# Release note

## 0.4.0

This guidance applies when upgrading to 0.4.0; it also covers behavior introduced
in earlier releases.

### Configuration upgrade note

For `sidecar.dev_mode` and
`sidecar.agent_invoke_context.include_full_prior_payloads`, use unquoted
`true` or `false`. Mixed-case spellings such as `yEs` now fail configuration
loading; check hand-edited configurations before upgrading. CLI-generated
configurations already use canonical booleans.

### Native forwarding upgrade note

Remove `valid_until` from every native
`forward` or `forward_composite` decision's `additional_predicates`, including
`additional_forwards` entries. Even equal or shorter supplied deadlines are
refused. Use the destination's configured `valid_for`; continuation expiry is
bounded by inherited authority and the 24-hour root limit. Dates inside your
business payload remain ordinary data. A2A's separate shorter-expiry contract
and the library's absolute expiry cap are preserved.

Native candidates are checked before outgoing proof signing or send. For
example, `amount_max:8000` cannot continue as `amount_max:9500`. The receiving
sidecar independently enforces this rule, including against a deliberately
constructed widened chain. Ordinary narrowing and fresh authority under a
still-valid original approval remain possible through the normal authorization
path; an existing narrow chain is not widened.

The native callback's `200` / `dispatched` acknowledgement precedes background
completion. Observe the later local outcome: a refused `forward` emits a
`dispatch` failure with `ERR_CHAIN_INVALID`; a refused reactive
`forward_composite` emits `composite_mint` with that code. Valid sibling branches
continue. Composite candidates are checked against their own fresh-root and
attestation chain. Proactive composite candidate rejection is a synchronous
403; reserved expiry input is an invalid-decision response before dispatch.

## 0.4.1

Upgrade guidance: remove any `state_store.cold` block, including empty or
null blocks, and replace configured class/destination `predicates.valid_until`
with `valid_for`. An omitted destination timeout now inherits the global
5-second default instead of the former independent 3-second default. Set an
explicit `timeout_ms` to retain a deliberate destination override. Conflicting
explicit task references refuse native decisions before any branch signs or
sends; already-committed roots retain their provenance in a 207 response.
With A2A enabled and `deadline_seconds` below 5, the unchanged global default
is too large: set an explicit destination `timeout_ms` no greater than that
deadline (for example, 3000ms for 3 seconds), or lower the global dispatch budget.
CLI-generated configurations already supply explicit destination timeouts.

## 0.4.2

This release documents the native two-tenant reservation demo and links its public
setup, receipt/refusal and certificate-lifecycle exercises. This release carries
the updated guide and overview; runtime authorization, configuration and wire
behavior are unchanged from v0.4.1. Existing v0.4.1 artifacts remain available unchanged.

## 0.4.3

Distribution update: the runnable image is published after its matching
signed bundle. Runtime behavior and configuration remain the same as v0.4.2.

## 0.4.4

The configuration template links to the standalone AAC developer documentation
site. Current guide corrections can publish independently of sidecar releases.
Runtime behavior, configuration and authorization remain unchanged from v0.4.3.