## platform-engineering-labs/formae — pkg/plugin-conformance-tests/v0.2.6…pkg/plugin-conformance-tests/v0.2.7

_178+ commits._

### Features
- **feat(patch): element-level ownership partition for co-owned collections** (c8dbf3e)
- **feat(schema): fail verification when a @FieldHint sits on a class that is not a Resource or SubResource** (b0b1186)
- **feat(connect): derive the Azure tenant instead of asking for it** (156337f)
- **feat(metastructure): generators draw named outputs, and a keypair arm** (bf464b1)
- **feat(connect): give the Azure trust template machine-readable output** (e5b221f)
- **feat(datastore): resolve the postgres password from a named secret** (775f433)
- **feat(schema): name a value field's envelope kinds as formae.ValueSource** (9898e56)
- **feat(cli): show what rotates, when it last did, and what it feeds** (229570d)
- **feat(metastructure): rotate a generator on its declared cadence** (47a6c18)
- **feat(schema): render a generator binding as PKL source** (ead62a3)
- **feat(metastructure): refuse a generator that reaches a setOnce field** (7d922ea)
- **feat(schema): let a plugin resource field accept a generator output** (46bf9b0)
- **feat(metastructure,datastore,cli): draw a generator's value and deliver it to every sink** (5307c65)
- **feat(connect): connect an Azure subscription** (21a440b)
- **feat(metastructure,schema,datastore): bind a resource property to a generator with $gen** (bced7c1)
- **feat(conformance): record what providers do with hasProviderDefault fields** (bc7acff)
- **feat(metastructure,patch,datastore): witnessed out-of-band movement is drift** (16e93f1)
- **feat(metastructure): diff and persist declared generators** (03ad23f)
- **feat(schema): add the generator forma kind** (f8464f4)
- **feat(metastructure,datastore,cli): surface suppressed out-of-band drift on reconcile submissions** (44de30c)
- **feat: surface command attribution in queries and views** (314828d)
- **feat(connect): connect a GCP project** (93e95a4)
- **feat(connect): list local AWS profiles and their resolved accounts** (0ebb47c)
- **feat(connect): list the cloud connections registered on an installation** (c5eb324)
- **feat(connect): one quick-create link, Enter-to-continue, themed outcome lines** (ac53c40)
- **feat(cli): connect a cloud account to a hosted installation** (57fe5c9)
- **feat(credential): oidc-credential plugin type with broker pairing and SDK token source** (d49c473)
- **feat(login): sign in to the hosted platform without a profile** (63756ff)
- **feat(cli): add the hidden connection resolve command** (f27de98)
- **feat(cli): split command status and command list, and scope command queries to user work** (f2ffc79)
- **feat(agent): log the source of a command state transition** (1846a26)
- **feat(datastore): record an append-only agent boot event on startup** (88f0bd1)
- **feat(cli): follow Omarchy 4 themes alongside Omarchy 3** (519860f)
- **feat(network): add loopback SOCKS5 egress to the tailscale network plugin** (32b46e7)
- **feat(login): derive and prune hosted profiles from the caller's grants** (3bbea04)
- **feat(config): expose the Aurora Data API endpoint in agent configuration** (e8d9885)
- **feat(cli): resolve the agent connection as a sum type and route hosted requests** (45de2cb)
- **feat(cli): login and logout via the auth plugin, and recover once from stale credentials** (0cbcf93)
- **feat(agent): record the authenticated subject on command records** (7994c96)
- **feat(agent): carry the authenticated subject through the auth cache and request context** (424ce96)
- **feat(auth): login verbs, typed error codes, and subject fields in the plugin SDK** (abdb87c)
- **feat(metrics)!: emit a resource-update operation-failure counter and retire the resource-errors gauge** (760f2a8)
- **feat: add crypto keypair extension** (72ff97c)
- **feat(conformance): re-apply the extracted forma in the CRUD Extract phase** (aff4e59)

