Release Canon 26.10.2 with stable Agentic 26.10.1

.github/workflows/docker-publish.yaml

@@ -1,4 +1,5 @@
 # Copyright 2026 Firefly Software Foundation
+# SPDX-License-Identifier: Apache-2.0
 #
 # Multi-arch image build + GHCR push.
 #
@@ -57,7 +58,7 @@ concurrency:
 env:
   REGISTRY: ghcr.io
   PYFLY_REF: v26.09.04
-  AGENTIC_REF: v26.06.16
+  AGENTIC_REF: v26.10.1
 
 jobs:
   publish:

.github/workflows/pr-gate.yaml

@@ -1,4 +1,5 @@
 # Copyright 2026 Firefly Software Foundation
+# SPDX-License-Identifier: Apache-2.0
 #
 # PR gate -- runs on every pull request and on workflow_dispatch.
 # Checks:
@@ -35,10 +36,10 @@ concurrency:
 env:
   PYTHON_VERSION: "3.13"
   # Sibling checkouts staged as BuildKit / path contexts. The Python
-  # dependency itself resolves from the git tags in pyproject.toml
-  # (locked in uv.lock), so keep these equal to those tags.
+  # dependencies resolve from the PyFly tag and published Agentic wheel
+  # in pyproject.toml (locked in uv.lock). Keep these source tags aligned.
   PYFLY_REF: v26.09.04
-  AGENTIC_REF: v26.06.16
+  AGENTIC_REF: v26.10.1
 
 jobs:
   lint:

.github/workflows/publish-sdks.yaml

@@ -1,4 +1,5 @@
 # Copyright 2026 Firefly Software Foundation
+# SPDX-License-Identifier: Apache-2.0
 #
 # Publish the Java + Python SDKs.
 #
@@ -272,7 +273,11 @@ jobs:
           requirements = [f"flycanon @ https://github.com/fireflyframework/flycanon/releases/download/v{version}/flycanon-{wheel_version}-py3-none-any.whl"]
           for name in ("pyfly", "fireflyframework-agentic"):
               source = project["tool"]["uv"]["sources"][name]
-              requirements.append(f"{name} @ git+{source['git']}@{source['tag']}")
+              if "url" in source:
+                  reference = source["url"]
+              else:
+                  reference = f"git+{source['git']}@{source['tag']}"
+              requirements.append(f"{name} @ {reference}")
           pathlib.Path(f"dist/runtime-requirements-{version}.txt").write_text("\n".join(requirements) + "\n")
           pathlib.Path(f"dist/pyfly-{version}.yaml").write_bytes(pathlib.Path("pyfly.yaml").read_bytes())
           pathlib.Path(f"dist/INSTALL-SERVER-{version}.md").write_bytes(pathlib.Path("docs/released-server-install.md").read_bytes())

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to **flycanon** are documented here.
 
+## [26.10.2] - 2026-10-14
+
+### Dependencies
+
+- Adopt the published Agentic `26.10.1` wheel, with its exact digest recorded in the lock. Remove the obsolete Mistral 1.x resolver override and undeclared Agentic `rest`/`redis` extras; Canon continues to supply web and Redis support through its existing dependencies.
+- Retain the qualified pyfly `v26.09.04` pin and existing EDA migration history. A later pyfly upgrade requires a separately qualified drain or replay of queued legacy outbox events.
+
+### Distribution
+
+- Synchronize server and SDK versions, workflow references, and released-server installation examples for `26.10.2`. HTTP schemas and Canon's Azure builder and independent RLM cache behavior retain their existing contracts.
+
 ## [26.10.0] - 2026-10-12
 
 ### Fixed

README.md

@@ -19,7 +19,7 @@ over whole documents with citations — all behind a single HTTP service.
 [![agentic](https://img.shields.io/badge/genai-fireflyframework--agentic-purple)](https://github.com/fireflyframework/fireflyframework-agentic)
 [![OpenAPI](https://img.shields.io/badge/api-openapi%203.1-green)](docs/api-reference.md)
 [![vector store](https://img.shields.io/badge/vector--store-pgvector%20%7C%20qdrant%20%7C%20chroma-336791)](docs/architecture.md#retrieval-backend-pluggable-dense-store)
-[![Version](https://img.shields.io/badge/version-26.10.1-green.svg)](#)
+[![Version](https://img.shields.io/badge/version-26.10.2-green.svg)](#)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 
 </div>

docs/deployment.md

@@ -37,13 +37,13 @@ all three. The differences are how you wire the dependencies.
 
