Release 0.1.3: eleven closed defects

[Shashankss1205]

Prepares 0.1.3, carrying PRs #72–#77.

Version moves in lockstep — pyproject.toml, grapharc.__version__, uv.lock, the README status line, the basics page's --version transcript, the serving cookbook's two /healthz transcripts, and the tripwire test that forces those page updates. (0.1.0 shipped with pyproject and __version__ disagreeing, and PyPI is immutable, so the lockstep is the point.) CHANGELOG.md's Unreleased section becomes ## 0.1.3.

What this release closes

Found by an adversarial sweep across the runtime, planner/policy, session/server and CLI/Slack surfaces, each reproduced before it was filed and re-verified against a live repro before its fix was merged.

Fail-open, silent — the ones that mattered most

• policy: resource = "node" rules are silently dropped — a policy denying a node kind still admits and runs it #66 a policy's resource = "node" rules were compiled by nobody, so a document denying a node kind still ran it — and the shipped example.toml uses exactly that form.
• slack: repeating --registry defeats the agent opt-in and the forced approval gate #61 repeating --registry walked a Slack user past the agent opt-in and the forced approval gate.
• permissions: a DENY rule naming a tool literally fails open when the name contains fnmatch metacharacters #59 a deny rule naming a tool literally failed open when the name contained fnmatch metacharacters, and visible() advertised the tool to the model.
• runtime: fan-out Send payloads bypass state isolation and are never checked against input_schema #67 fan-out payloads bypassed deep-copy isolation: two parallel workers received the same live object.

Contract and audit integrity

• runtime: invoke/stream silently drop unknown input keys, though update_state refuses them #68 invoke/stream silently dropped unknown input keys, running the whole graph on defaults.
• runtime: a Ctrl-C'd sync node leaves no terminal trace event, while the async twin records one #70 a Ctrl-C'd sync node left no terminal trace event, and metrics then reported zero errors.
• cli: an unreadable input escapes as a raw traceback with exit 1, in four places that promise an exit-2 document #63 unreadable input escaped as a traceback in four places that promise an exit-2 document.
• cli: plan --approve --json prints prose before the JSON document, so the output does not parse #62 plan --approve --json printed prose ahead of the document, so the output would not parse.

Server

• server: an unauthenticated request with a non-ASCII token crashes /live with a 500 instead of a 401 #65 an unauthenticated non-ASCII token crashed /live with a 500 instead of a 401.
• server: the /live index lists and parses trace files outside the live root that the reader itself refuses #69 the /live index listed and parsed symlinked traces the reader itself 404s.
• slack: a NUL byte in a path raises out of handle_text instead of replying with a refusal #64 a NUL byte in a Slack path raised out of handle_text, so the bot answered with silence.

Verification

pytest → 1843 passed, 12 deselected (was 1754 at 0.1.2). ruff check grapharc tests → clean. Every fix was additionally confirmed against a live repro — real server for the /live fixes, real grapharc plan --policy for the node gate, real Harness.call for the permission gate.

Still open and deliberately not in this release: #60 (a budget-stopped run reports 0 tokens) and #71 (worst-case iteration under-count for acyclic plans), both of which want design decisions rather than patches.

🤖 Generated with Claude Code