### Fixes
- **fix(inventory): make wheel scrolling stop when the user does** (37e722f)
- **fix(connect): serve the templates that mark artifacts as formae's own** (81eb67e)
- **fix(metastructure): preserve frozen opaque secret references** (a596404)
- **fix(conformance): back off recoverable OOB operations** (8f86807)
- **fix(metastructure): guard discovery filter evaluation, and move it onto MatchFilter** (383de8b)
- **fix(extract): escape data keys that are not PKL identifiers** (a296f41)
- **fix(metastructure): judge late createOnly changes only on resolved references** (db593e5)
- **fix(rotation): make agent-owned rotation commit, not loop or fail** (935442c)
- **fix(metastructure): answer failed requests instead of terminating the persisters** (83550d1)
- **fix(metastructure): name the surviving object when a persist fails after a cloud write** (d1c791e)
- **fix(metastructure): refuse target replace that cascades across stacks** (e9d5ab8)
- **fix(update): refuse to initialize an install root instead of wiping it** (da0192e)
- **fix(schema): raise the rotation cadence floor to fifteen minutes** (d070c4c)
- **fix(agent): exit when the orchestrator application stops** (f36cb08)
- **fix(metastructure): rotate a credential into the resources that consume it** (a811b9f)
- **fix(schema): declare the metadata hash, not the zip hash, for dependents (#742)** (86581f1)
- **fix(schema): reopen dependent metadata after downloading it (#741)** (4bc979b)
- **fix(schema): refresh dependent plugin checksums on schema publish (#739)** (1b03616)
- **fix(cli): stop help rendering from creating a config store** (b4a534b)
- **fix(rotation): stop a sync wedging rotation, and keep the cadence through extract** (62252d3)
- **fix(connect): ask whether a token exists before blaming the subscription** (f900e51)
- **fix(metastructure,datastore): literal dotted map keys survive path handling, and corrupted unmanaged rows re-ingest** (b683eef)
- **fix(schema): floor the rotation cadence at one minute** (13930fb)
- **fix(datastore): resolve the Postgres password per connection** (d04d5bb)
- **fix(metastructure): delete generators with their stack and refuse dangling references** (72c5d6b)
- **fix(metastructure): extract a generator binding in its authored shape** (c77cf65)
- **fix(metastructure,schema): extract keeps a reference's sub-key selector** (19645c3)
- **fix(discovery): make filters mean what they say** (98fc3f0)
- **fix(patch,resource-update): empty values survive hinted fields and unresolved reference adds plan** (f78d128)
- **fix(resolver): restate the hashed marker from the value a reference resolved** (f0a9761)
- **fix(connect): keep the Google sign-in's own instructions when it fails (#703)** (6259016)
- **fix(patch): honor explicit-empty EntitySet declarations as user-initiated clears** (700d1f2)
- **fix(query): drop the dead managed key from the command grammar** (a572aed)
- **fix(inventory): keep row styling and the cursor bar alive past the first page** (3ba6fda)
- **fix(resolver,resource-update): secret-sourced reference occurrences converge via resolution provenance** (bea003f)
- **fix(patch,resolver,resource-update): close the cross-change gaps in reference planning** (5e1b1ae)
- **fix(resource-update): classify absent referenced properties by cause, reject dangling removals, and stop requiredOnUpdate churn** (a09ea59)
- **fix(resolver): follow reference chains to the value the chain root will hold** (274e782)
- **fix(cli): detect kitty graphics inside a herdr pane** (471f30a)
- **fix(resource-update): execution-time patch regeneration is mode-faithful and fails loudly on late createOnly diffs** (e2b676c)
- **fix(resolver): plan-time references resolve against effective desired state** (085e818)
- **fix(patch): only strip writeOnly+createOnly fields lacking a stored baseline** (f0b5e61)
- **fix(connect): let an agent beside the operator reach the Google sign-in (#689)** (73c9c3d)
- **fix(agent): report plugin output at the level the plugin chose** (9ae08e0)
- **fix(connect): default the AWS region rather than refusing a profile without one** (1ea6759)
- **fix(login): refresh the credential when no sign-in produced it** (17b99e0)
- **fix(connection): isolate plugin discovery in the contract tests** (66c3506)
- **fix(login): harden the hosted fallthrough and make id-file creation dir-safe** (2bb2014)
- **fix(metastructure): reject dangling refs to deleted resources, and deconflict cascade destroys** (b1070cc)
- **fix(metastructure): unique unmanaged labels, and one sync update per resource** (89c9b2e)
- **fix(login): activate what you signed in to, and fall through to hosted** (1280442)
- **fix(scripts): confine the mutation-test run and name a crashed one** (ba68bac)
- **fix(scripts): mutate a module-root package from its own directory** (7d3da99)
- **fix(ci): cap mutation-test memory so a runaway mutant cannot kill the runner** (04d439d)
- **fix(secrets): keep secret material out of the synthesized cascade patch** (b49954e)
- **fix(profile): show with no name resolves the configuration it would use** (368d964)
- **fix(ci): fail the mutation check when a changed package produces no result** (c28bc2f)
- **fix(resource-update): record why a create failed before it reached the plugin** (8c9c855)
- **fix(secrets): unfreeze non-secret updates on a setOnce secret** (765ff2e)
- **fix(cli): qualify stack policy timestamps as UTC** (14a0979)
- **fix(schema): correct schema-version detection and glob version-independent subtrees** (e7eff35)
- **fix(secrets): inherit opacity for a reference into a map-shaped secret** (dbc879d)
- **fix(conformance): report why a command failed, not just that it did** (7fb9fa6)
- **fix(metastructure): ignore stale NotFound reads when persisting deletes** (161d767)
- **fix(cli): derive the cursor-row selection band from the theme background** (de5de98)
- **fix(tests): pass the authenticated subject to ApplyForma in secret JSON tests** (abceddd)
- **fix(conformance): fail loudly on an unresolvable reference and apply $json** (0d7de94)
- **fix(resolver): resolve a reference to a secret against the live source on update** (dca0b08)
- **fix(conformance): decide discoverability before creating resources** (70c5252)
- **fix(patch): keep the provider's read spelling out of the patch it receives** (d4ad1ad)
- **fix(patch): make the executed patch agree with the plan on reference-fed fields** (fa94dac)
- **fix(metastructure): treat JSON map keys as literals in property merge paths** (4cbc487)
- **fix(target-update): compare a hashed-at-rest credential ref by identity** (0a3ba9f)
- **fix(patch): compare reference resolutions against the applied baseline instead of the provider echo** (aca7236)
- **fix(agent): size the plugin-operator watchdog from the operator's retry cadence** (c3bb770)
- **fix(conformance): retry formae version resolution across a release publish window** (90a2302)
- **fix(conformance): simulate the extract re-apply and bound harness CLI calls** (b9a2ea5)
- **fix(schema): resolve an extract union to the member the value belongs to** (998cb12)
- **fix(transformations): match nested opaque field hints so sub-resource secrets are hashed at rest** (4979bbb)
- **fix(schema): collect inherited properties from intermediate schema base classes** (d3ccc05)
- **fix(datastore): count resource errors by latest completed outcome** (9689a37)
- **fix(schema): classify extract resources by class identity, not superclass name** (e53140d)