 ## Install from release packages
 
-For a host installation using the released wheel, follow [Install the released server](released-server-install.md). A wheel install needs explicit framework Git references and the matching source archive for `pyfly.yaml` and migrations.
+For a host installation using the released wheel, follow [Install the released server](released-server-install.md). A wheel install needs explicit framework references and the matching source archive for `pyfly.yaml` and migrations.
 
 ## Pull the image
 
 ```bash
 docker pull ghcr.io/fireflyframework/flycanon:latest          # latest main
-docker pull ghcr.io/fireflyframework/flycanon:26.10.1          # specific release
+docker pull ghcr.io/fireflyframework/flycanon:26.10.2          # specific release
 docker pull ghcr.io/fireflyframework/flycanon:26.10            # latest 26.10.x
 ```
 
@@ -380,15 +380,15 @@ finds its table and only verifies it. Before 26.7.1 every process created
 those lazily, and PostgreSQL refuses that for `flycanon_app`: it checks
 `CREATE` on the schema before it honours `CREATE TABLE IF NOT EXISTS`, and
 demands ownership before `CREATE INDEX IF NOT EXISTS`. One piece of that
-lazy DDL remains, in PyFly rather than flycanon: `PostgresEventBus.start()`
+lazy DDL remains, in pyfly rather than flycanon: `PostgresEventBus.start()`
 still runs the outbox `CREATE TABLE / INDEX IF NOT EXISTS` in every
-process. Until PyFly skips it on existing tables, a `serve` process that
+process. Until pyfly skips it on existing tables, a `serve` process that
 runs as `flycanon_app` needs the two statements below on top of the
 grants above; they widen nothing else (the role stays NOBYPASSRLS, and
 the two outbox tables hold no tenant rows):
 
 ```sql
--- Temporary, for PyFly's outbox DDL at boot (see the note above).
+-- Temporary, for pyfly's outbox DDL at boot (see the note above).
 GRANT CREATE ON SCHEMA public TO flycanon_app;
 ALTER TABLE pyfly_eda_outbox  OWNER TO flycanon_app;   -- or a NOLOGIN role
 ALTER TABLE pyfly_eda_offsets OWNER TO flycanon_app;   -- both roles belong to
@@ -681,12 +681,12 @@ The recommended upgrade dance:
 
 ```bash
 # 1. Pull the new image
-docker pull ghcr.io/fireflyframework/flycanon:26.10.1
+docker pull ghcr.io/fireflyframework/flycanon:26.10.2
 
 # 2. Run migrations against the live database
 docker run --rm \
   --env-file .env \
-  ghcr.io/fireflyframework/flycanon:26.10.1 migrate
+  ghcr.io/fireflyframework/flycanon:26.10.2 migrate
 
 # 3. Roll the API + worker deployments
 docker compose --env-file .env up -d

docs/released-server-install.md

@@ -1,45 +1,49 @@
 # Install the released server
 
-The server wheel requires Python 3.13 and explicit framework Git references. Package installers do not apply the repository's `[tool.uv.sources]` settings when installing a wheel. Installing only `flycanon-26.10.1-py3-none-any.whl` may fail because the matching Agentic version is not available from the package index.
+The server wheel requires Python 3.13 and explicit framework references. Package installers do not apply the repository's `[tool.uv.sources]` settings when installing a wheel. Use the release requirements file to reproduce the qualified framework selection.
 
 Use the released source archive for the operator configuration and migration files, and install the released wheel for the Python application. This keeps the runtime configuration and executable package on the same version.
 
 ## Download and verify
 
-Download `flycanon-26.10.1-py3-none-any.whl`, `flycanon-26.10.1.tar.gz`, `runtime-requirements-26.10.1.txt`, and `SHA256SUMS` from the [26.10.1 release](https://github.com/fireflyframework/flycanon/releases/tag/v26.10.1). Verify the downloaded files against their matching checksum entries before extracting or installing them.
+Download `flycanon-26.10.2-py3-none-any.whl`, `flycanon-26.10.2.tar.gz`, `runtime-requirements-26.10.2.txt`, and `SHA256SUMS` from the [26.10.2 release](https://github.com/fireflyframework/flycanon/releases/tag/v26.10.2). Verify the downloaded files against their matching checksum entries before extracting or installing them.
 
 ```bash
-tar -xzf flycanon-26.10.1.tar.gz
-cd flycanon-26.10.1
+tar -xzf flycanon-26.10.2.tar.gz
+cd flycanon-26.10.2
 uv venv --python 3.13 .venv
-uv pip install --python .venv/bin/python -r ../runtime-requirements-26.10.1.txt
+uv pip install --python .venv/bin/python -r ../runtime-requirements-26.10.2.txt
 ```
 
