chore(main): release 0.1.0

[github-actions]

🤖 I have created a release beep boop

0.1.0 (2026-07-31)

Features

• a fact can carry a precondition (56cbbb2)
• a fact can carry a precondition (9ec6960)
• a probe fixture that reaches the dynamic branch (91b9dfa)
• a probe fixture that reaches the dynamic branch (538c089)
• a split update request body gets its own construct function (67f0c23)
• acceptance harness, and back out an unevidenced constraint (5425c38)
• acceptance harness, and back out an unevidenced constraint (f7f7570)
• accFixture — curated fixture values + data-block dependencies (Stage 0 / D3) (2b610f1)
• an API that misbehaves on purpose, for ground truth (7938e9f)
• ci: gate generated code on drift and verify SDK bindings (f4ad50a)
• classic tests wave — 13 resources end to end (Stage 2) (0a51b7a)
• commit live probe evidence, and gate on re-deriving it offline (7778c48)
• conditional facts merge into Behaviour variants (2782df0)
• curated fixture hints carry what the generator refuses to guess (489756f)
• data sources and actions get generated acceptance tests (1932093)
• env-gated acceptance tests — skipUnlessEnv (Stage 0 / D6) (598b6fc)
• ephemerals emit end to end, piloted by the credential secret (5372a67)
• ephemerals emit end to end, piloted by the credential secret (24bfb27)
• export blueprints as Provider Code Specification v0.1 (f1304f4)
• fold probe facts into a blueprint, widening only (0bd966a)
• gate the blueprint against the spec, and map the conditional structure (6b0ddbd)
• gate the blueprint against the spec, and map the conditional structure (6515cf3)
• generate a OneOf validator from the documented value set (d7c608d)
• generate a OneOf validator from the documented value set (aeae664)
• generate a resource identity schema (53936b0)
• generate acceptance tests, and stop blanking never-returned fields (36e02c7)
• generate acceptance tests, and stop blanking never-returned fields (35534dc)
• generate actions, and verify every kind's bindings against the SDK (96ff544)
• generate actions, and verify every kind's bindings against the SDK (94b1816)
• generate data sources, and parameterise schema rendering by kind (41060e9)
• generate data sources, and parameterise schema rendering by kind (d7c48cb)
• generate list resources as a facet of the resource they list (1cd8969)
• generate nested attributes at any depth (d111f7d)
• generate nested attributes at any depth (2460921)
• generate resource identity and list resources (6f944c3)
• generate terraform-plugin-framework providers from a blueprint (cd2f437)
• generate terraform-plugin-framework providers from a blueprint (183ce81)
• generate the acceptance test helper and HCL fixtures (0cdda72)
• generate the acceptance test helper and HCL fixtures (082790d)
• generate validators from declared bounds (a4c0467)
• generate validators from declared bounds (dc59457)
• generated acceptance tests can be gated on an environment variable (efd18f2)
• immutability evidence becomes RequiresReplace, proven by a replace step (419a1aa)
• import codegen-spec v0.1 as draft blueprints (a2a553b)
• infer blueprints from OpenAPI schemas, and raise coverage to 91% (172c296)
• infer nested objects from OpenAPI (2620156)
• infer nested objects from OpenAPI (adc2409)
• ingest selects waves and scaffolds probe-plan worksheets (5c713ab)
• ingest wave selection + probe-plan draft scaffolding (Stage 0 / D4) (357fabd)
• land the conditional-facts and full-surface emitter stack (f4fe0b7)
• list resources render filters, serve include-resource and get a query test (f7998d8)
• make schema.version reach the schema, with an upgrader to match (5f7685d)
• make schema.version reach the schema, with an upgrader to match (efce610)
• make the Terraform block kind the top level of the IR (4b2710b)
• merge records a conditional fact instead of applying it (e920be5)
• merge records a conditional fact instead of applying it (dfcf590)
• nested attributes, SDK binding checks and a drift gate (e840f15)
• per-operation update request body types (Stage 0 / D2) (c355c8f)
• per-resource plan resolution — the bulk record driver (Stage 0 / D5) (09b8377)
• pin the OpenAPI snapshot and discover resource candidates (11d4de1)
• probe catalogue, HTTP record/replay, quirk server (Phase 4.1-4.3) (67b8b41)
• probe plans resolve per resource, making multi-resource record runs real (ed1c43d)
• probe read-only tier, merge, and live evidence (Phase 4.4-4.5) (6b10fbd)
• probe: immutability with its control, and the two-negative enum rule (516e217)
• probe: immutability with its control, and the two-negative enum rule (ccb23fd)
• probe: normalisation and write side effects; the catalogue is complete (74553bc)
• probe: normalisation and write side effects; the catalogue is complete (e3ac961)
• probe: requiredness and server defaults, and a body the loop was eating (95204d0)
• probe: requiredness and server defaults, and a body the loop was eating (533b00b)
• probes attribute mixed presence to gates and report numeric texture (c57a2f4)
• probes reach every branch a fixture declares (fd3fee2)
• probe: scope the cost model, and fix two defects that made facts wrong (f52fe93)
• probe: scope the cost model, and fix two defects that made facts wrong (52ea299)
• probe: the first live run, and the six defects it found (01ca5ca)
• probe: the first live run, and the six defects it found (a95c66d)
• probe: the first three mutating probes, and the ordering bug they exposed (1a0b9ab)
• probe: the first three mutating probes, and the ordering bug they exposed (0152e4f)
• probe: the gate, as a table of conditions rather than a conjunction (0507ff7)
• probe: the ledger, and an id field for the sweeper to delete by (5cf35a7)
• probe: the ledger, and an id field for the sweeper to delete by (cb05423)
• probe: the write path, the sweeper, and a budget that can afford to clean up (ea106a2)
• probe: wire the gate, the sweeper and the exit codes into the CLI (1fbac51)
• probe: wire the gate, the sweeper and the exit codes into the CLI (86409fb)
• Provider Code Specification v0.1 interop (Phase 3) (d6980b2)
• record and replay HTTP, with fail-closed redaction (21b80a8)
• register the probe catalogue, with costs and stated failure modes (dd2ffd8)
• registry documentation, rendered from the schema it documents (0c29bd9)
• registry documentation, rendered from the schema it documents (ac6a4ff)
• rename the binary, pin the OpenAPI snapshot, discover resources (5d8e0a1)
• route create and update through a retrying read, so state mapping has one call site (2db72bb)
• route create and update through a retrying read, so state mapping has one call site (bf641d0)
• run Terraform in CI, and fix a release pipeline that never worked (92012b1)
• run Terraform in CI, and fix a release pipeline that never worked (5196d33)
• scaffold hand-written hooks and generate cross-attribute rules (ba495db)
• scaffold hand-written hooks and generate cross-attribute rules (dbe1272)
• specs fetches, and the snapshot records its own way home (808d27a)
• specs fetches, and the snapshot records its own way home (a083dae)
• support nested attributes so the full tag surface round-trips (00474ac)
• sweep naming — suffix tier + blueprint override with read alias (Stage 0 / D1) (5a7cf39)
• sweep naming learns a suffix tier and a blueprint override (dca10cb)
• the blueprints build from the 7.0.98 snapshot (ba6beb4)
• the classic tests wave — thirteen resources through the whole pipeline (5f21e25)
• the IR gains ephemerals, list filter schemas and acceptance seeds (24ed760)
• the live acceptance gate runs weekly (876deef)
• the re-record, and the blueprint stops telling half-truths (f85c070)
• the re-record, and the blueprint stops telling half-truths (6a14140)
• the read-only probe tier, with offline fact re-derivation (7e12745)

