Prepare v0.2.0 - #93
Merged
Merged
Conversation
Restructures 1,104 lines of [Unreleased] — written incrementally by many parallel branches, with `### Fixed` repeated a dozen times — into a released [0.2.0] section in Keep a Changelog order, each heading once. An audit against the actual v0.1.0..main diff found the section described six things that were never shipped, all from the sketch work whose wire-format change was pulled before merge while its changelog text stayed. Removed or corrected: - topk.Inspect / Summary / Ingested / Coverage — no such symbols exist. - A BREAKING entry claiming the TopK wire format gained a flagged ingested-weight field and that rows written by this version do not decode on older binaries. The format is byte-identical to v0.1.0, so that entry would have told operators a rolling deploy was unsafe when it is not. A fabricated breaking change is as harmful as a missing one. - "TopK honours the wire K" — decode() still reads the header K into a local and discards it. Now documented as deferred, with the keep-K-identical guidance that actually applies. - A monoidlaws claim of a K=4-over-K=32 fuzz case; only the Bloom non-default-capacity case landed. - WithClock / WithClockSkewBound listed under Removed. They were added and withdrawn inside this window and never existed in a tag, so nobody upgrading from v0.1.0 has anything to migrate. - An unsupported "23 verified defects" count in the lead-in. Release-readiness fixes in the same pass: - go.mod: `go 1.26.2` -> `go 1.24.0`. The patch-level directive was whatever `go mod init` wrote in the initial commit and forced every consumer onto >= 1.26.2. Verified the tree builds at 1.24. - SECURITY.md said pkg/admin ships permissive `Access-Control-Allow-Origin: *`. It does not — applyCORS returns early with no headers when no origins are configured. Replaced with the hazard that is real: auth is off by default. Also corrected the claim that the spark-connect-go `replace` lives in the root go.mod; it is in the submodule. - STABILITY.md asked for exactly this release; now records that it was cut, and why the sparkconnect submodule stays untagged. - README had no install line at all — no `go get`, no import path. - CHANGELOG gained the Keep a Changelog link references it lacked, and the [0.1.0] heading date now matches the actual tag (2026-05-12, not 2026-05-07). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X2YMxeLgyRc9i5XPyEV75S
CI caught this: four Go jobs failed at `go 1.24.0`. Five direct dependencies — x/net, grpc, x/sys, connectrpc.com/connect and apache/arrow-go — declare `go 1.25.0`. My local verification was inadequate. `go build` with 1.24.0 in go.mod succeeded here only because the toolchain is 1.27 and GOTOOLCHAIN=auto silently used it; CI installs exactly the go.mod version via `go-version-file`, then a dependency demands more. Building on a newer toolchain does not test a lowered directive — which is the same shape as the Go 1.27 break this repo already had, in the opposite direction. Now verified by walking the module graph for any dependency whose go directive exceeds ours (zero), rather than by building locally. The sparkconnect submodule moves to 1.25.0 too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01X2YMxeLgyRc9i5XPyEV75S
The previous commit changed both go.mod files and missed go.work, which
carries its own go directive. CI builds in workspace mode (go.work
composes the root module with pkg/exec/batch/sparkconnect), so the
workspace directive is what actually gates the build:
go: go.work requires go >= 1.26.2 (running go 1.25.0)
Found by running GOTOOLCHAIN=go1.25.0 rather than reasoning about it.
That is the check that corresponds to the claim — building on a newer
toolchain cannot test a lowered directive, and I had now made that
mistake twice in a row.
Verified with the exact toolchain: build, vet and the full -race unit
suite pass on real Go 1.25.0 for both the root module and the submodule,
and still pass on 1.27.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X2YMxeLgyRc9i5XPyEV75S
This was referenced Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first tag since
v0.1.0on 2026-05-12 — 49 commits, 150 files, +18,184/−1,569.The changelog was describing work that does not exist
Before restructuring I had an agent audit
[Unreleased]against the realv0.1.0..maindiff. Verdict: materially wrong. Six claims described the sketch work whose wire-format change I pulled before merge — while its changelog text stayed behind.The dangerous one:
The format is byte-identical to v0.1.0. That entry would have told operators a rolling deploy of a TopK pipeline was unsafe, and pushed them into a migration they don't need. A fabricated breaking change is as harmful as a missing one — arguably worse, because it also teaches people the changelog can't be trusted.
Verified against the code, not the claim:
topk.gohas zero matching symbols, the wire-format doc block is unchanged, and the shippedsaturation_test.gosays outright that closing the gap "needs the ingested weight in the header, which is a wire-format change and is deliberately NOT on this branch."Also removed or corrected:
topk.Inspect/Summary/Coveragedecode()still reads the header K into a local and discards itmonoidlawsfuzzes K=4 over K=32WithClock/WithClockSkewBoundunder RemovedStructure
1,104 lines written incrementally by many branches, with
### Fixedappearing a dozen times, are now a## [0.2.0] - 2026-08-28section in Keep a Changelog order —Security/Added/Changed(with#### Breaking changes) /Removed/Fixed, each heading exactly once.A separate agent diffed the claim sets to confirm the restructure lost nothing; it reported only cosmetic losses, which I accepted.
Release-readiness fixes
go.mod:go 1.26.2→go 1.24.0. The patch-level directive was whatevergo mod initwrote in the initial commit and forced every consumer onto ≥ 1.26.2 — most shops evaluating a framework are a release or two behind, so it was a silent "you cannot even try this". Verified the tree builds at 1.24.SECURITY.mdwas wrong about security. It warned thatpkg/adminships permissiveAccess-Control-Allow-Origin: *. It doesn't —applyCORSreturns early with no headers when no origins are configured, and that was fixed some time ago. Replaced with the hazard that is actually real: auth is off by default and the admin API leaks pipeline metadata. Also corrected the claim that thespark-connect-goreplacelives in the rootgo.mod; the root has none.README.mdhad no install line at all — nogo get, nogo install, no import path. The single most likely action on release day had no documented form.STABILITY.mdasked for exactly this release; it now records that it was cut, plus what remains.The sparkconnect submodule stays untagged, deliberately
pkg/exec/batch/sparkconnect/go.modrequires the root module atv0.0.0-00010101000000-000000000000, resolved only by an in-treereplace ... => ../../../... Go ignoresreplacedirectives in non-main modules, so tagging it today would publish a module no consumer could build. Recorded inSTABILITY.mdas a prerequisite rather than left as a surprise.Test plan
go 1.24.0directive, root module and submodulemake test-unitgreen,golangci-lint0 issues## [Unreleased]present and empty;## [0.2.0]dated; each H3 oncev0.2.0🤖 Generated with Claude Code
https://claude.ai/code/session_01X2YMxeLgyRc9i5XPyEV75S