-The requirements file selects the released server wheel and these canonical framework tags:
+The requirements file selects the released server wheel and these canonical framework references:
 
 ```text
 pyfly @ git+https://github.com/fireflyframework/fireflyframework-pyfly.git@v26.09.04
-fireflyframework-agentic @ git+https://github.com/fireflyframework/fireflyframework-agentic.git@v26.06.16
+fireflyframework-agentic @ https://github.com/fireflyframework/fireflyframework-agentic/releases/download/v26.10.1/fireflyframework_agentic-26.10.1-py3-none-any.whl
 ```
 
 The equivalent installation without a requirements file is:
 
 ```bash
 uv pip install --python .venv/bin/python \
-  'flycanon @ https://github.com/fireflyframework/flycanon/releases/download/v26.10.1/flycanon-26.10.1-py3-none-any.whl' \
+  'flycanon @ https://github.com/fireflyframework/flycanon/releases/download/v26.10.2/flycanon-26.10.2-py3-none-any.whl' \
   'pyfly @ git+https://github.com/fireflyframework/fireflyframework-pyfly.git@v26.09.04' \
-  'fireflyframework-agentic @ git+https://github.com/fireflyframework/fireflyframework-agentic.git@v26.06.16'
+  'fireflyframework-agentic @ https://github.com/fireflyframework/fireflyframework-agentic/releases/download/v26.10.1/fireflyframework_agentic-26.10.1-py3-none-any.whl'
 ```
 
 A fresh installation with these references resolved all runtime dependencies without `--no-deps` or a separate resolver override. Installing optional providers may require additional extras and configuration; this command does not verify cloud accounts or model-provider credentials.
 
+## Framework migration compatibility
+
+This release retains pyfly `v26.09.04` and the existing PostgreSQL EDA outbox. A later pyfly upgrade uses different outbox tables and requires a separate drain or replay of queued legacy events. Qualify that cutover before changing the pyfly pin; the current migration history and Azure/RLM behavior remain the existing ones.
+
 ## Configure the runtime
 
-Keep `pyfly.yaml`, `alembic.ini`, `migrations/`, and `env_template` from the source archive in the working directory. The wheel does not supply the root-level `pyfly.yaml`. The release also provides a byte-identical `pyfly-26.10.1.yaml` copy for operators who already have a migration scaffold; install it as `pyfly.yaml` in the runtime working directory.
+Keep `pyfly.yaml`, `alembic.ini`, `migrations/`, and `env_template` from the source archive in the working directory. The wheel does not supply the root-level `pyfly.yaml`. The release also provides a byte-identical `pyfly-26.10.2.yaml` copy for operators who already have a migration scaffold; install it as `pyfly.yaml` in the runtime working directory.
 
 The configuration selects the PostgreSQL event adapter and separate API/worker consumer groups. Starting without it can activate framework defaults, including an attempted Kafka connection to `localhost:9092` and a separate management listener. Do not rely on those defaults for the released service.
 
-Set the database URL, embedding model and dimensions, provider credentials, platform API keys, object-storage location, and optional Redis settings for your environment. Use [`env_template`](https://github.com/fireflyframework/flycanon/blob/v26.10.1/env_template) and the [deployment guide](https://github.com/fireflyframework/flycanon/blob/v26.10.1/docs/deployment.md) for the exact settings. Store real secrets outside published configuration and supply them through your operator's environment or secret manager.
+Set the database URL, embedding model and dimensions, provider credentials, platform API keys, object-storage location, and optional Redis settings for your environment. Use [`env_template`](https://github.com/fireflyframework/flycanon/blob/v26.10.2/env_template) and the [deployment guide](https://github.com/fireflyframework/flycanon/blob/v26.10.2/docs/deployment.md) for the exact settings. Store real secrets outside published configuration and supply them through your operator's environment or secret manager.
 
