attestation v1 subject payload) and `WaveAttestation` (the full v1 wire envelope, with the + `alg`/`sig` invariant enforced). (#11) +- **`capabilities.json`** — registers this repository with the organization's platform + registry for discovery and lifecycle tracking. (#3) - `CONFIG__AI_TIMEOUT` was 600s inside a 360s step, so the runner killed the - step before pr-agent could reach its own timeout or fall back to a secondary - model. Now 300s. +### Changed - Fixing the first exposed a third: `stamp attempt 2 end` runs under - `if: always()`, so when attempt 2 never ran the verdict subtracted from zero - and reported a 1787580408-second attempt as a confident TIMED OUT. +- **License: Apache-2.0** — the specification and repository now carry the Apache-2.0 + license, with a NOTICE file reserving the WAVE marks; `openapi.yaml`'s `info.license` and + the README were updated to match, and the staging server entry was removed from the spec. + (#6) - Contributors on forks are affected: a maintainer's `/review` on a fork PR is - now declined with a warning rather than silently running. - (wave-av/wave-foundation-public#73) +## [1.0.0] - 2026-04-05 ### Added -- **Fleet agent directory resolve** (`GET /identity/resolve`) — identity-fabric E1. Adds the - `Identity` tag, the `identityResolve` operation (`agent` query param, optional `org` - self-assertion), and the `IdentityResolveResponse` oneOf (`AgentIdentity` | - `TelephonyIdentity`) so generated clients see the documented telephony variation. Directory - data is public only: `key`/`keys` are Doppler key NAMES, never values. Gateway gate: - `directory:read` scope (distinct from compliance `identity:read`). -- **SDK types generated from the spec** (`generated/api-types.d.ts`) — `openapi-typescript@7.13.0` - now emits typed paths/operations/schemas from `openapi.yaml`, and the `sdk-types` CI gate - regenerates them on every PR and fails if the committed artifact has drifted from the spec. - Consumers get typed clients without keeping their own copy in sync. -- **Breaking-change gate** (`breaking-change` CI job) — PRs are diffed against the base branch - with `oasdiff`; an unacknowledged breaking change fails the build unless the PR body carries - the explicit `Breaking: yes` marker. +- Initial public release: the WAVE OpenAPI 3.1 specification (12 API modules). -- **MoQ join-token mint surface** (`openapi.yaml`) — the Media over QUIC product had no spec at - all, so no SDK or CLI could be generated for it. Adds the `MoQ` tag and both mint operations: - - `POST /moq/publish/{ns}/{track}` (`mintMoqPublishToken`, scope `moq:write`) and - `GET /moq/subscribe/{ns}/{track}` (`mintMoqSubscribeToken`, scope `moq:read`), with the - optional `x-wave-declare-protocol` publish header. - - `MoqJoinToken` response schema (`relayWsUrl`, `joinToken`, `expiresIn`, `ns`, `track`, `role`, - `scope`, optional `protocol`) and the `MoqNamespaceParam` / `MoqTrackParam` path parameters - constrained to `^[a-z0-9-]{1,64}$`. - - Failure modes are specified alongside the happy path: `400 MOQ_JOIN_BAD_RESOURCE`, 401, the - 402 x402 challenge, 403, 429, and the fail-closed `503 MOQ_JOIN_UNCONFIGURED`. - - `X402PaymentRequired` / `X402Accepts` schemas and a reusable `PaymentRequired` response — the - 402 body is **not** the `Error` envelope (its `error` member is a string and the normalized - error object is nested under `error_detail`), which the spec previously did not capture. - - The MoQ media session itself is intentionally **not** modelled: it is not an HTTP surface. The - tag description explains the direct-to-relay flow, the `join` query parameter / - `x-wave-moq-join` header token carriers, and pins the surface to - `draft-ietf-moq-transport-18` (draft-19, published 2026-07-06, is not yet deployed). -- **WAVE Attestation Standard v1** (`attestation/` directory): - - `attestation/ATTESTATION-STANDARD-v1.md` — Frozen v1 specification: wire envelope - shape, field types, canonicalization algorithm (`canonicalJson` + `attestationId`), - Ed25519 signature scheme, verification procedure, and v0→v1 version history. - - `attestation/attestation-v1.schema.json` — JSON Schema Draft 2020-12 for the v1 - envelope. Includes `$defs` for `RenderAttestationSubject`, `ContextAttestationSubject`, - and `SettlementAttestationSubject`. Enforces the `alg:"none"` ⟺ `sig:null` invariant - via `allOf/if/then/else`. - - `attestation/verifier-reference.md` — Standalone verifier procedure: step-by-step - algorithm, `VerifyResult`/`VerifyError` type definitions, helper function signatures - (`attestationSubject`, `canonicalJson`, `attestationId`, `fetchKeys`), and outcome - reference table. - - `attestation/well-known-keys.md` — `/.well-known/wave-attestation-keys.json` endpoint - specification: JWKS-style OKP/Ed25519 response shape, `kid`/`x`/`iat`/`exp` field - definitions, key rotation policy (30-day overlap window, ≤5 keys at once), signature - wire encoding, and security requirements. -- **OpenAPI component schemas** (`openapi.yaml` `components/schemas`): - - `RenderAttestation` — render attestation v1 subject payload (the `subject` field for - `kind: render` envelopes). - - `WaveAttestation` — full v1 wire envelope schema with `id`/`kind`/`v`/`subject`/ - `alg`/`sig`/`created` fields and the `alg`/`sig` invariant. +[Unreleased]: https://github.com/wave-av/api-spec/compare/v1.0.0...HEAD +[1.0.0]: https://github.com/wave-av/api-spec/releases/tag/v1.0.0