0.4.1 (June 29, 2026)

This release adds public supportability and recovery contracts needed by the official plugin bundle while preserving the existing 0.4 runtime semantics.

Added

  • Public agora.core.acceptance, agora.core.failures, agora.core.health, and agora.core.recovery contract facades for consistent plugin diagnostics.
  • agora.metrics.prometheus, a supported facade for Prometheus rendering helpers used by first-party plugins.
  • Public Prometheus rendering helpers from agora.metrics.exporters for first-party plugin observability without private imports.
  • AGORA_CORE_API_VERSION and AGORA_CORE_API_COMPATIBILITY so plugin manifests can declare a core runtime API range separately from the manifest schema version.
  • DeliveryConfig(dlq_redactor=...) for scrubbing DLQ payloads before any DLQ sink persists records, checkpoints, details, or error messages.
  • Run-scoped distributed fencing through RunFence and FenceLostError, with fail-closed validation before protected side effects.
  • AI token and cost governance through AIBudgetPolicy, AICostCatalog, and related usage and error types.
  • Machine-readable doctor and recovery diagnostics for checkpoint, DLQ, plugin, coordinator, and runtime readiness checks.

Changed

  • Scheduled and worker runtimes propagate distributed fencing through pipeline execution.
  • Recovery CLI commands expose richer remediation and capability details.
  • AI middleware reports token and estimated-cost metrics consistently through the shared provider contract.
  • AIMiddleware resets run-scoped budget usage on each run start.
  • /ready now reports ready only after a successful pipeline run instead of treating an idle process as ready.
  • HealthCheckable.health_snapshot() now supports both sync and async component health implementations.

Fixed

  • DedupMiddleware no longer persists dedup markers before downstream delivery succeeds, preventing replay data loss after sink failure.
  • DedupMiddleware now respects an explicitly supplied empty store instance instead of replacing it with a new in-memory store.
  • SinkRouter.write_batch() preserves per-record WriteResult failures from native batch sinks instead of treating the entire batch as successful.
  • Middleware-failure DLQ write failures no longer advance checkpoints when a DLQ sink is configured but cannot persist the failed record.

Security

  • WebhookSink redacts credentials, query strings, and fragments from log and exception diagnostics while still using the original URL for requests.
  • DLQ redaction hooks can be applied centrally at runtime so all DLQ backends receive already-scrubbed payloads.
  • First-party plugin contract checks now scan the real sibling agora-etl-plugins checkout and fail if no plugin source roots are found, avoiding vacuous contract passes.

Compatibility

  • This is an additive release on the 0.4.x line.
  • Official plugins that import the new supportability or Prometheus facades require agora-etl>=0.4.1.