 Provision the PostgreSQL database, required extensions and roles using the deployment guide. Apply migrations as a separate operator step before serving a new database:
 
@@ -68,4 +72,4 @@ The standard `flycanon serve` command listens on all interfaces using `FLYCANON_
 curl -fsS http://127.0.0.1:8500/api/v1/version
 ```
 
-Verify authenticated source ingestion, source retrieval and canonical-memory retrieval in the intended tenant and workspace. A version response confirms the running package, while those operations exercise the configured database, retrieval and authorization boundaries. The release acceptance used a fresh wheel installation and verified source/memory retrieval for two independent project workspaces with no cross-project results; a newly provisioned operator environment still needs its own acceptance checks.
+Verify authenticated source ingestion, source retrieval and canonical-memory retrieval in the intended tenant and workspace. A version response confirms the running package, while those operations exercise the configured database, retrieval and authorization boundaries. The release checks include a fresh wheel installation and native PostgreSQL tests for tenant/workspace isolation. A newly provisioned operator environment still needs authenticated ingestion and retrieval checks with its own configuration.

openapi.json

@@ -5103,7 +5103,7 @@
       "url": "https://github.com/fireflyframework/flycanon/blob/main/LICENSE"
     },
     "title": "flycanon",
-    "version": "26.10.1"
+    "version": "26.10.2"
   },
   "openapi": "3.1.0",
   "paths": {

pyproject.toml

@@ -1,8 +1,10 @@
+# Copyright 2026 Firefly Software Foundation
+# SPDX-License-Identifier: Apache-2.0
 [project]
 name = "flycanon"
 # CalVer YY.MM.PP -- bumped per release. Note that PEP 440 normalises
 # ``26.05.04`` -> ``26.5.4`` in the built wheel filename.
-version = "26.10.1"
+version = "26.10.2"
 description = "Operational Knowledge Repository -- versioned, provenance-tracked canonical knowledge with hybrid retrieval and RAG, exposed as a standalone HTTP microservice over fireflyframework-pyfly and -agentic. Part of Firefly Framework, platform-agnostic by design."
 readme = "README.md"
 requires-python = ">=3.13,<3.14"
@@ -25,7 +27,7 @@ dependencies = [
     # ChunkHit / HybridRetriever / reciprocal_rank_fusion -- lives in
     # ``core/services/retrieval/fusion.py``. Document intake runs on
     # flycanon's own per-format SourceLoaders.
-    "fireflyframework-agentic[rest,security,redis,openai-embeddings,binary,vectorstores-pgvector]>=26.6.16",
+    "fireflyframework-agentic[security,openai-embeddings,binary,vectorstores-pgvector]>=26.10.1",
 
     # Source intake -- the high-fidelity per-format SourceLoaders. Binary
     # normalisation (HEIC / SVG / TIFF rasterisation, archive + email
@@ -153,30 +155,11 @@ azure = [
 requires = ["hatchling>=1.18"]
 build-backend = "hatchling.build"
 
-[tool.uv]
-# fireflyframework-agentic depends on pydantic-ai>=1.99, whose transitive
-# ``pydantic-ai-slim[mistral]`` drags in ``mistralai>=2.0.0`` -- which exists
-# on PyPI only as pre-releases (2.x rc builds) and forces in
-# ``opentelemetry-semantic-conventions==0.60b1``. flycanon never uses the
-# mistral provider, so pin mistralai to the stable 1.x line to keep the
-# resolver on stable wheels. Drop once mistralai 2.x reaches stable or
-# pydantic-ai stops requesting it.
-override-dependencies = [
-    "mistralai>=1.0.0,<2.0.0",
-]
-
 [tool.uv.sources]
-# Both framework deps are consumed from their published git tags so fresh
-# clones / CI resolve them without any sibling path; uv.lock pins the exact
-# commits behind the tags. 26.7.1 moved to pyfly v26.09.04 / agentic
-# v26.06.14 (the pins the dworkers programme runs on); the suite passed
-# unchanged on them. agentic moved to v26.06.16 on 2026-09-24: its vector
-# store asked `pg_extension` before `CREATE EXTENSION`, without which first
-# use of the store fails on a managed PostgreSQL that already has it. Note pyfly v26.09 subscribes a CQRS cache-invalidation
-# bridge on the EDA bus in every process -- see the ``pyfly.eda.group``
-# comment in pyfly.yaml for the consumer-group split that requires.
+# Qualified runtime references: PyFly retains the existing EDA schema; Agentic
+# resolves from its immutable published wheel. uv.lock records the wheel digest.
 pyfly = { git = "https://github.com/fireflyframework/fireflyframework-pyfly.git", tag = "v26.09.04" }
-fireflyframework-agentic = { git = "https://github.com/fireflyframework/fireflyframework-agentic.git", tag = "v26.06.16" }
+fireflyframework-agentic = { url = "https://github.com/fireflyframework/fireflyframework-agentic/releases/download/v26.10.1/fireflyframework_agentic-26.10.1-py3-none-any.whl" }
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/flycanon"]

sdks/java/README.md

@@ -41,7 +41,7 @@ Compatible with **flycanon service version `26.10.x`**.
 
 | SDK | Service |
 |-----|---------|
-| `26.10.1` | `26.10.x` (unchanged HTTP contract; identifier-aware PII matching) |
+| `26.10.2` | `26.10.x` (unchanged HTTP contract; Agentic dependency adoption) |
 | `26.5.7` | `26.5.x` |
 
 ## Install
@@ -50,7 +50,7 @@ Compatible with **flycanon service version `26.10.x`**.
 <dependency>
   <groupId>com.firefly</groupId>
   <artifactId>flycanon-sdk</artifactId>
-  <version>26.10.1</version>
+  <version>26.10.2</version>
 </dependency>
 ```
 
