## platform-engineering-labs/formae — pkg/plugin-conformance-tests/v0.2.5…pkg/plugin-conformance-tests/v0.2.6

_90 commits._

### Features
- **feat(cli): revamp feedback polish (wording, query-bar cursor, watch removal, simulate bar)** (335f8dc)
- **feat(cli): omarchy theme with live OS-theme follow** (2105614)
- **feat(cli): themeable CLI with light/dark appearance** (9e80bf4)
- **feat(extract): schema-version compatibility check + auto-add missing plugin deps** (41f53a3)
- **feat(secrets): hash opaque values regardless of plugin schema; scrub all versions** (5ac7187)
- **feat(datastore): load all resource versions and update a version in place** (e6e5fe0)
- **feat(schema): @formae.Flag to override CLI flag for typed Props members** (4ab313d)
- **feat(migration): scrub RDS master-password fields on the backfill sweep** (bcd580d)
- **feat(migration): hash known secret types despite stale embedded schema** (a67b0d7)
- **feat(resource_update): keep hashed secrets out of plugin update write-inputs** (629f6b6)
- **feat(resource_update): make the hashed-value guard operation-aware for delete and update prior-state** (636c0a1)
- **feat(migration): one-time backfill hashing of pre-existing plaintext secrets** (1d58ea0)
- **feat(forma_persister): hash read/actual progress; keep DesiredState input plaintext for resume** (65e2192)
- **feat(resolver): error when a hashed secret would be sent to a plugin** (0b9def6)
- **feat(transformations): schema-keyed hashing of opaque values and top-level patch ops** (5da0e47)
- **feat(schema): add SecretValue type and Opaque FieldHint derived from field type** (b388482)
- **feat(model): add Opaque FieldHint and Schema.Opaque selector** (5d2d783)
- **feat(model): add typed $hashed discriminator and log redaction to Value** (cb2e2b0)
- **feat(agent): reap resources on permanently-unreachable targets** (9c02f68)
- **feat(synchronizer): evict unmanaged inventory rows matching discovery filters during sync** (12023dc)
- **feat(cli): add a prominent confirm bar to the simulate/apply preview** (23af945)
- **feat(cli): replace legacy rendering with Charmbracelet TUI stack** (799eb29)
- **feat(cli): sudo-less plugin/update reads and a new 'formae refresh'** (2fbd847)
- **feat(schema): typed CLI properties for extends-based formae** (bf8770d)
- **feat(build): bundle standard-bundle plugin examples into the formae opkg** (7c563ce)
- **feat(plugin): pass the caller's prior model to plugin Read (#548)** (f45d2f3)
- **feat(metastructure): canonicalize serialized-JSON String fields in the update diff** (2e6cffd)
- **feat(cli): add cancel --force to drive stuck commands to terminal Canceled** (0923f62)
- **feat(schema): split WriteOnly into WriteOnly + RequiredOnUpdate hints** (69041eb)
- **feat(cli): add `formae profile` command and per-invocation `--profile` flag** (5ef304f)
- **feat: embed resolvables inside String-typed fields (PLA-68 / RFC-28) (#531)** (89d6b45)
- **feat(auto-reconciler): retry failed updates from resource_updates** (1b367b2)

