[DenysMoskalenko]

Release audit of 26 October 2026, following maintenance/release-audit.md. Plugin 0.6.0 → 0.7.0.

Inventory

Item	Pinned	Current	Bucket	Outcome
rustc / clippy	1.99.0	1.99.1 (15 Oct)	a	channel, chef tag, prose; fixes an x86_64 FFI bool miscompile; clippy unchanged; latest-rust-1.99.1 is amd64 + arm64
rig / rig-core / rig-agent / rig-rmcp	0.44	0.45.0 (19 Oct)	b + c + f	migrated (owner decision); 4 of 28 snippets broke; memory subsystem replaced
rmcp	2	3.7.0	b	hold ended: rig-rmcp 0.45 requires rmcp ^3.5; ClientInfo → ClientConfig
redis	1.7	1.8.0 (23 Oct)	a	features, defaults, MSRV and taught signatures unchanged (source diff + probe)
rstest	0.27	0.28.0	a	only #[case(..)] on an argument tightened, which no skill teaches (probe 19/19)
httpmock	0.8	0.9.0	a	removals untaught (MockExt, Mock.id, …); every taught call compiles (probe)
otel collector contrib	0.162.0	0.163.2	a	multi-arch; nothing touches the otlp receiver, debug exporter or traces pipeline
cargo-nextest	recommended 0.9.148	0.9.149	a	eMudhra CA distrust in self-update
astral-sh/setup-uv	v10.3.0	v10.3.2	a	repo CI only
jsonwebtoken	11	11.1.0	c (pre-existing)	auth.md said reject_tokens_expiring_in_less_than is new in 11; it arrived in 9.3.0
tokio	1.53 floor	1.54.1 (locked)	-	no change: no fix relied on, 1.54.0 yanked
bon, uuid, sha2, utoipa-swagger-ui, serde_json, config, thiserror	-	locked current	-	no change
scaffold lockfile	-	-	a	rstest/httpmock bumped, 7 orphans dropped, 590 → 583 packages
opentelemetry set	0.32 / 0.33 / 0.39	0.33.1 / 0.34 / 0.42.1	hold	reqwest-tracing still 0.7.1 without opentelemetry_0_33 (TrueLayer/reqwest-middleware#288 open)
testcontainers	0.27	0.28.0	hold	testcontainers-modules still 0.15.0
NATS server	2.14-alpine	2.15.1	hold	async-nats 0.50.0 has no server_2_15; 2.14.8 still supported
redis 2.0.0-rc.1, rig 0.46.0-rc.1	-	pre-releases	-	skipped

rig 0.45 in building-rig-agents (0.4.1 → 0.5.0)

• Memory: .memory(MemoryStore::default()) plus a one-segment .conversation(log). With no conversation, 0.45 saves every run to one log named after the agent, so every caller shares it (0.44 skipped memory). The skill now scopes the log per user and uses .without_memory() with no id; an ## Important bullet, Memory Rules and Eval 4 follow. Durable backends implement AsyncStore with compare-and-write appends; windows go through view(.., LastMessages) and history(..) in a compiled ask() helper.
• MCP: McpConnection::new(service).tools() replaces tools_from_server; rmcp = "3", ClientConfig.
• Tools: PortableTool and the builder typestate are gone. Builder tools now join a shared tool_server_handle registry, so every agent on that handle advertises them (documented in TOOLS and AGENTS-CORE).
• build_agent connects through Catalog::builtin().connect_with("vendor/model", ..), tested offline for all three vendors with an unlisted model.
• Errors: PromptError::Memory { error, response }. In-band error envelopes now carry a status, so a {"error":{"code":429}} body is a 429. Memory errors stay on the 503 catch-all, as decided.
• Smaller: effect::Answered, on_outcome per attempt, resume keeps answered calls, .connect(http) on configs, Arc<Message> histories, test doubles. Each change has a row in the new VERSION-DRIFT 0.44 → 0.45 table and its behaviour list.

Owner decisions (asked with recommendations)

• Migrate rig now.
• PromptError::Memory, SessionError::Changed included, stays 503 through the catch-all; this is documented.
• Adopt Catalog::connect_with. The other bucket-d proposals were not applied:
  • DynModel::check once in build_agent, to flag a missing max_tokens on an unlisted Claude id at startup.
  • rig-memory CompactionPolicy / Summarizer in place of the hand-rolled compact_history. Whether it is thinking-binding safe is unverified.
  • AgentRunner::memory(store) for a per-tenant store.
• Evals: building-rig-agents only, with the plugin, capped at $15.

Verified

• make check: validator 0 errors; 93 bins and 27 test files compile clippy-clean; 71/71 snippet tests pass against Docker Postgres 18, Redis 8 and NATS 2.14.
• Scaffold on 1.99.1: make check (clippy, deny, machete) and make test 15/15. make lint (prek): all hooks pass.
• cargo deny check on both the scaffold lock and the full add-when-needed graph (935 packages, rig 0.45 + rmcp 3): ok.
• Research and probes: one compile probe per bump (rig 0.45 with every rig snippet, redis 1.8, rstest/httpmock).
• Validation: an independent fact-check against the crate sources, plus a consistency/mirror/necessity check.
• Final reviews: fresh-eye, ponytail-review and /code-review xhigh. Every finding was checked against crate sources before acting on it. Fixed:
  • an invalid upsert SQL hint, which Postgres rejected (bytes ambiguous);
  • first-save handling for a missing log;
  • files held in AsyncStore;
  • a collision-free escape of sub in the log name;
  • retry advice that reran tool side effects;
  • a contradictory agent_error comment;
  • duplicated memory-error text;
  • a missing memory feature note.
• Rejected review findings:
  • reverting build_agent and remapping memory errors (owner decisions);
  • dropping the UnsupportedOption arm (kept per the 12 Oct decision);
  • unreflowing lines (rewraps forced by inserted words).
• Evals (Opus 5.5, 1 run, Sonnet judge, $8.11): eval-2 to eval-5 and probe-1 to probe-7 scored 1.00. eval-1 scored 0.92. It missed the policy-refusal arm because the reply had no policy hooks, and a likely judge miss on "provider message logged". Neither line changed here.
• Not run: the throwaway-scaffold exercise and a Docker image build (only the chef tag moved; the tag was checked multi-arch on Docker Hub).