### Backend
- **revert(plugin): drop the per-call plugin deadline** (d9ecf80)

### Tests
- **test(blackbox): correct TTL properties and delete outcome predictions** (ba6ffb7)
- **test(secrets): preserve omitted values and settle repeated applies** (ed65b12)
- **test(e2e): drive the oidc-credential chain from connect through the real plugins** (5c0e5ef)
- **test(metastructure): cover the transitive hop of the rotation consumer walk** (b501e7d)
- **test(patch): pin what the planner does with undeclared collection content** (caeef3c)
- **test(blackbox): never resurrect an incarnation a folded delete already removed** (e9c9743)
- **test(property): exercise resource rename via OpApply** (88fce62)
- **test(blackbox): skip a CloudCreate that reuses a tracked native id** (68f7ec1)
- **test(blackbox): activate discovery and model its ingestion deterministically** (43f2603)
- **test(blackbox): revert optimistic properties for slots a failed command never touched** (5567aca)
- **test(blackbox): stop stale commands from resurrecting TTL-destroyed slots** (4e7dce9)
- **test(blackbox): assert cross-stack slots against the model like any other slot** (6bc1d54)
- **test(distributed): pin the oidc-credential announcement and token path over the real wire** (38d5151)
- **test(blackbox): predict patch outcomes with the agent's field semantics** (fae5c6a)
- **test(blackbox): compute drift end states deterministically instead of tolerating a sync window** (7e6a211)
- **test(cli): pin absolute-TTL stack rendering to the stored policy form** (c863737)

### Docs
- **docs(plugin): document and pin the update-path properties contract** (f6eac64)

### Chore
- **chore(sdk): pin the SDK modules to released versions** (38aa991)
- **refactor(discovery): retire the legacy tag-based label keys** (0a09d61)
- **refactor(metastructure): give the drift readers their own package** (afbaaae)
- **chore(plugin): pin the credential module at a resolvable version** (dc5149d)
- **chore: keep agent working documents out of the tree** (405ed93)
- **refactor(datastore): bound the boot write without a caller context** (b506a22)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/platform-engineering-labs/formae?utm_source=github-action)._