### Fixes
- **fix(secrets): opaque-secret conformance digest-compare + extract import de-dup** (f32f208)
- **fix(inventory): show the loading spinner on the first frame** (2715e72)
- **fix(cli): add a blank line above the printed logo banner** (a00ff6d)
- **fix(sync): re-hash a $res resolvable's opaque value on read-merge** (8d50617)
- **fix(extract): preserve the $hashed marker on serialized opaque secret values** (c62120e)
- **fix(cli): don't warn when XDG_CONFIG_HOME equals $HOME/.config** (8ec6e85)
- **fix(cli): make the hashed-secret guard error actionable** (7fed7e9)
- **fix(sync): re-hash a resolvable's opaque value on read-merge** (6e64d01)
- **fix(migration): page the secret backfill to bound startup memory** (aeead95)
- **fix(fakeaws): keep formae.Value in Secret.secretString union so plain values still evaluate** (8c03350)
- **fix(resource_update): keep hashed envelope in sync PreviousProperties for idempotent backfill** (25092cd)
- **fix(transformations): hash patch-op secrets structurally, not by value match** (d9e6710)
- **fix(schema): mark typealias-typed secret fields opaque** (8f71eea)
- **fix(transformations): make schema-opaque patch-op hashing idempotent** (fc9d338)
- **fix(resolve_cache): stop logging resolved secrets; preserve schema-opaque metadata** (3d692f6)
- **fix(aurora): update all payload columns on resource_updates upsert conflict** (4f64827)
- **fix(resource_update): use schema-aware hashing in update comparison** (dccb04e)
- **fix(resource_persister): compare drift against the hashed copy so secrets converge** (b09e234)
- **fix(random): prevent id() panic and bias via integer arithmetic** (b6aa558)
- **fix(cli): correct table-view header highlight and sort cell-styling** (752bab5)
- **fix(build): make bundled example dirs world-readable** (c0f6d7c)
- **fix(policy): handle auto-reconcile policies in update generator** (c49fef4)
- **fix(extract): use an accurate stack description for adopted resources** (80462f6)
- **fix(e2e): unpin aws plugin now that the Role read fix has shipped** (d5d45e9)
- **fix: skip schema defaults for absent nullable properties on extract (#547)** (a60d088)
- **fix(metastructure): forget unmanaged resources when their target is deleted** (3d78c66)
- **fix(cli): show only genuinely-changed properties in the plan** (44b9a07)
- **fix(generator): stop double-escaping quotes in extract output** (31301b7)
- **fix(metastructure): converge no-op reconcile for list-valued resolvable properties** (70ce913)
- **fix(metastructure): resolve nested array hints by index-less path** (6e71e8e)
- **fix(metastructure): resolve bare-stack embed references by (label, type)** (e94050e)
- **fix: re-trigger discovery in conformance discovery-wait loop** (a2dface)
- **fix(changeset): propagate resolved target config to dependent deletes on a mutable update** (9bf6a57)
- **fix(patch): suppress unchanged opaque values from patch generation** (11ec4f2)
- **Merge pull request #524 from platform-engineering-labs/fix/docker-standard-channel** (9b71041)
- **fix(docker): install standard metapackage from the stable channel** (4d56b6b)
- **fix(patch): replace Atomic list fields wholesale instead of remove+add** (c0d9055)
- **Merge pull request #520 from platform-engineering-labs/fix-docker-home** (433c24c)
- **fix: explicitly set HOME to deal with runtimes that do not** (6a2a864)
- **fix(resolve): surface failing ref + property on terminal resolve miss** (2d8387b)
- **fix(auto-reconciler): include destroy commands in baseline query** (9a523b2)
- **fix(discovery): re-arm periodic tick lost to a one-shot cycle** (fba86e0)
- **fix(changeset): give ResolveCache plugin reads the full PluginOperationCallTimeout** (30234fe)

### Backend
- **Merge pull request #567 from platform-engineering-labs/jeroensoeters/pla-320-backfill-bounded-memory** (8570ad9)
- **Merge pull request #562 from platform-engineering-labs/jeroensoeters/pla-320-opaquesecret-values-persisted-unhashed-on-the-readactual** (42d142f)

### Tests
- **test: close postgres datastore pool during conformance cleanup to avoid connection exhaustion** (c56a0f3)
- **test: add sync-completion helpers and replace fixed sleeps in synchronizer tests** (20107b7)
- **test(workflow): end-to-end secret hashing across sinks, drift, and guard backstop** (a0f98af)
- **test(fakeaws): mark Secret.SecretString opaque and enrich Read with bare secret** (efc1761)

### Docs
- **docs: remove internal ticket/RFC references from code comments** (d6774a1)

### Chore
- **refactor(transformations): remove unused transformer scaffolding** (80c6735)
- **ci(release): update plugin nightly gate to the tier-1 set** (d772bd2)
- **refactor(metastructure): reparent updaters under ChangesetExecutor for termination cascade (#537)** (d0489d3)
- **ci(e2e): cap Configure AWS Credentials steps at 5 min so a stalled STS call fails fast** (3d3f864)
- **chore: remove one-time plugin-discovery migration** (1841f38)
- **chore: remove obsolete slow remote-spawn warning** (e7f1bd4)
- **ci(e2e): pin status-check context to the test name** (81dcb7c)
- **refactor(discovery,sync): use GenericTimeout for periodic re-arm** (845d72e)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/platform-engineering-labs/formae?utm_source=github-action)._