@@ -418,7 +418,7 @@ use).
 ## Versioning
 
 The SDK pins its version to the service's CalVer (`YY.MM.PP`), so
-`flycanon-sdk@26.10.1` is the matching client for service version
+`flycanon-sdk@26.10.2` is the matching client for service version
 `26.10.x`. Upgrade the SDK in lockstep with the service. Both
 clients (`CanonClient`, `ReactiveCanonClient`) ship from the same
 artifact -- no separate dependency to manage.

sdks/java/pom.xml

@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
     Copyright 2026 Firefly Software Foundation.
+    SPDX-License-Identifier: Apache-2.0
     Licensed under the Apache License, Version 2.0.
 -->
 <project xmlns="http://maven.apache.org/POM/4.0.0"
@@ -18,7 +19,7 @@
 
   <groupId>com.firefly</groupId>
   <artifactId>flycanon-sdk</artifactId>
-  <version>26.10.1</version>
+  <version>26.10.2</version>
   <packaging>jar</packaging>
 
   <name>flycanon-sdk</name>

sdks/java/src/main/java/com/firefly/flycanon/sdk/CanonClient.java

@@ -94,7 +94,7 @@ public final class CanonClient {
     static final String HEADER_IDEMPOTENCY_KEY = "Idempotency-Key";
 
     /** SDK version. Mirrors {@code pom.xml}. */
-    public static final String SDK_VERSION = "26.10.1";
+    public static final String SDK_VERSION = "26.10.2";
 
     private final RestClient restClient;
     private final ObjectMapper mapper;

sdks/python/README.md

@@ -33,17 +33,17 @@ Compatible with **flycanon service version `26.10.x`**.
 
 | SDK | Service |
 |-----|---------|
-| `26.10.1` | `26.10.x` (unchanged HTTP contract; identifier-aware PII matching) |
+| `26.10.2` | `26.10.x` (unchanged HTTP contract; Agentic dependency adoption) |
 | `26.8.0` | `26.8.x` (embedding sets, `flycanon reindex`, `ChunkStats.by_embedding_model`) |
 | `26.7.1` | `26.7.x` (routes realigned: `?mode=async`, `/query/stream`, `/conversations/{id}/turn`, `/query/suggest`, `?after_id=`; `X-API-Key`; `delete_source`, `purge_workspace`) |
 | `26.5.7` | `26.5.x` |
 
 ## Install
 
 ```bash
-uv add https://github.com/fireflyframework/flycanon/releases/download/v26.10.1/flycanon_sdk-26.10.1-py3-none-any.whl
+uv add https://github.com/fireflyframework/flycanon/releases/download/v26.10.2/flycanon_sdk-26.10.2-py3-none-any.whl
 # or
-pip install https://github.com/fireflyframework/flycanon/releases/download/v26.10.1/flycanon_sdk-26.10.1-py3-none-any.whl
+pip install https://github.com/fireflyframework/flycanon/releases/download/v26.10.2/flycanon_sdk-26.10.2-py3-none-any.whl
 ```
 
 ## Quick start

sdks/python/pyproject.toml

@@ -1,6 +1,8 @@
+# Copyright 2026 Firefly Software Foundation
+# SPDX-License-Identifier: Apache-2.0
 [project]
 name = "flycanon-sdk"
-version = "26.10.1"
+version = "26.10.2"
 description = "Async-first Python client for the flycanon Operational Knowledge Repository service."
 readme = "README.md"
 requires-python = ">=3.11"