Skip to content

SchemaRouter 0.16.0

SchemaRouter 0.16.0 is an enterprise data onboarding and authorization release built on the typed capability and execution boundary established in earlier releases.

The release expands the kinds of caller-owned data systems that can be registered safely without turning SchemaRouter into an IAM server, database proxy, or autonomous orchestrator.

Identity-aware authorization

Applications can pass a verified PrincipalContext and enforce deny-by-default RBAC/ABAC across roles, departments, teams, and trusted attributes.

Authorization is applied before model-visible retrieval and revalidated at execution. Data-scope rules can additionally narrow visible fields, trusted row/tenant filters, graph relationship sets, and traversal depth.

Authentication, SSO/token verification, identity directories, and database-native roles remain host-owned.

Relational database onboarding

SchemaRouter can introspect local SQLite connections and caller-owned SQLAlchemy Engines into typed read-only capabilities.

The model does not receive arbitrary SQL authority. The generated surface uses introspected schema, bounded projection, exact-match parameters where supported, and parameterized execution.

The SQLAlchemy path is designed to work with dialect-supported relational/warehouse systems while keeping credentials, pools, and live connections outside model-visible contracts.

Vector databases

The provider-neutral vector contract is complemented by native caller-owned adapters for:

  • Qdrant;
  • Milvus;
  • Pinecone;
  • Weaviate;
  • Chroma;
  • PostgreSQL/pgvector.

Adapters discover or require explicit collection/index schema information, validate vector dimensions, keep embedding/vector creation inside trusted host code, and apply principal-derived metadata filters through vendor-safe query structures.

Graph and RDF data

The graph contract now includes native caller-owned adapters for:

  • Neo4j;
  • Amazon Neptune Database / Neptune Analytics;
  • ArangoDB;
  • FalkorDB;
  • SPARQL 1.1 endpoints.

FalkorDB support includes graph, label, relationship and property discovery plus bounded read-only traversal through ro_query(). Release-gated compatibility starts a real FalkorDB container and executes discovery and traversal with the official Python client.

Raw Cypher, AQL, Gremlin, or SPARQL does not become model-visible execution authority.

Document, search, key-value and time-series data

The bounded record-store contract adds native caller-owned adapters for:

  • MongoDB;
  • Elasticsearch / OpenSearch;
  • Amazon DynamoDB;
  • Azure Cosmos DB for NoSQL;
  • Couchbase;
  • ClickHouse;
  • InfluxDB 2.x / Flux.

Vendor query languages remain inside trusted adapter code rather than model output.

Redis boundary

Generic Redis record/vector/search support is intentionally not part of the first-class core database surface in 0.16. FalkorDB is supported specifically as a graph database through the graph contract.

This keeps the core focused on data models with clear schema discovery and bounded execution semantics. Redis-specific use cases can still be implemented through plugins or adopter-owned adapters when needed.

Provider discovery boundary

Unknown-provider discovery remains proposal-first: discovery may produce inspectable candidates, but registration requires explicit approval and never grants execution authority by itself.

Existing provider-first onboarding for known services remains available.

Compatibility

The stable retrieval and execution facade remains intact. The 0.16 additions are new onboarding, authorization, and adapter surfaces around the same capability contracts.

SchemaRouter remains Beta / pre-1.0. Database/vendor support means the bounded adapter and contract exist in core; it does not imply every hosted account, vendor version, or deployment topology has completed live external acceptance.

Documentation

0.16 reorganizes the repository landing pages so README stays focused on product identity, quickstart, architecture, supported source families, authorization boundaries, and links to the full documentation.

Detailed database behavior now lives under:

Release integrity

Publication requires the exact 0.16.0 release commit to pass the protected CI/security matrix, package checks, compatibility smoke suite, Python preview, and live FalkorDB acceptance. The normal release workflow then creates v0.16.0, builds and clean-installs wheel/sdist artifacts, emits SBOM/provenance metadata, publishes through PyPI Trusted Publishing, and verifies the published artifacts.