Bug Fixes

• a minimal fixture must include what the API requires, not what the schema does (975be3a)
• a refusal that blames another field is not about the value sent (94fbf05)
• a refusal that blames another field is not about the value sent (01a3cdf)
• align the root module's Go version with the pilot's (2c6ef7a)
• an attribute the API fills in must be Computed (94d68bb)
• ci: align the root module's Go version with the pilot's (e017b8c)
• ci: close a script-injection hole and satisfy the checks it was masking (8ac5a87)
• ci: gate dependabot auto-merge on an unspoofable id, declare least privilege (e600207)
• ci: remove the remaining template injections from run and script bodies (a148873)
• ci: resolve the shellcheck findings actionlint reports (bc4d314)
• ci: stop persisting checkout credentials in read-only jobs (17fdc8a)
• claim immutability only for the identifier (4e43852)
• close off phase 5 — correct claims the phase made stale (28c62bf)
• close off phase 5 — correct claims the phase made stale (589e8b9)
• datasource fixtures declare data blocks the test reads from state (e3b844e)
• deps: bump golang.org/x/net in the pilot to clear 11 advisories (ded95ec)
• deps: bump grpc to 1.82.1, which both scanners accept (d931204)
• deps: bump grpc to clear the last critical advisory (8ed83af)
• deps: take the remaining x/net and x/text patches (6dc1ad4)
• drop the acceptance workflow's dispatch inputs (967ba7f)
• empty data-block list leaves fixtures byte-identical (649a7e2)
• example validation stops resolving a provider that does not exist (d256ead)
• examples validate via scratch dir + injected provider requirement (a8cfe6d)
• fact identity, findings and fixture copying are condition-aware (9379b1b)
• fact identity, findings and fixture copying are condition-aware (eca84ad)
• fixture validation skips the two shapes validate cannot check (9447438)
• fixtures are fragments, so the version rule goes (392fe56)
• four bugs the first live acceptance run found (9c0e88a)
• freeze the recording's subject beside its plan (offline gate red since #66) (cecae45)
• make the tree gofumpt-clean and drop a test under the complexity limit (d1b6cec)
• release the toolkit as 0.1.0 rather than 1.0.0 (537e510)
• release the toolkit as 0.1.0 rather than 1.0.0 (d1534f1)
• remove the last shadowed err (ab53b2a)
• resolve a never-returned attribute to null instead of leaving it unknown (7ab6452)
• resolve probe evidence and replay across a base path (ea36a6f)
• stop codespell reading AtMost as prose (8141f13)
• stop codespell reading the ThousandEyes SDK alias as a typo (2d144ce)
• stop codespell tripping on Go identifiers, and hold the PR title rule (652f5f3)
• the action reversal takes the last word (e6f8c5c)
• the action reversal takes the last word (56b640c)
• the recording's subject is frozen beside its plan (22a97bc)
• tune tflint and trivy for the acceptance dependency (9e5cc41)
• what the first live acceptance run found (d82e325)
• what the first live acceptance run found (43555c5)

---

This PR was generated with Release Please. See documentation.