Skip to content

SchemaRouter 0.14.0

SchemaRouter 0.14.0 is an operability and ecosystem-validation release built on the stable-core retrieval/execution boundary established in 0.12.0.

The release does not turn SchemaRouter into an autonomous agent framework and does not promote an unfinished research result into a product guarantee. Its focus is practical operation: inspecting sources before registration, preserving execution authority across restarts and schema changes, making registered capabilities easier to inspect, and validating composition with surrounding agent ecosystems.

Safer source inspection and authentication

Structured-source discovery is now easier to diagnose without granting execution authority.

  • probe_url(...) can inspect a source without registering or executing it.
  • Ordinary HTML and unsupported URLs fail with explicit diagnostics instead of silently producing an empty tool surface.
  • Automatic URL discovery is passive by default.
  • OpenAPI authentication requirements are part of the canonical endpoint/tool contract, while credential values remain in trusted runtime configuration.
  • Schema watches and HTTP validators stay pinned to the exact accepted source/contract identity.

The result is a clearer separation between recognizing a capability source and authorizing a runtime binding.

Runtime lifecycle and persisted state

0.14.0 fills operational gaps that matter once a registry survives beyond one process.

  • persisted registries can restore trusted process-local bindings through explicit startup rebinding;
  • SQLite registry/trace formats are versioned and support validated migration from the legacy unversioned format;
  • breaking or security-relevant schema drift has explicit accept/reject handling;
  • capability removal is available through one high-level lifecycle operation;
  • health probes remain coherent across accepted contract transitions;
  • runtime shutdown closes watchers, monitors, bindings, and owned resources through one public lifecycle;
  • adapter plugins can participate in the same conservative schema-refresh boundary.

Persisted schema data still does not contain credentials, live clients, sockets, subprocess handles, or other execution authority.

Capability Explorer and first-use path

The documentation and inspection surface now matches the product model more closely.

The protocol-neutral Capability Explorer provides a Swagger-style, read-only view of registered tools, endpoints, parameters, output fields, units/qualifiers, fingerprints, binding state, authentication requirements, health state, and schema-watch status. It does not expose execution buttons or credentials.

The public quickstart now uses a real, no-auth OpenAPI provider while mandatory CI keeps a deterministic offline equivalent. Runnable examples cover local callables, SDK bindings, multiple providers, schema drift, MCP stdio, framework integrations, context reduction, and inspection.

Adapter and agent-ecosystem composition

The installed package is exercised against external-style integration boundaries rather than only repository-local fixtures.

0.14.0 includes runnable adapter and decision-backend plugin examples and built-wheel validation for:

  • PydanticAI ToolSearch composition;
  • OpenAI Agents SDK dynamic MCP filtering;
  • mcp-agent large-tool catalogs;
  • downstream SourceAdapter entry-point plugins.

These checks establish compatibility evidence for the tested pinned surfaces. They are not claims that SchemaRouter replaces those frameworks or that every version of a third-party project is supported.

English and Korean documentation

The GitHub Pages site now provides English and Korean from one site with an in-header language selector.

English remains the canonical documentation source. Korean first-class pages cover the main onboarding, concept, protocol, inspection, and trust surfaces. For pages not yet translated, the same Korean URL exists and clearly links to the current English original instead of returning a 404. A source-blob manifest makes the documentation build fail when a translated page falls behind its canonical source.

Release and research records

Mechanical public facts are now derived from canonical repository sources.

  • the stable version/date comes from CHANGELOG.md;
  • the development/release version comes from pyproject.toml;
  • the public experiment count comes from benchmarks/research-experiment-ledger.json;
  • protected CI rejects stale public fact lines;
  • a scheduled workflow can open a reviewable synchronization PR when those facts drift;
  • the research evidence exporter also runs on relevant main changes and on a schedule.

The release pipeline additionally emits SHA256SUMS.txt and release-manifest.json with the exact release source SHA, artifact names, sizes, and SHA-256 digests. These files are attached to the GitHub Release alongside wheel, sdist, and the SPDX SBOM.

Stable-core and research boundary

The active 0.14 research program continues independently from this package release. Corrective re-retrieval, runtime qualification, held-out generalization, final-answer quality, and field-level projection evidence are not treated as product defaults until their preregistered gates and evidence rules permit that conclusion.

The package release therefore does not claim that those open experiments have completed or that their partial rows establish production superiority.

Compatibility

There is no intentional breaking public API change relative to 0.13.0.

The stable product boundary remains:

registered typed capabilities
  -> bounded retrieval / planning
  -> local schema + policy + binding validation
  -> trusted execution
  -> validated/projected ToolResult

SchemaRouter remains Beta / pre-1.0.

Release integrity

Publication requires the exact release commit to pass the protected CI/security matrix. The release workflow then:

  1. creates the annotated v0.14.0 tag at that exact green main SHA;
  2. builds and clean-installs wheel and sdist;
  3. generates an SPDX JSON SBOM;
  4. emits GitHub provenance attestations;
  5. generates SHA256SUMS.txt and release-manifest.json;
  6. publishes to PyPI through Trusted Publishing;
  7. downloads the exact public wheel and sdist and verifies their digests against the trusted build;
  8. installs the published wheel, sdist, lightweight extras, and combined integration extras outside the checkout.